Xunlei (XNET) Risk Factors

The internet industry is rapidly evolving and subject to continual technological changes. As the internet infrastructure continues to develop, the internet may become more easily accessible through alternative technological innovations in the future, which may make our existing products and services less attractive to our users, and we may lose our existing users and fail to attract new users, which may further adversely impact our business, financial condition and results of operations. In addition, user demand for internet content may also shift over time. Currently, internet users appear to have significant demand for multimedia acceleration, online games and online streaming services, and we expect such demand to continue. However, we cannot assure you that the behavior of internet users will not change in the future. For example, it is expected that the development of 5G technology may have certain impacts on mobile internet user's behavior. If 5G technology reduces our users' demand for internet acceleration, our membership subscription and cloud computing services will be negatively affected unless we are able to successfully develop alternative products or services to take advantage of new opportunities created by this new technology. If we fail to upgrade our services in response to changes in user demand in an effective and timely manner, the number of our users and advertisers may decrease. Furthermore, changes in technologies and user demand may require substantial capital expenditures in product development and infrastructure. To further expand our user base and offer our users a wider range of access points, we are expanding our business to mobile devices in part through potentially pre-installed acceleration products in mobile phones. In addition, we are continually developing and upgrading products and services, including our cloud computing services, which is expected to utilize the idle capacity of our users, and seeking strategic cooperation with hardware manufacturers such as smartphone makers, which may require significant resources from us. However, if we are not able to perfect our new technologies or to achieve the intended results or if our innovations cannot respond to the needs of our users or if our users are not attracted to our upgraded or new products and services, we may not be able to maintain or expand our user base, and our business, results of operations and prospects may be materially and adversely affected.

Our operations rely on our networks and servers, which can suffer system failures, interruptions and downtime. Our network systems are vulnerable to damage from computer viruses, fires, floods, earthquakes, power losses, telecommunication failures, computer hacking, security breach, and similar events despite our implementation of security measures, which may cause interruptions to the services we provide, degrade the user experience, disclosure of our data or user data, such as personal information, names, accounts, user IDs and passwords, and payment or transaction related information, or cause users to lose confidence in our products. Our efforts to protect our company data and user data may also be unsuccessful due to software bugs or other technical malfunctions, employee error or malfeasance, government surveillance, or other factors. The satisfactory performance, stability, security and availability of our websites and our network infrastructure are critical to our reputation and our ability to attract and retain users and advertisers. Our network and servers contain information regarding file index, advertising records, premium licensed digital media content and various other facets of the business to assist management and help ensure effective communication among various departments and offices of our company. Any failure to maintain the satisfactory performance, stability, security and availability of our network, website, servers or technology platform, whether such failure results from intentional cyber-attacks by hackers, from issues with our own technology and team or from other factors beyond our control, may cause significant harm to our reputation and impact our ability to attract and maintain users and business partners. We have put in place various measures to prevent such incidents from happening and internal reporting procedures with respect to such incidents. However, such prevention measures may not function in a way as we expect due to the evolution of the sophistication of cyber-attacks, advances in technology, an increased level of sophistication and diversity of our products and services, an increased level of expertise of hackers, new discoveries in the field of cryptography or others, software bugs or other technical malfunctions, or other evolving threats. From time to time, our users in certain locations may not be able to gain access to our network or our websites for a period of time lasting from several minutes to several hours, due to server interruptions, power shutdowns, internet connection problems or other reasons. For example, in 2020, one of our products experienced a system failure due to an extremely high usage rate, which lasted for around three hours and affected a large portion of our users. Although we have fixed the server promptly, we cannot assure you that such instances will not occur in the future. Any server interruptions, break-downs or system failures, including failures which may be attributable to events within or outside our control that could result in a sustained shutdown of all or a material portion of our network or website, could reduce the attractiveness of our service offerings. In addition, any substantial increase in the volume of traffic on our network or website will require us to increase our investment in bandwidth, expand and further upgrade our technology platform. We do not maintain insurance policies covering losses relating to our network systems due to very limited available insurance products in the insurance market in China. As a result, any system failure, interruptions or network downtime for an extended period may have a material adverse impact on our revenues and results of operations. We rely on information