A.History and Development of the Company Alibaba Group Holding Limited is an exempted company incorporated with limited liability under the laws of the Cayman Islands on June 28, 1999, and we conduct our business through our subsidiaries and variable interest entities. We are listed on the NYSE under the symbol “BABA” and on the Hong Kong Stock Exchange under the stock codes “9988 (HKD Counter)” and “89988 (RMB Counter).” Alibaba Group Holding Limited is a Cayman Islands holding company. The principal executive offices of major businesses within Alibaba Group are located at 960-1 West Wen Yi Road, Yu Hang District, Hangzhou 311121, People’s Republic of China. Our telephone number at this address is +86‑571‑8502‑2088. Our registered office in the Cayman Islands is located at the offices of Trident Trust Company (Cayman) Limited, Fourth Floor, One Capital Place, P.O. Box 847, George Town, Grand Cayman, Cayman Islands. Our agent for service of process in the United States is Corporation Service Company located at 19 West 44th Street, Suite 200, New York, NY 10036. Our corporate website is www.alibabagroup.com. For information about our significant subsidiaries, as that term is defined under Section 1-02 of Regulation S-X under the U.S. Securities Act, please see “ – C. Organizational Structure.” During this fiscal year, to advance our “user first” strategy and enhance user experience, we undertook a strategic combination of Taobao and Tmall Group, Ele.me and Fliggy into Alibaba China E-commerce Group. We simplified the financial reporting structure by reclassifying Cainiao, Amap and Hujing Digital Media and Entertainment Group into “All others.” Following this strategic re-alignment, for fiscal year 2026, our business segments are (1) Alibaba China E-Commerce Group, (2) Alibaba International Digital Commerce Group, (3) Cloud Intelligence Group and (4) All others. We have a demonstrated track record of successful organic business creation. We are investing decisively in our strategic priorities of AI + Cloud and consumption. In addition to organic growth, we have made, or have entered into agreements to make strategic investments, acquisitions, dispositions and alliances that are intended to further our strategic objectives. See “Item 5. Operating and Financial Review and Prospects — A. Operating Results — Recent Investments, Acquisitions, Dispositions and Strategic Alliance Activities” for more information. We fund our operations and strategic investments from cash generated from our operations and through debt and equity financing. See “Item 5. Operating and Financial Review and Prospects – B. Liquidity and Capital Resources – Liquidity and Capital Resources” for more information. For more information on our capital expenditures, see “Item 5. Operating and Financial Review and Prospects – B. Liquidity and Capital Resources – Capital Expenditure and Capital Commitment.” We are subject to the periodic reporting and other disclosure requirements under the U.S. Exchange Act that are applicable to foreign private issuers in the United States. Under the U.S. Exchange Act, we are required to file periodic reports, financial statements and other information with the SEC. We are required to, among other things, file our annual report on Form 20-F within four months after the end of each fiscal year. However, we are exempt from certain disclosure requirements under the U.S. Exchange Act that apply to domestic U.S. companies, and we are not required to file periodic reports and financial statements with the SEC as frequently or as promptly as domestic U.S. companies with securities registered under the U.S. Exchange Act. See “Item 3. Key Information — D. Risk Factors — Risks Related to Our ADSs and Shares — As a foreign private issuer in the United States, we are exempt from certain disclosure requirements under the U.S. Exchange Act, which may afford less protection to holders of our ADSs than they would enjoy if we were a domestic U.S. company.” Copies of our periodic reports, financial statements and other information, once filed with the SEC, can be read and copied at the SEC’s Public Reference Room at 100 F Street, N.E., Washington, D.C. 20549 and at the SEC’s regional offices in New York, New York and Chicago, Illinois. You can also request copies of these documents, upon payment of a duplicating fee, by writing information on the operation of the SEC’s Public Reference Room. The SEC also maintains an Internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. Our annual report and some of the other information submitted by us to the SEC may be accessed through this website. Such information can also be found on our investor relations website at https://www.alibabagroup.com/en-US/investor-relations. B. Business Overview Our Mission Our mission is to make it easy to do business anywhere. Our founders started our company to champion small businesses, in the belief that the Internet would level the playing field by enabling small enterprises to leverage innovation and technology to grow and compete more effectively in domestic and global economies. We believe that concentrating on customer needs and solving their problems – whether those customers are consumers, 78 Table of Contents merchants or enterprises – ultimately will lead to the best outcome for our business. In the digital era, we are staying true to our mission by helping our customers and business partners harness the power of digital technology, AI and cloud infrastructure to optimize operations, unlock new opportunities and drive innovation. Our decisions are guided by how they serve our mission over the long term, not by the pursuit of short-term gains. Our Vision We do not pursue size or power; we aspire to be a good company that will last for 102 years. For a company that was founded in 1999, lasting for 102 years means we will have spanned three centuries, an achievement that few companies can claim. Our culture, business models and systems are built to last, so that we can achieve sustainability in the long run. Our Values Our values are fundamental to the way we operate and how we recruit, evaluate and compensate our people. •Customers first, employees second, shareholders third – This reflects our choice of what’s important, in order of priority. Only by creating sustained customer value can employees grow and shareholders achieve long-term benefit. •Trust makes everything simple – Trust is both the most precious and fragile thing in the world. The story of Alibaba is a story of building and cherishing trust. Complexity begets complexity, and simplicity breeds simplicity. Aliren (阿里人) are straightforward – what you see is what you get. With trust, there is no second-guessing or suspicion, and the result is simplicity and efficiency. •Change is the only constant – Whether you change or not, the world is changing, our customers are changing and the competitive landscape is changing. We must face change with respect and humility. Otherwise, we will fail to see it, fail to respect it, fail to understand it and fail to catch up with it. Whether you change yourself or create change, both are the best kinds of change. Embracing change is the most unique part of our DNA. •Today’s best performance is tomorrow’s baseline – In Alibaba’s most challenging times, this spirit has helped us overcome difficulties and survive. In bad times, we know how to motivate ourselves; in good times, we dare to set “dream targets” (stretch goals). Face the future, or we regress. We must shoot for the moon, challenge ourselves, motivate ourselves and exceed ourselves. •If not now, when? If not me, who? – This was a tagline in Alibaba’s first job advertisement and became our first proverb. It is not a question, but a call of duty. This proverb symbolizes the sense of ownership that each Aliren must possess. •Live seriously, work happily – Work is now, life is forever. What you do in your job is up to you, but you have responsibility to the ones who love you. Enjoy work as you enjoy life; treat life seriously as you do work. If you live with purpose, you will find reward. You make Alibaba different and make your loved ones proud. Everyone has their own view of work and life; we respect each person’s choice. Whether you live by this value depends on how you live your life. Company Overview Alibaba’s strategic priorities are AI + Cloud and consumption. We provide the technology infrastructure and marketing reach to help merchants, brands, retailers and other businesses leverage technology to engage with their users and customers and operate in a more efficient way. We empower enterprises with our full-stack AI capabilities and services to facilitate their AI transformation and to support the growth of their businesses. AI technology will also enhance user value across our e-commerce and other Internet platforms to transform our existing businesses. In fiscal year 2026, our businesses comprise Alibaba China E-commerce Group, Alibaba International Digital Commerce Group, AI + Cloud businesses, and others. An ecosystem has developed around our platforms and businesses that consists of consumers, merchants, brands, retailers, enterprises, third-party service providers, strategic alliance partners and other businesses. 79 Table of Contents Alibaba China E-commerce Group E-commerce We are the largest retail commerce business in the world in terms of GMV in the twelve months ended March 31, 2026, according to Analysys. To further enhance overall user experience, in fiscal year 2026 we undertook a strategic combination of Taobao and Tmall Group, Taobao Instant Commerce (formerly known as Ele.me) and Fliggy into Alibaba China E-commerce group, to transform our various e-commerce platforms into a comprehensive consumption platform. Leveraging our product and supply chain capabilities as well as fulfillment and delivery expertise, our consumers can enjoy a one-stop consumption experience with broad variety of quality products and services at attractive prices as well as a wide selection of delivery options that satisfy their needs. Quick Commerce Taobao Instant Commerce, a leading local services and on-demand delivery platform in China, enables consumers to use the Taobao, Taobao Instant Commerce, and Alipay apps to order meals, groceries, pharmaceuticals, FMCG, electronics, flowers, and apparel online. In addition, Fengniao Logistics, the on-demand delivery network of Taobao Instant Commerce, provides last-mile logistics services for Tmall brands and Alibaba Health. China Commerce Wholesale 1688.com, China’s largest integrated domestic wholesale marketplace in the twelve months ended March 31, 2026 by net revenue according to Analysys, connects wholesale buyers and sellers across a wide range of categories. Alibaba International Digital Commerce Group Alibaba International Digital Commerce Group (AIDC) operates various retail and wholesale platforms to empower brands, merchants and SMEs to serve global buyers and consumers through wide product selection and differentiated customer experiences. International Commerce Retail Our International commerce retail businesses, including AliExpress, Trendyol and Lazada, empower brands and merchants with local market insights and critical commerce infrastructure. AliExpress, one of our international e-commerce platforms, enables global consumers to buy directly from manufacturers and distributors in China and around the world. Trendyol, which we believe is by far the leading e-commerce platform in Türkiye in terms of GMV in 2025, and serves consumers with a broad selection of products and services. Lazada, a leading e-commerce platform in Southeast Asia, serves one of the largest markets in the global e-commerce industry by providing consumers with access to a broad range of offerings from local SMEs, as well as regional and global brands. International Commerce Wholesale We operate Alibaba.com, China’s largest integrated international online wholesale marketplace in the twelve months ended March 31, 2026 by revenue, according to Analysys. During fiscal year 2026, buyers who sourced business opportunities or completed transactions on Alibaba.com were located across over 190 countries. AI + Cloud Businesses We possess full-stack AI capabilities. Chips and cloud computing form the infrastructure layer, while the AI model and application layer comprises foundation models, model-as-a-service (MaaS), and both enterprise and consumer applications. Alibaba Group is the world’s fourth largest and Asia Pacific’s largest Infrastructure-as-a-service provider by revenue in 2025 in U.S. dollars, according to Gartner April 2026 report (Source: Gartner®, “Market Share: IaaS, Worldwide, 2025”, 10 April 2026, Sorted by Infrastructure-as-a-Service (IaaS), Vendor Revenue Basis) (Asia Pacific refers to Mature Asia/Pacific, China (Region), Emerging Asia/Pacific and Japan (Region), and market share refers to that of Infrastructure-as-a-Service (IaaS)). Alibaba Group is also China’s largest provider of public cloud services by revenue in 2025, including PaaS and IaaS services, according to IDC (Source: IDC Quarterly Public Cloud Service Tracker, 2025H2&Q4). Leveraging our full-stack cloud capabilities and proprietary products portfolio, Cloud Intelligence Group offers a comprehensive suite of cloud services based on a three-tiered architecture of infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and model-as-a-service (MaaS) to customers worldwide. We leverage 80 Table of Contents these product capabilities and technologies to provide our customers across various verticals with industry-specific solutions, enabling intelligent business decisions and operations in the AI era. T-Head, our chip design subsidiary, has brought its proprietary GPU into production at scale, supporting end-to-end AI workloads from training and fine-tuning to inference. Qwen model family, our enterprise-grade large model suite, drives rapid AI adoption across key verticals and delivers measurable productivity gains through its full-stack, multimodal capabilities. Powered by our most advanced Qwen foundation model, Qwen app, our flagship consumer-facing AI application transforms proprietary model leadership into scalable, real-world applications. Wukong, our AI-to-B AI agent platform, enables AI-powered upgrades to enterprise workflows. We believe the added value of our AI + Cloud services translates into direct and tangible results, and these services have become a critical foundation for our customers, many of whom are reputable industry leaders in their respective verticals. Other businesses We continue to innovate and develop new service and product offerings with the aim of addressing the evolving needs of our customers, improving efficiency in their daily lives and creating synergies among our ecosystem participants. Our other businesses include Freshippo, Cainiao, Alibaba Health, Hujing Digital Media and Entertainment Group, Amap, among others. Our Ecosystem An ecosystem has developed around our platforms and businesses, consisting of consumers, merchants, brands, retailers, enterprises, third-party service providers, strategic alliance partners and other businesses. At the nexus of this ecosystem are our technology platform, our marketplace rules and the role we play in connecting these participants to make it possible for them to discover, engage and transact with each other and manage their businesses anytime and anywhere. Our ecosystem has strong self-reinforcing network effects benefiting its various participants, who are in turn invested in the growth and success of our ecosystem. The following chart sets forth our main businesses for fiscal year 2026 by segment: Our Strategies With the dawn of the AI agent era, AI models and capabilities are rapidly being embedded into all kinds of mainstream work environments, with token consumption surging across sectors. For enterprises and organizations, AI technology advancement drives profound industry transformation that changes the way people live and work. AI application provides enterprises and organizations with innovative tools to elevate productivity to a new level. On the consumption side, AI will also profoundly reshape e-commerce for both merchants and consumers. At the same time, consumers are seeking enhanced and more efficient shopping experience enabled by quick commerce. 81 Table of Contents While such transformation presents tremendous opportunities, it requires us to be more focused, innovative and agile in establishing strategic priorities and strengthening our competitive advantages. We have continued to invest decisively in our strategic priorities – AI + Cloud and consumption, and we have seen great momentum with technological advances, customer adoption, market share and user engagement over the past fiscal year. Looking ahead, we continue to strive to strengthen our leadership and build core capabilities in these two strategic priorities. AI + Cloud As we enter into a new era driven by agents, compared to earlier phases of AI, models and applications have become much more closely integrated and this is critically important for both model and application development. In the early stages of AI, most pre-training relied on static datasets. Now, in the agentic era, many advances will stem from the close integration between models and business applications, as well as from data feedback loops generated in real customer usage scenarios. Faced with an industry transformation and strategic opportunity of this magnitude, Alibaba Group is in a new phase of entrepreneurial reinvention and critical investment oriented toward the future. Alibaba has built complete full-stack AI capabilities set to support this exponential growth in demand. We possess full-stack AI capabilities: chips and cloud computing form the infrastructure layer, while the AI model and application layer — anchored by Alibaba Token Hub Business Group — comprises foundation models, MaaS, and both enterprise and consumer applications. Together, these give us end-to-end coverage and use cases across the entire stack. At the infrastructure layer, the compute demands of large-scale AI models require reliable cloud infrastructure for optimal efficiency, creating clear and massive demand for cloud services in the AI era. We will continue to invest in AI infrastructure. We remain committed to building a reliable, efficient and globally distributed AI infrastructure network that empowers our customers and ecosystem partners to capture growth opportunities in the AI era. We will continue to expand T-Head’s compute supply and contribute high-quality compute to our cloud infrastructure and MaaS platform, strengthening the competitiveness of our cloud services. We aim to deepen T-Head’s co-design with Alibaba Cloud infrastructure and our foundation models to deliver superior price-performance and lower inference costs. At the model and application layer, we have established the Alibaba Token Hub Business Group with the core mission of creating, delivering, and applying tokens. AI technological capabilities are fundamental to our growth strategy, with AI foundation models playing an important role in elevating productivity. We will continue to invest in proprietary AI foundation models to maintain technological leadership. Through foundational architectural innovation of our foundation models, we strive to improve inference efficiency while reducing inference costs. On the consumer application side, we launched the Qwen app building on the strength of our foundation models. We aim to deepen Qwen app’s integration across Alibaba’s ecosystem, giving it unique capabilities across the lifestyle domain and enabling it to become the leading all-in-one personal AI assistant for life, work, and learning. We also launched our AI-to-B agent platform, Wukong. We aim to progressively integrate business-to-business (B2B) commercial capabilities across Alibaba’s entire ecosystem to support Wukong in becoming the ultimate AI work assistant. Beyond the application layer, MaaS serves as the channel linking the model and application layers. In addition to supporting our internal businesses, we are investing in our MaaS offering to support a broad range of external AI industry applications and to capture the enormous market value and opportunity in this area. In addition, we believe there are significant opportunities to be captured outside China by addressing the AI compute and MaaS needs of international customers and Chinese customers expanding overseas. Leveraging our proven expertise from the Chinese market, we strive to offer industry-leading and cost-effective technologies and products that are competitive on the global stage. Looking ahead, to deliver tailored, customer-centric support to global enterprises and organizations, we will further expand the coverage of our global infrastructure network and localized support teams, accelerate the establishment of a global AI infrastructure network and promote the globalization of AI-related products. We believe that our continued commitment to long-term growth and investment in overseas markets will unlock incremental growth opportunities for us. Consumption Consumption continues to present significant opportunities in China and globally. China’s digital consumption market encompasses diverse value propositions. As a comprehensive consumer platform, Taobao serves a broad and varied consumer base. To further strengthen our competitiveness and tap into new growth potential, we continue to expand the platform’s offerings of high-quality products and services to meet multi-tiered consumer demands, ultimately delivering a shopping experience defined by quality products, competitive pricing and exceptional service. We continue to invest in user growth and have increased our focus on competitively priced products, customer service and membership programs, aimed at delivering an exceptional user experience in all aspects. Across our efforts of executing a multi-tiered strategy to cater to all aspects of consumption 82 Table of Contents needs, we view price competitiveness as one of our key value propositions. To make the price of our products more appealing to our consumers, we continue to leverage our position as China’s leading e-commerce platform to further improve the efficiency of our service offerings and supply chain capabilities. We strive to improve our consumers’ shopping experience via a more reliable and multi-tiered delivery experience. We see a huge market opportunity in quick commerce. Quick commerce addresses widespread, everyday needs for consumers. Taobao already has a large and diverse user base and large base of existing merchants, while we also have well-established on-demand fulfillment infrastructure. Looking ahead, we anticipate greater convergence between traditional e-commerce and quick commerce. We believe quick commerce is reshaping users’ consumption habits. Quick commerce represents a high-frequency use case and through this strategic investment, we aim to drive greater user engagement and long-term user growth on Taobao and Tmall. Going forward, we will also continue to invest in key AI initiatives as consumers adapt to consumption in the AI agent era. Alibaba has both leading AI full stack capabilities and extensive lifestyle and commerce use cases. We believe there are synergies to be realized by gradually integrating Qwen app with e-commerce, map navigation, local services, and more, to create an AI-powered entry point for everyday life. We believe AI innovation and ecosystem collaboration reinforcing each other will deliver substantial user value to consumers. While enhancing consumer experiences, we are also actively improving the operating environment for merchants on our platform. We are strengthening support for merchants that provide high-quality products and services to consumers and leveraging AI to boost their operating efficiency. We are rolling out new AI-driven tools, including Wukong, our AI-native enterprise agent, for merchants to help upgrade their operating models with AI. Together, we strive to foster a sustainable and mutually beneficial ecosystem for all stakeholders. Despite evolving complexities in the global macro environment, we remain firmly committed to providing a multi-tiered suite of product and service offerings to our consumers worldwide, and creating growth opportunities for our global merchants and partners. Our core globalization strategies are supported by our robust ecosystem of consumption and technology. Environmental, Social and Governance Responsibilities ESG, as the foundation of our long-term strategy, not only provides a framework for solving a series of global challenges, but is fundamental to Alibaba’s journey towards lasting 102 years. We believe we can only create and sustain a profitable and prosperous business by bringing about positive changes to society. We are committed to assuming greater responsibility while pursuing business excellence as the operator of a platform economy. Our Businesses Alibaba China E-commerce Group E-Commerce We operate the largest retail commerce business in the world in terms of GMV in the twelve months ended March 31, 2026, according to Analysys. We aim to build a comprehensive consumer platform integrating daily life services and e-commerce. Consumers can access our various marketplaces, channels, features, services and content within our ecosystem through the Taobao app. Empowered by our commerce technologies and services, we appeal to a massive consumer base by providing them with diversified and comprehensive offerings at attractive prices supported by quality services. •Consumers We serve a large and diversified consumer base in China, across both large cities and less-developed areas, and we continue to grow our user base. We believe our platforms continue to appeal to consumers at various income levels and address all aspects of consumption needs. We focus on enhancing user experience on our platform, and have consolidated supply chains, user bases and membership benefits across our businesses and launched a tiered loyalty program that connects Taobao Instant Commerce, Fliggy and Amap, enhancing user experiences across a full spectrum of consumption scenarios. Generally, the longer the consumers have been with us, the more orders they tend to place across a more diverse range of product categories. 88VIP members, our highest spending consumer group, showed a similar level of retention rate in fiscal year 2026 compared to that of fiscal year 2025. 83 Table of Contents •Products and Services We believe our ecosystem offers the most comprehensive range of products and services among global commerce platforms to meet the diverse demands of our massive and diversified consumer base across different segments. We have developed a digital commerce infrastructure that offers an upgraded consumer experience by deepening the collaboration across businesses within our ecosystem. Leveraging our product and supply chain capabilities, consumers can enjoy a broad variety of quality products, such as branded products, imported goods, products sourced directly from manufacturers and farms as well as idle goods. We have also developed logistics expertise and capabilities that allow us to offer a full range of high-frequency fulfillment services to satisfy consumer demand. Our comprehensive delivery options include on-demand delivery, half-day delivery, same-or-next-day delivery and next-day pick-up services, which capture the varying needs of consumers living in large cities and less-developed areas. Our key businesses are: oTaobao and Tmall Taobao means “search for treasure” in Chinese. It serves as the starting point and destination portal for many users’ shopping journey and provides a top-level traffic funnel that directs users to the various marketplaces, channels and features within our ecosystem. The platform leverages a balanced mix of brands and diversified supplies to build up its merchandise assortment. Consumers from both large cities and less-developed areas come to Taobao to enjoy an engaging and personalized shopping experience, optimized by our data analytics and technology. Tmall caters to consumers’ demand for high-quality products and premium shopping experience. Branded goods fulfill this quality-driven consumption needs, and a large number of international and Chinese brands and retailers have established storefronts on the platform, with full control over their own branding and merchandising. Merchants, brands and retailers can take advantage of our significant traffic to extend and build brand awareness and customer engagement. We enable brands to accurately identify and engage with target consumers. Diversified supply connects value-seeking consumers with directly sourced value-for-money products, offering a variety of quality products, which empowers long-tail merchants and manufacturers, enable SMEs to achieve sustainable growth on our platform. oTmall Global Tmall Global addresses the increasing demand of consumers in China for international products and brands. Tmall Global serves as the premier platform through which overseas brands and retailers reach consumers in China, build brand awareness and gain valuable consumer insights to form their overall China strategies, without the need for physical operations in China. We believe Tmall Global is a leading import e-commerce platform in China. oTmall Supermarket Tmall Supermarket offers daily necessities, FMCG and general merchandise through Taobao app with same-or-next-day delivery services. By leveraging our technology capabilities and consumer insights, Tmall Supermarket facilitates the digital transformation of its offline partners, enhancing their supply chain management capabilities. oXianyu Xianyu is China’s largest consumer-to-consumer community and marketplace for idle goods, in terms of GMV for the twelve months ended March 31, 2026, according to Analysys. Through Xianyu, consumers can find a wide variety of second-hand goods, recycled goods, consignment, items for rent, and long-tail products, offered by individual users and small businesses. 