Taoping (TAOP) Risk Analysis

On March 16, 2007, the SCNPC passed a new Enterprise Income Tax Law, or the EIT Law. On November 28, 2007, the State Council of China passed its implementing rules, which took effect on January 1, 2008. Under the EIT Law, an enterprise established outside of China with "de facto management bodies" within China is considered a "resident enterprise," meaning that it can be treated in a manner similar to a Chinese enterprise for enterprise income tax purposes. The implementing rules of the EIT Law define de facto management as "substantial and overall management and control over the production and operations, personnel, accounting, and properties" of the enterprise. On April 22, 2009, the State Administration of Taxation issued the Notice Concerning Relevant Issues Regarding Cognizance of Chinese Investment Controlled Enterprises Incorporated Offshore as Resident Enterprises, or the Notice, also referred to as SAT Circular 82. The Notice further interprets the application of the EIT Law and its implementation rules to non-Chinese enterprise or group controlled offshore entities. Pursuant to the Notice, an enterprise incorporated in an offshore jurisdiction and controlled by a Chinese enterprise or group will be classified as a "non-domestically incorporated resident enterprise" if (i) its senior management in charge of daily operations reside or perform their duties mainly in China; (ii) its financial or personnel decisions are made or approved by bodies or persons in China; (iii) its substantial assets and properties, accounting books, corporate chops, board and shareholder minutes are kept in China; and (iv) at least half of its directors with voting rights or senior management habitually reside in China. A resident enterprise would be subject to an enterprise income tax rate of 25% on its worldwide income and must pay a withholding tax at a rate of 10%, when paying dividends to its non-PRC shareholders. However, it remains unclear as to whether the Notice is applicable to an offshore enterprise controlled by Chinese natural persons. It is unclear how tax authorities will determine tax residency based on the facts of each case. We may be deemed to be a resident enterprise by Chinese tax authorities. If the PRC tax authorities determine that we are a "resident enterprise" for the PRC enterprise income tax purposes, a number of unfavorable PRC tax consequences could follow. First, we may be subject to the enterprise income tax at a rate of 25% on our worldwide taxable income as well as PRC enterprise income tax reporting obligations, which would materially reduce our net income. Second, although, under the EIT Law and its implementing rules, dividends paid to us from our PRC subsidiaries would qualify as "tax-exempt income," we cannot guarantee that such dividends will not be subject to a 10% withholding tax, as the PRC foreign exchange control authorities, which enforce the withholding tax, have not yet issued a guidance with respect to the processing of outbound remittances to entities that are treated as resident enterprises for the PRC enterprise income tax purposes. It is possible that future guidance issued with respect to the new "resident enterprise" classification could result in a situation, where a 10% withholding tax is imposed on dividends we pay to our shareholders that are non-resident enterprises and with respect to gains derived by said shareholders from transferring our shares. Finally, if we are deemed a PRC resident enterprise, dividends paid to our non-PRC individual shareholders and any gain realized on the transfer of our shares by such shareholders may be subject to PRC tax at a rate of 20%, if such income is deemed to be from PRC sources. If we were treated as a "resident enterprise" by the PRC tax authorities, we would be subject to taxation in both the U.S. and China, and we may not be able to claim our PRC tax as a credit to reduce our U.S. tax.

