A. History and Development of the Company Since inception, our company has been operating the Credit-Tech platform in China which enables an effective match between credit demand and supply by offering Credit-Tech services. As a spin-off from the 360 Group, we started operating independently in July 2016, when Shanghai Qibutianxia (formerly known as Beijing Qibutianxia Technology Co., Ltd.) incorporated Shanghai Qiyu. In March 2017, Fuzhou Microcredit was founded and obtained the approval to conduct online micro-lending business. In June 2018, Fuzhou Financing Guarantee was founded and obtained the license to provide financing guarantee services. In April 2018, we were incorporated in the Cayman Islands as an offshore holding company under our former name, 360 Finance, Inc., to facilitate our financing and offshore listing on Nasdaq. In May 2018, all shareholders of Shanghai Qibutianxia adopted a unanimous resolution to reorganize for offshore listing and determine to spin off the Credit-Tech service, micro-lending as well as related financing guarantee businesses, which were operated by Shanghai Qiyu, Fuzhou Microcredit and Fuzhou Financing Guarantee, all of which are VIEs. We conduct our business in the PRC through our subsidiaries, the VIEs and the VIEs’ subsidiaries. During the reorganization process we issued ordinary shares and preferred shares to the beneficial owners of Shanghai Qibutianxia in exchange for the contribution of Shanghai Qiyu, Fuzhou Microcredit and Fuzhou Financing Guarantee. In addition, we have incorporated a wholly owned subsidiary, HK Qirui International Technology Limited, as our offshore holding company in Hong Kong and further incorporated a wholly owned subsidiary in China, Shanghai Qiyue, which is also referred to as our WFOE in this annual report. Our WFOE has entered into a series of contractual arrangements with Shanghai Qiyu, Fuzhou Microcredit, and Fuzhou Financing Guarantee and their respective record shareholders. These contractual arrangements enable us to exercise effective control over the VIEs; receive substantially all of the economic benefits of the VIEs; and have an exclusive option to purchase all or part of the equity interests in and assets of them when and to the extent permitted by PRC law. For risks and uncertainties associated with this structure, please see “Item 3. Key Information—D. Risk Factors—Risks Related to Our Corporate Structure.” As a result of our direct ownership in our WFOE and the contractual arrangements with the VIEs, we are regarded as the primary beneficiary of the VIEs, and treat them as our consolidated affiliated entities under U.S. GAAP. Accordingly, we are able to consolidate the financial results of the VIEs in our combined and consolidated financial statements in accordance with U.S. GAAP. In May 2018, we officially launched our capital-light model. In June 2018, Fuzhou Financing Guarantee was established and later obtained the license to provide financing guarantee services. In September 2018, we issued an aggregate of 24,937,695 series B preferred shares to several investors in a private placement transaction and raised US$203.5 million. 76 Table of Contents In December 2018, our ADSs commenced trading on the Nasdaq Global Market under the symbol “QFIN.” We raised from our initial public offering approximately US$43.3 million in net proceeds after deducting underwriting commissions and discounts and the offering expenses payable by us. In January 2019, Shanghai Financing Guarantee obtained the license to conduct financing guarantee business. In order to streamline and consolidate the operation of our financing guarantee business, we phased out financing guarantees provided by Shanghai Financing Guarantee and now conduct all of our financing guarantee business through Fuzhou Financing Guarantee. Shanghai Financing Guarantee was approved by the PRC authority to cancel its financing guarantee certificate, and such certificate had been returned to the PRC authority for cancellation. In May 2019, we won the Achievement in Credit Risk Management Award given by the Asian Banker. In July 2019, we completed a follow-on public offering of ADSs by certain selling shareholders. Through the follow-on offering the selling shareholders sold an aggregate of 9,609,000 ADSs at the price of US$10.00 per ADS. Net proceeds to the selling shareholders, after deducting underwriting commissions and before expenses, amounted to approximately US$92.7 million. We did not receive any proceeds from the sale of the ADSs by the selling shareholders. In August 2019, we launched the Intelligence Credit Engine (ICE), an open platform that offers financial institution partners intelligent marketing services. In September 2019, we were approved by the People’s Bank of China to access the Credit Reference Center. In October 2019, we were the first group to join the anti-fraud alert platform led by the Ministry of Public Security. In June 2020, we were among the first group to pass the filing with National Internet Finance Association of China for mobile finance app. In June 2020, we launched our innovative “embedded finance” model. In August 2020, we changed our name to 360 DigiTech, to better reflect our focus on technology empowerment. In November 2020, the ADSs were transferred from the Nasdaq Global Market to begin trading on the Nasdaq Global Select Market. In July 2021, we were awarded “China’s Best Credit-Tech Services,” “China’s Best Implementation in Anti-Fraud Technology of the Year” and “China’s Best Technological Implementation in Risk Data and Analysis of the Year” at the China Country Awards 2021 by The Asian Banker. In November 2021, we were awarded “New Champions 2021 – Excellence in agile business governance” by the World Economic Forum, being Asia’s only award-winning corporation at the New Champion Awards 2021. In November 2022, we completed our public offering in Hong Kong and the trading of our class A ordinary shares on the Hong Kong Stock Exchange commenced on November 29, 2022 under the stock code “3660.” Immediately upon the completion of our secondary listing on the Hong Kong Stock Exchange, all the then-outstanding class B ordinary shares converted into class A ordinary shares on a one-for-one basis pursuant to the conversion notice delivered by Aerovane Company Limited to the company. No class B ordinary shares remained outstanding upon that conversion and we have not issued any further ones. 77 Table of Contents On March 31, 2023, we held an extraordinary general meeting and (i) varied and amended our authorized share capital by (a) re-designating and re-classifying all authorized Class B ordinary shares as Class A ordinary shares each on a one-for-one basis and (b) re-designating and re-classifying all authorized and unissued shares of a par value of US$0.00001 each of such class or classes (however designated) as the board of directors of our company may determine in accordance with the memorandum of association and articles of association of our company as class A ordinary shares each on a one-for-one basis, (ii) adopted the third amended and restated memorandum and articles of association, and (iii) changed our English name from “360 DigiTech, Inc.” to “Qifu Technology, Inc.” and adopted “奇富科技股份有限公司” as our dual foreign name. Previously, under our dual class voting structure, our share capital comprises class A ordinary shares and class B ordinary shares. Each class B ordinary share is entitled to 20 votes, and each class A ordinary share is entitled to one vote on all matters subject to vote at a general meeting of us. As a result of our varied and amended authorized share capital, we unwound our dual-class shareholding structure and all the issued shares of our company (including the class B ordinary shares with super-voting rights) were redesignated and reclassified into class A ordinary shares which entitle holders to one vote for each share. In July 2023, we were awarded “Best Lending Implementation in China” at the China Awards Program 2023 by the Asian Banker. In September 2023, the national standards for financial large language models in China were officially released, and we were one of the leading entities in collaboration with the China Academy of Information and Communications Technology for the formulation of these standards. In August 2024, we gradually rolled out the rebranding of our primary user interface, 360 Jietiao app to Qifu Jietiao app, to better reflect our position as a Credit-Tech platform. On June 30, 2025, we held our annual general meeting and (i) changed our English name from “Qifu Technology, Inc.” to “Qfin Holdings, Inc.”, and (ii) adopted the fourth amended and restated memorandum and articles of association. After the change of our English name, we updated our logo from to . Our Chinese and English stock names of “奇富科技 - S” and “QFIN - S”, respectively, and the dual foreign name of “奇富科技股份有限公司” remain unchanged. Our principal executive offices are located at Building 1, No. 98 Qingyijiang Road, Putuo District, Shanghai 200331, People’s Republic of China. Our telephone number at this address is +86 21 5835-7668. Our registered office in the Cayman Islands is located at PO Box 309, Ugland House, Grand Cayman, KY1-1104, Cayman Islands. Our agent for service of process in the United States is Cogency Global Inc., located at 122 East 42nd Street, 18th Floor, New York, NY 10168. The information that we have filed electronically with the SEC can be accessed at http://www.sec.gov. Our annual reports, quarterly results, press release and other SEC filings can also be accessed via our investor relationship website at https://ir. qfin.com. The information contained on our website is not part of this annual report. 