84 Table of Contents •Consumer and Merchant Experience We aim to build a comprehensive platform integrating shopping and daily life services that enhance our user’s experience across a full spectrum of consumption scenarios. The massive amount of user and merchant activities taking place every day on our China commerce retail platforms generate significant consumer insights. By leveraging proprietary AI and data technologies, we are able to aggregate and build on deep consumer insights to provide more accurate search results and relevant recommendation feeds that enhance the shopping experience for our consumers. Our various commerce platforms also enable merchants to engage with consumers through a variety of formats, including livestreaming, short-form videos, interactive games and microblogs. We continue to introduce interactive features to facilitate user engagement with brands, merchants and content creators. Along with these features and formats, our relevant and engaging entertainment content plays an important role in consumers’ product discovery process and shopping journey, and drives user stickiness and retention on our various platforms. On the merchant end, we focus on improving their operating environment and help them enhance efficiency. Merchants, brands and retailers turn to Taobao and Tmall not only for their broad user base, but also for their consumer insights and technology. Taobao and Tmall have driven the digitalization and transformation of merchants, brands and retailers by enabling them to digitalize their operations, engage, acquire and retain consumers, increase brand recognition, innovate product offerings, manage supply chains and enhance operating efficiency. In particular, Taobao and Tmall offer a variety of one-stop brand marketing and promotional products to help merchants, brands and retailers quickly acquire new users, launch new products and to improve conversions. Merchants, brands and retailers can easily create storefronts and listings on Taobao and Tmall. We provide merchants with diversified marketing services to enhance their business performance. Taobao and Tmall merchants can purchase P4P, in-feed marketing and display marketing and software services to direct traffic to their storefronts. In addition, merchants can acquire additional traffic from third-party marketing affiliates to further expand their reach. We continue to see increasing penetration of Quanzhantui due to its convenience of use and improvement of marketing efficiency. Additionally, we implemented user-friendly promotion mechanisms and increased support for merchants that provide high-quality products and consumer services. •Branding and Monetization Platforms - Alimama, our proprietary monetization platform Alimama is our monetization platform. Using our proprietary technology, this platform matches the marketing demands of merchants, brands and retailers on all of the platforms in our ecosystem with the media resources on our own platforms and third-party properties. The platform supports P4P marketing and software services based on keyword search rankings, in-feed marketing targeting different groups of consumers, or display marketing at fixed positions that are bid on through auctions, as well as cost per thousand impression (CPM)-based, time-based marketing formats, or individual campaigns at fixed cost, through the display of photos, graphics, videos and livestreaming. The ranking of P4P search results on our marketplaces is based upon proprietary algorithms that take into account the bid price of keywords, the popularity and quality of an item, service or merchant, as well as customer feedback rankings of the merchant or service provider. Our in-feed and display marketing and software services take these factors into consideration, along with other consumer insights generated across our ecosystem, to further deliver an engaging and relevant content discovery process and shopping experience to our consumers through livestreaming, short-form videos, interactive games and other formats. The relevance and comprehensiveness of insights based on commercial activity and user activity in our ecosystem as well as our AI capabilities such as Quanzhantui which provide a unique advantage for Alimama to deliver the most relevant information to users through highly engaging content and effective format, which in turn enables merchants to improve their efficiency and ensure their sustainable development on our platform. Alimama also has an affiliate marketing program that places marketing displays on third-party apps and websites, thereby enabling marketers, if they so choose, to extend their marketing and promotional reach to properties and users beyond our own platforms. Our affiliate marketing program not only provides additional traffic to our marketplaces, but also generates revenue to us. 85 Table of Contents Alimama operates Taobao Ad Network and Exchange, or TANX, one of the largest real-time online bidding marketing exchanges in China. TANX helps publishers monetize their media inventories both on mobile apps and web properties. TANX automates the buying and selling of tens of billions of marketing impressions on a daily basis. Quick Commerce Taobao Instant Commerce Taobao Instant Commerce (formerly known as Ele.me), a leading local services and on-demand delivery platform in China, enables consumers to use the Taobao, Taobao Instant Commerce and Alipay apps to order meals, groceries, pharmaceuticals, FMCG, electronics, flowers, and apparel online. In addition, Fengniao Logistics, the on-demand delivery network of Taobao Instant Commerce, provides last-mile logistics services for Tmall brands and Alibaba Health. In fiscal year 2026, we rebranded “Ele.me” to “Taobao Instant Commerce” to closely align it with the Taobao app and strengthen our branding. To unlock synergies with our e-commerce business, we expanded our product offerings for non-food categories and accelerated the onboarding of offline stores, with nearly 5,000 Tmall brands on the Taobao Instant Commerce channel as of March 31, 2026. China Commerce Wholesale 1688.com 1688.com, China’s largest integrated domestic wholesale marketplace in the twelve months ended March 31, 2026 by net revenue, according to Analysys, provides sourcing and online transaction services by connecting manufacturers and wholesale sellers to wholesale buyers in China. These manufacturers, wholesale sellers and wholesale buyers trade a diverse range of products. Sellers may purchase a China TrustPass membership for an annual subscription fee to list items on 1688.com, reach customers, provide quotations and transact on the marketplace without any additional charges. Paying members may also pay for premium memberships and value-added services, such as premium data analytics and upgraded storefront management tools, as well as customer management services, such as P4P marketing and software services from the website and app. In fiscal year 2026, value-added services and customer management services together contributed the majority of 1688.com’s total revenue. In fiscal year 2026, 1688.com continue to utilize a series of AI tools to enhance the day-to-day operations of buyers and sellers. Buyers can source products more efficiently via smart search, price comparison and product review analyses. Sellers can streamline their store management and product listing processes using innovative features such as AI digital assistant and intelligent product highlights generation. Alibaba International Digital Commerce Group Alibaba International Digital Commerce Group operates various retail and wholesale platforms including AliExpress, Trendyol, Lazada and Alibaba.com. While maintaining a strategic emphasis on key regions, AIDC narrowed loss significantly year-over-year, driven by enhancing operating and investment efficiency. International Commerce Retail In fiscal year 2026, our international commerce retail businesses together achieved 9% revenue growth, primarily driven by strong performance in cross-border operations and supported by technological innovation, business model enhancement, supply chain upgrade and enhanced consumer experience AliExpress AliExpress is a global e-commerce platform targeting consumers around the world and enabling them to buy directly from manufacturers and distributors in China and around the world. Consumers can access the marketplace through AliExpress’ mobile app or websites. As of March 31, 2026, AliExpress covered over 200 countries and regions globally. AliExpress continues to expand its regional merchant networks and supply chains to diversify and enrich its product offerings in different markets. AliExpress’ Choice provides an enhanced experience to consumers by combining better product selection, price and quality with speed of logistics and great customer support. The unit economics of the AliExpress' Choice business continued to improve substantially. In FY26, AliExpress introduced its “AliExpressDirect” model that leverages inventories in over 30 countries, and launched the “Brand+” program that provides go-to-market solutions to brands going overseas. 86 Table of Contents Trendyol Trendyol, which we believe is by far the leading e-commerce platform in Türkiye in terms of GMV in 2025, and serves consumers with a broad selection of products and services. Consumers also enjoy quality and convenient delivery services provided by Trendyol’s fulfillment and logistics networks. Beyond Türkiye, Trendyol has expanded to other valuable emerging markets, by leveraging its abundant product supply and fast and reliable logistics capability. Lazada Lazada, a leading e-commerce platform in Southeast Asia, serves one of the largest markets in the global e-commerce industry by providing consumers with access to a broad range of offerings from local SMEs, and regional and global brands. Additionally, Lazada operates one of the leading e-commerce logistics network in Southeast Asia, serving its consumers and merchants with reliable, quality and convenient logistics services that are critical to online shopping experience in Southeast Asia. International Commerce Wholesale Alibaba.com is China’s largest integrated international online wholesale marketplace in terms of revenue in the twelve months ended March 31, 2026, according to Analysys. It connects Chinese and overseas suppliers to overseas wholesale buyers, who are typically trade agents, wholesalers, retailers, manufacturers and SMEs engaged in the import and export business, and provides them with sourcing, online transaction, digital marketing, digital supply chain fulfillment and financial services. Sellers on Alibaba.com may purchase an annual membership to reach customers, provide quotations and transact on the marketplace. As of March 31, 2026, Alibaba.com had over 240,000 paying members from China and around the world. Sellers may also purchase additional value-added services to manage product listings and facilitate transaction processes, such as upgraded storefront management tools, customer relationship management SaaS services, trade assurance and logistics fulfillment services, as well as customer management services, such as P4P marketing and software services from the website and app. In fiscal year 2026, value-added services and customer management services together contributed the majority of Alibaba.com’s total revenue. Additionally, during the same period, over 47 million buyers from over 190 countries sourced business opportunities or completed transactions on Alibaba.com. During fiscal year 2026, Alibaba.com saw broader adoption by merchants of its AI-powered tools for marketing, procurement and product listing, which provided multiple ways for the platform to monetize. In fiscal year 2026, we released Accio, an AI-enabled business-to-business procurement engine, and Accio work, an agentic business platform designed to handle the full operating lifecycle of global small and medium – sized businesses beyond sourcing alone, aiming to lower the entry barrier for cross-border commerce and enhance operational efficiency. AI + Cloud Businesses We possess full-stack AI capabilities. Chips and cloud computing form the infrastructure layer, while the AI model and application layer comprises foundation models, MaaS, and both enterprise and consumer applications. Cloud Intelligence Group Alibaba Group is the world’s fourth largest and Asia Pacific’s largest Infrastructure-as-a-service provider by revenue in 2025 in U.S. dollars, according to Gartner April 2026 report (Source: Gartner®, “Market Share: IaaS, Worldwide, 2025”, 10 April 2026, Sorted by Infrastructure-as-a-Service (IaaS), Vendor Revenue Basis) (Asia Pacific refers to Mature Asia/Pacific, China (Region), Emerging Asia/Pacific and Japan (Region), and market share refers to that of Infrastructure-as-a-Service (IaaS)). Alibaba Group is also China’s largest provider of public cloud services by revenue in 2025, including PaaS and IaaS services, according to IDC (Source: IDC Quarterly Public Cloud Service Tracker, 2025H2&Q4). In 2025, the revenue of China’s public cloud service market, including IaaS, PaaS and SaaS markets, accounted for 0.2% of China’s GDP, which is significantly lower than that of the U.S. and indicates tremendous room for growth. The industry has experienced significant growth in recent years with increasing adoption of both infrastructure services and value-added services by enterprises. The technologies that power Cloud Intelligence Group originally grew out of the massive scale and complexity of the needs of our China commerce businesses, which encompass commerce, payments and logistics. Leveraging our full-stack cloud capabilities and proprietary products portfolio, Cloud Intelligence Group offers a comprehensive suite of cloud services based on a three-tiered architecture of infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and model-as-a-service (MaaS) to customers worldwide. These services not only enable our customers to build a flexible, scalable, affordable and secure technology infrastructure, but also equip them with leading data capabilities that efficiently handle complex management, analytics and machine 87 Table of Contents learning tasks, thereby generating significant business insights and enabling intelligent business decisions and operations. We leverage these capabilities and technologies to support our ecosystem and provide our customers across various verticals with industry-specific solutions, including those for commerce, financial services and industrial applications. In addition, as part of our globalization strategy, Cloud Intelligence Group continued to expand our international cloud computing infrastructure to better serve our customers’ needs in overseas markets. As of March 31, 2026, Cloud Intelligence Group offered computing services in 34 regions globally. Cloud Intelligence Group has built a comprehensive MaaS ecosystem centered around our AI + Cloud businesses, establishing China’s first and globally leading full-stack agentic service capability. According to Frost & Sullivan’s “State of GenAI: Foundational Model in Chinese Enterprise, 2025H2”, Qwen ranked first with a 32% market share in enterprise-level large model invocation in China in 2H2025. According to Omdia’s “AI Cloud Market: China - 1H25”, Alibaba Cloud ranked first, capturing 35.8% market share in China’s AI cloud market. Our self-developed AI platform, Platform for AI (PAI), and our Lingjun Intelligent Computing Service utilizes advanced software-hardware integrated optimization technology to achieve high performance and large-scale cluster scalability, to enable stability in large model training and near-linear acceleration. PAI provides a serverless service mode that offers end-to-end support for the fine-tuning, evaluation, and deployment of major open-source large models, as well as comprehensive inference optimization solutions. Cloud Intelligence Group’s unique advantages lie in our proprietary technology and continued commitment to invest in research and development of new product offerings and industry-specific solutions for our customers and partners. Cloud Intelligence Group continues to attract customers that are reputable and have the potential to adopt cloud services at a meaningful scale. In fiscal year 2026, Cloud Intelligence Group served approximately 67% of A-share listed companies in China. As AI transformation accelerates, our customers, especially those from traditional verticals, have increased their usage of our cloud services. We believe our cloud services have become a critical foundation that many of our customers increasingly depend on in their daily operations. T-Head T-Head, our chip design subsidiary, has brought its proprietary GPU into production at scale, supporting end-to-end AI workloads from training and fine-tuning to inference. Compatible with mainstream AI frameworks, T-Head enhances our long-term computing supply capacity. By combining its capabilities with our Qwen models and cloud computing, it delivers highly cost-effective AI services to external customers. This business has scaled rapidly and now contributes meaningfully to our cloud infrastructure supply. Qwen Model Family Qwen model family, our enterprise-grade large model suite, continues to drive rapid AI adoption across key verticals, including intelligent manufacturing, financial services, consumer retail, and cloud-native development, delivering measurable productivity gains through its full-stack, multimodal capabilities. Underpinned by cutting-edge AI foundation models, extensive real-world deployment, and clear technological leadership, our Qwen models are scaling rapidly in both technology innovation and adoption. Qwen models have demonstrated leading capabilities in multimodal AI with strong performance across reasoning, coding, agentic tasks and multimodal understanding, while delivering higher inference efficiency and broader global accessibility. Qwen App Powered by our most advanced Qwen foundation model, Qwen app, our flagship consumer-facing AI application transforms proprietary model leadership into scalable, real-world applications. Under the new era of task‑oriented execution in the AI industry, Qwen app is deeply integrated with core services across our ecosystem, including Taobao and Tmall, Taobao Instant Commerce, Amap, Fliggy, and Alipay. Qwen app intelligently coordinates services across multiple platforms as an AI assistant capable of executing large‑scale, real‑world complex tasks. This ecosystem-wide integration further expands our user reach, strengthens engagement across Alibaba’s platforms, and reinforces our leadership in applied AI. Since its launch, Qwen app has seen tremendous growth in user engagement. In March 2026, consumer-facing Qwen has surpassed 295 million monthly active users across all platforms. Wukong Wukong is our AI-native enterprise-grade AI-to-B agent platform. Wukong enables AI-powered upgrades to enterprise workflows while remaining compatible with each organization’s data permissions and management processes. It serves as the unified interface for Alibaba’s AI capabilities in enterprise work environments. B2B commercial capabilities across Alibaba’s entire ecosystem will be progressively integrated via technical formats, such as Wukong Skills, to support Wukong in becoming the ultimate AI work assistant. DingTalk provides the enterprise operating system foundation, including users, permissions, and ecosystem for Wukong, while 88 Table of Contents Wukong redefines DingTalk into an AI-native enterprise platform in the AI Agent era. In March 2026, DingTalk was integrated as Wukong into the AI + Cloud framework, with Wukong positioned as the core token consumption platform and value amplifier for MaaS. In March 2026, DingTalk’s paying active daily users surpassed 36 million. According to QuestMobile, DingTalk is the largest business efficiency mobile app in China by monthly active users in March 2026. Other businesses In addition to those discussed above, our other businesses also include Freshippo, Cainiao, Alibaba Health, Hujing Digital Media and Entertainment Group, Amap, among others. Amap Amap, a leading provider of mobile digital map, navigation and real-time traffic information in China, provides users with a simple one-stop access point to services such as navigation, local services and ride-hailing. In addition, Amap provides digital map data, navigation software and real-time traffic information to automobile manufacturers as well as aftermarket consumers in China. Amap also empowers major platforms and infrastructural service providers, including our China commerce retail platforms, Cainiao and Alipay. In fiscal year 2026, Amap launched the "Amap Street Stars" feature, a trust-based rating system designed to strengthen consumer confidence and enable merchants to focus on operations, ultimately supporting the healthy and sustainable growth of the offline service sector. Furthermore, Amap undertook a comprehensive AI transformation with the launch of Amap 2025, bringing spatial intelligence into dynamic real-world scenarios. On October 1, 2025, the first day of the National Day holiday in China, Amap recorded an all-time high of more than 360 million peak daily active users. Cainiao Cainiao has established a smart logistics network with end-to-end logistics capabilities on a global scale, powered by practical and cost-effective logistics technologies solutions. Cainiao controls the key nodes of the logistics network to ensure service quality, efficiency and reliability, while leveraging trusted partners’ capabilities to drive scalability and capital efficiency. Cainiao provides a wide array of innovative logistics solutions in China and around the world, serving both our e-commerce businesses as well as third parties. In 2026, Cainiao launched ZeeBot, an innovative climbing robot enhancing warehouse space utilization and order picking efficiency for customers. In fiscal year 2026, Cainiao continued to expand its global logistics network, strengthening its presence in key European markets. Hujing Digital Media and Entertainment Group Youku, a leading online long-form video platform in China, produces and distributes high-quality video content, enabling users to search, view and share such content quickly and easily across multiple devices. The Youku brand is among the most-recognized online video brands in China. Insights we gain from our ecosystem and our proprietary technology enable Youku to leverage AI technology to deliver relevant and captivating content to its users. Damai Entertainment has a diversified business model, providing performance and event ticketing management in both domestic and international markets, IP-related licensing and operations, content production, promotion and distribution, as well as data services for the entertainment industry. Damai Entertainment’s subsidiary Damai is a comprehensive live performances service provider in China, providing ticketing management for events including concerts, plays and sports events. In fiscal year 2026, Damai maintained its leading position in the concert ticketing industry by serving almost all large-scale concerts in China. In addition, Damai Entertainment continues to tap into high-quality IP and explore IP commercialization. 