Regulatory authorities in China have implemented and are considering further legislative and regulatory proposals concerning data protection. China's new Data Security Law went into effect on September 1, 2021. The Data Security Law provides that the data processing activities must be conducted based on "data classification and hierarchical protection system" for the purpose of data protection and prohibits entities in China from transferring data stored in China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. The Data Security Law sets forth the legal liabilities of entities and individuals found to be in violation of their data protection obligations, including rectification order, warning, fines of up to RMB5 million, suspension of relevant business, and revocation of business permits or licenses. On July 7, 2022, CAC promulgated the Security Assessment Measures for Outbound Data Transfers, or the "Measures," which became effective on September 1, 2022. The Measures applies to the security assessment of critical data and personal information collected and generated by a data processor in its operation in the PRC, which are to be provided abroad. Article 4 of the Measures stipulates that a data processor shall declare security assessment for its outbound data transfer to the CAC through the local cyberspace administration at the provincial level if the data processor provide data abroad under any of the following circumstances: (i) where a data processor provides critical data abroad; (ii) where a critical information infrastructure operator or a data processor processing the personal information of more than one million people provides personal information abroad; (iii) where a data processor has provided personal information of 100,000 people or sensitive personal information of 10,000 people in total abroad since January 1 of the previous year; and (iv) other circumstances prescribed by the CAC for which declaration for security assessment for outbound data transfers is required. On November 7, 2016, the SCNPC promulgated the Cybersecurity Law of the PRC which came into effect on June 1, 2017 and applies to the construction, operation, maintenance and use of networks as well as the supervision and administration of cybersecurity in China. The PRC Cybersecurity Law defines "network operators" as owners and administrators of networks and network service providers, are subject to various security protection-related obligations, including: (i) complying with security protection obligations under graded system for cybersecurity protection requirements, which include formulating internal security management rules and operating instructions, appointing cybersecurity responsible personnel and their duties, adopting technical measures to prevent computer viruses, cyber-attack, cyber-intrusion and other activities endangering cybersecurity, adopting technical measures to monitor and record network operation status and cybersecurity events; (ii) formulating a emergency plan and promptly responding and handling security risks, initiating the emergency plans, taking appropriate remedial measures and reporting to regulatory authorities in the event comprising cybersecurity threats; and (iii) providing technical assistance and support to public security and national security authorities for protection of national security and criminal investigations in accordance with the law. On July 10, 2021, the CAC issued the Cybersecurity Review Measures (revised draft for public comments), which took effect on February 15, 2022. The revised Cybersecurity Review Measures authorize the CAC to conduct cybersecurity review on a range of activities that affect or may affect national security. The PRC National Security Law defines various types of national security, including technology security and information security. The revised Cybersecurity Review Measures expands the cybersecurity review to data processing operators in possession of personal information of over 1 million users if the operators intend to list their securities in a foreign country. Under the revised Cybersecurity Review Measures, the scope of entities required to undergo cybersecurity review to assess national security risks that arise from data processing activities would be expanded to include all critical information infrastructure operators who purchase network products and services and all data processors carrying out data processing activities that affect or may affect national security. In addition, the revised Cybersecurity Review Measures provide that all such entities that maintain or store the personal information of more than 1 million users and undertake a public listing of securities in a foreign country would be required to pass cybersecurity review, which would focus on the potential risk of core data, important data, or a large amount of personal information being stolen, leaked, destroyed, illegally used or exported out of China, or critical information infrastructure being affected, controlled or maliciously used by foreign governments after such a listing. An operator that violates these Measures shall be dealt with in accordance with the provisions of the PRC Cybersecurity Law and the PRC Data Security Law. On November 14, 2021, the CAC released the Regulations on Network Data Security (draft for public comments) and accepted public comments until December 13, 2021. The draft Regulations on Network Data Security provide more detailed guidance on how to implement the general legal requirements under legislations such as the Cybersecurity Law, Data Security Law and the Personal Information Protection Law. The draft Regulations on Network Data Security follow the principle that the state will regulate based on a data classification and multi-level protection scheme, under which data is largely classified into three categories: general data, important data and core data. Personal data and important data will be subject to "key" protection and core data to "strict" protection. We believe that the data we access falls within the category of "general data," because such data is data of our member merchants, does not involve personal information and is not large in volume. Further, when we conduct advertising data collection and analysis, such data is only related to the placement and delivery of ads, which does not involve any personal information. However, we may constitute an online platform operator under the draft Regulations on Network Data Security, which is defined as a platform that provides information publishing, social network, online transaction, online payment and online audio/video services, because our PRC subsidiary Biznest is operating a smart cloud platform that publishes commercial ads of our advertiser clients. Online platform operator under the draft Regulations will be required, among other things, to disclose terms and privacy policies and the algorithms they use. Where there are any changes that would result in significant impacts on users' rights and interests, online platform operators will be required to seek public comments for at least 30 business days and publish how the public comments have been considered and incorporated into the final versions and why other comments are rejected. The draft Regulations also set forth procedures for reporting data breach incidents. In the event that a data breach incident has caused harm to any individuals or organizations, a data processor should notify the relevant individuals and organizations within 3 business days, unless such notices are not required under applicable laws or regulations. Additionally, if we are deemed as a data processor listed overseas under the draft Regulations, we will be required to carry out an annual data security assessment on our own or by engaging a third party data security services institution and submit a data security assessment report for the prior year to the local cyberspace affairs administration department before January 31 of each year. The Regulations on Network Data Security (draft for public comments) were released for public comments and subject to further changes. On August 20, 2021, the SCNPC promulgated the Personal Information Protection Law which became effective on November 1, 2021. The Personal Information Protection Law provides a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in China. The Personal Information Protection Law also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to be set by Chinese cyberspace regulators are also required to store in China personal information generated or collected in China, and to pass a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Lastly, the Personal Information Protection Law contains proposals for significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year and may also be ordered to suspend any related activity by competent authorities. As our smart cloud platform is engaged in the advertising business, the advertising industry is not subject to any foreign investment restrictions and our smart cloud platform does not collect any personal information, we believe that we will be able to comply with the requirements of the PRC Cybersecurity Law, the PRC Data Security Law and related implementing regulations. However, interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with the PRC Cybersecurity Law and the PRC Data Security Law could increase the cost to us in providing our services, require changes to our operations or may prevent us from providing certain services. On February 25, 2023, the SAMR released the Administrative Measures for Internet Advertising, which came into effect on May 1, 2023 and replaced Interim Measures for the Administration of Internet Advertising. The Administrative Measures for Internet Advertising further strengthen the responsibilities of Internet platform operators and enhance their review obligation in Internet advertising activities. Any failure to comply with the Administrative Measures for Internet Advertising may result in administrative liabilities, including warnings, public denouncement, fines, enforcement orders requiring us to correct, suspension of business or even criminal liabilities, all of which may materially and adversely affect our business and results of operations. Our smart cloud platform, currently engaged in the advertising business, complies with the requirements of the Administrative Measures for Internet Advertising.