78 Table of Contents B. Business Overview Established in 2016, we are a leading AI-empowered Credit-Tech platform in China. Leveraging our sophisticated machine learning models and data analytics capabilities, we provide a comprehensive suite of technology services to assist financial institutions, consumers, and SMEs in the loan lifecycle, ranging from borrower acquisition, preliminary credit assessment, fund matching and post-facilitation services, with Qifu Jietiao app as our primary user interface. We are dedicated to making credit services more accessible and personalized to consumers and SMEs through Credit-Tech services to financial institutions, whereby we deploy our technology solutions to help financial institutions identify the diversified needs of consumers and SMEs, effectively access prospective borrowers that are creditworthy through multi-channels, enhance credit assessment on prospective borrowers, and manage credit risks and improve collection strategies and efficiency, among others. With user insights distilled from long-term engagement with users across life and business scenarios enabled by AI and data analytics, our technology solutions empower financial institutions across different stages of the loan lifecycle, enabling them to extend the reach of services and satisfy the financing needs of consumers and SMEs, and deliver to users more accessible credit services. In turn, we derive service fees from our technology solutions to financial institutions. We started to explore overseas expansion in 2024, leveraging our cutting-edge financial technologies to serve the underserved segments in selected overseas markets. We believe these initiatives will bring long-term growth to the company and diversify our business portfolio geographically. As of December 31, 2025, we had cumulatively facilitated approximately RMB2,539.1 billion (US$363.1 billion) of loans to 38.9 million borrowers. As of the same date, we had 63.6 million users with approved credit lines, accumulatively. Our Services We match underserved and unserved users with credit demand to a diversified pool of financial institutions with credit to supply, through both credit-driven services and platform services. The following table presents our operating data related to credit-driven services and platform services for the years ended or as of December 31, 2023, 2024 and 2025: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ For the year ended/ As of December 31, ​ ​ ​ ​ 2023 ​ 2024 ​ 2025 ​ ​ Loan ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Loan ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Loan ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ facilitation ​ ​ ​ Ending ​ ​ ​ facilitation ​ ​ ​ Ending ​ ​ ​ facilitation ​ ​ ​ Ending ​ ​ ​ ​ volume ​ % ​ balance ​ % ​ volume ​ % ​ balance ​ % ​ volume ​ % ​ balance ​ % ​ (in RMB millions, except for percentages) Credit-driven services ​ ​ ​ 204,811 ​ ​ ​ 55.5 ​ ​ ​ 72,002 ​ ​ ​ 49.6 ​ ​ ​ 151,380 ​ ​ ​ 47.0 ​ ​ ​ 57,415 ​ ​ ​ 41.9 ​ ​ ​ 182,694 ​ ​ ​ 55.9 ​ ​ ​ 66,515 ​ ​ ​ 52.8 Platform services 164,321 44.5 73,268 50.4 170,589 53.0 79,599 58.1 144,375 44.1 59,497 47.2 Total 369,132 100.0 145,270 100.0 321,969 100.0 137,014 100.0 327,069 100.0 126,012 100.0 ​ 79 Table of Contents Credit-driven services Under the credit-driven services category, we match prospective borrowers with financial institutions and empower financial institutions in borrower acquisition, credit assessment, fund matching and post-facilitation services. Loan products offered under this line of services are primarily funded by our financial institution partners, with the remainder extended by Fuzhou Microcredit, which is licensed to conduct micro-lending business in China, or trusts and ABSs. In both cases, we bear credit risks of the loans. For loans extended by our financial institution partners, we provide guarantees against potential defaults. Such contractual guarantee arrangement is underwritten either by the licensed VIEs, or third-party licensed guarantee companies or insurance companies, to which we may provide back-to-back guarantee at their request. With respect to loan facilitation services for loans funded by financial institution partners, we charge service fees directly from our financial institutional partners pursuant to pre-negotiated terms based on the contractual agreements that vary from case to case. Our service fee rate is typically the difference between the loan pricing rate, which is set by the financial institutions, and a fixed rate negotiated between us and the respective financial institutions. For loans funded by Fuzhou Microcredit, we charge borrowers interest fees, which reflects a number of factors including the credit profile of the borrowers, the availability of funding and the associated funding cost, and the tenor of loan products, among others. Platform services Our platform services include loan facilitation and post-facilitation services through our capital-light model, intelligent marketing services to financial institution partners under Intelligence Credit Engine, referral services and other technology solutions. We currently do not take credit risk under platform services. For the years ended December 31, 2023, 2024 and 2025, loans facilitated under our platform services accounted for approximately 44.5%, 53.0% and 44.1% of our total loan facilitation volume, respectively. Capital-light model We launched our capital-light model in 2018 with the focus on implementing our strategic transition from a traditional risk bearing loan facilitator to a technology enabler. Under our capital-light model, we facilitate transactions between prospective borrowers and our financial institution partners through a suite of technology-enabled services spanning across the loan lifecycle, including borrower acquisition, technology empowerment in credit assessment, and post-facilitation services such as loan performance monitoring and loan collection. Under our capital-light model, we historically provided limited guarantee to certain collaborating insurance companies in the event of bankruptcy and certain financial institution partners pursuant to their internal requirements. Given the nature of such guarantee arrangements and our assessment that the likelihood of bankruptcy to occur with respect to the insurance companies is remote, such credit risks that we took under the platform services were negligible. We have not provided such guarantee arrangements since 2024. For loans facilitated under our capital-light model, we generate income through service fees charged to financial institution partners according to pre-negotiated terms that vary from case to case. Our service fee rate is typically a certain percentage of the pricing rate that is set by the financial institution partners on the loans to borrowers. Intelligence Credit Engine (ICE) ICE is an open platform that offers financial institution partners and other lending platforms intelligent marketing services. For loans facilitated through ICE, we match prospective borrowers with financial institution partners based on comprehensive data analysis and cloud computing technologies, and assist financial institution partners with preliminary credit screening of borrowers, but do not provide advanced credit assessment. We earn pre-negotiated service fees from financial institution partners and do not bear credit risks. Our service fee rate is typically a certain percentage of the pricing rate that is set by the financial institution partners on the loans to borrowers, and the service fee rate is subject to negotiations with the financial institution partners and varies from case to case. Referral services As different financial institution partners prescribe different metrics assigned with various values in granting credit line approvals to prospective borrowers, some users fail to match the criteria of our financial institution partners and are rejected by them. However, such borrowers may still be within the target borrower group of other online lending companies. To offer more products and better user experience to our users and maximize the value of user traffic on our platform, we provide referral services primarily to other online lending companies in line with industry practice and earn referral fees. We consider referral services to be supplemental in nature to our loan facilitation services. 