Wang & Lee Group, Inc. (WLGS) Risk Analysis

Nasdaq Listing Rule 5101 provides Nasdaq with broad discretionary authority over the initial and continued listing of securities in Nasdaq and Nasdaq may use such discretion to deny initial listing, apply additional or more stringent criteria for the initial or continued listing of particular securities, or suspend or delist particular securities based on any event, condition, or circumstance that exists or occurs that makes initial or continued listing of the securities on Nasdaq inadvisable or unwarranted in the opinion of Nasdaq, even though the securities meet all enumerated criteria for initial or continued listing on Nasdaq. In addition, Nasdaq has used its discretion to deny initial or continued listing or to apply additional and more stringent criteria in the instances, including but not limited to where the company engaged an auditor that has not been subject to an inspection by PCAOB, an auditor that PCAOB cannot inspect, or an auditor that has not demonstrated sufficient resources, geographic reach, or experience to adequately perform the company's audit; (ii) where a company planned a small public offering, which would result in insiders holding a large portion of the company's listed securities. Nasdaq was concerned that an offering size was insufficient to establish the company's initial valuation, and there would not be sufficient liquidity to support a public market for the company; and (iii) where the company did not demonstrate sufficient nexus to the U.S. capital market, including having no U.S. shareholders, operations, or members of the board of directors or management. For the any aforementioned concerns, we may be subject to the additional and more stringent criteria of Nasdaq for our continued listing. On October 24, 2023, the Company received a notice from Nasdaq indicating that it no longer complies with the minimum bid price requirement for continued listing on the Nasdaq Capital Market pursuant to the Nasdaq Listing Rule 5550(a)(2). The closing bid price for the Company's ordinary shares had fallen below $1.00 per share for 30 consecutive business days and accordingly, the Company no longer complied with the minimum bid price requirement for continued listing on the Nasdaq Capital Market pursuant to the Nasdaq Listing Rule 5550(a)(2). The Nasdaq Listing Rules also provide the Company a compliance period of 180 calendar days in which to regain compliance. If the Company chooses to implement a reverse stock split, it must complete the split no later than ten business days prior to the April 22, 2024. On April 23, 2024, Nasdaq granted an additional 180-day compliance period, or until October 21, 2024, for the Company to implement the reverse stock split.

There is no statutory enforcement in the British Virgin Islands of judgments obtained in the U.S., however, the courts of the British Virgin Islands will in certain circumstances recognize such a foreign judgment and treat it as a cause of action in itself which may be sued upon as a debt at common law so that no retrial of the issues would be necessary, provided that: - the U.S. court issuing the judgment had jurisdiction in the matter and the company either submitted to such jurisdiction or was resident or carrying on business within such jurisdiction and was duly served with process;         - the judgment is final and for a liquidated sum;         - the judgment given by the U.S. court was not in respect of penalties, taxes, fines or similar fiscal or revenue obligations of the company;         - in obtaining judgment there was no fraud on the part of the person in whose favor judgment was given or on the part of the court;         - recognition or enforcement of the judgment in the British Virgin Islands would not be contrary to public policy; and         - the proceedings pursuant to which judgment was obtained were not contrary to natural justice.         The British Virgin Islands courts are unlikely:         - to recognize or enforce against the Company, judgments of courts of the U.S. predicated upon the civil liability provisions of the securities laws of the U.S.; and         - to impose liabilities against the Company, predicated upon the certain civil liability provisions of the securities laws of the U.S. so far as the liabilities imposed by those provisions are penal in nature.