89 Table of Contents Freshippo Freshippo, our new retail platform for groceries and fresh goods, integrates advanced technology and AI to redefine a healthy and convenient retail experience. Leveraging its excellent product innovation and research and development capabilities, robust supply chain management and multi-layer and multi-temperature logistics and fulfillment infrastructure, Freshippo continues to optimize its product matrix and build up private label offerings to deliver high-quality and healthy selections for consumers. By embedding AI capabilities across the entire retail value chain, Freshippo is building a new consumption paradigm by seamlessly integrating online and offline retail experiences and continues to drive operating efficiency through technology. In fiscal year 2026, Freshippo consistently focused on selected retail formats and expanded footprints to additional emerging cities and counties, which continues to strengthen the brand’s reputation among consumers. Furthermore, Freshippo strengthened its integration with Taobao Instant Commerce by providing high-quality product offerings. As a result, Freshippo’s overall GMV exceeded RMB 107 billion in fiscal year 2026. Freshippo Supermarket, one of Freshippo’s core retail format, operates over 490 stores with online transactions contributing more than 60% of Freshippo Supermarket’s GMV in fiscal year 2026. During the same period, Freshippo achieved positive full-year adjusted EBITA for the second consecutive year, attributable to the scalability and sustainability of the business. Alibaba Health Alibaba Health, our flagship platform in the healthcare sector, deeply integrates AI technology with pharmaceutical and healthcare service capabilities across the entire value chain. Alibaba Health has built an intelligent healthcare ecosystem that seamlessly combines online and offline capabilities. With a focus on user needs, we leverage AI technology to empower the intelligent transformation of medical and doctor services, enhancing the accessibility of pharmaceutical and health products as well as service efficiency. In addition, we actively explore innovative approaches for “AI+Healthcare” industry transformation. Sales and Marketing Our sales and marketing efforts emanate from the fundamental pillars that constitute our ecosystem, which include Alibaba China E-commerce Group, Alibaba International Digital Commerce Group, and Cloud Intelligence Group. We have wide consumer recognition of our brands and enjoy significant organic traffic through word-of-mouth. We believe the reputation and ubiquitous awareness of our brands and platforms in China and abroad provide us with the best and most cost-efficient marketing channel. In addition, we continue to improve our user experience by enriching interactive content, broadening the assortment of value-for-money products and consolidating membership benefits across our businesses to enhance user experience across a full spectrum of consumption scenarios. During fiscal year 2026, we enhanced our marketing efforts, such as by organizing a highly coordinated marketing and promotional campaign for the 11.11 Global Shopping Festival and AliExpress’ Black Friday promotion, in order to expand our user base both within China and abroad. We expect to continue allocating our resources in future marketing activities. We also expect to enhance our monetization capability through leveraging our AI and data technologies to develop and offer more personalized and innovative services, so as to improve customer experience and wallet share. Furthermore, our major business segments and other elements in our ecosystem provide synergistic advantages and create cross-promotional opportunities. Our AI + Cloud businesses remain committed to continually upgrading our products and services to better facilitate the AI transformation and long-term sustainable growth of our customers. We have established a professional in-house sales team that works closely with our solution architects and product team to provide product recommendation and services to our customers. We have also conducted a variety of marketing activities to promote our brand and products and grow our customer base on an ongoing basis. Our Technology Technology is key to our success in achieving efficiency, improving user experience, and enabling innovation. Our world-class proprietary technology supports peak order volumes of up to hundreds of thousands per second, delivers tens of billions of online marketing impressions per day, and enables millions of merchants, brands and other businesses to conduct their operations efficiently and effectively. The uniqueness of our technology lies in the unparalleled large-scale application environment due to the scale of our businesses as well as our diverse range of product and service offerings. By continually applying our technology across our businesses, we generate knowledge and innovations that drive improvements and further technological development. Our research and development team members play key roles in various international standardization organizations in areas such as security, and actively participate in international open-source foundations focusing on areas such as software engineering, cloud-native applications and databases. In fiscal year 2026, we further pursued our strategic focus on “AI + Cloud” and consumption and will continue to focus on three areas: cloud and AI infrastructure, AI foundation models and native applications, and the AI-driven transformation of our existing businesses. Key components of our technology include those described below: 90 Table of Contents Artificial Intelligence Qwen model family, our enterprise-grade large model suite, continues to drive rapid AI adoption across key verticals, including intelligent manufacturing, financial services, consumer retail, and cloud-native development, delivering measurable productivity gains through its full-stack, multimodal capabilities. Underpinned by cutting-edge AI foundation models, extensive real-world deployment, and clear technological leadership, our Qwen models are scaling rapidly in both technology innovation and adoption. Qwen models have demonstrated leading capabilities in multimodal AI with strong performance across reasoning, coding, agentic tasks and multimodal understanding, while delivering higher inference efficiency and broader global accessibility. Technology Infrastructure Our data centers utilize a leading distributed fault-tolerant architecture, advanced self-developed power and cooling equipment, AI-driven intelligent monitoring and operation technologies to provide reliable support, with high elasticity and high-density capabilities, to our intelligent computing business. Combined with a high proportion of clean energy use, our data centers provide stable, secure, efficient, agile, and green infrastructure services. Cloud Operating System We have developed a proprietary general-purpose distributed computing operating system, Apsara, inclusive of Shenlong Compute (our hardware virtualization architecture), Pangu (our distributed cloud storage system)and Luoshen (our cloud network structure), and have built the Lingjun Intelligent Computing Cluster and a global AI computing network, providing Cloud Intelligence Group’s customers and our core businesses with enhanced computing power, accelerated computation, storage and network capabilities to support their and our business growth in the new technology era. Database We have comprehensively optimized the three-tier disaggregated architecture of our cloud-native transactional database, PolarDB, enhancing its processing capabilities for AI workloads, with built-in model operator services to meet online inference demands and the LakeBase architecture for efficient management of massive metadata in the AI era. We have also continuously refined the serverless capabilities of our cloud-native analytical database, AnalyticDB. By achieving full serverless compute and supporting heterogeneous computing scheduling, and by integrating large model, we now support real-time analytics, online inference and generation on a super-large scale. Furthermore, we have upgraded the cloud-native multimodal database, Lindorm, to handle full-stack AI multimodal data processing. Through storage optimization, processing convergence, and large model integration, we have realized fused retrieval and intelligent processing of multimodal data. Concurrently, capabilities such as database operations and maintenance (O&M) and data analytics have undergone a comprehensive intelligent upgrade via an agent-based model. Big Data Analytics Platform We have continued to advance the technology architecture for data-AI integrated products. Through OpenLake architecture, we have built AI omni-modal data infrastructure to optimize storage-computation efficiency and costs. We have comprehensively upgraded our large-scale distributed technical capabilities across both computing engines and AI training and inference platforms, achieving deep optimization of our training and inference services. Furthermore, we provide computing services equipped with AI coding and agentic capabilities, along with out-of-the-box model customization capabilities. Security We are committed to building a comprehensive security system, with technical capabilities covering core areas such as network security, data protection, business risk control, and AI safety. We have built an end-to-end multi-dimensional defense system, including endpoints, public networks, backbone networks and data centers, to continue to strengthen cloud-native security technologies ensuring the safety of customer data and consumer data. The Fuyuan large model serves as the underlying intelligent engine in the security domain, providing intelligent support for network security, data privacy, and business risk control. Cybersecurity Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a comprehensive process for identifying, assessing and managing material risks from cybersecurity threats. In addition to the cybersecurity risk management framework that is centrally designed and implemented across our businesses, certain of our businesses have also formulated more detailed cybersecurity risk management measures tailored to their operations. 91 Table of Contents The Compliance and Risk Committee of our board of directors is responsible for overseeing our overall compliance and risk management framework, including cybersecurity risk management. Our risk management committee, consisting of senior management team members across legal, finance, security, technology and other departments, designs the implementation and operation of our compliance and risk management policies and procedures and review risk assessment reports. Among the risk management committee members, the head of Security Department has over 10 years of experience in the fields of data security and cybersecurity. Our risk management committee reports to the Compliance and Risk Committee on material regulatory developments, risk management measures and risk incidents, including those related to cybersecurity. In case a significant cybersecurity incident occurs, our risk management committee will review the information and issues involved, oversee the remedial procedures to be taken and report to the Compliance and Risk Committee as appropriate. Led by our head of Security Department, our team of dedicated cybersecurity, data security and technology professionals with extensive industry knowledge and having integrated AI technology to build an intelligent proactive defense system, are responsible for detecting, tracking and remediating cybersecurity incidents, as well as assessing and mitigating cybersecurity threats, and reporting to the risk management committee as appropriate. As part of our cybersecurity risk management process, we embed AI capabilities into risk identification, development security, incident response and other key areas, leverage AI for automated vulnerability detection and attack simulation to identify potential risks, regularly conduct application security assessments and vulnerability testing and maintain various incident response plans to protect against potential attacks. In addition, we monitor industry trends on cybersecurity risks and may also obtain input on our system and network security from external intelligence teams and experts. We require all our employees to undertake data security and compliance training program annually and employees involved in app development and in the Security Department to take more specialized courses and obtain certification before product release. We operate mostly on our proprietary information systems, and in the few circumstances where we engage third-party service providers, we work closely with them to ensure their compliance with our cybersecurity standards. We are not faced with any risks from cybersecurity threat that have materially affected or are reasonably likely to materially affect us, including our business, results of operations, or financial condition. However, despite the cybersecurity risk management procedures and measures that we have implemented, we still face risks of security breaches and attacks against our systems and network which may adversely affect our operation and result in data loss and leakage. For more information, see “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry— Security breaches and attacks against our systems and network, and any potentially resulting breach or failure to otherwise protect personal, confidential and proprietary information, could damage our reputation and negatively impact our business, as well as materially and adversely affect our financial condition and results of operations.” Competition We face competition principally from established Chinese Internet companies and their respective affiliates, global and regional e-commerce players, cloud computing service providers, logistics service providers and digital media and entertainment providers. These competitors generate significant traffic and have established strong brand recognition, robust technological capabilities and significant financial resources. The areas in which we compete primarily include: •Consumers. We compete to attract, engage and retain consumers based on the variety, quality and value of products and services listed on our platforms, the engagement of digital media and entertainment content available on our platforms, the overall user experience of our products and services, and the effectiveness of our consumer protection measures. •Merchants, Brands, Retailers and other Businesses. We compete to attract and retain merchants, brands and retailers based on the size and the engagement of consumers on our platforms and the effectiveness of our products and services to help them build brand awareness and engagement, acquire and retain customers, complete transactions, expand service capabilities, protect intellectual property rights and enhance operating efficiency. In addition, we compete to attract and retain businesses of different sizes across various industries based on the effectiveness of our cloud service offerings to help them enhance operating efficiency and realize their digitalization transformation ambitions. •Marketers. We compete to attract and retain marketers, publishers and demand-side platforms operated by agencies based on the reach and engagement of our properties, the depth of our consumer insights and the effectiveness of our branding and marketing solutions. •AI + Cloud Customers. We compete to attract and retain enterprises, developers and organizations by offering full stack AI capabilities to accelerate their AI transformation, enhance productivity and reduce operational costs. •Talent. We compete for motivated and capable talent, including engineers and product developers to build compelling apps, tools, and functions and to provide services for all participants in our ecosystem. 92 Table of Contents If international players gain greater access to the China market, certain of our business could be subject to greater competition. As we acquire new businesses and expand into new industries and sectors, we face competition from major players in these industries and sectors. In addition, as we continue to expand into markets outside of China, we increasingly face competition from domestic and international players operating in these markets. See “Item 3. Key Information - D. Risk Factors — Risks Related to Our Business and Industry — If we are unable to compete effectively, our business, financial condition and results of operations would be materially and adversely affected.” Seasonality Our overall operating results fluctuate from quarter to quarter as a result of a variety of factors, including seasonal factors and economic cycles that influence consumer spending as well as promotions. Historically, we have experienced seasonal fluctuations mainly in our commerce businesses. Our China commerce businesses typically record the highest levels of revenues in the fourth calendar quarter of each year due to a number of factors, including merchants allocating a significant portion of their online marketing budgets to the fourth calendar quarter, promotions, and the impact of seasonal buying patterns in respect of certain merchandise categories such as apparel. We also typically record lower levels of revenues in the first calendar quarter of each year due to a lower level of allocation of marketing budgets by merchants early in the calendar year and during the Chinese New Year holiday, during which time consumers generally spend less and businesses in China are generally closed. Our international commerce businesses are also subject to seasonal fluctuations depending on the markets we operate in. Regulation We operate in an increasingly complex legal and regulatory environment. We are subject to a variety of PRC and foreign laws, rules and regulations across a number of aspects of our business. As we have expanded our operations to other countries, we have become increasingly subject to applicable regulations in these jurisdictions. This section primarily summarizes the principal PRC laws, rules and regulations that we believe have the most significant impact on our business and operations within the PRC, because the PRC remains the country where we conduct a significant majority of our business and generate a significant majority of our revenues. Other jurisdictions where we conduct business have their own laws and regulations that cover many of the areas covered by PRC laws and regulations, but their focus, specifics and approaches may differ considerably. Current PRC laws, rules and regulations restrict foreign ownership in, among other areas, value-added telecommunication services, which include the operations of ICPs. As a result, we operate our Internet businesses and other businesses in which foreign investment is restricted or prohibited in the PRC through various contractual arrangements with VIEs that are incorporated in the PRC and owned by PRC citizens or by PRC entities which are ultimately owned and/or controlled by PRC citizens, and holds all regulated licenses associated with these businesses. The applicable PRC laws, rules and regulations governing foreign ownership and investment may change in the future. We may be required to obtain additional approvals, licenses and permits and to comply with any new regulatory requirements adopted from time to time. Moreover, substantial uncertainties exist with respect to the interpretation and implementation of these PRC laws, rules and regulations. See “Item 3. Key Information - D. Risk Factors — Risks Related to Doing Business in the People’s Republic of China — There are uncertainties regarding the interpretation and enforcement of PRC laws, rules and regulations, and changes in policies, laws, rules and regulations in the PRC could adversely affect us.” PRC Regulation Regulation of Telecommunications and Internet Information Services Regulation of Telecommunications Services Under the Telecommunications Regulations of the PRC, or the Telecommunications Regulations, promulgated on September 25, 2000 by the State Council of the PRC and most recently amended in February 2016, a telecommunications service provider in China must obtain an operating license from the MIIT, or its provincial counterparts. The Telecommunications Regulations categorize all telecommunications services in China as either basic telecommunications services or value-added telecommunications services. Our online and mobile commerce businesses, as well as Youku’s online video businesses, are classified as value-added telecommunications services. Foreign investment in telecommunications businesses is governed by the State Council of the PRC’s Administrative Rules for Foreign Investment in Telecommunications Enterprises, or the Foreign Investment Telecommunications Rules, which was recently amended 93 Table of Contents on March 29, 2022 and became effective on May 1, 2022. According to the amended Foreign Investment Telecommunications Rules, a foreign investor’s beneficial equity ownership in an entity providing value-added telecommunications services in China is generally not permitted to exceed 50% unless otherwise allowed by the competent PRC governmental authorities. Although the revised Foreign Investment Telecommunications Rules no longer require major foreign investors holding equity in enterprises providing value-added telecommunications services in China to have a good track record and operational experience in providing these services, the PRC governmental authorities have not promulgated the relevant implementation rules. Accordingly, there are uncertainties as to whether foreign investors without a good track record and operational experience in providing these services may qualify as major foreign investors in value-added telecommunications enterprises. Based on the Notice regarding the Strengthening of Ongoing and Post Supervision of Foreign Invested Telecommunication Enterprises issued by the MIIT in October 2020, foreign invested telecommunications enterprises are no longer subject to the requirement for prior MIIT approval. Nonetheless, these enterprises still need to submit the relevant materials to the MIIT to apply for new telecommunications operating permits or amended permits. Although the Negative List allows foreign investors to hold more than 50% equity interests in a value-added telecommunications service provider engaging in e-commerce, domestic multi-party communications, or storage-and-forward and call center businesses, other requirements provided by the amended Foreign Investment Telecommunications Rules shall still apply. The MIIT’s Notice Regarding Strengthening Administration of Foreign Investment in Operating Value-added Telecommunications Businesses, or the MIIT Notice, issued on July 13, 2006 prohibits holders of these service licenses from leasing, transferring or selling their licenses in any form, or providing any resource, site or facility, to any foreign investors intending to conduct this type of business in China. In addition to restricting dealings with foreign investors, the MIIT Notice contains a number of detailed requirements applicable to holders of value-added telecommunications service licenses, including that license holders or their shareholders must directly own the domain names and trademarks used in their daily operations and each license holder must possess the necessary facilities for its approved business operations and maintain its facilities in the regions covered by its license, including maintaining its network and providing Internet security in accordance with the relevant regulatory standards. The MIIT or its provincial counterparts have the power to require corrective actions after they discover any non-compliance by license holders, and where license holders fail to take those steps, the MIIT or its provincial counterparts have the power to revoke the value-added telecommunications service licenses. On December 28, 2016, the MIIT promulgated the Notice on Regulating Telecommunications Services Agreement Matters, or the Telecommunications Services Agreement Notice, which came into effect on February 1, 2017. According to the Telecommunications Services Agreement Notice, telecommunications service providers must require their users to present valid identification certificates and verify the users’ identification information before provision of services. Telecommunications service providers are not permitted to provide services to users with unverifiable identity or users who decline to proceed with identity verification. Regulation of Internet Information Services As a subsector of the telecommunications industry, Internet information services are regulated by the Administrative Measures on Internet Information Services, or the ICP Measures. “Internet information services” are defined as services that provide information to online users through the Internet. Internet information service providers that provide commercial services are required to obtain an operating license from the MIIT or its provincial counterpart. To the extent the Internet information services provided relate to certain matters, including news, publication, education or medical and healthcare (including pharmaceutical products and medical equipment matters), approvals or filings must also be obtained from the relevant industry regulators in accordance with the laws, rules and regulations governing those industries. Regulation of Advertising Services The principal regulations governing advertising businesses in China are: •the Advertising Law of the PRC (2021, as amended); •the Advertising Administrative Regulations (1987, as amended); •the Administrative Regulations on Internet Information Search Services (2016); and •the Administrative Measures for Internet Advertising (2023). These laws, rules and regulations require companies such as ours that engage in advertising activities to obtain a business license that explicitly includes advertising in the business scope from the SAMR, formerly the SAIC, or its local branches. The applicable PRC advertising laws, rules and regulations contain certain prohibitions on the content of advertisements in China (including prohibitions on misleading content, superlative wording, socially destabilizing content or content involving obscenities, 94 Table of Contents superstition, violence, discrimination or infringement of the public interest). Advertisements for anesthetic, psychotropic, toxic or radioactive drugs are prohibited, and the dissemination of advertisements of certain other products, such as tobacco, patented products, pharmaceuticals, medical instruments, agrochemicals, foodstuff, alcohol and cosmetics, are also subject to specific restrictions and requirements. Advertisers, advertising operators or advertising distributors may be subject to civil liability if they infringe the legal rights and interests of third parties, such as infringement of intellectual property rights, unauthorized use of a name or portrait and defamation. On June 25, 2016, the Cyberspace Administration of China promulgated the Administrative Regulations on Internet Information Search Services, or the Internet Search Regulations, which came into effect on August 1, 2016. According to the Internet Search Regulations, Internet search service providers must verify paid-search service customers’ qualifications, limit the ratio of paid-search results on each web page, and clearly distinguish paid-search results from natural search results. On February 25, 2023, the SAMR released the Administrative Measures for Internet Advertising, which came into effect from May 1, 2023. The Administrative Measures for Internet Advertising set out, among other things, the following requirements for Internet advertising activities: •online advertisements for tobacco (including e-cigarettes) are not allowed, and online advertisements for prescription medicine are not allowed unless otherwise permitted by laws and regulations; •online advertisements for special commodities and services such as medical treatments, pharmaceuticals, medical devices, agrochemicals, veterinary medicine, health foods and food for special medical purposes must be reviewed by competent authorities before online publication, and the advertisements for such commodities and services are not allowed to be published in the form of introducing health and wellness knowledge. In addition, when introducing health and wellness knowledge, information such as the address or contact information of commodity operators or service providers and shopping links related to these products must not appear on the same page or at the same time; •advertisements for medical treatments, pharmaceuticals, health foods, special medical purpose formula foods, medical devices, cosmetics, alcohol, beauty advertisements, and online game advertisements that are detrimental to the physical and mental health of minors shall not be published on Internet media targeted to minors; •Internet advertisements must be visibly marked as “advertisement”, while paid-search results must be obviously distinguished from natural search results; •when promoting commodities or services through knowledge introduction, experience sharing or consumer evaluation, and purchase methods such as shopping links are attached, the advertisements publishers shall visibly mark them as “advertisements”; •“pop-up ads” must be clearly marked with a “close” sign and be closable with one click. Furthermore, the advertisers and publishers are prohibited from engaging in certain behaviors that hinder one-click closure; •if the Internet advertisements are published by means of algorithmic recommendation or other technologies, the rules related to algorithm recommendation services and advertising records shall be included in the advertising archives. According to the Administrative Measures for Internet Advertising, the advertisers are responsible for the authenticity of the content of Internet advertisements, while the Internet advertisement publishers and advertisement agencies are required to establish, improve, and implement registration, review, and archive management systems for Internet advertising businesses, which include verifying and registering advertiser information, verifying supporting documents and advertisements content, and allocating advertising review personnel familiar with advertising laws and regulations or establish advertising review bodies. In addition, the Administrative Measures for Internet Advertising require Internet platform operators providing Internet information services to take measures to prevent and stop illegal advertisements, which include recording and storing the real identity information of users who publish advertisements for at least three years, monitoring and investigating the content of advertisements, and employing measures to stop illegal advertisements. Internet platform operators are also required to establish effective complaint and reporting mechanisms, cooperate with market regulatory departments in investigating illegal conduct, and use measures such as warnings, suspending or terminating services for users who publish illegal advertisements. Furthermore, Internet platform operators are prohibited from using technical means or other methods to obstruct market regulatory departments’ advertising monitoring. Regulation of Online and Mobile Commerce China’s online and mobile commerce industry as well as the PRC laws, regulations or rules specifically regulating this industry are constantly evolving. On December 24, 2014, the MOFCOM promulgated the Provisions on the Procedures for Formulating 95 Table of Contents Transaction Rules of Third Party Online Retail Platforms (Trial) to regulate the formulation, revision and enforcement of transaction rules for online retail marketplace platforms. These provisions impose more stringent requirements and obligations on online trading or