80 Table of Contents Other technology solutions In 2020, we began to offer financial institutions on-premise deployed, basic risk management SaaS solutions, or RM SaaS solutions. Since 2023, we started to offer end-to-end technology solutions, including user acquisition, risk management, credit operation and post-facilitation services to financial institutions based on on-premise deployment, SaaS or hybrid model, which we refer to as total technology solutions. Basic RM SaaS solutions and total technology solutions together are previously referred to as other technology solutions. Integrated with our credit assessment insights and algorithms as well as other proprietary technologies, other technology solutions help financial institution partners acquire borrowers and improve credit assessment results. Under this model, we typically take technology service fees or consulting fees for the corresponding technology solutions elected by the financial institutions. However, as basic RM SaaS solutions only generated marginal returns and has little potential for up selling, we ceased providing such solutions at the end of 2024 and now focus on developing our end-to-end technology solutions under our “Qifu DigiTech” brand. We expect that the end-to-end technology solutions will deepen our cooperation with the financial institution partners and empower them to achieve better efficiency. In terms of accounting treatments, under credit-driven services, we either provide guarantees for loans funded by financial institution partners, which are recorded as off-balance sheet loans, or fund loans through trusts and ABSs or Fuzhou Microcredit, which are record as on-balance sheet loans. Under platform services, all loans facilitated through our platform are recorded as off-balance sheet loans. We have a large balance of guarantee liabilities during the years ended December 31, 2023, 2024 and 2025, as we provide guarantees under credit-driven services. We also have a large balance of accounts receivable and contract assets as well as financial assets receivable during the same period, mainly arising from off-balance sheet loans, as well as loans receivable, mainly arising from on-balance sheet loans. We have established an evaluation process designed to determine the adequacy of our impairment allowances and guarantee liabilities, and an allowance for uncollectible receivables and contract assets based on estimates that incorporate historical delinquency rate by vintage and other factors surrounding the credit risk of specific underlying loan portfolio. However, actual losses and credit risks are difficult to forecast. For more details, see “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We need to engage guarantee companies to provide credit enhancement or additional comfort to our financial institution partners, and we recognize guarantee liabilities for accounting purposes. If we fail to source and engage a guarantee company to our financial institution partners’ satisfaction at a reasonable price, our collaboration with our financial institution partners will deteriorate, and our results of operations may be adversely and severely impacted. If our guarantee liability recognition fails to address our current status, we may face unexpected changes to our financial conditions,” “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We are subject to credit risks associated with our accounts receivable, contract assets, financial assets receivables and loans receivable” and “Item 5. Operating and Financial Review and Prospects—On- and Off-balance Sheet Treatment of Loans.” In terms of revenue recognition, we recognize financing income from on-balance sheet loans over the lifetime of the loans using effective interest method. For the off-balance sheet loans funded by financial institution partners, we recognize revenue from loan facilitation services, revenue from post-facilitation services and revenue from guarantee services (only applicable to off-balance sheet loans facilitated under credit-driven services). Please refer to “Item 5. Operating and Financial Review and Prospects—On- and Off-Balance Sheet Treatment of Loans” and “Item 5. Operating and Financial Review and Prospects—Key Line Items And Specific Factors Affecting Our Results of Operations—Net revenue” for details. Products offered to users Our core product offered to users in Mainland China is an affordable, digital revolving line of credit allowing multiple loan drawdowns, with a convenient application process and flexible loan tenors. Our products are provided under the Qifu Jietiao brand. Our engagement with prospective consumer borrowers begins with a credit application which typically takes a few minutes. Once approved by our financial institution partners, a prospective borrower is granted a line of credit, typically with a principal amount ranging from RMB1,000 to RMB200,000, for drawdowns based on specific needs with an amount typically between RMB500 and RMB200,000. The average single drawdown amount in 2025 was RMB9,227 (US$1,319). When an approved borrower makes a drawdown request, we perform preliminary credit assessment on such borrower to ensure his or her continued qualification for drawdown before the request is transmitted to our financial institution partners for their independent final risk assessment and loan disbursement approval. Once a drawdown is approved, a borrower may elect a loan tenor best suited for his or her financial needs, in fixed terms of one month, three months, six months, twelve months, eighteen months, twenty-four months or thirty-six months, to be repaid in monthly installments. The average amount of approved credit line for each borrower in 2025 was RMB16,710 (US$2,390). In the instance where we provide guarantee services, the guarantee services are provided throughout the loan tenor. We are also offering other payment terms such as repayment at any time with a fixed daily interest. There is no interest-free period, but we may offer interest-free coupons in certain limited cases as promotional activities to encourage borrowers’ engagements with our platform. 