technology systems to process, transmit and cache or store electronic information in our day-to-day operations, including customer, employee and company data. The secure processing, maintenance and transmission of this information is critical to our operations and the legal environment surrounding information security, storage, use, processing, disclosure and privacy is demanding with the frequent imposition of new and changing requirements. We also store certain information with third parties. Our information systems and those of our third-party vendors are subjected to computer viruses or other malicious codes, unauthorized access attempts, and cyber- or phishing-attacks and also are vulnerable to an increasing threat of continually evolving cybersecurity risks and external hazards, as well as improper or inadvertent staff behavior, all of which could expose confidential company and personal data systems and information to security breaches. Any such breach could compromise our networks, and the information stored therein could be accessed, publicly disclosed, lost or stolen. Such attacks could result in our intellectual property and other confidential information being lost or stolen, disruption of our operations, and other negative consequences, such as increased costs for security measures or remediation costs, and diversion of management attention. Any actual or perceived access, disclosure or other loss of information or any significant breakdown, intrusion, interruption, cyber-attack or corruption of customer, employee or company data or our failure to comply with federal, state, local and foreign privacy laws or contractual obligations with customers, vendors, payment processors and other third parties, could result in legal claims or proceedings, liability under laws or contracts that protect the privacy of personal information, regulatory penalties, disruption of our operations, and damage to our reputation, all of which could materially adversely affect our business, revenue and competitive position. For example, in 2020, a few individual users had taken advantage of a technical flaw of certain of our products to make fraudulent purchases and managed to cash out. We have promptly identified and patched the technical flaw. While we will continue to implement additional protective measures to reduce the risk of and detect cyber-incidents, cyber-attacks are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Our protective measures may not protect us against attacks and such attacks could have a significant impact on our business and reputation. In addition, there has been a trend tightening the regulation of privacy and user data protection globally. We may become subject to new laws and regulations applying to the solicitation, collection, processing or use of personal or consumer information that could affect how we store, process and share data with our customers, suppliers and third-party sellers. For example, the National Information Security Standardization Technical Committee issued the latest Standard of Information Security Technology-Personal Information Security Specification, which came into effect in March 2020. Under such standard, the personal data controller refers to entities or persons who are authorized to determine the purposes and methods for using and processing personal information. The personal information controller should follow the principles of legality, justification and necessity in handling personal information. The personal information controller should obtain a consent from a personal information provider and provide such personal information provider an independent choice when the product or service offered by the personal information controller has multiple functions. On November 28, 2019, the Secretary Bureau of the Cyberspace Administration of China, the General Office of the Ministry of Industry and Information Technology, the General Office of the Ministry of Public Security and the General Office of the State Administration for Market Regulation jointly promulgated the Identification Method of Illegal Collection and Use of Personal Information Through App, which provides guidance for regulatory authorities to identify illegal collection and use of personal information through mobile apps, for the app operators to conduct self-examination and self-correction, and for other participants to voluntarily monitor compliance. Moreover, the PRC Constitution, the PRC Criminal Law, the Civil Code of the PRC and the PRC Internet Security Law protect individual privacy in general, which require certain authorization or consent from internet users prior to collection, use or disclosure of their personal data and also protection of the security of the personal data of such users. In particular, Amendment 7 to the PRC Criminal Law prohibits institutions, companies and their employees in the telecommunications and other industries from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services. In addition, we may need to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the U.S., Europe and elsewhere. For example, the European Union adopted the General Data Protection Regulation, or the GDPR, which became effective on May 25, 2018. The GDPR imposes additional obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. New privacy laws will continue to come into effect around the world in 2020, with one of the most significant being the California Consumer Privacy Act, or the CCPA, which became effective on January 1, 2020. Compliance with existing, proposed and recently enacted laws, including implementation of the privacy and process enhancements called for under GDPR, CCPA and regulations from other legislations, can be costly. Any failure to comply with these regulatory standards could subject us to legal and reputational risks. Any inability, or perceived inability, to adequately address privacy and data protection concerns, even if unfounded, or comply with applicable laws, regulations, policies, industry standards, contractual obligations, or other legal obligations could result in additional cost and liability to us or company officials, damage our reputation, inhibit sales, and otherwise adversely affect our business.