service operators as well as marketplace platform providers. For example, marketplace platform providers are obligated to make public and file their transaction rules with MOFCOM or its respective provincial counterparts, to enable examination of the legal status of each third-party merchant selling products or services on their platforms and display on a prominent location on the merchant’s web page the information stated in the merchant’s business license or a link to its business license, and group buying website operators must only allow a third-party merchant with a proper business license to sell products or services on their platforms. Where marketplace platform providers also act as online distributors, these marketplace platform providers must make a clear distinction between their online direct sales and sales of third-party merchant products on their marketplace platforms. In addition to these existing regulations, the relevant governmental authorities continue to consider and issue guidelines and implementing rules governing the online and mobile commerce industry. For example, three PRC governmental authorities (the MOF, General Administration of Customs and STA) issued a Notice on Tax Policy for Cross-Border E-commerce Retail Imports on March 24, 2016 to regulate cross-border e-commerce trading which experienced rapid growth in recent years. According to the notice, which became effective on April 8, 2016, goods imported through cross-border e-commerce retail are subject to tariff, import value-added tax, or VAT, and consumption tax based on the type of goods. Individuals purchasing any goods imported through cross-border e-commerce are liable to pay tax, while e-commerce companies, e-commerce transaction platform operators or logistics companies shall be responsible for withholding such tax. On August 31, 2018, the Standing Committee of the National People’s Congress promulgated the PRC E-commerce Law, or the E-commerce Law, which came into effect on January 1, 2019. The E-commerce Law imposes a series of requirements on e-commerce operators including e-commerce platform operators, merchants operating on the platform and the individuals and entities carrying out business online. According to the E-commerce Law, e-commerce operators who provide search results based on consumers’ characteristics such as hobbies and consumption habits shall also provide consumers with options that are not targeted at their personal characteristics at the same time, and respect and fairly protect the legitimate interests of consumers. The E-commerce Law requires e-commerce platform operators to, among other things, verify and register the identities, addresses, contacts and licenses of merchants who apply to provide goods or services on their platforms, establish registration archives and update this information on a regular basis; submit the identification information of the merchants on their platforms to market regulatory administrative authorities as required and remind the merchants to complete registration with market regulatory administrative authorities; submit identification information and tax-related information to tax authorities as required in accordance with the laws and regulations regarding the administration of tax collection and remind the individual merchants to complete the tax registration; and establish intellectual property rights protection rules and take necessary measures against infringement of intellectual property rights by merchants on their platforms. In addition, e-commerce platform operators are not allowed to impose unreasonable restrictions over or add unjustified conditions to transactions concluded on their platforms by merchants, or charge merchants operating on their platforms any unreasonable fees. According to the E-commerce Law, e-commerce platform operators are required to assume joint liability with the merchants and may be subject to warnings and fines up to RMB2,000,000 where (i) they fail to take necessary actions where they know or should have known that the products or services provided by the merchants on the platform do not meet personal and property security requirements, or otherwise infringe upon consumers’ legitimate rights; or (ii) they fail to take necessary actions, such as deleting and blocking information, disconnecting, terminating transactions and services, where they know or should have known that the merchants on the platform infringe upon the intellectual property rights of others. With respect to products or services affecting consumers’ health and safety, e-commerce platform operators will be held liable if they fail to review the qualifications of merchants or fail to safeguard the interests of consumers, and may be subject to warnings and fines up to RMB2,000,000. Building on the existing framework established by the E-commerce Law, the State Council of the PRC further elaborated on tax-related obligations on June 23, 2025 by publishing the Regulation on Reporting of Tax-related Information by Internet Platform Enterprises, which came into effect on the same day. This regulation stipulates additional requirements for e-commerce platform operators, including the need to report and verify detailed identity and income information of merchants on their platforms to the relevant tax authorities. On March 15, 2021, the SAMR promulgated the Measures for the Supervision and Administration of Online Trading, or the Online Trading Measures, which was recently amended on March 18, 2025 with the amendment that took effect as of May 1, 2025. The Online Trading Measures impose a series of regulatory requirements on new forms of online trading, such as online social networking e-commerce and online livestreaming e-commerce. The Online Trading Measures expressly prohibit an online transaction platform operator from unreasonably restricting or setting any unreasonable conditions on transactions on its platform and interfering with merchants’ independent business operations, including prohibiting or restricting the merchants to operate on other e-commerce platforms. Furthermore, the Online Trading Measures require e-commerce platform operators to verify and update each merchant’s 96 Table of Contents profile on a regular basis and monitor their market participant registration status. In October 2020, the SAMR promulgated the Interim Provisions for Regulating Promotional Activities, which requires e-commerce platform operators to design rules and procedures to foster fair and transparent merchandise promotional activities. On April 16, 2021, the Cyberspace Administration of China and six other PRC governmental authorities jointly issued the Administrative Measures on Online Livestreaming Marketing (Trial), which came into effect on May 25, 2021. According to the Administrative Measures on Online Livestreaming (Trial), online livestreaming marketing platforms are required, among other things, to set up a system to internally rank streamers by metrics such as views and transaction volumes, and take heightened regulatory measures in relation to key livestreaming operators. In addition, online livestreaming marketing platforms are also required to establish and maintain risk management systems to guard against high-risk marketing activities, including taking measures such as pop-up warnings, limiting traffic, suspending livestreaming, and prominently alerting users of the risks involved in transactions that are conducted outside livestreaming platforms. On March 1, 2022, the Supreme People’s Court of the PRC issued the Provisions on Issues Concerning the Application of Law for the Trial of Cases on Online Consumption Disputes (I), which came into effect on March 15, 2022 and clarify the responsibilities of online consumption platforms. According to these judicial interpretations, standard terms provided by e-commerce operators that are unfair and unreasonable to consumers may be deemed invalid, and contracts entered into between e-commerce operators and any other entity leading to false publicity by means of fictitious deals, hits or user comments shall also be null and void. Moreover, e-commerce platform operators shall be held liable as the product seller or service provider if the labels used mislead consumers to believe that the product or service is provided by the e-commerce platform. Furthermore, operators of livestreaming platforms and operators of online catering service platform are responsible for verifying the qualification and license of live-streamers who sell food products and online food service operators, respectively. The operators of e-commerce platforms can be held jointly liable for damages incurred by consumers resulting from defects in foods purchased from merchants on their platforms, if these operators fail to fulfill certain requirements and obligations. On July 31, 2025, the SAMR issued the Compliance Guidelines for Charging Practices of Online Trading Platforms, which clearly define the scope of platform fees, and establish the core principle that platform fee standards shall be formulated in a reasonable manner based on operating costs, following the principles of fairness, legality and good faith. On December 18, 2025, the Cyberspace Administration of China and SAMR issued the Measures for the Supervision and Administration of Livestreaming E-commerce and Measures for the Supervision and Administration of Online Trading Platform Rules, which both came into effect on February 1, 2026. Pursuant to the Measures for the Supervision and Administration of Live E-Commerce, live e-commerce platform operators shall establish and improve mechanisms governing the registration and cancellation of live streaming accounts, codes of conduct for on-platform transactions, quality assurance for goods and services, protection of consumer rights and interests, personal information and data security, as well as the administration of live room operators, live marketing personnel and relevant service agencies. The Measures for the Supervision and Administration of Online Trading Platform Rules require online transaction platform operators not to, through platform rules, impose unreasonable restrictions on the independent business activities of in-platform operators, or charge unreasonable fees, liquidated damages or compensation for damages; or to adopt platform rules to exclude or restrict consumers’ rights, reduce or exempt its own liabilities, unreasonably increase consumers’ liabilities, or engage in big data-enabled price discrimination against existing customers. Furthermore, on December 28, 2025, the SAMR issued the Administrative Measures on the Fulfillment of Food Safety Primary Responsibilities by Livestreaming E-commerce Operators. On January 27, 2026, the SAMR issued the Provisions on the Administrative Measures on the Fulfillment of Food Safety Primary Responsibilities by Online Food Sales Operators and the Administrative Measures on the Fulfillment of Food Safety Primary Responsibilities by Online Catering Service Operators, which shall come into force on May 20, 2026 and June 1, 2026 respectively. These three regulations impose higher and more specific compliance requirements covering safety management, qualification verification, information disclosure, risk investigation and order information retention for online food, catering and live‑streaming e‑commerce platforms. Moreover, these regulations introduce a “dual penalty” mechanism that significantly increases platform’s liability for any failure to fulfill food safety obligations. Regulation of Mobile Apps On June 28, 2016, the Cyberspace Administration of China promulgated the Regulations for the Administration of Mobile Internet Application Information Services, which was amended on June 14, 2022 and came into effect on August 1, 2022, requiring ICPs who provide information services through mobile Internet apps to, among other things, verify the real identities of registered users through mobile phone numbers or other similar channels; establish and improve procedures for protection of user information; and establish and improve procedures for information content censorship. 97 Table of Contents On June 14, 2022, the Cyberspace Administration of China promulgated the revised Regulations for the Administration of Mobile Application Information Services, which came into effect on August 1, 2022. Pursuant to the revised Regulations for the Administration of Mobile Application Information Services, mobile app providers shall comply with relevant provisions on the scope of necessary personal information, which means the personal information without which the app cannot perform its basic functional services, when engaging in personal information processing activities and shall not compel users to agree to non-essential personal information collection or ban users from their basic functional services due to their refusal of providing unnecessary personal information. In addition, mobile app providers shall, among other things, verify the real identities of registered users; establish and improve procedures for protection of user information and information content censorship, fulfill data security protection obligations and various obligations of minors’ protection, and shall not induce users to download the applications by illegal methods or bad information. Furthermore, mobile app providers who launch new technologies, applications or functions with the attribute of public opinion or the ability of social mobilization shall conduct security assessment in accordance with the relevant provisions. If an application provider violates these regulations, application distribution platforms may issue warnings, suspend the release of its applications, or terminate the sale of its applications, and/or report the violations to governmental authorities, and the application provider may be imposed administrative penalty by the Cyberspace Administration of China and relevant competent authorities in accordance with relevant laws and regulations. According to the Provisions on the Scope of Necessary Personal Information Required for Common Types of Mobile Internet Applications which became effective on May 1, 2021, necessary personal information is defined as the personal information necessary for ensuring the normal operation of the basic functional services of the apps, without which the app cannot perform its basic functional services. Regulation of Internet Content The PRC government has promulgated measures relating to Internet content through various ministries and agencies, including the MIIT, the News Office of the State Council of the PRC, the Ministry of Culture and Tourism and the General Administration of Press and Publication. In addition to various approval and license requirements, these measures specifically prohibit Internet activities that result in the dissemination of any content that is found to contain pornography, promote gambling or violence, instigate crimes, undermine public morality or the cultural traditions of the PRC or compromise state security or secrets. ICPs must monitor and control the information posted on their websites. If any prohibited content is found, they must remove the content immediately, keep a record of it and report to the relevant authorities. If an ICP violates these measures, the PRC government may impose fines and revoke any relevant business operation licenses. Regulation of Broadcasting Audio/Video Programs through the Internet We are subject to various laws and regulations in connection with providing online audio/video programs and livestreaming via our platform. For example, according to the Rules for the Administration of Internet Audio and Video Program Services, commonly known as Circular 56, jointly issued by the State Administration of Radio, Film, and Television, or the SARFT, and the MIIT, all online audio/video service providers are generally required to be either wholly state-owned or state-controlled. According to the relevant official answers to press questions published on the SARFT’s website dated February 3, 2008, online audio/video service providers that already had been operating lawfully prior to the issuance of Circular 56 may re-register and continue to operate without becoming state-owned or controlled, provided that the providers have not engaged in any unlawful activities. This exemption will not be granted to online audio/video service providers established after Circular 56 was issued. We are also subject to a series of requirements for audio/video content posted on our platform. The General Administration of Press and Publication, Radio, Film and Television, or GAPPRFT (which was split into the National Radio and Television Administration, or NRTA, and the State Administration of News and Publication in March 2018) released several notices on the administration of online audio/video programs, which stress that entities producing online audio/video content must obtain a permit for radio and television program production and operation, and that online audio/video content service providers should not release any Internet dramas or micro films that were produced by any entity lacking the permit. For Internet dramas or micro films produced and uploaded by individual users, the online audio/video service providers transmitting this content will be deemed responsible as the producer. Furthermore, the online audio/video contents, including Internet drama and micro films, are required to be filed with the relevant authorities before release. According to the Circular on Strengthening the Administration of the Online Show Livestreaming and E-commerce Livestreaming issued by the National Radio and Television Administration, or the NRTA, on November 12, 2020, the overall ratio of front-line content analysts to livestreaming rooms shall be 1:50 or higher on platforms providing e-commerce livestreaming services. A platform shall report the number of its livestreaming rooms, streamers and content analysts to the provincial branch of the NRTA on a quarterly basis. To host any e-commerce promotional events such as E-commerce festivals, E-commerce days or promotion days using livestreaming, live performances, live variety shows and other live programs, the platforms shall register the information of guests, 98 Table of Contents streamers, content and settings with the local branch of NRTA 14 business days in advance. Online e-commerce livestreaming platforms shall conduct relevant qualification examination and real-name authentication on businesses and individuals providing livestreaming marketing services and keep complete examination and authentication records, and shall not enable imposters or businesses or individuals without qualification or real-name registration to conduct livestreaming marketing services. On April 12, 2022, the NRTA and the Publicity Department of the China Communist Party Central Committee promulgated the Notice on Strengthening the Administration of Live Games on Online Audio/Video Program Platforms, specifying that online livestreaming platforms shall discretely select the hosts and guests with political standpoint, moral character, artistic standard and social evaluation as the selection criteria, and resolutely refuse hosts and guests who are politically incorrect, or have committed any violations of laws, regulations, public order or good morals. The notice further specifies that online livestreaming platforms shall establish and implement a mechanism for the protection of minors, implement the real-name registration system, prohibit minors from tipping, and establish a special channel for returning the tips of minors. Regulation of Internet Publication The SARFT is responsible for nationwide supervision and administration of publishing activities in China. On February 4, 2016, the GAPPRFT, the SARFT’s predecessor, and the MIIT jointly promulgated the Online Publication Service Administration Rules, or the Online Publication Rules, which took effect on March 10, 2016. Pursuant to the Online Publication Rules, an online publication service provider must obtain the Online Publication Service License from the GAPPRFT. The term “online publication service” is defined as the provision of online publications to the public through information networks. The term “online publications” is defined as digital works characteristic of publishing such as editing, production or processing provided to the public through information networks. The Online Publication Rules expressly prohibit foreign invested enterprises from providing online publication services. In addition, if an online publication service provider intends to cooperate for an online publication services project with foreign invested enterprises, overseas organizations or overseas individuals, it must report to the GAPPRFT and obtain an approval in advance. Also, an online publication service provider is prohibited from lending, leasing, selling or otherwise transferring the Online Publication Service License, or to allow any other online information service provider to provide online publication services in its name. Regulation of Internet Drug Information Service According to the Notice of Effectively Carrying out the Promotion and Implementation of Best Practices from Relevant Pilot Reforms released in January 2025 and the Administrative Provisions on the Filing of Internet-based Information Services for Drugs and Medical Devices released in December 2025, ICP service operators that provide information regarding drugs or medical equipment are required to file a record with the applicable provincial level counterpart of the National Medical Products Administration. On August 3, 2022, the SAMR released the Administrative Measures for the Supervision of Online Drug Sales, which came into effect on December 1, 2022, for the regulation of enterprises engaging in online drug sales and online drug trading third-party platforms. According to these measures, enterprises engaging in online drug sales shall be drug marketing authorization holders or drug business enterprises, and shall report relevant information including names of the websites and application programs, the IP addresses and domain names, etc. to the medical products regulators. In addition, drug trading third-party platforms are also required to file relevant information including their names, legal representatives, etc. with the provincial medical products administration. Regulation of Internet News Information Services On May 2, 2017, the Cyberspace Administration of China issued the Administrative Provisions on Internet News Information Services, which came into effect on June 1, 2017 and define news information as reports and commentary on political, economic, military, diplomatic and other social and public affairs, as well as reports and commentary on emergency social events. Pursuant to these provisions, the Cyberspace Administration of China and its local counterparts are the government department in charge of supervision and administration of Internet news information. Furthermore, an ICP operator must obtain approval from the Cyberspace Administration of China in order to provide Internet news information services, including through websites, applications, forums, blogs, microblogs, public accounts, instant messaging tools, and webcasts. Regulation of Internet Culture Activities On February 17, 2011, the Ministry of Culture, the predecessor of the Ministry of Culture and Tourism, promulgated the Internet Culture Administration Tentative Measures, or the Internet Culture Measures, which was most recently amended in December 2017. The Internet Culture Measures require ICP operators engaging in “Internet culture activities” to obtain a permit from the Ministry of 99 Table of Contents Culture and Tourism. The term “Internet culture activities” includes, among other things, online dissemination of Internet cultural products (such as audio-video products, gaming products, performances of plays or programs, works of art and cartoons) and the production, reproduction, importation, publication and broadcasting of Internet cultural products. On August 12, 2013, the Ministry of Culture promulgated the Notice on Implementing the Administrative Measures for the Content Self-examination of Internet Culture Business Entities. According to this notice, any cultural product or service shall be reviewed by the provider before being released to the public and the review process shall be done by persons who have obtained the relevant content review certificate. On October 23, 2015, the Ministry of Culture promulgated the Notice on Further Strengthening and Improving the Content Review of Online Music, which took effect on January 1, 2016 and stipulate that ICPs shall carry out self-examination in respect of the content management of online music, which shall be regulated by the cultural administration departments in process or afterwards. According to this notice, ICP operators are required to submit their content administrative system, review procedures, and work standards to the provincial culture administrative department where they are located for filing within a prescribed period. Regulation of Audio/Video Program Production On July 19, 2004, the SARFT promulgated the Administrative Measures on the Production and Operation of Radio and Television Programs, which came into effect on August 20, 2004 and most recently amended by NRTA on June 3, 2025. These measures provide that anyone who wishes to produce or operate radio or television programs must first obtain an operating permit for their business. On December 25, 2001, the State Council of the PRC promulgated the Regulations for the Administration of Films, or the Film Regulations, which became effective on February 1, 2002. The Film Regulations set forth the general regulatory guidelines for China’s film industry and address practical issues with respect to production, censorship, distribution and screening. They also establish the SARFT as the sector’s regulatory authority, and serve as the foundation for all other legislation promulgated in this area. The Film Regulations provide the framework for an industry-wide licensing system operated by the SARFT, under which separate permits (and permit application procedures) apply. Regulation of Express Delivery Services The PRC Postal Law, which took effect in October 2009 and was most recently amended in 2015, sets forth the fundamental rules on the establishment and operation of an express delivery company. According to the PRC Postal Law, an enterprise that operates and provides express delivery services is required to obtain a Courier Service Operation Permit. Pursuant to the PRC Postal Law, “delivery” refers to delivery of correspondence, parcels, printed materials and other items to specific individuals or entities according to the names and addresses on the envelopes or packages, including mail acceptance, sorting, transportation, delivery, and “express delivery” refers to rapid mail “delivery” within a specified time limit. The PRC Postal Law also requires that a company operating express delivery services must apply for and obtain the Courier Service Operation Permit prior to applying for its business license. Pursuant to the Administrative Measures on Courier Service Operation Permits, which was promulgated by the Ministry of Transport in June 2015 and most recently amended in November 2019, any entity engaging in express delivery services is required to obtain a Courier Service Operation Permit from the State Post Bureau or its local counterpart and is subject to their supervision and regulation. The express delivery business must be operated within the permitted scope and the valid term of the Courier Service Operation Permit. On March 2, 2018, the State Council of the PRC promulgated the Provisional Regulations for Express Delivery, or the Provisional Regulations, which came into effect on May 1, 2018 and was most recently amended on April 13, 2025 with effect from June 1, 2025. The Provisional Regulations reiterate that a company operating express delivery services must obtain the Courier Service Operation Permit and sets forth specific rules and security requirements for express delivery operations. Regulation of Anti-counterfeiting According to the Trademark Law of the PRC, counterfeit or unauthorized production of the label of another person’s registered trademark, or sale of any label that is counterfeited or produced without authorization will be deemed as an infringement of the exclusive right to use a registered trademark. The infringing party will be ordered to cease infringement immediately, a fine may be imposed and the counterfeit goods will be confiscated. The infringing party may also be held liable for damages suffered by the owner of the intellectual property rights, which will be equal to the gains obtained by the infringing party or the losses suffered by the owner as a result of the infringement, including reasonable expenses incurred by the owner in connection with enforcing its rights. 