81 Table of Contents Total loan facilitation volume made through our platform in 2023, 2024 and 2025 was RMB369.1 billion, RMB322.0 billion and RMB327.1 billion (US$46.8 billion), respectively. The outstanding balance of all loans made through our platform as of December 31, 2025 was RMB126.0 billion (US$18.0 billion). The weighted average contractual tenor of loans we facilitated in 2023, 2024 and 2025 was 11.21 months, 10.05 months and 10.50 months, respectively. Our Service Process and Operation Flow With the focus on empowering financial institution partners and serving consumers and SMEs, our platform offers services covering the entire loan lifecycle. In particular, we set forth below the service process and operation flow for our end-to-end loan facilitation services under credit-driven services, as well as our capital-light model and ICE under platform services, which are the three primary models of services we offer. Credit-driven services and our capital-light model follow the same service process and operational flow from credit line approval to loan drawdown, and differ only in the post-facilitation stage, where under credit-driven services in which we bear credit risks, we make guarantee repayments to our financial institution partners if needed. For ICE, as we provide financial institution partners intelligent marketing services, we mainly conduct preliminary credit screening of prospective borrowers during the credit line approval stage, therefore participating in fewer steps in the loan lifecycle than we do under credit-driven services and our capital-light model. Stage 1: Credit line approval Step 1: Paperless credit application. For new users, our service journey begins with such users’ registration of an account on our platform by providing us with certain basic information and authorization to collect other information for fraud detection and credit assessment, among others. The credit application process typically takes a few minutes, after which we initiate a user portrait profiling, fraud detection and credit assessment process. Step 2: Portrait profiling, fraud detection and credit assessment. We deploy the Argus Engine to build a prospective borrower profile for fraud detection and credit assessment. Drawing on our database, AI-enabled credit assessment system, Argus Engine, and understanding through interactions with a broad user base, we are able to develop a more accurate and comprehensive prospective borrower portrait. Once an applicant passes the fraud detection test, we initiate a comprehensive credit assessment and generate a proprietary credit score for the applicant under credit-driven services and our capital-light model, or conduct only preliminary credit screening under ICE. Under credit-driven services and our capital-light model, following credit assessment, our Cosmic Cube Pricing Model formulates initial pricing recommendation to be provided to financial institution partners based on the overall credit profile of prospective borrowers and other market factors. See “—Credit Assessment” for details of the credit assessment process. Step 3: Recommendation and matching. Through our workflow system CloudBank, under both credit-driven services and our capital-light model, we then recommend the prospective borrower’s profile along with pricing recommendation to our financial institution partners and share the results of our preliminary credit assessment with them to facilitate their final risk management and credit decision making including loan tenor, approved credit line, and other key terms of a loan product. For ICE, we only recommend prospective borrowers to financial institution partners based on the results of preliminary credit screening, and do not provide pricing recommendations. Step 4: Final risk management and credit decision by financial institutions. The financial institution partners conduct final risk management and make their credit decisions based on their respective credit process and regulatory guidelines. Step 5: Notice on credit line approval. Following their final risk management, each financial institution partner will respond to our workflow system indicating approval or rejection, and in the case of approval, their maximum level of credit exposure. Upon receiving the credit approval decision from financial institution partners, we pass such information to prospective borrowers through our platform. 82 Table of Contents The diagram below illustrates the step-by-step workflow and transaction process at the stage of credit line approval under the credit-driven service and our capital-light model. For ICE, as we only recommend prospective borrowers to financial institutions after preliminary credit screening, we do not participate in the credit line approval step, and financial institutions offer their own loan products and directly notify the borrowers of their credit approval decision. The diagram below illustrates the step-by-step workflow and transaction process at the stage of credit line approval under ICE. Stage 2: Loan drawdown Once a credit line is granted, a prospective borrower may request a drawdown at any time, subject to the credit limit approved by the financial institution partner. Upon receipt of a drawdown request, the Argus Engine conducts a streamlined credit assessment to ensure the prospective borrower’s continued qualification for drawdown and notifies our financial institution partners of the drawdown request, which complete their final risk management and reach a drawdown decision. We undertake to notify the borrower the drawdown decision and the financial institution partner that is matched with the borrower will disburse loan to the borrower. Once the principal of the loan is transferred to the borrower, we recognize revenue from loan facilitation services for services provided to the financial institution partner. 83 Table of Contents The diagram below illustrates the step-by-step workflow and transaction process at the stage of loan drawdown under the credit-driven service and our capital-light model. For ICE, although the prospective borrower’s drawdown application is made through our platform, the application is directly sent to our financial institution partner through the application programming interface (API) without us processing of the information in any way. The diagram below illustrates the step-by-step workflow and transaction process at the stage of loan drawdown under ICE. Stage 3: Post-facilitation services: continual credit profile monitoring and collection Robust data analytics technologies have enabled us to continuously monitor the credit profiles of borrowers. After a borrower makes a loan drawdown, our Argus Engine tracks his or her borrowing and repayment activities, and automatically adjusts such borrower’s credit profile on an ongoing basis. Borrowers typically make repayments to our financial institution partners through third-party payment platforms rather than through our platform. We recognize revenues from post-facilitation services on a straight-line basis over the term of the underlying loans. We typically collect pre-negotiated service fees (inclusive of fees for loan facilitation services, post-facilitation services and guarantee service fees, if applicable) from financial institution partners on a monthly basis as borrowers make repayments over the term of the underlying loans. The diagram below illustrates the step-by-step workflow and transaction process at the stage of our post-facilitation services under credit-driven services and our capital-light model under platform services for cases where repayment is made on time. 84 Table of Contents If a loan is overdue, the Argus Engine, together with other robust data analytical algorithms, will automatically prescribe an initial collection approach based on borrower profiles. Based on the analysis results, we will first initiate an AI-driven, automated process, including AI-initiated calls and text messages, for collection of the outstanding amount. Thereafter, in-house human collection calls are typically made, along with other automated collection techniques, subject to adjustments. For details of our collection efforts, see “—Credit Assessment—Collection.” For loans under credit-driven services where we take credit risks, we will make guarantee repayments to the financial institution partners if a loan is past due for a certain period subject to the terms of the relevant agreements, after which we will retain any repayment made by the borrower. In the meantime, we will deploy continuous collection efforts, including outsourcing the collection to third-party collection service providers, to collect the delinquent amount, particularly after an extended period of loan delinquency. After notifying the borrower that fails to make repayment over a certain time frame, the financial institution partners would assign their claims to Fuzhou Financing Guarantee, and Fuzhou Financing Guarantee, as obligee, shall acquire the rights related to the claims. For loans under our capital-light model where we do not take credit risks, we, or the third-party collection service providers which are involved at a later stage, will continue to make collection efforts in accordance with agreements with the financial institution partners up to a predetermined point in time. Because we take credit risks and provide guarantee services under credit-driven services and currently do not take credit risks under platform services, the gross fees charged under credit-driven services are generally higher than the fees charged under platform services. The following diagrams display the step-by-step workflow and transaction process of loan collection under the credit-driven services and our capital-light model. For loans