We may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions. We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. Our customers and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information. The PRC Criminal Law, as amended by Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In April 2020, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security. In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business license or relevant permits. In April 2020, the Cyberspace Administration of China and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures, which became effective in June 2020. Pursuant to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security. On November 14, 2021, the Cyberspace Administration of China ("CAC") issued a revised draft of the Measures for Cybersecurity Review for public comments ("Draft Measures"), which required that, in addition to "operator of critical information infrastructure" any "data processor" carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad. The Cyberspace Administration of China has said that under the proposed rules companies holding data on more than 1,000,000 users must now apply for cybersecurity approval when seeking listings in other nations because of the risk that such data and personal information could be "affected, controlled, and maliciously exploited by foreign governments". The cybersecurity review will also investigate the potential national security risks from overseas IPOs. We do not know what regulations will be adopted or how such regulations will affect us and our listing on Nasdaq. In the event that the Cyberspace Administration of China determines that we are subject to these regulations, we may be subject to fines and penalties. On June 10, 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which will take effect on September 1, 2021. The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits The costs of compliance with, and other burdens imposed by, CSL and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business. Further, if the enacted version of the Measures for Cybersecurity Review mandates clearance of cybersecurity review and other specific actions to be completed by companies like us, we face uncertainties as to whether such clearance can be timely obtained, or at all. On January 4, 2022, thirteen PRC regulatory agencies, namely, the CAC, the NDRC, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the Ministry of Finance, MOFCOM, SAMR, CSRC, the People's Bank of China, the National Radio and Television Administration, National Administration of State Secrets Protection and the National Cryptography Administration, jointly adopted and published the Measures for Cybersecurity Review (2021), which became effective on February 15, 2022. The Measures for Cybersecurity Review (2021) required that, among others, in addition to "operator of critical information infrastructure" any "operator of network platform" holding personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review. We do not expect to be subject to the cybersecurity review by the CAC, given that: (i) using our products and services do not require providing users' personal information; (ii) we possess minimum amount, if not none of personal information in our business operations; (iii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities and (iv) our operations are in HK SAR, a Special Autonomous Region apart from mainland PRC. However, there remains uncertainty as to how the Draft Measures will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Draft Measures. If any such new laws, regulations, rules, or implementation and interpretation comes into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us. We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, shut down our website, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations. We believe that we have been in compliance with the data privacy and personal information requirements of the CAC. Neither the CAC nor any other PRC regulatory agency or administration has contacted the Company in connection with the Company's or its subsidiaries' operations. The Company is currently not required to obtain regulatory approval from the CAC nor any other PRC authorities for its and its subsidiaries' operations in HK SAR. Further, the PRC laws or regulations related to data security are not enforceable in HK SAR. We may be subject to a variety of laws and other obligations regarding data protection in HK SAR. The Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) (the "PDPO") came into force on December 20, 1996. The PDPO states that any person who controls the collection, holding, processing or use of personal data (the "data user") shall not do any act, or engage in a practice, that contravenes any of the data protection principles set out in Schedule 1 to the PDPO (the "Data Protection Principles") unless the act or practice, as the case may be, is required or permitted under the PDPO. Personal data means any data (a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to or processing of the data is practicable. The Data Protection Principles set out that (1) personal data must be collected in a lawful and fair way, for a purpose directly related to a function or activity of the data user. Data subjects must be notified of the purpose for which the data is to be used and the classes of persons to whom the data may be transferred. Data collected should be adequate but not excessive; (2) personal data must be accurate and should not be kept for a period longer than necessary for the fulfillment of the purpose for which the data is or is to be used; (3) personal data must be used for the purpose for which the data is collected or for a directly related purpose unless voluntary and explicit consent with a new purpose is obtained from the data subject; (4) a data user shall take practicable steps to safeguard any personal data held against unauthorized or accidental access, processing, erasure, loss or use; (5) a data user shall take practicable steps to ensure that its policies and practices in relation to personal data, the kind of personal data it holds and the main purposes for which the personal data is or is to be used for are made known to the public; and (6) a data shall be entitled to request access to personal data and must be allowed to correct the personal data if it is inaccurate. Moreover, the Personal Data (Privacy) (Amendment) Ordinance 2021 (the "PDPAO") came into effect on October 8, 2021. It amends the PDPO, particularly to: (i) criminalize doxing, i.e. unconsented disclosure of personal information of targeted individuals and groups; (ii) introduce a cessation notice regime to tackle doxing with extra-territorial reach; and (iii) substantially expand the investigation and enforcement powers of the Privacy Commissioner for Personal Data, in contexts beyond doxing. Our directors are of the view that we are not likely to be in breach of the PDPO and the PDPAO, for the following reasons: (i) using our products and services do not require providing users' personal information and (ii) we possess minimum amount, if not none of the personal information in our business operations. Nonetheless, we are subject to laws and regulations relating to the collection, storage, use, processing, transmission, retention, security and transfer of personal information and other data. The interpretation and application of laws, regulations and standards on data protection and privacy are still uncertain and evolving. We cannot assure you that the governmental authorities will not interpret or implement the laws or regulations in ways that negatively affect us. We may be subject to investigations and inspections by government authorities regarding our compliance with laws and regulations on data privacy, and we cannot assure you that our practices will always fully comply with all applicable rules and regulatory requirements. In addition, laws, regulations and standards on data protection and privacy continue to develop and may vary from jurisdiction to jurisdiction. Complying with emerging and changing international requirements may cause us to incur substantial costs or require us to change our business practices.