Our cloud-based applications involve the storage and transmission of our customers' proprietary and confidential information. Any security breaches, unauthorized access, unauthorized usage, virus or similar breach or disruption could result in loss of confidential information, damage to our reputation, early termination of our contracts, litigation, regulatory investigations, indemnity obligations, or other liabilities. If our security measures are breached as a result of third-party action, employee error, malfeasance or otherwise and, as a result, someone obtains unauthorized access to customer data, our reputation will be damaged, our business may suffer and we could incur significant liability. Because the techniques used to obtain unauthorized access or sabotage computer systems change frequently, and generally are not identified until they are launched against a target, we may be unable to anticipate these hacking techniques or implement adequate preventative measures. Any or all of these concerns could negatively affect our ability to attract new customers and cause existing customers to elect not to renew or upgrade their subscriptions, or subject us to third-party lawsuits, regulatory fines, or other action or liability, which could adversely affect our operating results.

The markets for out-of-home digital advertising and digital security information systems in China are intensely competitive and are characterized by frequent technological changes, evolving industry standards, and changing in customer demands. We face competition from multiple domestic competitors in each segment and increased competition may result in price reductions, reduced margins, and inability to gain or hold market share. Our future revenue stream, to a large degree, depends on our ability to capitalize on our technology strength and capabilities to offer new software applications and services to a broader client base. We must make investments in research and development to continue developing and offering new software applications and internet related products and services, and to enhance our existing software applications and internet related services to maintain market acceptance of our products and services. We may encounter challenges in innovation and introduction of new products and services. Our software applications under development may not be successfully completed or, if developed, may not achieve significant customer acceptance. If we are unable to successfully define, develop, introduce competitive new software applications, and enhance the existing ones, our future operating results would be adversely affected. The timeline for software developments is difficult to predict. Timely launch of new applications and their acceptance by customers are important to our future success. A delay in the development or introduction of new applications could have a significantly adverse impact on our results of operations.

Historically, a significant portion of our revenues have been derived from a limited number of customers or related parties. For the year ended December 31, 2023, we generated about $0.2 million of revenue from related parties. For the years ended December 31, 2023, 2022 and 2021, approximately 30%, 24% and 29%, respectively, of our revenues of continuing operations were derived from our five largest customers, including related parties. The loss of any of these significant customers and related parties would adversely affect our revenues and shareholder value.