facilitated under ICE, we also provided limited collection services to a small portion of financial institution partners based on their special requests. Credit Demand Target user In consumer Credit-Tech market, we mainly target the large and growing Chinese population of users who typically has stable income with promising growth potentials and has greater user lifetime values, but are underserved or unserved by the traditional financial institutions. Prospective borrowers are generally drawn to our platform for supplemental credit solutions. In the SME Credit-Tech market, our products mainly aim to serve SMEs with an annual operating revenue below RMB5 million, which are typically granted with credit line below RMB1 million. We believe this group of SMEs are unserved or underserved by traditional financial institutions, which typically focus on enterprises with large-scale operations. We believe we are chosen by our users because of our reputation as a trusted and reliable platform and the convenient, fast, intuitive and transparent user experience that we offer through our platform. We have established a large base of loyal creditworthy users. As of December 31, 2025, we had 63.6 million cumulative users with approved credit lines in the aggregate, among which 59.7% had credit cards, mortgage loans or auto loans and 40.0% were between 25 to 35 years old. Our repeat borrower contribution was 93.3% for the year ended December 31, 2025. 85 Table of Contents User acquisition We strive to diversify the network for user acquisition, which currently comprises online advertising on channels operated by leading internet companies, “embedded finance” cooperation with online platforms with heavy user traffic, offline promotions and referral programs with other platforms. Online advertising We partner with leading internet traffic platforms to acquire borrowers via online advertising. We are improving our targeted marketing capabilities by leveraging data analytics so that we can place advertisements to intended users who fit into our target borrower profile more effectively. We have also developed analytics algorithms in collaboration with channel partners based on the anonymous user information aggregated from such channel partners so that users of the channel partners with credit needs can be directed to our platform with improved precision and efficiency. We intend to continue optimizing our proprietary AI and data analytics systems and expand the network of channel partners to improve user acquisition efficiency. Embedded finance model In 2020, we started cooperating with leading online platforms with heavy user traffic under “embedded finance” model. These platform partners include, among others, leading short-form video platform, e-commerce platforms, ride-hailing companies and smart phone companies. In 2024, we started to explore collaborations with selected financial institutions to engage their existing customer bases, leveraging their proprietary traffic alongside our differentiated pricing and service capabilities to expand the breadth and depth of our user coverage. Under this model, we embed our credit assessment, data analytics and other proprietary technology solutions within the partnering internet platforms and financial institutions. Therefore, credit services used by end users of our partnering platforms will be ultimately provided by us. Through “embedded finance”, we are able to reach more users effectively while empowering our partnering platforms and financial institutions to improve user experience and further unleash the monetization value of their user base. We have become the Credit-Tech service partner of many leading online platforms and financial institutions across various categories, gaining access to a large number of internet users across consumption scenarios for potential conversion into borrowers. As of December 31, 2025, we had partnered with 75 leading online platforms and financial institutions cumulatively. Offline promotion and borrower referral programs In the meantime, we conduct offline sales and marketing activities to promote our products and services in specific regions and for specific products. In addition, we continue to acquire new users through borrower referral programs. Credit Supply We have a stable and diversified base of funding partners. We primarily rely on our financial institution partners, including national and regional banks and consumer finance companies, to fund our credit products. From time to time, we also fund a certain percentage of loans through Fuzhou Microcredit. With sufficient and strong funding commitment from our financial institution partners, we have the flexibility to recommend suitable products to borrowers with different combinations of funding sources depending on market conditions. For the year of 2025, financial institutions including Fuzhou Microcredit accounted for 100% of our total funding. Financial institutions Our financial institution partners are mainly national and regional commercial banks and consumer finance companies. The value we add to our financial institution partners includes efficient borrower acquisition through online and offline channels, credit assessment technology empowerment, post-facilitation services and risk-adjusted returns throughout economic cycles, among others. Our technology infrastructure helps enhance financial institution partners’ risk management, providing them with a more seamless and real-time risk management experience. In certain special cases and as mutually agreed upon by us and a small number of financial institution partners pursuant to their internal business requirements and procedures, some of the loans facilitated through our platform are funded by and disbursed indirectly through trusts, which also provide us with more flexibility to utilize the funds from the trusts for loan facilitation within the specified time frame and are in line with the industry norms. 86 Table of Contents As of December 31, 2025, we had established partner relationship with a total of 167 financial institutions cumulatively, including national and regional banks and consumer finance companies, across 26 provinces and autonomous regions of provincial level and 70 cities in China. Fuzhou Microcredit In March 2017, Fuzhou Microcredit was established, which has obtained the regulatory approval and micro-lending license to originate loans. The sources of funding for the loans funded by Fuzhou Microcredit include its registered capital, profits from its operations, shareholder loans and bank loans. In 2025, RMB69.4 billion (US$9.9 billion) of credit drawdowns on our platform were initially funded by Fuzhou Microcredit, representing approximately 21.2% of our total funding during such period. All loans funded by Fuzhou Microcredit were recorded on our balance sheet. Currently, Fuzhou Microcredit has a registered capital of RMB5 billion, which has been fully paid. Alternative funding initiatives We have explored and expect to continue exploring alternative funding initiatives, which include standardized capital instruments such as the issuance of ABSs and ABNs. The type of underlying assets in the asset backed special plans includes beneficial rights in trusts and loans receivable. As of December 31, 2025, we had cumulatively issued ABSs and ABNs of RMB67.6 billion (US$9.7 billion) with a comprehensive cost of funding between 3% and 4%. In addition, our shelf registration of ABSs and ABNs with a total value of issuance amounting to RMB19.4 billion has been approved by the Shanghai Stock Exchange and Shenzhen Stock Exchange and National Association of Financial Market Institutional Investors, as applicable, as of December 31, 2025. Credit Assessment We believe our industry-leading credit assessment capabilities are a key competitive advantage allowing us to expand our business while maintaining consistently solid asset quality of the loan portfolios. Our credit assessment technology solutions are built upon a comprehensive database, a sophisticated credit profiling engine, and an efficient post-facilitation service process. With our technology empowerment, financial institutions conduct core risk management and credit approval independently to achieve better risk management. Comprehensive database Large volume of high-quality data is a key factor differentiating Credit-Tech platforms. With users’ consent to our use of their data, we have developed a comprehensive database comprising a large volume of reliable information including, among others, a user’s credit history, credit lines granted by banks, consumption pattern and past repayment behavior, that are relevant to the assessment of a given user’s credit risk against future borrowing. We develop our database and build user profile primarily with our first-hand and proprietary data. Meanwhile, we also partner with third-party data providers to enrich our database of credit information. For example, we have access to the People’s Bank of China’s credit reporting system, which allows us to retrieve and submit data on borrowers’ credit profiles. 