Design-build contracts are used as a project delivery method that provides the owner with a single point of responsibility for both design and construction. Therefore, we can have the ability to assume design and engineering responsibilities. However, in the event of a design error or omission that causes damages, there is a risk we would not be able to absorb the full amount of the liability incurred despite having trial and omission insurance. In this case, we may be responsible for the liability, resulting in a potentially material adverse effect on our financial position, results of operations, cash flows and liquidity.

In recent years, the economy in HK SAR and globally has experienced general increases in inflation and labor costs. As a result, average wages in HK SAR and certain other regions are expected to increase. In addition, we are required by HK SAR laws and regulations to pay various statutory employee benefits, including mandatory provident fund to designated government agencies for the benefit of our employees. The relevant government agencies may examine whether an employer has made adequate payments to the statutory employee benefits. Those employers who fail to make adequate payments may be subject to fines and other penalties. As a result, we expect that our labor costs, including wages and employee benefits, will continue to increase. According to the Census and Statistics Department of Hong Kong, most of the prices of raw materials and workers' wages have moderately increased over the past six years. In particular, the ageing workforce in the local construction industry has been one of the significant issues and the market demand for experienced workers has remained strong. However, the shortage in skillful workers for both general and special trades in the construction may result in higher expenditure for fitting-out works service providers to retain high-caliber workers in order to ensure timely delivery of fitting-out projects. As a result, recruiting a pool of sufficient labor force while maintaining the business operations economically has become one of the market challenges for fitting-out works contractors. Unless we are able to hire able and skilled workers and control our labor costs or pass on these increasing labor costs, our financial condition, and results of operations may be adversely affected.

On occasion, we rely on third-party subcontractors to perform some of the work on many of our contracts, but we are ultimately responsible for the successful completion of their work. Although we seek to require bonding or other forms of guarantees from all of our subcontractors, we are not always able to obtain such bonds or guarantees. In situations where we are unable to obtain a bond or guarantee, we may be responsible for the failures on the part of our subcontractors to perform as anticipated, resulting in a potentially adverse impact on our cash flows and liquidity. In addition, if the project's total costs exceed our original estimates, we could experience reduced profits or a loss for that project, which could have an adverse impact on our financial position, results of operations, cash flows, and liquidity.