In the past few years, U.S. publicly traded companies that have substantially all of their operations in China, particularly companies like us have been the subject of intense scrutiny, criticism, and negative publicity by investors, financial commentators, and regulatory agencies, such as the SEC. Much of the scrutiny, criticism, and negative publicity has centered around financial and accounting irregularities and mistakes, lack of effective internal controls over financial accounting, inadequate corporate governance policies or lack of adherence thereto and, in many cases, allegations of fraud. As a result of the scrutiny, criticism, and negative publicity, the publicly traded stocks of many U.S. listed Chinese companies have sharply decreased in value and, in some cases, have become virtually worthless. Many of these companies are now subject to shareholder lawsuits and SEC enforcement actions, and are conducting internal and external investigations into the allegations. It is not clear the effect of this sector-wide scrutiny, criticism, and negative publicity will have on our Company, our business, and our stock price. If we become the subject of any unfavorable allegations, whether such allegations are proven to be true or untrue, we will have to expend significant resources to investigate such allegations defending our Company. This situation will be costly, time-consuming, and distract our management from growing our company.

We are subject to legal and regulatory requirements, political uncertainty and social, environmental and economic conditions in multiple jurisdictions, over which we have little control and which are inherently unpredictable. Our operations in such jurisdictions, particularly as a company based in the PRC, create risks relating to, among others, compliance; organizing local operating entities; establishing, staffing and managing foreign business locations; navigating foreign government taxes, regulations and permit requirements; enforceability of our contractual rights; trade restrictions or exchange controls. Such conditions may increase our costs, impact our operations and business plans and require significant management attention, and may harm our business if we unable to manage them effectively.

The COVID-19 outbreak has led governments across the globe to impose a series of measures intended to contain its spread, including border closures, travel bans, quarantine measures, social distancing, and restrictions on business operations and large gatherings. The outbreak of COVID-19 has caused companies like us and our business partners to implement temporary adjustments to work schedules and travel plans, mandating employees to work from home and collaborate remotely. As a result, we may have experienced lower efficiency and productivity, internally and externally, which may adversely affect our service quality. Moreover, our business depends on our employees. If any of our employees has contracted or is suspected of having contracted COVID-19, these employees will be required to be quarantined and they could pass it to other of our employees, potentially resulting in severe disruption to our business. Most of the restrictive measures previously adopted by the Chinese governments at various levels to control the spread of the COVID-19 virus have been revoked or replaced with more flexible measures since December 2022. The revocation or replacement of the restrictive measures to contain the COVID-19 pandemic could have a positive impact on our normal operations. However, the extent to which the COVID-19 pandemic may continue to impact our results will depend on future developments, which are highly uncertain and cannot be predicted as of the date of this report, including the effectiveness of vaccines and other treatments for COVID-19, and other new information that may emerge concerning the severity of the pandemic and steps taken to contain the pandemic or treat its impact, among others. Given the general slowdown in economic conditions globally, volatility in the capital markets as well as the general negative impact of the COVID-19 outbreak on the global market, we cannot assure you that we will be able to maintain the growth rate we have experienced or projected.

The value of our ordinary shares will be indirectly affected by the foreign exchange rate between the U.S. dollar and RMB, and between the two currencies and other currencies in which our sales may be denominated. Appreciation or depreciation in the value of RMB relative to the U.S. dollar would affect our financial results reported in U.S. dollar without giving effect to any underlying change in our business or results of operations. Fluctuations in the exchange rate will also affect the relative value of any dividend we issue that will be exchanged into U.S. dollars, as well as earnings from any U.S. dollar-denominated investments we make in the future. Since July 2005, the RMB has no longer been pegged to the U.S. dollar. Although the People's Bank of China regularly intervenes in the foreign exchange market to prevent significant short-term fluctuations in the exchange rate, RMB may appreciate or depreciate significantly in value against the U.S. dollar in the medium to long term. Moreover, it is possible that in the future PRC authorities may lift restrictions on fluctuations in the RMB exchange rate and lessen intervention in the foreign exchange market. Very limited hedging transactions are available in China to reduce our exposure to the exchange rate fluctuations. To date, we have not entered into any hedging transactions. While we may enter into hedging transactions in the future, the availability and effectiveness of these transactions may be limited. We may not be able to successfully hedge our exposure at all. In addition, our foreign currency exchange losses may be magnified by PRC exchange control regulations that restrict our ability to convert RMB into foreign currencies.