87 Table of Contents Credit assessment engine The success of our business relies on the effectiveness of our credit profiling systems. The “brain” of our credit profiling systems is our Argus Engine. Our Argus Engine integrates user database, AI-powered data analytics, and expert experience based on AI technologies, such as machine learning and deep learning, into comprehensive models. It allows us to effectively recognize and infer the patterns and relationships between information nodes and develop user profiles more accurately without substantial human intervention. For example, our Argus Engine is capable of automatically and continually training its algorithms with data in real life, and iterating and refining the precision of its profiling and decision making across the lifecycle of a loan. In addition, we have equipped the Argus Engine with a number of cutting-edge technologies in the area of AI, including machine learning and deep learning, which enable a more effective screening of fraudulent application and a more precise profile buildup. For example, integrated with visual risk technology under deep learning, our Argus Engine is able to verify the identity of a prospective borrower, denying those applications completed with what it believes to be a false identify, allowing for another layer of effective protection from frauds. For another instance, we have programed large-scale social network (knowledge graph) into our Argus Engine for fraud detection, which empowers us to comprehensively map and reason about connections between our users, and therefore more effectively identify organizational fraudulent behaviors. Leveraging its three core functions of anti-fraud, credit assessment and risk alert, Argus Engine helps us effectively build user profile, conduct overall credit assessment for each prospective borrower and detect frauds, thereby lowering the possibility of loan delinquency. Behavior analysis and fraud detection The Argus Engine is deployed to conduct fraud detection and initial credit screening of a prospective borrower, generating an F-Score which is a proprietary metric quantifying potential fraud risks of the borrower. Through our Argus Engine, we seamlessly combine data aggregation with fraud detection capabilities as follows. ● Identity authentication. We use facial recognition technology and other tools and processes to verify the identity of a prospective borrower, denying those applications with what we believe to be false identities. ● Blacklist filtering. We maintain a real-time list of suspicious devices and accounts referred to as a blacklist and to which we have automated access. We refer to the blacklist as well as fraud records provided by third-party institutions to filter prospective borrowers with high fraud risks. ● Telecommunication fraud prevention. Our anti-telecommunication fraud system integrates black or gray list, AI powered source tracking technologies, as well as real time transaction and risk monitoring models. This system enables fraud prevention across the entire lending process, from pre-facilitation borrower acquisition to post-facilitation services. Its telecommunication fraud prevention mechanism features fraud risk alert, fraud interception and post-fraud feedback. ● Anti-fraud algorithms. We filter prospective borrowers through the use of anti-fraud algorithms based on machine learning: ● we utilize supervised machine learning processes to learn from known fraud behavior patterns, training our algorithms to develop rules to identify similar patterns and deny suspicious applications; ● we utilize unsupervised machine learning to run anomaly detection to detect individual and aggregated abnormal patterns for the purpose of identifying unknown fraud behaviors; and ● we conduct a social network analysis, connecting seemingly unrelated factors to often detected fraud schemes. For example, when a new user uses the same mobile device as that of users A and B to access our services, our social network analysis algorithm is able to automatically catch the high correlations that may exist between the new user and the existing users A and B. If users A and B have been flagged by our system due to previous collaborative fraudulent loan applications, and the same mobile device has been identified as owned by the leader of this fraudulent organization, the social network analysis algorithm is able to conclude that the new user is likely to be a member of the fraudulent organization and subsequently direct the new user for manual verification. 88 Table of Contents Proprietary credit scoring and risk models When a credit application is deemed to not represent a fraud risk, it is then subjected to the credit assessment module of our Argus Engine. This module will select and analyze variables associated with a given credit application. The variables that the Argus Engine analyzes are selected based on the perceived risk profiles of the applicants. The Argus Engine ultimately generates an A-Score to quantify an applicant’s credit profile. Prospective borrowers with higher A-Scores typically receive recommendation for higher credit limits. The A-Score is then directed to the Cosmic Cube Pricing Model for pricing. We conduct credit assessment each time a new borrower requests a drawdown. A-Score is the result of the initial credit assessment performed on an applicant based on his/her credit profile, considering various factors such as financial condition, education, past credit history and social behaviors. Different from A-Score, B-Score is applied to existing borrowers on our platform with more than three months of borrowing history, by monitoring borrower behaviors, such as account, drawdown, repayment, among others. The B-Score replaces the A-Score for the purpose of future credit assessment and re-evaluation. The B-Score is reevaluated each time the borrower applies for a drawdown and at the end of each month. Given that we have high repeat borrower contribution, B-Score, reflecting the latest borrower behavior, plays a relatively more prominent role in our overall credit assessment process. Based on the B-Score assigned to borrowers, the system adjusts recommendation of their credit line both proactively and in response to the requests made by them. For a given borrower, the request for credit line adjustment can be done no more than once every three months. A typical 15% to 25% increase will be given to the credit line of the borrower if the underlying adjustment is approved. Real-time risk events monitoring Leveraging the expansive and complicated relational network of a borrower’s financial connections, Argus Engine can extract the most important information from the massive dataset and determine the borrower’s credit profile. When a borrower makes an online credit drawdown or application, we need to conduct real-time credit assessment, which necessitates the support of a powerful credit profiling engine. As of December 31, 2025, the real-time graph engine was in the fourth generation with more than 3.7 billion nodes and 232 billion edges. It provides more than 390 million online calculations daily, mapping first-degree connections in an average of 5 milliseconds, and second-degree connections in an average of 40 milliseconds. Backed by powerful computation, our real-time screening net can accurately identify risks from group fraud, multiple platform borrowing and default, among others. ​ 89 Table of Contents Collection We believe we optimize the collection process for delinquent loans based on the use of a C-Score we assign to each borrower in default using the Argus Engine. The C-Score processes data from historical collection efforts to automatically identify the most efficient channel for collection, including text messages, mobile app push notices, AI-initiated collection calls, human collection calls, emails or legal letters. We also outsource our collection to