100 Table of Contents Under the Civil Code of the PRC, an Internet service provider may be subject to joint liability if it is aware that an Internet user is infringing upon the intellectual property rights of others through its Internet services, such as selling counterfeit products, and fails to take necessary measures to stop that activity. If an Internet service provider receives a notice from an infringed party regarding an infringement, the Internet service provider is required to take certain measures, including deleting, blocking and unlinking the infringing content, in a timely manner. In addition, under the Online Trading Measures, as an operator of an online trading platform, we must adopt measures to ensure safe online transactions, protect consumers’ rights and prevent unfair competition. Regulation of Monopoly and Unfair Competition On June 24, 2022, the Standing Committee of the National People’s Congress promulgated the amended PRC Anti-monopoly Law, which came into effect on August 1, 2022. The amended PRC Anti-monopoly Law requires that where concentration of undertakings reaches the filing threshold stipulated by the State Council of the PRC, a filing must be made with the anti-monopoly authority before the parties implement the concentration. Concentration refers to (i) merger of undertakings; (ii) acquisition of control over other undertakings by acquiring equities or assets; or (iii) acquisition of control over, or the possibility of exercising decisive influence on, an undertaking by contract or by any other means. The anti-monopoly authority may also require business operators to file for merger control review where concentration of undertakings fails to reach such filing threshold but there is evidence that the concentration has or may have the effect of eliminating or restricting competition. If business operators fail to comply with the mandatory filing requirement, the PRC State Administration for Market Regulation, or the SAMR, is empowered to terminate the transaction, require the disposal of relevant assets, shares or businesses within certain period, or take any other necessary measures to restore the pre-concentration status, and may also impose fines of up to 50% of the previous year’s turnover of the filing obligor if the concentration has or may have the effect of eliminating or restricting competition, or fines of up to RMB25 million if the concentration does not have such effect. In addition, the amended PRC Anti-monopoly Law introduces a “stop-clock mechanism” which may prolong the merger control review process. The SAMR issued a new set of guidelines in September 2018 to set forth the specific procedures and materials for review of concentration of undertakings. On August 3, 2008, the State Council of the PRC promulgated the Provisions of the State Council of the PRC on the Thresholds for Filing of Concentration of Undertakings, which was most recently amended in January 2024, clarifying the filing thresholds of merger control review and significantly adjusting the revenue threshold of merger control filing to either one of the following two conditions: •the worldwide revenue of all business operators involved in the concentration exceeds RMB12 billion collectively in previous fiscal year, and the revenue in China of at least two business operators among them each exceeds RMB800 million in previous fiscal year; or •the revenue in China of all the business operators involved in the concentration exceeds RMB4 billion collectively in previous fiscal year, and the revenue in China of at least two business operators among them each exceeds RMB800 million in previous fiscal year. Even if the aforementioned revenue threshold is not met, the transaction may be required to be reported to anti-monopoly authority of the State Council of the PRC if there is evidence to prove that the concentration of operators has or may have the effect of excluding or restricting competition. In addition, on March 10, 2023, the SAMR released the Provisions on the Review of Concentration of Undertakings, or the Review Provisions, which came into effect from April 15, 2023 and replaced the Interim Provisions on the Review of Concentration of Undertakings issued on October 23, 2020. These provisions provide detailed rules on how to operate the “stop-clock mechanism”, allowing the SAMR to suspend the calculation of time period for merger review if (i) the notifying parties fail to provide the documents or information so that the review cannot proceed, (ii) new circumstances or new facts appear, and the review cannot proceed without examining the new circumstances or facts, or (iii) the proposed remedies require further assessment, and the relevant parties request for suspension. If the filing threshold is not met but the proposed concentration has or may have the effect of eliminating or restricting competition, the SAMR can request the undertakings to notify. If the concentration has not yet been implemented, the standstill obligation automatically kicks in. Even if the concentration has been implemented, the undertakings need to file a notification within 120 days and take necessary measures to reduce the negative impact the concentration has on competition such as temporarily stopping the implementation of the concentration. The amended PRC Anti-monopoly Law prohibits a business operator with a dominant market position from abusing such position, such as by selling commodities at unfairly high prices or buying commodities at unfairly low prices, selling products at prices below cost without any justifiable cause, or refusing to trade with a trading party without any justifiable cause. Sanctions for violation of the prohibition on the abuse of dominant market position include an order to cease the relevant activity, confiscation of the illegal gains and fines up to 50% of sales revenue of the preceding year. On March 10, 2023, the SAMR issued the Provisions on the Prohibitions of Acts of Abuse of Dominant Market Positions, which came into effect from April 15, 2023 and replaced the Interim Provisions on 101 Table of Contents the Prohibition of Acts of Abuse of Dominant Market Positions issued on June 26, 2019 to further prevent and prohibit the abuse of dominant market positions. The amended PRC Anti-monopoly Law also prohibits business operators from entering into monopoly agreements, which refers to agreements that eliminate or restrict competition with competing business operators or transaction counterparties, such as by boycotting transactions, fixing or changing the price of commodities, limiting the output of commodities or fixing the price of commodities for resale to third parties, among others, unless the business operators can prove the agreements do not have the effect of eliminating or restricting competition, their market share in relevant market is below the standard set by the anti-monopoly authority, or the agreements satisfy certain exemptions under the amended PRC Anti-monopoly Law, such as improving technologies, increasing the efficiency and competitiveness of small and medium-sized undertakings, or safeguarding legitimate interests in cross-border trade and economic cooperation with foreign counterparts. Sanctions for violations include an order to cease the relevant activity, confiscation of illegal gains, and fines up to 50% of sales revenue of the preceding year, fines up to RMB25 million if there is no sales revenue of the preceding year, or fines up to RMB15 million if the intended monopoly agreement has not been performed. In addition, business operators are prohibited from organizing other business operators to reach any monopoly agreement or providing substantive assistance for others to reach such agreements under the amended PRC Anti-monopoly Law. On March 10, 2023, the SAMR issued the Provisions on the Prohibition of Monopoly Agreements, which was most recently amended on December 9, 2025 and came into effect from February 1, 2026 to further enhance the enforcement on the supervision of monopoly agreements. In addition, the amended PRC Anti-monopoly Law further regulates monopolistic behaviors in the Internet sector. The amended PRC Anti-monopoly Law, among others: •provides in general provisions that enterprises must not engage in monopolistic behaviors through data and algorithms, technology, capital advantages, or platform rules; and •provides that enterprises with dominant market position must not abuse their dominant positions through data and algorithms, technology, capital advantages, or platform rules. In February 2021, the SAMR published the Guidelines on Anti-monopoly Issues in Platform Economy, or the Platform Economy Anti-monopoly Guidelines. The Platform Economy Anti-monopoly Guidelines set out detailed standards and rules in respect to the definition of relevant markets, typical types of cartel activity and abusive behavior by companies with market dominance, which provide further guidance for enforcement of anti-monopoly laws regarding network platform operators. The Platform Economy Anti-monopoly Guidelines further detail the types of horizontal agreements, vertical agreements, hub-and-spoke agreements and collusion which may constitute monopoly agreements in the platform economy. The Platform Economy Anti-monopoly Guidelines also set out a number of key factors that may be relevant in identifying a dominant undertaking, including, among others, predatory pricing, unfair pricing, refusal to deal, restraint of trade, tie-in, unreasonable trading conditions and discrimination. In addition, concentration of undertakings involving contractual arrangements is expressly included within the ambit of SAMR’s merger control review if the filing thresholds are met. Under the Platform Economy Anti-monopoly Guidelines, the SAMR is empowered to investigate if the filing threshold is not met but the proposed concentration may have the effect of eliminating or restricting competition, and the SAMR will pay close attention to those cases where one of the following circumstances exists: (i) a party to the concentration is a start-up or an emerging platform; (ii) the turnover is low because the business model of the parties to the concentration involves the provision of free services or services charged at low prices; (iii) the relevant market is highly concentrated; and (iv) the number of competitors is small. These measures and guidelines may require us to make adjustments to some of our business practices, and our business, financial condition and results of operations may be materially and adversely affected. In addition, due to our size, these measures and guidelines may affect us more than our competitors. On January 28, 2026, the SAMR published the Guidelines on Anti-monopoly Compliance of Internet Platforms, setting forth comprehensive compliance management requirements for internet platform operators. The Guidelines on Anti-monopoly Compliance of Internet Platforms provides refinements for monopolistic conducts of internet platforms, setting forth typical scenarios of abusing market dominance, including without limitation: (i) unreasonable high or low pricing: including charging in-platform operators fees that are significantly higher than those charged by comparable business platforms; (ii) sales below cost: including selling goods or providing services at below-cost prices by means of excessive subsidies, cross-subsidies and the like without legitimate grounds; (iii) refusal to deal: including removing products from shelves, banning accounts, complicating transaction procedures, restricting traffic flow, closing interfaces, and suspending data sharing; (iv) exclusive dealing: including imposing exclusive cooperation clauses; requiring in-platform operators not to cooperate with specific competing platforms or not to participate in promotional campaigns launched by such competing platforms; and (v) bundling or attaching unreasonable trading conditions: including adopting punitive measures such as search result demotion, traffic restriction, imposing technical barriers, service suspension and revocation of authorization by relying on standard terms, pop-up windows and mandatory operational steps that cannot be easily opted out of, modified or rejected by users. 102 Table of Contents According to the Anti-unfair Competition Law promulgated by the Standing Committee of the National People’s Congress of China on September 2, 1993 and most recently amended on June 27, 2025, business operators may not engage in anti-competitive activities, such as undue influence transactions, confusion marketing, commercial bribery, trade secret infringement and commercial libel. Failure to comply with the Anti-unfair Competition Law would subject business operators to various administrative penalties, such as imposition of fines, confiscation of illegal gains and an order to cease business activities, and payment of compensatory damages. On June 27, 2025, the National People’s Congress released the amendment to the PRC Anti-unfair Competition Law, which became effective on October 15, 2025. The amendment imposes more obligations on platform operators, requiring platform operators to incorporate fair competition provisions in their platform service agreements and transaction rules and take necessary measures to promptly prohibit operators’ unfair competition practices on their platforms. Additionally, the amendment prohibits platform operators from using data, algorithms or technology to disrupt or impede the normal business operations of other operators and further specifies the prohibited behaviors, such as obtaining and using data legally held by other operators through fraud and other improper means, and abusing platform rules to carry out malicious transactions. Moreover, platform operators are required not to compel operators on their platforms to sell goods at prices below cost, thereby disrupting the order of fair competition. In May 2024, the SAMR issued the Interim Measures on Online Anti-unfair Competition, which came into effect on September 1, 2024. These Measures have improved the standards and regulatory requirements for various types of online unfair competition behaviors, including the new manifestations of traditional unfair competition behaviors such as counterfeiting, confusion and false advertising, and the new types of unfair competition behaviors conducted through technological means such as reverse bidding manipulation and illegal data acquisition. Regarding platform operators, these Measures highlight the platform operators’ responsibilities and require platforms operators to strengthen the management of competition behavior within the platform. Necessary measures should be taken to deal with unfair competition behavior within the platform, relevant records should be kept, and timely reports should be made to the market supervision authorities. In addition, these Measures prohibit platforms from abusing their competitive advantages to obstruct the normal operation of network products or services of other operators, using service agreements or transaction rules to unreasonably restrict the transactions of operators within the platform, or charging unreasonable service fees to operators within the platform. If a platform operator fails to comply with the requirements of these Measures, it may be subject to administrative penalties including rectification orders, fines and orders to suspend operations. Regulation of Internet Security The Decision in Relation to Protection of Internet Security enacted by the Standing Committee of the National People’s Congress of China on December 28, 2000, as amended, provides that the following activities conducted through the Internet are subject to criminal punishment: •gaining improper entry into a computer or system of strategic importance; •disseminating politically disruptive information or obscenities; •leaking state secrets; •spreading false commercial information; or •infringing intellectual property rights. The Administrative Measures on the Security Protection of Computer Information Network with International Connections, issued by the Ministry of Public Security on December 16, 1997 and amended on January 8, 2011, prohibit the use of the Internet in a manner that would result in the leakage of state secrets or the spread of socially destabilizing content. The Provisions on Technological Measures for Internet Security Protection, or the Internet Security Protection Measures, promulgated on December 13, 2005 by the Ministry of Public Security require all ICPs to keep records of certain information about their users (including user registration information, log in and log out time, IP address, content and time of posts by users) for at least 60 days and submit the above information as required by laws and regulations. Under these measures, value-added telecommunications services license holders must regularly update information security and content control systems for their websites and must also report any public dissemination of prohibited content to local public security authorities. If a value-added telecommunications services license holder violates these measures, the Ministry of Public Security and the local security bureaus may revoke its operating license and shut down its websites. The Communication Network Security Protection Administrative Measures, which were promulgated by the MIIT on January 21, 2010, require that all communication network operators, including telecommunications service providers and Internet domain name service providers, divide their own communication networks into units. These communication network units shall be rated in accordance with degree of damage to national security, economic operation, social order and public interest in the event a unit is damaged. Communication network operators must file the division and ratings of their communication networks with the MIIT or its local counterparts. If a communication network operator violates these measures, the MIIT or its local counterparts may order rectification or impose a fine up to RMB30,000 in case a violation is not duly rectified. 103 Table of Contents Internet security in China is also regulated and restricted from a national security standpoint. On July 1, 2015, the National People’s Congress Standing Committee promulgated the PRC National Security Law, or the National Security Law, which took effect on the same date and replaced the former National Security Law promulgated in 1993. According to the National Security Law, the state shall ensure that the information system and data in important areas are secure and controllable. In addition, according to the National Security Law, the state shall establish national security review and supervision institutions and mechanisms, and conduct national security reviews of key technologies and IT products and services that affect or may affect national security. There are uncertainties on how the National Security Law will be implemented in practice. On November 7, 2016, the National People’s Congress Standing Committee promulgated the PRC Cybersecurity Law, or the Cybersecurity Law, which came into effect on June 1, 2017, and applies to the construction, operation, maintenance and use of networks as well as the supervision and administration of cybersecurity in China. The Cybersecurity Law defines “networks” as systems that are composed of computers or other information terminals and relevant facilities used for the purpose of collecting, storing, transmitting, exchanging and processing information in accordance with certain rules and procedures. “Network operators,” who are broadly defined as owners and administrators of networks and network service providers, are subject to various security protection-related obligations including, among others, security protection, user identity verification, cybersecurity emergency response planning and technical assistance. According to the Cybersecurity Law, network service providers must inform users about and report to the relevant authorities any known security defects and bugs, and must provide continuous security maintenance services for their products and services. Network products and service providers shall not contain or provide malware. Network service providers who do not comply with the Cybersecurity Law may be subject to fines, suspension of their businesses, shutdown of their websites, and revocation of their business licenses. In addition, the Cybersecurity Law provides that personal information and important data collected and generated by operators of critical information infrastructure in the course of their operations in the PRC should be stored in the PRC, and the law imposes heightened regulation and additional security obligations on operators of critical information infrastructure. On October 28, 2025, the Standing Committee of the National People's Congress amended the Cybersecurity Law, effective on January 1, 2026, which strengthens enforcement measures and significantly increased penalties for violations of the law. The amendment also provides high penalties and reinforced responsibilities for platform content management, thereby imposing significant compliance pressure on e-commerce platforms. In addition, the PRC Anti-Telecom and Online Fraud Law was promulgated by the National People’s Congress Standing Committee on September 2, 2022 and came into effect on December 1, 2022. In order to prevent and curb the telecom and online fraud, the Anti-Telecom and Online Fraud Law requires, among others, Internet service providers to obtain real identity information of users before providing certain services including information and software distribution services, etc. On July 30, 2021, the State Council of the PRC promulgated the Regulations on Security Protection of Critical Information Infrastructure, effective on September 1, 2021, which provide that a “critical information infrastructure” refers to an important network facility and information system in important industries such as public communications and information services, as well as other important network facilities and information systems that may seriously endanger national security, national economy, people’s livelihood, or public interests in the event of their damage, loss of function, or data leakage. The competent governmental authorities and supervision and management authorities of the aforementioned important industries will be responsible for (i) identification of critical information infrastructures in their respective industries in accordance with relevant identification rules, and (ii) promptly notifying the identified operators and the public security department of the State Council of the PRC of the identification results. However, the exact scope of “critical information infrastructure operators” under the current regulatory regime still remains unclear, and the PRC government authorities have discretion in the interpretation and enforcement of these laws, rules and regulations. On April 13, 2020, the Cyberspace Administration of China, the NDRC, the MIIT, and several other governmental authorities jointly issued the Measures for Cybersecurity Review, or the Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, the purchase of cyber products and services including core network equipment, high-performance computers and servers, mass storage devices, large databases and application software, network security equipment, cloud computing services, and other products and services that have an important impact on the security of critical information infrastructure which affects or may affect national security is subject to cybersecurity review by the Cybersecurity Review Office. On December 28, 2021, the Cyberspace Administration of China, together with certain other PRC governmental authorities, promulgated the Revised Cybersecurity Review Measures which replaced the then-effective version and took effect on February 15, 2022. According to the Revised Cybersecurity Review Measures, operators of critical information infrastructure who purchase network products and services and network platform operators who carry out data processing activities that affect or may affect national security shall be subject to cybersecurity review. In addition, any network platform operator possessing over one million users’ individual information must apply for a cybersecurity review before listing abroad. Relevant competent governmental authorities may also initiate cybersecurity review if they determine certain network products, services or data processing activities affect or may affect 104 Table of Contents national security. Article 10 of the Revised Cybersecurity Review Measures also sets out certain general factors that are the focus in assessing the national security risk in a cybersecurity review, including (i) the risks of critical information infrastructure being illegally controlled by any individual or organization or subject to interference or destruction; (ii) the harm caused by the disruption of the supply of the product or service to the continuity of critical information infrastructure business; (iii) the security, openness, transparency and diversity of sources of the product or service, the reliability of supply channels, and risks of supply disruption due to political, diplomatic, trade and other factors; (iv) compliance with PRC laws, administrative regulations and department rules by the provider of the product or service; (v) the risk of core data, important data or a large amount of personal information being stolen, leaked, damaged, illegally used, or illegally transmitted overseas; (vi) the risk that critical information infrastructure, core data, important data or a large amount of personal information for a listing being affected, controlled, and maliciously used by foreign governments, as well as network information security risks; and (vii) other factors that may endanger the security of critical information infrastructure, cybersecurity and data security. However, there are still uncertainties as to the exact scope of network products or services or data processing activities that will or may affect national security, and the PRC government authorities have discretion in the interpretation and enforcement of these measures. According to the Administrative Provisions on Security Vulnerability of Network Products jointly promulgated by the MIIT, the Cyberspace Administration of China and the Ministry of Public Security, which came into effect on September 1, 2021, network product providers, network operators as well as organizations or individuals engaging in the network product security vulnerability discovery, collection, release and other activities shall establish channels to receive information of security vulnerability of their respective network products and shall examine and fix such security vulnerability in a timely manner. Network product providers are required to report relevant security vulnerability of network products with the MIIT within two days of discovery and provide technical support to network product users. Network operators shall take measures to examine and fix security vulnerability after discovering or becoming aware that their networks, information systems or equipment have security loopholes. According to these provisions, the network product providers and network operators who fail to perform the aforementioned obligations may be subject to administrative penalty in accordance with the Cybersecurity Law. On September 11, 2025, the Cyberspace Administration of China issued the Measures for the Administration of the Reporting of Cybersecurity Incidents, which came into force on November 1, 2025. The Measures stipulate that network operators that construct or operate networks within the territory of the PRC or provide services through networks shall report cybersecurity incidents in accordance with the provisions. According to these measures, where critical