ZTO Express (ZTO) Risk Factors

We have access to a large amount of confidential information in our day-to-day operations. Each waybill contains the names, addresses, phone numbers and other contact information of the sender and recipient of a parcel. The content of the parcel may also constitute or reveal confidential information. The proper use and protection of confidential information is essential to maintaining customer trust in us and our services. Our technology systems also process and store a significant amount of confidential information and data for the proper functioning of our network. Security breaches and hacker attacks on our system might result in a compromise to the technology that we use to protect confidential information. We may not be able to prevent third parties, especially hackers or other individuals or entities engaging in similar activities, from illegally obtaining confidential information in our possession. Such individuals or entities may engage in various other illegal activities using such information. Further, as parcels move through our network from pickup to delivery, a large number of personnel handle the flow of parcels and have access to significant amounts of confidential information. Some of these personnel may misappropriate the confidential information despite the security policies and measures we have implemented. In addition, most of the delivery and pickup personnel are not our employees, which makes it more difficult for us to implement sufficient and effective control over them. Practices regarding the collection, use, storage, transmission and security of personal information have recently come under increased public scrutiny. On June 10, 2021, the Standing Committee of the National People's Congress promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law, among other things, provides for a security review procedure for the data activities that may affect national security.  On December 28, 2021, the Cyberspace Administration of China and twelve other government authorities promulgated the new Measures for Cybersecurity Review, or Cybersecurity Review Measures, which took effect on February 15, 2022, to replace the original measures promulgated in 2020. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services, and network platform operators engaging in data processing activities, must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulate that the network platform operators holding over one million users' personal information shall declare to the Cybersecurity Review Office for a cybersecurity review before any public offering at a foreign stock exchange. On August 17, 2021, the State Council promulgated the Regulations on the Security Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to the Regulations on the Security Protection of Critical Information Infrastructure, critical information infrastructure shall mean any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, technology and industry, as well as other important network facilities and information systems which, in case of destruction, loss of function or leak of data, may result in serious damage to national security, the national economy and the people's livelihood and public interests. In addition, the administration departments of each critical industry and sector shall be responsible to formulate eligibility criteria and determine the critical information infrastructure operator in the respective industry or sector. The operators shall be informed about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date of this annual report, no detailed rules or implementation has been issued by any administration department of any such critical industry and sector. Furthermore, the exact scope of "critical information infrastructure operators" under the current regulatory regime remains unclear, and the PRC governmental authorities may have certain discretion in the interpretation and enforcement of these laws. Therefore, it is uncertain whether we would ultimately be deemed as a critical information infrastructure operator under PRC law. It also remains uncertain whether the future regulatory changes would impose additional restrictions on companies like us. As of the date of this annual report, we have not received any official letter or document issued by the competent governmental authorities identifying us as a critical information infrastructure operator under the Regulations on the Security Protection of Critical Information Infrastructure, we have not been involved in any investigations on cybersecurity review made by the Cyberspace Administration of China on such basis and we have not received any inquiry, notice, warning, or sanctions in such respect. We may need to declare to the Cybersecurity Review Office for a cybersecurity review and we may not be able to ascertain the results of such a declaration. If we are unable to comply with the cybersecurity, data privacy and critical information infrastructure requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the application stores, among other sanctions, which could materially and adversely affect our business and results of operations. On July 7, 2022, the Cyberspace Administration of China promulgated the Measures on Security Assessment of Cross-border Data Transfer which became effective on September 1, 2022. The Measures on Security Assessment of Cross-border Data Transfer shall apply to the security assessment of the provision of important data and personal information collected and generated by data processors in the course of their operations within the territory of the PRC by such data processors to overseas recipients. Pursuant to such measures, a data processor shall apply to the national cyberspace administration for the security assessment of the outbound data transfer through the local provincial cyberspace administration, if it intends to provide data abroad under any of the following circumstances: (i) the data processor provides important data abroad; (ii) the critical information infrastructure operator or the data processor that has processed the personal information of over one million people provides personal information abroad; (iii) the data processor that has provided the personal information of over 100,000 people or the sensitive personal information of over 10,000 people cumulatively since January 1 of the previous year provides personal information abroad; (iv) any other circumstance where an application for the security assessment of outbound data transfer is required by the national cyberspace administration. If we are required for the security assessment of outbound data transfer, we face uncertainties as to whether such assessment or any other specific related actions can be timely completed, or at all. If we fail to comply with such requirements may subject us to suspension of services, fines, and revoking business permits or business licenses, among other things. Apps are specially regulated by the Administrative Provisions on Mobile Internet Applications Information Services (Revised in 2022), promulgated by the Cyberspace Administration of China, last amended on June 14, 2022 and became effective on August 1, 2022. These provisions set forth the requirements on the app information service and the app distribution service. The Cyberspace Administration of China and its local branches shall be responsible for the supervision and administration of nationwide and local app information content respectively. We are currently in compliance with these provisions in all material aspects and we may still have to invest certain cost to ensure our app operation continuous compliance with the regulatory requirements. In August 2021, the Standing Committee of the NPC promulgated the PRC Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. We update our privacy policies from time to time to meet the latest regulatory requirements of PRC government authorities and adopt technical measures to protect data and ensure cybersecurity in a systematic way. Nonetheless, the PRC Personal Information Protection Law elevates the protection requirements for personal information processing, and many specific requirements of this law remain to be clarified by the Cyberspace Administration of China, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations. On February 17, 2023, the CSRC promulgated the Overseas Listing Trial Measures, which became effective on March 31, 2023. Pursuant to the Overseas Listing Trial Measures, overseas offering and listing by domestic companies shall strictly abide by the laws, administrative regulations and state rules concerning national security in the areas of foreign investment, cybersecurity, data security and etc., and duly fulfill their obligations to protect national security. If the intended overseas offering and listing necessitates a national security review (for example, a cybersecurity review), the national security review procedures must be completed before the application for such offering and listing is submitted to overseas regulators and foreign stock exchanges. If we are not able to comply with the requirements under the laws, administrative regulations and rules concerning national security in spheres of foreign investment, cybersecurity, data security and other aspects in a timely manner, or at all, our future capital raising activities may be materially and adversely affected. In general, compliance with the existing PRC laws and regulations, as well as additional laws and regulations that PRC regulatory bodies may enact in the future, related to data security and personal information protection, may be costly and result in additional expenses to us, and subject us to negative publicity, which could harm our reputation and business operations. There are also uncertainties with respect to how such laws and regulations will be implemented and interpreted in practice. Any failure or perceived failure by us to prevent information security breaches or to comply with privacy policies or privacy-related legal obligations could cause our customers to lose trust in us and our services. Any perception that the privacy of information is unsafe or vulnerable when using our services, could damage our reputation and substantially harm our business.