third-party collection service providers, particularly after 60 days of delinquency. To fulfill the compliance requirements, we have adopted and enforced comprehensive collection policies and procedures, including close monitoring of our third-party service providers, to ensure that all our collection practices, including in-house and third-party practices, are in compliance with current laws and regulations. First of all, all collection operations, either conducted by our in-house collection team or through third-party agencies, must be processed on our proprietarily developed online operation platform and call-out platform so that we are able to track and perform full-angle inspection on the collection practices. Secondly, all borrower data are subject to a desensitization procedure before they are used for collection. Our system enables a close-loop monitoring over the process of the collection exercise, from case categorization and the desensitization of delinquent borrowers’ information to the dispatch of delinquency information to the collection team or third-party collection agencies, as the case may be, and the collection call initiation. It ensures that only the necessary and minimum amount of desensitized data are being used for collection and that no data are able to be saved locally. Thirdly, all manual collection calls, either initiated by our in-house collection team or by third-party agents, are recorded and transmitted to our inspection system for an “AI + manual” dual inspection procedure, where our AI models will perform automatic, preliminary analysis on the content of the collection conversation against the rules that we set, identifying the expressions that are suspected to be deviating from our rules, and our inspection team will then further investigate the cases and provide improvement advice. Fourthly, we maintain real-time inspection on all collection operations. Our system constantly analyzes the real-time recording of the collection calls for potential defects or violations. Once a defect or violation is identified, a notice will be promptly sent to the on-site collection supervisor for intervention, so that we are able to proactively de-escalate the situation, prevent violative collections and deliver better user experience. Last but not least, we stipulate into each service agreements with our third-party agencies obligations of such agencies to abide by our policies, comply with laws and regulations, preserve confidentiality, refrain from using excessive or otherwise inappropriate measures. We have built an AI-powered collection and borrower service system based on automatic speech recognition, text-to-speech and natural language processing technologies. In 2025, the application of our AI-powered collection had handled 72% of our total collection volume. Our collection system can conduct automatic outbound calls in batches and interact with borrowers. We assess the appropriateness of AI-driven communication, and will adjust the approach and tone of the system, based on the risk level and the type of collection. This assessment is conducted automatically and we leverage the capability for all early-stage notification, contact confirmation and basic collection negotiations, while focusing our collection team on complicated collection cases, or other challenging interactions as identified by our system, to increase our operational efficiency and reduce our collection costs. In 2025, we maintained a 30-day collection rate of approximately 86.3%. Data And Privacy Protection We are dedicated to protecting users’ privacy, and we have implemented a data privacy and security system to ensure the security, confidentiality and integrity of data. We adopt policies to make sure we obtain users’ consent in collecting and using their data. We have promulgated a user privacy policy on our platform, setting forth our data use practices and privacy protection protocols. When a user registers an account via our app, he or she must read through and agree to the privacy agreement before the registration can be completed. Besides, in certain phases of the loan application process that involve data collection or usage, such as activating facial recognition function to facilitate credit assessment and transaction security, our users will be prompted again to read through and agree to separate authorization agreements on our data collection and use practices before they can proceed. We only use the user data for the stated purposes as authorized by the users of our app in connection with credit assessment and as otherwise required by applicable laws and regulations. All user data which we collected and generated from our operations in the PRC are stored in the PRC territory and the user data which we recognize as sensitive data are encrypted with the double encryption approach of data encryption and database encryption. We store user data in accordance with applicable laws and regulations, and we have adopted and implemented internal controls system and protocols focused on data security and personal information protection. Our core systems have all passed and been certified as the Level III Protection of the National Information System. We require all of our employees to comply with the protocols, respect the privacy of users, and protect their information. In addition, we limit our employees’ access to de-identified information and the output of such credit analysis only (except for key data security personnel whose access is subject to stringent internal approval) for purposes of mitigating the possibility of data leakage and avoiding unnecessary privacy invasion as much as possible. 90 Table of Contents With rigorous data privacy and security system, in June 2020, our fintech service application, Qifu Jietiao received both the app security certification and the app information security certification from the National Computer Virus Emergency Response Center, which is the official agency for anti-virus internet security and designated testing body for the “Special Crackdown on the Illegal Collection and Misuse of Personal Information by Apps” initiative by the Ministry of Public Security. In particular, Qifu Jietiao received a level 3 rating for both app privacy and data security, the highest level granted by the center. Given the ongoing regulatory environment, the certifications granted to us recognize our core competency in privacy protection and security technology and further solidify our competitive advantage in terms of regulatory compliance. Technology & Security We are a technology-driven company. The success of our business is dependent upon our technological capabilities, which deliver a superior user experience, protect information on our platform, increase operational efficiency and facilitate continued innovation. Our innovation efforts are driven by strong research and development and risk management teams, which accounted for 35.9% of our total employees, as of December 31, 2025. Principal components of our technology infrastructure include: ● Data science. Data science contributes to many elements of our business and operations, extending across an entire loan lifecycle. Our Argus Engine allows us to aggregate and assess thousands of data points to build a comprehensive profile for each user which guides fraud detection, credit assessment and general borrower behavior, useful in anticipating borrowers’ needs. Our Cosmic Cube Pricing Model then applies similar data science strategies in establishing pricing. Our workflow system CloudBank is capable of processing millions of transactions every day and integrates with our financial institution partners’ systems in loan disbursements, credit decisions, and payment clearances. We have also developed our network relationship database with tens of billions of connecting points for fraud detection purpose. The algorithms powering the majority of our decision systems iterate in real-time through machine learning, allowing us to promptly identify and correct operational issues. ● Artificial intelligence. We have identified specific applications for AI across our platform, notably around precision marketing, rapid underwriting and post-facilitation services. We consistently upgrade our capabilities through machine learning. For instance, our fraud detection and credit assessment capabilities are based on the self-learning of the Argus Engine, which consistently re-evaluates statistically significant variables and re-develops policies around