information infrastructure is involved, the network operator shall immediately report the incident to the protection department and the public security authority within 1 hour; where a cybersecurity incident is serious or extremely serious, the protection department shall, upon receiving the report, immediately report to the national cyberspace administration and the public security authority under the State Council, and in any case within 30 minutes of receipt. The Cyberspace Administration of China is responsible for organizing and implementing cybersecurity reviews, while the competent departments in key industries such as finance, telecommunications, energy and transport shall be responsible for organizing and implementing security review of cyber products and services in their respective industries or fields. On November 15, 2018, the Cyberspace Administration of China issued the Provisions on Security Assessment of the Internet Information Services with Public Opinion Attributes or Social Mobilization Capacity, which came into effect on November 30, 2018. The provisions require ICPs to conduct security assessments on their Internet information services if their services include functions that provide channels for the public to express opinions or have the capability of mobilizing the public to engage in specific activities. ICPs must conduct self-assessment on, among other things, the legality of new technology involved in the services and the effectiveness of security risk prevention measures, and file the assessment report with the local competent cyberspace administration authority and public security authority. On September 17, 2021, the Cyberspace Administration of China and the SAMR, together with several other governmental authorities, jointly issued the Guidelines on Strengthening the Comprehensive Regulation of Algorithm for Internet Information Services, which provide that relevant regulators shall carry out daily monitoring of data use, application scenarios and effects of algorithms, and conduct security assessments of algorithm, and that an algorithm filing system shall be established and classification and hierarchical security management of algorithms shall be adopted. On December 31, 2021, the Cyberspace Administration of China, the MIIT, the Ministry of Public Security and the SAMR jointly promulgated the Administrative Provisions on Algorithm Recommendation for Internet Information Services, or the Algorithm Recommendation Provisions, which came into effect on March 1, 2022. The Algorithm Recommendation Provisions implement the classification and hierarchical management of algorithm recommendation service providers based on various criteria, and stipulate that algorithm recommendation service providers shall clearly inform users of their provision of algorithm recommendation services, and properly publicize the basic principles, intentions, and main operating mechanisms of algorithm recommendation services, and that algorithm recommendation service providers selling goods or providing services to consumers shall protect consumers’ rights of fair trade, and are prohibited from carrying out illegal 105 Table of Contents conduct such as unreasonable differentiated treatment on transaction conditions based on consumers’ preferences, purchasing habits, or such other characteristics. In October 2021, the SAMR released the draft Guidelines for Classification and Grading of Internet Platforms, or the Draft Classification Guidelines, and the draft Guidelines for Implementing Subject Responsibilities of Internet Platforms, or the Responsibilities Guidelines, for public comments. The Classification Guidelines divide Internet platforms into super platforms, large platforms, and small and medium platforms, on the basis of the scale of users, business types, and restrictive capacities. The Responsibilities Guidelines further lay down additional responsibilities for operators of super platforms with respect to fair competition, equal governance, open ecosystem, data management, internal governance, risk assessment and prevention, security audit and innovation. For example, super platforms should promote interoperability between the services they provide and those provided by other platforms. On November 25, 2022, the Administrative Provisions on Deep Synthesis of Internet Information Services was jointly issued by the Cyberspace Administration of China, MIIT and Ministry of Public Security, and took effect on January 10, 2023. According to these provisions, deep synthesis technology refers to any technology that utilizes deep learning, virtual reality or any other generative or synthetic algorithm to produce text, images, audio, video, virtual scenes or other network information. These provisions emphasize that the providers of deep synthesis services, as the primary entities responsible for the information security, should not use deep synthesis services to engage in activities prohibited by laws and regulations. If the Cyberspace Administration of China and other competent government authorities find that the deep synthesis service has a serious information security risk, they may require the deep synthesis service providers and technical supporters to suspend information updates, user account registration or other related services, and deep synthesis service providers and technical supporters shall take measures to rectify and eliminate such information security risks. A violation of these provisions by deep synthesis service providers and/or technical supporters will subject them to penalties under the laws related to the administration of public security. Deep synthesis service providers and/or technical supporters may also be prosecuted for criminal responsibility if their act constitutes a crime. On March 18, 2023, the Cyberspace Administration of China released the Provisions on the Administrative Law Enforcement Procedures for the Cyberspace Administration Authorities, which came into effect on June 1, 2023. These provisions clarify the procedures of cyberspace administrative law enforcement actions of the cyberspace administration authorities, as well as the procedures and requirements for administrative penalty. These provisions state that, prior to the imposition of administrative penalties, cyberspace administration authorities must notify parties concerned of their right to request a hearing, and that they must make such request within five days of receiving a notification, otherwise they shall be deemed to have waived their right to a hearing. On July 10, 2023, the Cyberspace Administration of China, together with other relevant authorities, released the Interim Measures on Generative AI Services, which came into effect on August 15, 2023 and mainly impose compliance requirements on providers of generative AI services. According to the Interim Measures on Generative AI Services, individuals or organizations that provide generative AI services of text, image, audios, videos and other content shall be responsible as the producers of such network information content and as the personal information processors to protect any personal information involved. Providers of generative AI services shall enter into service agreements with users registering for their generative AI services and shall adopt effective measures to prevent minor users from over-relying or addicting to generative AI services. In the event illegal content or users engaging in illegal activities using generative AI services are discovered, the generative AI services providers are required to take appropriate measures, including stopping the generation of such illegal content and suspending or terminating the provision of services, undergo rectifications, keep relevant records and report to the competent authority. Any provider of generative AI services with attribute of public opinions or capable of social mobilization shall conduct security assessment and complete certain filings in accordance with the Administrative Provisions on Internet Information Service Algorithm Recommendation. Providers of generative AI services may be subject to penalties for non-compliance, including warning, public denouncement, rectification orders and suspension of the provision of relevant services. The Measures for Labelling Artificial Intelligence-generated or -created Content and the related standards were released in early 2025 and took effect on September 1, 2025. According to these measures, Internet information service providers shall bear the obligation to label the AI-generated content. The related standards further provide specific methods for the AI-generated content labelling. Regulation of Data and Privacy Protection Under the ICP Measures, ICPs are prohibited from producing, copying, publishing or distributing information that is humiliating or defamatory to others or that infringes upon the lawful rights and interests of others. Depending on the nature of the violation, ICPs may face criminal charges or sanctions by PRC public security authorities for these acts, and may be ordered to temporarily suspend their services or have their licenses revoked. 106 Table of Contents Under the rules issued by the MIIT, ICPs are also prohibited from collecting any personal user information or providing any information to third parties without the consent of the user. The Cybersecurity Law provides an exception to the consent requirement where the information is anonymous, not personally identifiable and unrecoverable. ICPs must expressly inform the users of the method, content and purpose of the collection and processing of user’s personal information and may only collect information necessary for its services. ICPs are also required to properly maintain the user personal information, and in case of any leak or likely leak of the user’s personal information, ICPs must take remedial measures immediately and report any material leak to the telecommunications regulatory authority. The PRC government retains the power and authority to order ICPs to provide an Internet user’s personal information if a user posts any prohibited content or engages in any illegal activities through the Internet. According to the Cybersecurity Law, individuals may request that network operators make corrections to or delete their personal information in case the information is wrong or was collected or used beyond an individual’s agreement with network operators. On June 10, 2021, the Standing Committee of the National People’s Congress of China promulgated the Data Security Law which took effect in September 2021. The Data Security Law provides for data security and privacy obligations of entities and individuals carrying out data activities, prohibits entities and individuals in China from providing any foreign judicial or law enforcement authority with any data stored in China without approval from the competent PRC authority, and sets forth the legal liabilities of entities and individuals found to be in violation of their data protection obligations, including rectification order, warning, fine, suspension of relevant business, and revocation of business permits or licenses. The Data Security Law also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used, and an appropriate level of protection measures is required to be taken for the respective categories of data, for example, the processor of important data shall designate the personnel and management institution responsible for the data security, carry out risk assessment for its data processing activities and file the risk assessment report with the competent authorities. On March 15, 2024, the National Cybersecurity Standardization Technical Committee issued the Data Security Technology Data Classification and Grading Rules, which provide guidelines for identifying important data. This voluntary national standard became effective on October 1, 2024. In addition, the Data Security Law provides a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data and information. On July 7, 2022, the Cyberspace Administration of China promulgated the Measures for the Security Assessment of Cross-border Data Transmission, which came into effect on September 1, 2022 and shall regulate the security assessment on the cross-border data transfer by data processor of important data and personal information collected and generated during operations within the PRC. According to these measures, personal data processors will be subject to security assessment conducted by the Cyberspace Administration of China prior to any cross-border transfer of data if the transfer involves (i) important data; (ii) personal information transferred overseas by operators of critical information infrastructure or a data processor that has processed personal data of more than one million persons; (iii) personal information transferred overseas by a data processor who has already provided personal data of 100,000 persons or sensitive personal data of 10,000 persons overseas since January 1 of last year; or (iv) other circumstances as requested by the Cyberspace Administration of China. According to the official interpretation by the official of the Cyberspace Administration of China, cross-border data transfer activities subject to these measures include (1) the transmission and storage overseas by data processors of the data generated during PRC domestic operations, and (2) the access to or use of the data collected and generated by data processors and stored in the PRC by overseas institutions, organizations or individuals. Furthermore, any cross-border data transfer activities conducted in violation of the Measures for the Security Assessment of Cross-border Data Transmission before the effectiveness of these measures are required to be rectified by March 2023. In addition, on June 1, 2023, the Provisions on the Prescribed Agreement on Cross-border Data Transfer, or the Provisions on Prescribed Agreement promulgated by the Cyberspace Administration of China came into effect, which stipulate the applicable conditions for personal information processors to engage in cross-border data transfer through the establishment of prescribed agreements and the detailed procedure for executing prescribed agreements and filing with the provincial cyberspace administration. The Provisions on Prescribed Agreement provide a prescribed agreement template for data transfer activities and require that personal information processors shall enter into agreements strictly in accordance with the template and do not allow any side agreements in conflict with the template. On March 22, 2024, the Cyberspace Administration of China issued the Provisions on Promoting and Regulating Cross-border Data Flow, which provide several exemptions from undergoing security assessment, obtaining personal information protection certification, or entering into prescribed agreement for cross-border transfer of personal information for businesses. These exemptions include, among others, scenarios where a data processor transfers personal information abroad for the necessity of entering into or performing a cross-border shopping, cross-border delivery, cross-border remittances, or cross-border payments contract to which an individual is a party. The provisions also explicitly state that data processors are not required to conduct data security assessment for cross-border data transfers if the concerning data has not been notified or published as important data by relevant departments or regions. 107 Table of Contents In September 2024, the State Council of the PRC promulgated the Regulations on Network Data Security Management, which came into effect on January 1, 2025 and clarify the obligations of the network platform service providers. According to these regulations, network platform service providers shall clearly specify the network data security protection obligations of third parties who provide products or services on their platforms, procure these third parties to enhance their network data security management, and will need to bear legal liabilities where data processing activities by such third parties violate applicable laws or the platform rules and harm users. Large network platform operators are further required to release an annual social responsibility report on personal information protection and shall not carry out unfair or deceptive practices such as collecting and processing user data through misleading, fraudulent, or coercive means, unjustified restrictions on users’ access to network data generated on the platforms, and unreasonable differential treatment of users. These regulations further impose obligations on important data processors, including designating and specifying persons and management bodies responsible for data security, implementing regular data security risk assessment and other data protection measures, and submitting annual risk assessment reports to relevant authorities. On August 20, 2021, the Standing Committee of the National People’s Congress of China promulgated the Personal Information Protection Law which took effect in November 2021. The Personal Information Protection Law requires, among others, that (i) the processing of personal information should have a clear and reasonable purpose which should be directly related to the processing purpose, using a method that has the least impact on personal rights and interests, and (ii) the collection of personal information should be limited to the minimum scope necessary to achieve the processing purpose to avoid the excessive collection of personal information. Different types of personal information and personal information processing will be subject to various rules on consent, transfer, and security. Entities handling personal information shall bear responsibility for their personal information handling activities, and adopt necessary measures to safeguard the security of the personal information they handle. Otherwise, information processors could be subject to liability for their processing activities, including rectification, or suspension or termination of their provision of their services as well as confiscation of illegal income, fines or other penalties. The Personal Information Protection Law stipulates the specialized personal information protection obligations for the personal information processors who provide significant Internet platform services with a massive user base and complex business types. These processors are required to establish and improve a personal information protection compliance system, establish an independent agency to supervise the protection of personal information, formulate platform rules to clarify the norms for the processing personal information on the platform, stop providing services to products or service providers who illegally process personal information on the platform, issue personal information protection social responsibility reports regularly and accept social supervision. As the Data Security Law, the Personal Information Protection Law and relevant rules and regulations are still evolving, we may be required to make further adjustments to our business practices to comply with these laws, rules and regulations. On October 14, 2025, the Cyberspace Administration of China and the SAMR promulgated the Measures for the Certification of the Outbound Transfer of Personal Information, which took effect on January 1, 2026.These measures provide detailed implementation rules for the cross-border transfer certification, through which such cross-border transfer could be certified as in compliance with relevant laws, rules, regulations standards and technical specifications. A personal information processor that provides personal information to overseas recipients through certification shall meet all of the following conditions: (1) The personal information processor is not a CIIO; (2) the personal information processor has accumulatively provided to the overseas recipient the personal information of not less than 100,000 but less than one million people (excluding sensitive personal information) or the sensitive personal information of less than 10,000 people from January 1 of the current year. In addition, prior to applying for certification, the personal information processor shall fulfill its statutory obligations of notification, obtaining separate consent from individuals, and conducting a personal information protection impact assessment. Regulation of Consumer Protection Our online and mobile commerce business is subject to a variety of consumer protection laws, including the PRC Consumer Rights and Interests Protection Law, as amended and effective on March 15, 2014, and the Online Trading Measures, both of which have imposed stringent requirements and obligations on business operators, including Internet business operators and platform service providers like us. For example, consumers are entitled to return goods purchased online, subject to certain exceptions, within seven days upon receipt of goods without any reason. Furthermore, on March 15, 2024, the Implementing Rules of the Consumer Rights Protection Law of the People’s Republic of China was released and came into effect on July 1, 2024. These rules further specify the obligations stipulated in the PRC Consumer Rights and Interests Protection Law, such as protecting consumers’ personal and property safety, handling of defective products, prohibiting fraudulent advertising and unfair practices in standard terms, price transparency, quality guarantee, and protecting consumers' personal information. Pursuant to the PRC Consumer Rights and Interests Protection Law and its implementing rules, Internet trading platforms, including livestreaming marketing platforms, shall fulfill the undertakings that they make to consumers regarding their products or services, clearly notify consumers of auto-renewal and auto-pay before the consumers accept the service and before the date of automatic renewal or automatic payment, provide appropriate dispute resolution mechanisms for consumers and otherwise protect consumer rights. Furthermore, according to the Online Trading Measures, operators of online trading platforms are required to establish a system for monitoring the merchants and the goods or services information they 108 Table of Contents publish on the platforms. Operators of online trading platforms shall report to the SAMR or its local branches any violation of applicable laws, regulations or SAMR rules and shall take appropriate measures, such as warning, suspending or ceasing the services against the illegal activities. Additionally, these rules have added the protection of elderly and minors as consumers to the obligations of business operators regarding the protection of elderly and minors as consumers. Furthermore, these rules provide requirements to address situations where business operators may abuse technology, platform rules or their dominant positions to infringe on consumer rights, such as prohibiting price discrimination, fraudulent advertising and excessively collecting consumers’ personal information. In addition, these rules require livestreaming marketing platform operators to establish and improve mechanisms for consumer rights protection. On January 6, 2017, the SAIC issued the Interim Measures for No Reason Return of Online Purchased Commodities within Seven Days, which came into effect on March 15, 2017 and was amended on October 23, 2020, further clarifying the scope of consumers’ rights to make returns without a reason, including exceptions, return procedures and online marketplace platform providers’ responsibility to formulate seven day no-reason return rules and related consumer protection systems, and to supervise merchants for compliance with these rules. To ensure that merchants and service providers comply with these laws and regulations, we, as platform operators, are required to implement rules governing transactions on our platform, monitor the information posted by merchants and service providers, and report any violations by merchants or service providers to the relevant authorities. In addition, online marketplace platform providers may, pursuant to PRC consumer protection laws, be subject to liabilities if the lawful rights and interests of consumers are infringed in connection with consumers’ purchase of goods or acceptance of services on online marketplace platforms and the platform service providers fail to provide consumers with the contact information of the merchant or manufacturer. In addition, platform service providers may be jointly and severally liable with merchants and manufacturers if they are aware or should be aware that the merchant or manufacturer is using the online platform to infringe upon the lawful rights and interests of consumers and fail to take measures necessary to prevent or stop this activity. On January 1, 2024, the Regulations on the Protection of Minors on the Network came into effect and stipulate that important Internet platforms with large number of minor users and significant influence among minors must fulfill their obligations, including but not limited to establishing a protocol to oversee the protection of minors online and carrying out periodic impact assessment, adopting “teenager modes” for minors, and suspending services to providers of products or services on the platform who seriously violate laws and regulations and harm minors’ rights and interests. The Measures for the Identification of Network Platform Service Providers with a Large Number of Minor Users and Significant Influence on Minors issued in February 2026 with effect as of April 1, 2026 further clarify the scope of "important Internet platforms with large number of minor users and significant influence among minors" and require Internet platform service providers to conduct self-assessment of their impact on minors and submit a self-assessment report to government authority. Failure to comply with these consumer protection laws could subject us to administrative sanctions, such as the issuance of a warning, confiscation of illegal income, imposition of a fine, an order to cease business operations, revocation of business licenses, as well as potential civil or criminal liabilities. Regulation of Pricing In China, the prices of a very small number of products and services are guided or fixed by the government. According to the PRC Pricing Law, or the Pricing Law, business operators must, as required by the government departments in charge of pricing, mark the prices explicitly and indicate the name, production origin, specifications, and other related particulars clearly. Business operators may not sell products at a premium or charge any fees that are not explicitly indicated. Business operators must not conduct unlawful pricing activities, such as colluding with others to manipulate the market price, providing fraudulent discounted price information, using false or misleading prices to deceive consumers to transact, or conducting price discrimination against other business operators. In addition, in July 2021, the SAMR released the revised draft Provisions on the Administrative Penalties on Price-related Violations for public comment, which proposed significant penalties, including fines of up to 10% of revenue during the violation period, suspension of business or revocation of business license, for a number of price-related violations, such as below-cost pricing to squeeze out competitors, price discrimination, manipulation of market prices and fraudulent pricing. In particular, improper pricing by e-commerce platform operators, including the use of big data analysis, algorithms or other technologies to conduct differentiated pricing and price subsidies, may be subject to significant penalties, including fines of up to 5% of prior year’s revenue, suspension of business and revocation of business license. Failure to comply with the Pricing Law or other rules or regulations on pricing may subject business operators to administrative sanctions such as warnings, orders to cease unlawful activities, payment of compensation to consumers, confiscation of illegal gains, and/or fines. The business operators may be ordered to suspend business for rectification, or have their business licenses revoked if the circumstances are severe. Merchants on Tmall and Taobao undertake the primary obligation under the Pricing Law. However, in some cases, we, as platform operator, have been and may in the future be held liable and be subject to