We face significant competition in different areas of our business. Some of our existing or potential competitors have a longer operating history and significantly greater financial resources than we do, and in turn may be able to attract and retain more users and advertisers. Our competitors may compete with us in a variety of ways, including by conducting brand promotions and other marketing activities and making acquisitions. For example, in the cloud computing sector, we face existing intensive competition from leading Chinese internet companies such as Alibaba and Tencent. They generally have a stronger competitive position and have more resources and technological capability to compete in this sector. We cannot guarantee you that we will certainly be able to compete effectively with them and continuously increase our market share or maintain our existing market share. In the cloud acceleration sector, although we currently have a niche market in China for cloud acceleration products and services, we cannot guarantee that we will be able to maintain our established position in the future. We may face competition from leading Chinese internet companies if they start to allocate resources and focus on the development in this business sector or from startups who may develop similar or alternative products. With more entrants into the cloud acceleration business, aggressive price cutting by competitors may result in the loss of our existing subscribers. We may have to take actions to retain our user base and attract more subscribers at significant cost, including upgrading and developing existing and new products and services in order to meet users' changing demand, but we cannot assure you that such efforts will succeed, especially given the tightening control over internet content by the Chinese government. See "-If we fail to keep up with the technological development in the internet industry and users' changing demand, our business, financial condition and results of operations may be materially and adversely affected" and "-Regulation and censorship of information disseminated over the internet in China have adversely affected our business and may continue to adversely affect our business, and we may be liable for the digital media content on our platform." If we are unable to effectively compete in any aspect of our business, our business, financial condition and results of operations may be materially and adversely effected.

Under PRC advertising laws and regulations, advertisement channels such as us are obligated to monitor the advertising content they display to ensure that such content is true, accurate and in full compliance with applicable laws and regulations. PRC advertising laws and regulations set forth certain content requirements for advertisements in the PRC including, among other things, prohibitions on false or misleading content, superlative wording, socially destabilizing content or content involving obscenities, superstition, violence, discrimination or infringement of the public interest. In April 2015 and October 2018, the SCNPC subsequently issued the amended Advertisement Law, which took effect on September 1, 2015 and October 26, 2018, to further strengthen the supervision and management of advertisement services. Pursuant to the Advertisement Law, any advertisement that contains false or misleading information to deceive or mislead consumers shall be deemed false advertising. Furthermore, the Advertisement Law explicitly stipulates detailed requirements for the content of several different kinds of advertisement, including advertisements for medical treatment, pharmaceuticals, medical instruments, health food, alcoholic drinks, education or training, products or services having an expected return on investment, real estate, pesticides, feed and feed additives, and some other agriculture-related advertisement. On July 4, 2016, SAIC issued the Interim Measures for the Administration of Internet Advertising to specifically regulate internet advertising activities. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulation on advertising business" for details. In providing advertising services, we are required to review the supporting documents provided to us by advertising agencies or advertisers for the relevant advertisements and verify that the content of the advertisements complies with applicable PRC laws and regulations. Prior to distributing advertisements that are subject to government censorship and approval, we are obligated to verify that such censorship has been performed and approval has been obtained. Violation of these regulations may result in penalties, including fines, confiscation of advertising income, orders to eliminate the effect of illegal advertisement and cessation of publishing the advertisement. In circumstances involving serious violations, the State Administration for Industry and Commerce, or the SAIC, or its local branches may revoke violators' licenses or permits for their advertising business operations. To fulfill these monitoring functions specified by the PRC laws and regulations set forth above, we have taken several measures. In almost all of our advertising agreements, we require the advertising agencies or advertisers that entered into agreements with us: (i) ensure the advertising content provided to us is true, accurate and in full compliance with PRC laws and regulations; (ii) ensure such content does not infringe any third-party's rights and interests; and (iii) indemnify us for any liabilities arising from such advertising content. We have outsourced our advertising business to Itui in 2020 and required Itui to set up an effective review mechanism for each advertisement it placed on our websites and platform so as to ensure the contents are in full compliance with relevant legal requirements. However, we cannot assure you that all the contents contained in such advertisements are true and accurate as required by the advertising laws and regulations, especially given the uncertainty in the application of these laws and regulations. If we are found to be in violation of applicable PRC advertising laws and regulations in the future, we may be subject to penalties and our reputation may be harmed, which may have a material and adverse effect on our business, financial condition and results of operations.