We handle a large volume of parcels across our network, and face challenges with respect to the protection and inspection of these parcels. Parcels in our network may be stolen, damaged or lost for various reasons, and we and/or our network partners may face actual or alleged liability for such incidents. In addition, we may fail to detect unsafe or prohibited/restricted items. There have been incidents in the past where our network partners failed to strictly implement parcel screening procedures and allowed controlled items to be mailed through our network. Further, unsafe items processed and transported through our network, such as flammables and explosives, toxic or corrosive items and radioactive materials, may damage other parcels in our network, injure their recipients, harm our personnel and result in property damage. Failure to prevent prohibited or restricted items from entering our network may result in administrative or criminal penalties as well as civil liability for personal injury and property damage. The transportation of parcels involves inherent risks. We have a large number of vehicles and personnel involved in our transportation operations at all times, who are subject to risks associated with transportation safety, including transportation related injuries and losses. For example, our vehicles and personnel may be involved in traffic accidents from time to time, resulting in personal injury and loss or damage to parcels carried by them. In addition, frictions or disputes may occasionally arise from the direct interaction of our personnel with parcel senders and recipients, which may result in personal injury or property damage if such incidents escalate. The insurance policies we carry may not fully cover the damages caused by transportation related injuries or losses. Any of the foregoing could disrupt our services, cause us to incur substantial expenses and divert the time and attention of our management. We and our network partners may face claims and incur significant liabilities if found liable or partially liable for any injuries, damages or losses. Claims against us may exceed the amount of our insurance coverage or may not be covered by insurance at all. Government authorities may also impose significant fines on us or require us to adopt costly preventive measures. Furthermore, if our services are perceived to be unsafe by our end customers, e-commerce platforms and consumers, our business volume may be significantly reduced, and our business, financial condition and results of operations may be materially and adversely affected.

Our current operations are almost exclusively in China, but we also offer express delivery services in certain key overseas markets. We intend to continue to explore and enter into other international expansion initiatives in the future. These initiatives are likely to involve countries where we have limited operational experience and subject us to various risks, including changes in local economic and political conditions, changes in international laws and regulations, changes in tariffs, trade restrictions, trade agreements and taxation, and difficulties in managing or overseeing operations outside China. The occurrence or consequences of any of these risks may restrict our ability to operate in the affected country and/or decrease our profitability of our operations in that country. We will also be exposed to increased risk of loss from foreign currency fluctuations and exchange controls, as well as longer accounts receivable payment cycles. We may also fail to alter or adjust our business practices in time to avoid or reduce adverse effects from any of the foregoing risks.

Our business could be adversely affected by severe weather conditions and natural disasters, such as snowstorms, earthquakes, fire, typhoons or floods, or an outbreak of COVID-19, avian influenza, severe acute respiratory syndrome, influenza A (H1N1), H7N9 or another epidemic. Any of these occurrences could cause severe disruptions to our daily operations and may warrant a temporary closure of our facilities. Such closures may disrupt our business operations and adversely affect our results of operations. Our operation could also be disrupted if our suppliers, customers or business partners were affected by such natural disasters or health epidemics. For example, outbreaks of COVID-19 beginning in 2020 resulted in the temporary closure of many corporate offices, retail stores and manufacturing facilities across China, and our headquarters, dozens of our sorting hubs and thousands of service outlets across the country also suspended operations from time to time in 2022 due to COVID-19 resurgences caused by the Omicron variants.

We regard our trademarks, domain names, trade secrets, proprietary technologies and other intellectual property as critical to our business. We rely on a combination of intellectual property laws and contractual arrangements to protect our proprietary rights. We may fail to register, maintain and enforce intellectual property rights in the market where we operate if we do not provide sufficient evidence required by governmental authorities. The interpretation and enforcement of the laws and regulations and the enforcement practices by the governmental authorities may be changed if the laws and regulations change.  Confidentiality agreements and license agreements may be breached by counterparties, and there may not be adequate remedies available to us for any such breach. Accordingly, we may not be able to effectively protect our intellectual property rights or to enforce our contractual rights in the market where we operate. Policing any unauthorized use of our intellectual property is difficult and costly and the steps we have taken may be inadequate to prevent the misappropriation of our intellectual property. In the event that we resort to litigation to enforce our intellectual property rights, such litigation could result in substantial costs and a diversion of our managerial and financial resources. We cannot provide any assurance that we will prevail in such litigation. In addition, our trade secrets may be leaked or otherwise become available to, or be independently discovered by, our competitors. Any failure in protecting or enforcing our intellectual property rights could have a material adverse effect on our business, financial condition and results of operations.