fines or other penalties if the authorities determine that, our guidance for platform-wide promotional activities resulted in unlawful pricing activities by the merchants on our platforms or the pricing information we provided for platform-wide promotional activities was untrue or misleading. On December 9, 2025, the NDRC, the SAMR, and the Cyberspace Administration of China jointly promulgated the Rules on Price-Related Practices on Internet Platforms, which came into force on April 10, 2026. These rules provides that platform operators shall not impose unreasonable restrictions on or attach unreasonable conditions to the pricing practices of businesses on their platforms. In 109 Table of Contents addition, the platform operator or a business on its platform shall clearly mark prices for goods sold or services provided, applications, mini-programs and other channels. Furthermore, platform operators and merchants on platforms are prohibited from, with certain exemptions, selling goods or providing services at prices below cost for the purpose of excluding competitors or monopolizing the market, disrupting normal production and operation order, or harming national interests or the legitimate rights and interests of other operators. Labor Laws and Social Insurance Pursuant to the PRC Labor Law and the PRC Labor Contract Law, employers must execute written labor contracts with full-time employees. All employers must comply with local minimum wage standards. Violations of the PRC Labor Contract Law and the PRC Labor Law may result in the imposition of fines and other administrative and criminal liability in the case of serious violations. In addition, according to the PRC Social Insurance Law and the Regulations on the Administration of Housing Funds, employers in China must provide employees with welfare schemes covering pension insurance, unemployment insurance, maternity insurance, work-related injury insurance, medical insurance and housing funds. Other PRC Regulations Regulation of Corporate Governance On December 29, 2023, the Standing Committee of the National People’s Congress promulgated the amended PRC Company Law, which came into effect on July 1, 2024 and replaced the existing PRC Company Law. The revisions include (i) optimizing the governance mechanism, clarifying that the board of directors is the executive body of the company, allowing the company to choose to establish a corporate governance structure composed of “board of directors with an audit committee under the board of directors” or “board of directors and board of supervisors” based on its actual circumstances, and allowing small companies limited by shares to be incorporated without a board of directors; (ii) further improving the company capital system, introducing the authorized capital system for companies limited by shares, clarifying the classes of shares that can be issued by companies limited by shares, strengthening the principle of capital maintenance, and allowing the use of capital reserves to cover losses; (iii) strengthening the fiduciary duties of the directors, supervisors and senior management, including the responsibilities of the directors, supervisors and senior management to maintain adequate company capital and report related party transactions, their joint and several liabilities and liquidation obligations; and (iv) improving the company registration system, clarifying that equity interests and creditor rights can be contributed as capital, allowing the establishment of companies limited by shares with one shareholder, and introducing simplified procedures for capital reduction and de-registration of company to facilitate a company’s operation. On April 29, 2024, the SAMR issued the Measures for the Administration of Beneficial Owner Information. These measures specify the scope of market entities that are subject to filing obligations, the conditions to exemption from filing, and the definition and identification standards of beneficial owners. According to the general standard for identifying the beneficial owners, natural persons who meet any of the following conditions are beneficial owners: ultimately owning 25% or more equity interests, shares or partnership interests in an entity directly or indirectly, ultimately being entitled to 25% or more of its income or holding 25% or more of its voting rights, or exercising actual control over the entity individually or jointly. If there is no person who meets the aforesaid standards, the person responsible for routine operation and management shall be deemed as the beneficial owner. These measures provide that the actual control includes without limitation the control by agreement, but does not conclusively determine the beneficial owner under contractual arrangements, and uncertainties exist with respect to our disclosure of beneficial owners pursuant to these measures. Regulation of Foreign Investment On March 15, 2019, the National People’s Congress promulgated the 2019 PRC Foreign Investment Law, which became effective on January 1, 2020 and replaced the major former laws and regulations governing foreign investment in the PRC. Pursuant to the 2019 PRC Foreign Investment Law, “foreign investments” refer to investment activities conducted by foreign investors directly or indirectly in the PRC, which include any of the following circumstances: (i) foreign investors setting up foreign-invested enterprises in the PRC solely or jointly with other investors, (ii) foreign investors obtaining shares, equity interests, property portions or other similar rights and interests of enterprises within the PRC, (iii) foreign investors investing in new projects in the PRC solely or jointly with other investors, and (iv) investment of other methods as specified in laws, administrative regulations, or as stipulated by the State Council of the PRC. According to the 2019 PRC Foreign Investment Law and its implementing rules, China adopts a system of pre-entry national treatment plus negative list with respect to foreign investment administration, and the negative list will be proposed by the competent investment department of the State Council of the PRC in conjunction with the competent commerce department of the State Council of the PRC and other relevant departments, and be reported to the State Council of the PRC for promulgation, or be promulgated by 110 Table of Contents the competent investment department or competent commerce department of the State Council of the PRC after being reported to the State Council of the PRC for approval. Foreign investment beyond the negative list will be granted national treatment. Foreign investors shall not invest in the prohibited industries as specified in the negative list, while foreign investment must satisfy certain conditions stipulated in the negative list for investment in the restricted industries. The current industry entry clearance requirements governing investment activities in the PRC by foreign investors are set out in two categories, namely the Negative List (2024 version), promulgated by the NDRC and the MOFCOM and took effect in September 2024 and November 2024 respectively, and the Encouraged Industry Catalogue for Foreign Investment (2025 version), or the 2025 Encouraged Industry Catalogue, promulgated by the NDRC and the MOFCOM and took effect in December 2025 and February 2026 respectively. Industries not listed in these two categories are generally deemed “permitted” for foreign investment unless otherwise restricted by other PRC laws. Our major subsidiaries are registered in China and mainly engage in software development, technical services and consulting, all of which fall into the encouraged or permitted category. These major subsidiaries have obtained all material approvals required for their business operations. The Negative List does not apply to our major subsidiaries that are registered and domiciled in Hong Kong, the British Virgin Islands or the Cayman Islands, and operate outside of Chinese mainland. The businesses of our other PRC subsidiaries, including PRC subsidiaries of our major subsidiaries, are generally software development, technical services and consulting, which fall into the encouraged or permitted category. Industries such as value-added telecommunications services, including Internet information services, are generally restricted to foreign investment pursuant to the Negative List. We conduct business operations that are restricted or prohibited to foreign investment through variable interest entities. On December 19, 2020, the NDRC and MOFCOM promulgated the Foreign Investment Security Review Measures, which took effect on January 18, 2021. Under the Foreign Investment Security Review Measures, foreign investments in military, national defense-related areas or in locations in proximity to military facilities, or foreign investments that would result in acquiring the actual control of assets in certain key sectors, such as critical agricultural products, energy and resources, equipment manufacturing, infrastructure, transport, cultural products and services, IT, Internet products and services, financial services and technology sectors, are required to obtain approval from designated governmental authorities in advance. Although the term “actual control” is not clearly defined under the Foreign Investment Security Review Measures, it is possible that control through contractual arrangement may be regarded as a form of actual control and therefore requires approval from the competent governmental authority. Since there are significant uncertainties with respect to the interpretation and implementation of the Foreign Investment Security Review Measures, there are substantial uncertainties as to whether our contractual arrangements may be deemed as a method of foreign investment in the future. Regulation of Foreign Debts The Administrative Measures for Examination and Registration of Medium and Long-term Foreign Debts of Enterprises, or the Foreign Debts Measures, were promulgated by NDRC on January 5, 2023 and came in effect on February 10, 2023, requiring that the PRC enterprises and overseas enterprises or branches controlled by them, including holding companies with a VIE structure, to complete application for registration of foreign debts with the NDRC prior to the borrowing of foreign debts with a term of over one year. Tax Regulations PRC Enterprise Income Tax The PRC enterprise income tax, or EIT, is calculated based on the taxable income determined under the applicable PRC Enterprise Income Tax Law, or EIT Law, and its implementation rules, both of which became effective on January 1, 2008 and were most recently amended on December 29, 2018 and December 6, 2024, respectively. The EIT Law generally imposes a uniform enterprise income tax rate of 25% on all resident enterprises in China, including foreign-invested enterprises. The EIT Law and its implementation rules permit certain High and New Technologies Enterprises, or HNTEs, to enjoy a reduced 15% enterprise income tax rate if they meet certain criteria and are officially acknowledged. In addition, the relevant EIT laws and regulations also provide that entities recognized as Software Enterprises are able to enjoy a tax holiday consisting of a two-year-exemption commencing from their first profitable calendar year and a 50% reduction in ordinary tax rate for the following three calendar years. In 2020, the relevant governmental authorities further announced that Key Software Enterprises will be exempted from enterprise income tax for the first five years, commencing from the first year of profitable operation after offsetting tax losses generating from prior years, and be subject to a preferential income tax rate of 10% after the first five years. The qualification as a “Key Software Enterprise” is subject to annual evaluation and approval by the relevant authorities in China. A number of our PRC subsidiaries and operating entities are qualified to enjoy these types of preferential tax treatment. PRC VAT 111 Table of Contents According to the Regulation on the Implementation of the Value-Added Tax Law issued by the State Council of the PRC on December 25, 2025, a VAT rate of 6% applies to revenue derived from the provision of certain services. A taxpayer is allowed to offset the qualified input VAT paid on taxable purchases against the output VAT chargeable on the revenue from services provided. On December 25, 2024, the Standing Committee of the National People’s Congress promulgated the Value-added Tax Law of the People's Republic of China, which came into effect on January 1, 2026 and further clarifies the provisions related to VAT, including VAT rates, taxable amounts, tax preferences, and tax collection administration. On March 20, 2019, the MOF, the STA and the General Administration of Customs issued the Announcement on Policies for Deepening VAT Reform, or Announcement 39, which came into effect on April 1, 2019, to further slash VAT rates. According to Announcement 39, (i) the 16% or 10% VAT previously imposed on sales and imports by general VAT taxpayers is reduced to 13% or 9% respectively; (ii) the 10% purchase VAT credit rate allowed for procured agricultural products is reduced to 9%; (iii) the 13% purchase VAT credit rate allowed for agricultural products procured for production or commissioned processing is reduced to 10%; and (iv) the 16% or 10% export VAT refund rate previously granted to exportation of goods or labor services is reduced to 13% or 9%, respectively. PRC Import Tax According to the Notice on Tax Policy for Cross-border E-commerce Retail Imports, or New Tax Notice on Cross-Border E-commerce, which became effective on April 8, 2016, goods imported through cross-border e-commerce platforms have been treated as normal goods subject to VAT, consumption tax and tariff. In general, a VAT at the rate of 17% (before May 1, 2018) or 16% (from May 1, 2018 to March 31, 2019) or 13% (from April 1, 2019 onwards) is levied on most goods imported via cross-border e-commerce platforms and a 15% consumption tax is levied on high-end cosmetics and high-end skincare products, while no consumption tax is levied on regular skin care products, maternity or baby care products. As a preferential tax treatment, the Notice on Improving the Tax Policies on Cross-Border E-Commerce Retail Imports, which was issued on November 29, 2018 and took effect on January 1, 2019, provides that, if the goods imported through cross-border e-commerce platforms are within the quota of RMB5,000 per purchase order and RMB26,000 per year per buyer, there is a 30% discount off the applicable VAT and the consumption tax, and the tariff is waived. PRC Export Tax According to the Notice on the Taxation Policies for Cross-border E-Commerce Retail Export, or the E-Commerce Export Taxation Notice, which was jointly issued by the MOF and the STA and took effect on January 1, 2014, an e-commerce export enterprise may be exempt from or refunded with consumption tax and VAT upon satisfaction of certain conditions or requirements under such notice. However, third-party e-commerce platforms providing transaction services for e-commerce export enterprises are not eligible for a tax refund or exemption under the E-Commerce Export Taxation Notice. Regulation of Foreign Exchange and Dividend Distribution Foreign Exchange Regulation The principal regulations governing foreign currency exchange in China are the Regulations on Foreign Exchange Administration of the PRC. Under the PRC foreign exchange regulations, payments of current account items, such as profit distributions and trade and service-related foreign exchange transactions, may be made in foreign currencies without prior approval from SAFE by complying with certain procedural requirements. By contrast, approval from or registration with appropriate government authorities is required where Renminbi is to be converted into foreign currency and remitted out of China to pay capital expenses, such as the repayment of foreign currency-denominated loans, or foreign currency is to be remitted into China under the capital account, such as capital increases or foreign currency loans to our PRC subsidiaries. In June 2016, SAFE issued the Circular on Reforming and Regulating Policies on the Control over Foreign Exchange Settlement of Capital Accounts, or Circular 16, which took effect on the same day and was most recently amended in December 2023. Circular 16 provides that discretionary foreign exchange settlement applies to foreign exchange capital, foreign debt offering proceeds and remitted foreign listing proceeds, and the corresponding Renminbi obtained from foreign exchange settlement is not restricted from being used to extend loans to related parties or repay the inter-company loans (including advances by third parties). On January 18, 2017, SAFE promulgated the Circular on Further Improving Reform of Foreign Exchange Administration and Optimizing Genuineness and Compliance Verification, or Circular 3, which took effect on the same day. Circular 3 sets out various capital control measures with respect to outbound remittance of funds from PRC entities to offshore entities. Circular 3 requires banks to verify board resolutions, tax filing forms, and audited financial statements before wiring foreign invested enterprises’ foreign exchange distribution above US$50,000. Moreover, pursuant to Circular 3, PRC entities must explain in detail the sources of capital 112 Table of Contents and how the capital will be used, and provide board resolutions, contracts and other proof as a part of the registration procedure for outbound investment. On October 23, 2019, SAFE issued the Notice of Further Facilitating Cross-border Trade and Investment, or Circular 28, which took effect on the same day and was most recently amended in December 2023. Circular 28 allows non-investment foreign-invested enterprises to use their capital funds to make equity investments in China, provided that such investments do not violate the negative list and the target investment projects are genuine and in compliance with laws. According to the Circular on Optimizing Administration of Foreign Exchange to Support the Development of Foreign-related Business issued by SAFE on April 10, 2020, eligible enterprises are allowed to make PRC domestic payments with their income under capital accounts such as capital funds, foreign debts and proceeds from overseas listing without submitting evidence of genuineness to the banks in advance, provided the use of such funds is genuine and in compliance with administrative regulations on the use of income under capital accounts. We typically do not need to use our offshore foreign currency to fund our PRC operations. In the event we need to do so, we will apply to obtain the relevant approvals of SAFE and other PRC government authorities as necessary. Our PRC subsidiaries’ distributions to their offshore parent companies and our cross-border foreign exchange activities are required to comply with the various requirements under the relevant foreign exchange rules. Regulation of Dividend Distribution The principal laws, rules and regulations governing dividend distribution by foreign-invested enterprises in the PRC are the Company Law of the PRC, as amended, which applies to both PRC domestic companies and foreign-invested companies, and the 2019 PRC Foreign Investment Law and its implementation rules, which apply to foreign-invested companies. Under these laws, rules and regulations, foreign-invested enterprises may pay dividends only out of their accumulated profit, if any, as determined in accordance with PRC accounting standards and regulations. Both PRC domestic companies and wholly-foreign owned PRC enterprises are required to set aside as general reserves at least 10% of their after-tax profit, until the cumulative amount of their reserves reaches 50% of their registered capital. A PRC company is not permitted to distribute any profits until any losses from prior fiscal years have been offset. Profits retained from prior fiscal years may be distributed together with distributable profits from the current fiscal year. Regulation of Overseas Listing The PRC government has enhanced its regulatory oversight of Chinese companies listing overseas. The Opinions on Intensifying Crack Down on Illegal Securities Activities issued on July 6, 2021 called for (i) tightening oversight of data security, cross-border data flow and administration of classified information, as well as amendments to relevant regulations to specify responsibilities of overseas listed Chinese companies with respect to data security and information security; (ii) enhanced oversight of overseas listed companies as well as overseas equity fundraising and listing by Chinese companies; and (iii) extraterritorial application of PRC's securities laws. Furthermore, on February 17, 2023, the CSRC released the Trial Administrative Measures of Overseas Securities Offering and Listing by Domestic Companies and five relevant guidelines, or collectively, the Overseas Listing Trial Measures, which took effect from March 31, 2023, requiring Chinese domestic companies’ overseas offerings and listings of equity securities be filed with the CSRC. The Overseas Listing Trial Measures clarify the scope of overseas offerings and listings by Chinese domestic companies which are subject to the filing and reporting requirements thereunder, and provide, among others, that Chinese domestic companies that have already directly or indirectly offered and listed securities in overseas markets prior to the effectiveness of the Overseas Listing Trial Measures shall fulfill their filing obligations and report relevant information to the CSRC within three working days after conducting a follow-on offering of equity securities on the same overseas market, and follow the relevant reporting requirements within three working days upon the occurrence of any specified circumstances provided thereunder. According to the Overseas Listing Trial Measures, if we fail to complete the filing procedures with the CSRC for any of our follow-on offerings or fall within any of the circumstances where our follow-on offering is prohibited by the State Council of the PRC, our offering application may be discontinued and we may be subject to penalties, sanctions and fines imposed by the CSRC and relevant departments of the State Council of the PRC. On February 24, 2023, the CSRC and several other governmental authorities jointly issued the revised Provisions on Strengthening Confidentiality and Archives Administration of Overseas Securities Offering and Listing by Domestic Companies, or the Revised Confidentiality Provisions, which came into effect on March 31, 2023. According to the Revised Confidentiality Provisions, Chinese companies that directly or indirectly conduct overseas offerings and listings, shall strictly abide by the laws and regulations on confidentiality when providing or publicly disclosing, either directly or through their overseas listed entities, materials to securities services providers. In the event such materials contain state secrets or working secrets of government agencies, the Chinese companies shall first obtain approval from authorities, and file with the secrecy administrative department at the same level with the approving authority; in the event that such materials, if divulged, will jeopardize national security or public interest, the Chinese companies shall comply with procedures stipulated by national regulations. The Chinese companies shall also provide a written statement of the 113 Table of Contents specific sensitive information provided when providing materials to securities service providers, and such written statements shall be retained for inspection. Regulations Outside of the PRC While we conduct a significant majority of our business in the PRC, we also operate at smaller scales in a large number of jurisdictions outside of the PRC. The following is a summary of regulations outside of the PRC which we believe could have a significant impact on us. Data Protection Regulation in Europe The EU General Data Protection Regulation, or the EU GDPR entered into force on May 25, 2018. The EU GDPR applies to companies that process personal data (i) in the context of an establishment in the European Economic Area, or the EEA or (ii) outside of the EEA in relation to the offering of goods or services to, or the monitoring of the behavior of, individuals located in the EEA. The EU GDPR imposes stringent operational requirements for controllers of personal data, including, for example, disclosures about how personal data is to be used, limitations on retention of personal data and pseudonymized data, security requirements, mandatory data breach notification requirements, and the need for a valid legal basis for data processing activities. The activities of data processors are also regulated, and companies undertaking processing activities are required to offer certain guarantees in relation to the security of processing and the handling of personal data. Contracts with data processors need to include certain prescribed terms. Failure to comply with the EU GDPR and other laws relating to the protection of personal data may result in fines (for example, under the EU GDPR up to the greater of €20,000,000 or 4% of the total worldwide annual turnover), and other administrative penalties including criminal liability. Further legislative evolution in the field of European privacy is expected. For example, on November 19, 2025, the EU published a proposal to make certain simplifications to the GDPR and other data, privacy and cybersecurity related laws, including the ePrivacy Directive and AI Act. In addition, the EU re-evaluates the ‘adequacy’ of certain third country data protection frameworks every four years, which could result in additional compliance costs when transferring data outside the EEA. Regulation of Data and Digital Services in Europe The European regulatory framework governing data and digital services is rapidly evolving. The EU has recently enacted new laws and regulations on this subject, including the Digital Services Act, or the DSA, and the Data Act. The DSA entered into force on November 16, 2022 and the majority of its provisions became generally applicable on February 17, 2024. It governs intermediary services provided to recipients established or located in the EU, and is applicable to conduit and caching providers, hosting service providers, online platforms, online consumer marketplaces and search engines. The DSA’s obligations relate, amongst other things, to the removal of illegal content; algorithmic transparency; content moderation; so-called 'dark patterns'; recommender systems; the protection of children; know-your-trader requirements; traders' legal compliance; online advertising; accountability and reporting requirements; transparency; risk assessment and mitigation; independent audits; data sharing requirements; and the payment of an annual supervisory fee. The precise obligations depend on the nature and scale of the service provider; in particular, ‘very large online platforms’ and ‘very large online search engines’ (defined as having a monthly average of 45 million or more active recipients of the service in the EU) are subject to additional obligations under the DSA. Non-compliance with the DSA may result in fines of up to 6% of global annual turnover. The EU Commission has designated AliExpress as a very large online platform, or VLOP, under the DSA. It is also undergoing an ongoing assessment by the European Commission as to whether it may have infringed the DSA in relation to its risk assessment and mitigation measures. See “Item 3. Key Information — D. Risk Factors — Risks Related to Our Business and Industry — We are subject to complex and evolving laws and regulations regarding privacy and data protection, and cybersecurity. Complying with these laws and regulations increases our cost of operations, limits our business opportunities and may require changes to our data collection, use and other practices or negatively affect our user growth and engagement. Failure to comply with these laws and regulations could result in claims, regulatory investigations, litigation or penalties, or otherwise negatively affect our business.” The Data Act entered into force on January 11, 2024, and became applicable, for the most part, on September 12, 2025. Amongst other things, the Data Act requires certain cloud and edge