We have been exploring opportunities in overseas market. Operating business internationally may expose us to additional risks and uncertainties. As we have very limited experience in operating our business in overseas markets, we may be unable to attract a sufficient number of users, fail to anticipate competitive conditions or face difficulties in operating effectively in overseas markets. We may also fail to adapt our business models to the local market due to various legal requirements and market conditions. Our international operations and expansion efforts have resulted and may continue to result in increased costs and are subject to a variety of risks, including increased competition, fluctuations in foreign exchange rates, uncertain enforcement of our intellectual property rights, more complex distribution logistics and the complexity of compliance with foreign laws and regulations. Compliance with applicable Chinese and foreign laws and regulations, such as import and export requirements, anti-corruption laws, tax laws, foreign exchange controls and cash repatriation restrictions, data privacy requirements, environmental laws, labor laws, restrictions on foreign investment, and anti-competition regulations, increases the costs and risk exposure of doing business in foreign jurisdictions. Although we have strived to comply with these laws and regulations, a violation by our employees, contractors or agents could nevertheless occur, especially during the exploratory stages. In some cases, compliance with the laws and regulations of one country could violate the laws and regulations of another country. Violations of these laws and regulations could materially and adversely affect our brand, international growth efforts and business. We also could be significantly affected by other risks associated with international activities including, but not limited to, economic and labor conditions, increased duties, taxes and other costs and political instability. Margins on sales of our products in foreign countries, and on sales of products that include components obtained from foreign suppliers, could be materially and adversely affected by international trade regulations, including duties, tariffs and antidumping penalties. We are also exposed to credit and collectability risk on our trade receivables with customers in certain international markets. There can be no assurance that we can effectively limit our credit risk and avoid losses. In addition, political instability may also expose us to additional risks and uncertainties. If any of these economic or political risks materialize and we have failed to anticipate and effectively manage them, we may suffer a material adverse effect on our business and results of operations.

Our operations may be vulnerable to interruption and damage from natural and other types of catastrophes, including earthquakes, fire, floods, hail, windstorms, severe winter weather (including snow, freezing water, ice storms and blizzards), environmental accidents, power loss, communications failures, explosions, man-made events such as terrorist attacks and similar events. Due to their nature, we cannot predict the incidence, timing and severity of catastrophes. If any such catastrophe or extraordinary event occurs in the future, our ability to operate our business could be seriously impaired. Such events could make it difficult or impossible for us to deliver our services and products to our users and could decrease demand for our products. As we do not carry property insurance and significant time could be required to resume our operations, our financial position and results of operations could be materially and adversely affected in the event of any major catastrophic event. In addition, our business could be materially and adversely affected by the outbreak of pandemics such as influenza A (H1N1), avian influenza, H7N9, severe acute respiratory syndrome (SARS) or other epidemics. Any occurrence of these pandemic diseases or other adverse public health developments in China or elsewhere could severely disrupt our staffing or the staffing of our business partners, including our advertisers, and otherwise reduce the activity levels of our work force and the work force of our business partners, causing a material and adverse effect on our business operations. In response to the COVID-19 pandemic, we made remote working arrangement and suspended our offline work and all our business travels in early 2020 to ensure the safety and health of our employees. As a result, our customer service capacity was compromised which might have adversely affected our users' experience. As of the end of April 2020, we had completely resumed our operations. Although COVID-19 has been largely contained in China, there are still uncertainties regarding the COVID-19 pandemic, including the duration of the pandemic, and the extent of local and worldwide social, political, and economic disruption it may cause. It is also uncertain whether or not COVID-19 or a mutated version of the coronavirus will return in the future. While the COVID-19 pandemic has not materially and adversely affected our business, operations, or financial results as of the date of this annual report, it may have far-reaching impact, directly and indirectly, on many aspects of our operations, including potential impact on our customers, product users, suppliers, employees, cooperation partners, and the market in general, and the scope and nature of the impact continue to evolve. Resurgence of confirmed cases have happened and could happened again in the future, which could lead to the re-imposition of various restrictions. We will continue to monitor and assess the development of the COVID-19 pandemic and intend to make adjustments to our business accordingly.