We currently operate in HK SAR and the People's Republic of China to a small extent. In fiscal year 2019, we generated 6% of our revenue from mainland China for referring sub-contractors to a work site in mainland China. Since then, all our revenue has been generated in HK SAR. A slowdown or decline in economic conditions or uncertainty regarding the economic outlook in mainland China generally, or in HK SAR particularly, could result in reduced demand for construction projects, which could materially adversely affect our financial condition, results of operations and liquidity. Demand for construction projects depends on the overall condition of the local economies, the need for new or replacement infrastructure, the priorities placed on various projects funded by government spending levels. In particular, low tax revenues, credit rating downgrades, budget deficits and financing constraints, including timing and amount of government funding and competing governmental priorities, could negatively impact the ability of government agencies to fund existing or new public infrastructure projects. For example, during the most recent recession, decreases in tax revenues reduced funding for infrastructure projects. In addition, any instability in the financial and credit markets could negatively impact our customers' ability to pay us on a timely basis, or at all, for work on projects already in progress. The inability to pay could cause our customers to delay or cancel construction projects in our contract backlog and/or create difficulties for customers to obtain adequate financing to fund new construction projects, including through the issuance of municipal bonds.

Our business could be materially and adversely affected by catastrophic events or other business continuity problems, such as natural or man-made disasters, pandemics, social unrest, war, riots, terrorist attacks, or other public safety concerns. If we were to experience a natural or man-made disaster, disruption due to social or political unrest, or disruption involving electronic communications or other services used by us or third parties with which we conduct business, the continuity of our operations will partially depend on the availability of our people and office facilities and the proper functioning of our computer, software, telecommunications, transaction processing, and other related systems. A disaster or a disruption in the infrastructure that supports our businesses, a disruption involving electronic communications or other services used by us or third parties with whom we conduct business, or a disruption that directly affects our business exposure and operations in HK SAR, could have a material adverse impact on our ability to continue to operate our business without interruption. Our business could also be adversely affected if our employees are affected by epidemics, pandemics, natural or man-made disasters, disruptions due to social or political unrest or disruption involving electronic communications. In addition, our results of operations could be adversely affected to the extent that any epidemic or pandemic harms the Chinese or global economy in general. The incidence and severity of disasters, epidemics or pandemics or other business continuity problems are unpredictable, and our inability to timely and successfully recover could materially disrupt our businesses and cause material financial loss, regulatory actions, reputational harm, or legal liability.

As a publicly listed company, we will be required to file periodic reports with the SEC upon the occurrence of matters that are material to our company and shareholders. In some cases, we will need to disclose material agreements or results of financial operations that we would not be required to disclose if we were a private company. Our competitors may have access to this information, which would otherwise be confidential. This may give them advantages in competing with our company. Similarly, as a U.S.-listed public company, we will be governed by U.S. laws that our competitors, mostly private Chinese companies, are not required to follow. To the extent compliance with U.S. laws increases our expenses or decreases our competitiveness against such companies, our public listing could affect our results of operations.

We cannot be certain that our operations or any aspects of our business do not or will not infringe upon or otherwise violate trademarks, patents, copyrights, know-how or other intellectual property rights held by third parties, especially since we do not manage or control the intellectual property rights of any of our suppliers. We may be from time to time in the future subject to legal proceedings and claims relating to the intellectual property rights of others. In addition, there may be third-party trademarks, patents, copyrights, know-how or other intellectual property rights that are infringed by our products, services or other aspects of our business without our awareness. Holders of such intellectual property rights may seek to enforce such intellectual property rights against us in HK SAR, China, the United States or other jurisdictions. If any third-party infringement claims are brought against us, we may be forced to divert management's time and other resources from our business and operations to defend against these claims, regardless of their merits. Additionally, the application and interpretation of China's intellectual property right laws and the procedures and standards for granting trademarks, patents, copyrights, know-how or other intellectual property rights in China are still evolving and are uncertain, and we cannot assure you that PRC courts or regulatory authorities would agree with our analysis. If we were found to have violated the intellectual property rights of others, we may be subject to liability for our infringement activities or may be prohibited from using such intellectual property, and we may incur licensing fees or be forced to develop alternatives of our own. As a result, our business and results of operations may be materially and adversely affected.