service providers to (i) facilitate switching between and enable interoperability with third party providers, and (ii) impose appropriate safeguards before allowing third-country authorities to access non-personal data in the EU where this conflicts with EU or Member State laws. Regulation of AI in Europe The EU has introduced a new regulation applicable to certain AI, technologies and the data used to train, test and deploy them, the EU AI Act. The EU AI Act, which entered into force on August 1, 2024, has established a risk-based governance framework which 114 Table of Contents categorizes AI systems based on the risks associated with their intended purposes (e.g., “unacceptable” or “high” risk). AI practices involving “unacceptable” risk are prohibited outright as of February 2, 2025, and the requirements applicable to other risk categories (which will be imposed on both the providers and deployers of AI systems) will become effective on a staggered basis. For example, providers of “high”-risk AI systems will be required, among other things, to implement and maintain certain risk and quality management systems, conduct certain conformity and risk assessments, use appropriate data governance and management practices, and meet certain standards related to testing, robustness, transparency, human oversight and cybersecurity. These requirements are currently due to begin to apply from August 2, 2026. However, the EU is currently considering targeted amendments to the EU AI Act, including to adjust the timeline for applying rules on “high”-risk AI systems. The EU AI Act also sets out significant penalties for non-compliance, including fines of up to 7% of annual worldwide turnover or €35 million (whichever is higher) for the most serious breaches. In parallel, the EU has introduced revisions to the EU Product Liability Directive, which entered into force on December 8, 2024 and EU Member States must implement into their national laws by December 9, 2026, which may facilitate certain claims for damages in respect of AI. Preparing for and complying with the applicable requirements of the EU AI Act may affect our use of AI and our ability to provide, develop and improve our services, require additional compliance measures and changes to our operations and processes, and/or result in increased compliance costs, each of which could adversely affect our business, financial condition and results of operations. If we do not comply with the EU AI Act, we could be subject to enforcement actions that could result in fines or possible restrictions on our ability to offer certain services in the EU market, as well as to civil claims made against us. Global Anti-Base Erosion Rules The Organisation for Economic Co-operation and Development, or the OECD, published the “Global Anti-Base Erosion Model Rules” in 2021, which introduced a global minimum tax of 15% for certain multinational enterprises, or the Pillar Two Rules. Some jurisdictions have implemented or are in the process of implementing the Pillar Two Rules, which began to apply to us beginning in fiscal year 2025. Based on our current assessment, we do not believe the Pillar Two Rules have a material impact on us, but we will continue to monitor the legislative progress and assess the impact. Permissions and Approvals Required to be Obtained from PRC Authorities for our Business Operations In the opinion of Fangda Partners, our PRC legal counsel, our consolidated subsidiaries and the VIEs in China have obtained all major licenses, permissions and approvals from the competent PRC authorities that are necessary to the operations of our Alibaba China E-commerce Group, AIDC and Cloud Intelligence Group, which accounted for a substantial majority of our revenue in fiscal year 2026. In addition, we have implemented policies and control procedures to obtain and maintain the necessary licenses, permission and approvals to conduct our businesses. On the basis of the legal opinion issued by our PRC legal counsel and our internal policies and procedures, we believe that our consolidated subsidiaries and the VIEs in China have received the requisite licenses, permissions and approvals from the PRC authorities as are necessary for our business operations in China. Such licenses, permits, registrations and filings include, among others, Value-added Telecommunication License, License for Online Transmission of Audio-Visual Programs, Network Cultural Business License, Online Publishing Service License and License for Surveying and Mapping. If we, our consolidated subsidiaries or the VIEs in China (i) do not maintain such permissions or approvals, (ii) inadvertently conclude that such permissions or approvals are not required, or (iii) applicable laws, regulations, or interpretations change, and we or the VIEs are required to obtain such permissions or approvals in the future, we may be unable to obtain such necessary approvals, permits, registrations or filings in a timely manner, or at all, and such approvals, permits, registrations or filings may be rescinded even if obtained. Any such circumstance may subject us to fines and other regulatory, civil or criminal liabilities, and we may be ordered by the competent PRC authorities to suspend relevant operations, which could materially and adversely affect our business, financial condition, results of operations and prospects. Please see “Item 3. Key Information — D. Risk Factors — Risks Related to Our Business and Industry — We are subject to a broad range of laws and regulations, and future laws and regulations may impose additional requirements and other obligations that could materially and adversely affect our business, financial condition and results of operations, as well as the trading prices of our ADSs, Shares and/or other securities.” Furthermore, if the PRC government determines that the contractual arrangements constituting part of the VIE structure adopted by us do not comply with PRC regulations, or if these regulations change or are interpreted differently in the future, our securities may decline in value or become worthless if the determinations, changes, or interpretations result in our inability to assert contractual control over the assets of our consolidated subsidiaries and the VIEs in China that conduct a significant portion of our business operations. In addition, there are substantial uncertainties as to whether the VIE structure adopted by us may be deemed as a method of foreign investment in the future. If the VIE structure adopted by us were to be deemed as a method of foreign investment under any future laws, regulations and rules, and if any of our business operations were to fall under the “Negative List” for foreign investment, we would need to take further actions in order to comply with these laws, regulations and rules, which may materially 115 Table of Contents and adversely affect our current corporate structure, business, financial condition and results of operations. See “Item 3. Key Information — D. Risk Factors — Risks Related to Our Corporate Structure — Substantial uncertainties exist with respect to the interpretation and implementation of the PRC Foreign Investment Law and its implementing rules and other regulations and how they may impact the viability of our current corporate structure, business, financial condition and results of operations.” Given the uncertainties relating to the interpretation and enforcement of PRC laws, rules and regulations, it is possible that our existing operations may be found not to be in full compliance with relevant laws and regulations in the future. In addition, the PRC legal system is based in part on government policies and internal rules, some of which are not published on a timely basis or at all, and which may have a retroactive effect. As a result, we may not be aware of our violation of these policies and rules until after the occurrence of the violation. For more detailed information, see “Item 3. Key Information — D. Risk Factors — Risks Related to Doing Business in the People’s Republic of China — There are uncertainties regarding the interpretation and enforcement of PRC laws, rules and regulations, and changes in policies, laws, rules and regulations in the PRC could adversely affect us.” Permissions and Approvals Required to be Obtained from PRC Authorities for our Securities Offerings The PRC government has enhanced its regulatory oversight of Chinese companies listing overseas. In connection with our prior securities offerings and overseas listings, under PRC laws and regulations in effect as of the date of this annual report, after consulting our PRC legal counsel, Fangda Partners, we are not aware of any PRC laws or regulations which explicitly require us to obtain any permission from the CSRC or other Chinese authorities, and we, our consolidated subsidiaries and the VIEs in China (i) have not been required to obtain any permission from any PRC authority, (ii) have not been required to go through a cybersecurity review by the Cyberspace Administration of China, and (iii) have not received or were denied such requisite permissions by any PRC authority. There are uncertainties with respect to how PRC authorities will regulate overseas securities offerings and overseas listings in general, as well as the interpretation and implementation of any related regulations. Although we intend to fully comply with the then effective relevant laws and regulations applicable to any securities offerings we may conduct, there are uncertainties with respect to whether we will be able to fully comply with requirements to obtain any permissions and approvals from, or complete any reporting or filing procedures with, PRC authorities that may be in effect in the future. If we, our consolidated subsidiaries or the VIEs in China (i) do not maintain such permissions or approvals, (ii) inadvertently conclude that such permissions, approvals or filing or reporting are not required, or (iii) applicable laws, regulations, or interpretations change, and we or the VIEs are required to obtain such permissions, approvals or filing or reporting in the future, we may be unable to obtain such necessary approvals, permits, registrations or filings in a timely manner, or at all, and such approvals, permits, registrations or filings may be rescinded even if obtained. Any such circumstance could subject us to penalties, including fines, suspension of business and revocation of required licenses, significantly limit or completely hinder our and our subsidiaries' ability to offer securities to investors and cause our securities to decline in value or become worthless. For more detailed information, see “Item 3. Key Information — D. Risk Factors — Risks Related to Doing Business in the People’s Republic of China — There are uncertainties regarding the interpretation and enforcement of PRC laws, rules and regulations, and changes in policies, laws, rules and regulations in the PRC could adversely affect us” and “— Risks Related to Our Business and Industry — We may need additional capital but may not be able to obtain it on favorable terms or at all.” C. Organizational Structure Our significant subsidiaries, as that term is defined under Section 1‑02 of Regulation S‑X under the U.S. Securities Act, include the following entities: •Taobao Holding Limited, an exempted company incorporated with limited liability under the laws of the Cayman Islands and our wholly-owned subsidiary, which is a holding company of certain major subsidiaries of Alibaba China E-commerce Group. •Taobao China Holding Limited 淘寶中國控股有限公司, a limited liability company incorporated under the laws of Hong Kong, which is a direct wholly-owned subsidiary of Taobao Holding Limited and a holding company of certain major subsidiaries of Alibaba China E-commerce Group. •Alibaba.com Limited 阿里巴巴網絡有限公司, an exempted company incorporated with limited liability under the laws of the Cayman Islands and our wholly-owned subsidiary, which is a holding company of certain major subsidiaries relating to AIDC Group and Cloud Intelligence Group. •Alibaba.com Investment Holding Limited, a company incorporated with limited liability under the laws of the British Virgin Islands and a direct wholly-owned subsidiary of Alibaba.com Limited, which is the parent company of the holding company of AIDC Group and a holding company of certain subsidiaries relating to Cloud Intelligence Group. 116 Table of Contents •Alibaba Investment Limited, a company incorporated with limited liability under the laws of the British Virgin Islands and our wholly-owned subsidiary, which is a holding company for strategic investments and certain subsidiaries of Hujing Digital Media and Entertainment Group. •Alibaba Group Services Limited, a limited liability company incorporated under the laws of Hong Kong and our wholly-owned subsidiary, which operates as our treasury center in Hong Kong. •Taobao (China) Software Co., Ltd. 淘寶（中國）軟件有限公司, a limited liability company incorporated under the laws of the PRC and a direct wholly-owned subsidiary of Taobao China Holding Limited, which provides software and technology services for Taobao. •Zhejiang Tmall Technology Co., Ltd. 浙江天貓技術有限公司, a limited liability company incorporated under the laws of the PRC and a direct wholly-owned subsidiary of Taobao China Holding Limited, which provides software and technology services for Tmall. Like many large scale, multinational companies with businesses around the world and across industries, we conduct our business through a large number of Chinese and foreign operating entities, including VIEs. The chart below summarizes our corporate structure as of March 31, 2026 and identifies the subsidiaries and VIEs that together are representative of the major businesses operated by our group, including our significant subsidiaries and other representative subsidiaries, which we collectively refer to as our major subsidiaries, as well the corresponding representative VIEs, which we refer to as the representative VIEs: 1.Primarily involved in the operation of Taobao 2.Primarily involved in the operation of Tmall 3.Primarily involved in the operation of Cloud Intelligence Group 4.The holding company of AIDC Group 117 Table of Contents 5.A VIE For information about the major VIEs, which account for a significant majority of the total revenue and assets of the VIEs, please see “Item 3. Key Information — The VIE Structure Adopted by Our Company— Variable Interest Entity Financial Information.” Contractual Arrangements among Our Subsidiaries, the Variable Interest Entities and Variable Interest Entity Equity Holders Due to legal restrictions on foreign ownership and investment in, among other areas, value added telecommunications services, which include the operations of ICPs, we, similar to all other entities with foreign incorporated holding company structures operating in our industry in China, operate our Internet businesses and other businesses in which foreign investment is restricted or prohibited in the PRC through various contractual arrangements with VIEs that are incorporated in the PRC and owned by PRC citizens or by PRC entities owned and/or controlled by PRC citizens. The relevant VIEs hold the ICP licenses and other regulated licenses and operate our Internet businesses and other businesses in which foreign investment is restricted or prohibited. Specifically, for fiscal year 2026, our representative VIEs are Zhejiang Taobao Network Co., Ltd., Zhejiang Tmall Network Co., Ltd., Zhejiang Diantao Good Things Network Co., Ltd., and Alibaba Cloud Computing Ltd. See “— Organizational Structure” above. While the VIEs hold licenses and approvals and assets for regulated activities that are necessary for our business operations, as well as certain equity investments in businesses, to which foreign investments are typically restricted or prohibited under applicable PRC law, our subsidiaries hold the significant majority of our assets and operations and capture the significant majority of our revenue. Therefore, we directly capture the significant majority of the profits and associated cash flow from operations without having to rely on contractual arrangements to transfer cash flow from the VIEs to our subsidiaries. The currently effective contractual arrangements, as described in more detail below, by and among us, our relevant subsidiaries, the VIEs, and their shareholders include loan agreements, exclusive call option agreements, proxy agreements, equity pledge agreements and exclusive services agreements. As a result of the contractual arrangements with the VIEs and their shareholders, we include the financial results of each of the VIEs in our consolidated financial statements in accordance with U.S. GAAP. The VIE structure involves risks and is subject to uncertainties under PRC laws and regulations. See “Item 3. Key Information – D. Risk Factors – Risks Related to Our Corporate Structure.” VIE Structure Overview The following diagram is a simplified illustration of the typical ownership structure and contractual arrangements for VIEs: 118 Table of Contents For most of the VIEs, our group uses a different structure, or the Enhanced VIE Structure. The Enhanced VIE Structure maintains the primary legal framework that we and many peer companies in our industry have adopted to operate businesses in which foreign investment is restricted or prohibited in the PRC. We may also create additional holding structures in the future. Compared with the prior VIE structure adopted by many peer companies in our industry, which uses natural persons to serve as direct or indirect equity holders of the VIE, we have designed the Enhanced VIE Structure to: •reduce the key man and succession risks associated with natural person VIE equity holders, through a new structure that has widely dispersed interests among natural person interest holders; and •create a VIE ownership structure that is more stable and self‑sustaining, by distancing the natural person interest holders with the VIE with multiple layers of legal entities, including a partnership structure and multiple layers of contractual arrangements. VIE equity holders under the Enhanced VIE Structure Under the Enhanced VIE Structure, a VIE is typically held by a PRC limited liability company, instead of individuals. This PRC limited liability company is directly or indirectly owned by two PRC limited partnerships, each of which holds 50% of the equity interest. Each of these partnerships is comprised of (i) a PRC limited liability company, as general partner (which is formed by a number of selected members of the Alibaba Partnership and our management who are PRC citizens), and (ii) the same group of natural persons, as limited partners. Under the terms of the relevant partnership agreements, the natural person limited partners must be members of the Alibaba Partnership or our management who are PRC citizens and as designated by the general partner of the partnership. For our representative VIEs, these individuals are Jessie Junfang Zheng, Xiaofeng Shao, Zeming Wu and Fang Jiang (with respect to each of Zhejiang Taobao Network Co., Ltd., Zhejiang Tmall Network Co., Ltd., and Alibaba Cloud Computing Ltd.), and Jeff Jianfeng Zhang, Winnie Jia Wen, Jie Song and Yongxin Fang (with respect to Zhejiang Diantao Good Things Network Co., Ltd.). 119 Table of Contents The following diagram is a simplified illustration of the typical ownership structure and contractual arrangements of the VIEs under the Enhanced VIE Structure. (1)Selected members of the Alibaba Partnership or our management who are PRC citizens. Under the Enhanced VIE Structure, the designated subsidiary, on the one hand, and the corresponding VIE and the multiple layers of legal entities above the VIE, as well as the natural persons described above, on the other hand, enter into contractual arrangements, which are substantially similar to the contractual arrangements we have historically used for VIEs. See “— Loan Agreements,” “— Exclusive Call Option Agreements,” “— Proxy Agreements,” “— Equity Pledge Agreements” and “— Exclusive Services Agreements” below. There are risks associated with the VIE structure in general and the Enhanced VIE Structure. See “Item 3. Key Information — D. Risk Factors — Risks Related to Our Corporate Structure.” The following is a summary of our typical contractual arrangements. 120 Table of Contents Loan Agreements Pursuant to the relevant loan agreement, our respective subsidiary has granted a loan to the relevant VIE equity holders, which may only be used for the purpose of its business operation activities agreed by our subsidiary or the acquisition of the relevant VIE. Our subsidiary may require acceleration of repayment at its absolute discretion. When the VIE equity holders make early repayment of the outstanding amount, our subsidiary or a third party designated by it may purchase the equity interests in the VIE at a price equal to the outstanding amount of the loan, subject to any applicable PRC laws, rules and regulations. The VIE equity holders undertake not to enter into any prohibited transactions in relation to the VIE, including the transfer of any business, material assets or equity interests in the VIE to any third party. The parties to the loan agreement for each of the representative VIEs are the relevant VIE equity holders, on the one hand, and Taobao (China) Software Co., Ltd., Zhejiang Tmall Technology Co., Ltd. and Hangzhou AliCloud Apsara Information Technology Co., Ltd., our corresponding subsidiaries, on the other hand. Exclusive Call Option Agreements Under the Enhanced VIE Structure, each relevant VIE and its equity holders have jointly granted our relevant subsidiary (A) an exclusive call option to request the relevant VIE to decrease its registered capital at an exercise price equal to the higher of (i) the paid‑in registered capital in the relevant VIE and (ii) the minimum price as permitted by applicable PRC law, or the capital decrease price, and (B) an exclusive call option to subscribe for any increased capital of relevant VIE at a price equal to the capital decrease price, or the sum of the capital decrease price and the unpaid registered capital, if applicable, as of the capital decrease. Our subsidiary may nominate another entity or individual to purchase the equity interest or assets, or to subscribe for the relevant increased capital, if applicable, under the call options. Execution of each call option shall not violate the applicable PRC laws, rules and regulations. Each VIE equity holders has agreed that the following amounts, to the extent in excess of the original registered capital that they contributed to the VIE (after deduction of relevant tax expenses), belong to and shall be paid to our relevant subsidiaries: (i) proceeds from the transfer of its equity interests in the VIE, (ii) proceeds received in connection with a capital decrease in the VIE, and (iii) distributions or liquidation residuals from the disposal of its equity interests in the VIE upon termination or liquidation. Moreover, any profits, distributions or dividends (after deduction of relevant tax expenses) received by the VIE equity holder also belong to and shall be paid to our subsidiary. The exclusive call option agreements remain in effect until the equity interest or assets that are the subject of these agreements are transferred to our subsidiary. The parties to the exclusive call option agreement for each of the representative VIEs are the relevant VIE equity holder, the relevant VIE and our corresponding subsidiary. Proxy Agreements Pursuant to the relevant proxy agreement, each of the VIE equity holders irrevocably authorizes any person designated by our subsidiary to exercise the rights of the equity holder of the VIE, including without limitation the right to vote and appoint directors. The parties to the proxy agreement for each of the representative VIEs are the relevant VIE equity holder, the relevant VIE and our corresponding subsidiary. Equity Pledge Agreements Pursuant to the relevant equity pledge agreement, the relevant VIE equity holders have pledged all of their interests in the equity of the VIE as a continuing first priority security interest in favor of the corresponding subsidiary to secure the outstanding amounts advanced under the relevant loan agreements described above and to secure the performance of obligations by the VIE and/or its equity holders under the other structure contracts. Each subsidiary is entitled to exercise its right to dispose of the VIE equity holders’ pledged interests in the equity of the VIE and has priority in receiving payment by the application of proceeds from the auction or sale of the pledged interests, in the event of any breach or default under the loan agreement or other structure contracts, if applicable. These equity pledge agreements remain in force until the later of (i) the full performance of the contractual arrangements by the relevant parties, and (ii) the full repayment of the loans made to the relevant VIE equity holders. The parties to the equity pledge agreement for each of the representative VIEs are the relevant VIE equity holder, the relevant VIE and our corresponding subsidiary. Exclusive Services Agreements Under the Enhanced VIE Structure, each relevant VIE has entered into an exclusive service agreement with the respective subsidiary, pursuant to which our relevant subsidiary provides exclusive services to the VIE. In exchange, the VIE pays a service fee to our subsidiary, the amount of which shall be determined, to the extent permitted by applicable PRC laws as proposed by our subsidiary, resulting in a transfer of substantially all of the profits from the VIE to our subsidiary. 121 Table of Contents The exclusive call option agreements described above also entitle our subsidiary to all profits, distributions or dividends (after deduction of relevant tax expenses) to be received by the VIE equity holder, and the following amounts, to the extent in excess of the original registered capital that they contributed to the VIE (after deduction of relevant tax expenses) to be received by each VIE equity holder: (i) proceeds from the transfer of its equity interests in the VIE, (ii) proceeds received in connection with a capital decrease in the VIE, and (iii) distributions or liquidation residuals from the disposal of its equity interests in the VIE upon termination or liquidation. In the opinion of Fangda Partners, our PRC legal counsel: •the ownership structures of the representative VIEs in China and our corresponding subsidiaries do not and will not violate any applicable PRC law, regulation, or rule currently in effect; and •the contractual arrangements between the representative VIEs, the VIE holders and our corresponding subsidiaries governed by PRC laws are valid, binding and enforceable in accordance with their terms and applicable PRC laws, rules, and regulations currently in effect, and will not violate any applicable PRC law, regulation, or rule currently in effect. However, we have been further advised by our PRC legal counsel, Fangda Partners, that there are substantial uncertainties regarding the interpretation and application of current and future PRC laws, rules and regulations. Accordingly, the possibility that the PRC regulatory authorities and PRC courts may in the future take a view that is contrary to the opinion of our PRC legal counsel cannot be ruled out. We have been further advised by our PRC legal counsel that if the PRC government finds that the agreements that establish the structure for operating our business do not comply with PRC government restrictions on foreign investment in the aforesaid business we engage in, we could be subject to severe penalties including being prohibited from continuing operations. See “Item 3. Key Information — D. Risk Factors — Risks Related to Our Corporate Structure.” D. Property, Plant and Equipment As of March 31, 2026, we occupied facilities around the world with an aggregate gross floor area of office buildings, logistics warehouses, retail space, data centers and other facilities owned by us totaling approximately 18.7 million square meters. We maintain offices in many countries and regions, including Chinese mainland, Hong Kong SAR, Singapore and the United States. In addition, we maintain data centers in a number of countries including Chinese mainland, Hong Kong SAR, Indonesia, Malaysia, Thailand, Philippines, Singapore, UAE, Germany, the UK, Japan, South Korea, Mexico and the United States.