borrower credit assessment. A key benefit of AI is the automation of many of our processes. We can generally process a credit application from submission through drawdown approval without material human intervention, and our internal preliminary credit assessment mostly only takes less than a minute in accordance with recent IT records, achieving massive operational efficiency. For example, our AI-powered voice system, which we utilize for the collection of delinquent loans, primarily conducting quality inspections on the recordings of collection calls, analyzing the effectiveness and content of completed collections and optimizing future communication strategies, has significantly reduced the need for collections staff, particularly those involved in quality inspection, and has empowered the remaining team to operate more efficiently and effectively. ● Security. We are committed to maintaining a secure online platform. Our focus on security provides operational benefits, as our reputation for data safety helps foster borrower trust and facilitates the collection of sensitive information. Key features of our security system are as follows: ● Our firewall monitors and controls incoming and outgoing traffic 24 hours per day, and the firewall is updated and trained periodically with mimic attacks from hackers to spot potential loopholes and protect our platform from malware, computer virus and hackings; ● Our server security is built upon a dedicated private cloud that provides both physical and virtual isolation. Combined with 24/7 firewall monitoring, regular penetration testing, least-privilege access control, encryption of data in transit and at rest, automated patch management, and real-time log alerting, it ensures a secure and reliable server environment; and ● All transmission of borrower information is encrypted. 91 Table of Contents We have also adopted a series of policies on internal controls over information systems and network access management. We maintain redundancy through a real-time multi-layer data backup system to prevent loss of data resulting from unforeseen circumstances. We conduct periodic reviews of our technology platform, identifying and correcting problems that may undermine our system security. ● Stability. Our servers run on a dedicated private cloud. Our system infrastructure is hosted in data centers at three separate locations in Beijing and Shanghai, and we maintain redundancy through a real-time multi-layer data backup system to ensure network reliability. We have established change management, segregation of duties, and continuous monitoring mechanisms to effectively reduce operational risks and ensure uninterrupted system operation. Our platform adopts a modular architecture consisting of multiple interconnected components, each of which can be independently upgraded or replaced without affecting the functioning of other components. This makes our platform both highly reliable and scalable. ● Scalability. With a modular architecture, our platform can be easily expanded as data storage requirements and user visits increase. In addition, load balancing technology helps us improve the distribution of workloads across multiple computing components, optimizing resource utilization and minimizing response time. Meanwhile, we have built our system in a partner-friendly approach as we provide flexible options to our partners regarding the scope of the data to be provided as well as how the data is provided. With such flexibility, we can cut a considerable amount of time and monetary cost in synchronizing the systems of ours and our partners’. For instance, it typically takes one to two weeks for us to develop our system access to a new partner’s system, which is a key selling point when prospective financial institution partners evaluate joining our platform. Marketing And Brand Awareness We primarily employ and implement variable online sales and marketing methods, supplemented with traditional promotional activities and general brand and awareness building. We focus on building brand awareness through online marketing campaigns, including cooperating with leading online platforms for directing user traffic to our business and boosting public relations as well as other offline advertising. We invest in a series of marketing activities to further solidify our brand image and continue to grow our user base, including collaborating with leading social media, video and live streaming platforms to extend our brand to a broader potential user group. Seasonality We experience seasonality in our business, mainly correlating to the seasonal fluctuations in internet usage and traditional personal behavior patterns in China. For example, individual borrowers generally reduce their borrowings during national holidays in China, particularly during the Chinese New Year holiday season in the first quarter of each year. Furthermore, when e-commerce platforms hold special promotional campaigns, for example, on November 11 and December 12 each year, we typically observe an increase in borrowing proceeds immediately following these campaigns. However, the seasonal trends that we have experienced in the past may not apply to, or be indicative of, our future operating results. Competition We primarily target the consumer Credit-Tech market, and compete for borrowers, financial institution partners and other third-party services with other Credit-Tech platforms with a similar market focus, which mainly include Credit-Tech platforms backed by large internet companies, and independent Credit-Tech platforms that operate standalone platforms without support from traditional financial institutions or large internet companies. As the macro and regulatory environment evolved in recent years, we have observed dynamic changes in the market landscape. In particular, the regulatory developments in 2025 have accelerated the reshaping of the competitive landscape. As regulatory compliance becomes increasingly important, we expect that smaller Credit-Tech platforms whose business models have historically relied on higher pricing, and lack the capabilities to maintain profitability under the tightened pricing environment, will come under increasing pressure. In an evolving landscape, platforms with robust compliance capabilities and established scale may be better positioned for a sustainable, long-term development. In addition, many leading internet and technology companies that possess large user bases, substantial financial resources and high frequency consumption platform entered the consumer Credit-Tech market in the past few years. However, many of them have since scaled back their effort in developing Credit-Tech business by themselves to optimize their strategic priorities. Instead, some leading internet and technology companies choose to partner with leading Credit-Tech platforms like us to help them better monetize their user base with comprehensive financing solutions. Such partnerships are the basis for “embedded finance.” 92 Table of Contents We believe that our deep understanding of users, robust credit assessment systems, effective user acquisition channels, user-friendly product designs, and broad and diversified funding sources form a substantial competitive advantage over many of our peers. Such competitive advantage, along with our consistent track record of solid execution, also in turn helps us gain trust from financial institutions and strengthen our relationship with business partners. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We face increasing competition, and if we do not compete effectively, our operating results could be harmed” for more information about the market where we operate and the competition we face. Intellectual Properties We regard our trademarks, domain names, software copyrights, know-how, proprietary technologies and similar intellectual property as critical to our success, and we rely on a combination of patent, copyright, trademark and trade secret laws in China, as well as licensing agreements and other contractual protections, to protect our proprietary technology. As of December 31, 2025, we had 388 registered trademarks and 135 trademarks pending approval in China, and 13 registered trademarks and 20 trademarks pending approval outside of China. As of the same date, we had 492 registered patents and 362 patents pending approval in China, and 8 patents pending approval outside of China. As of December 31, 2025, we had 153 registered software copyrights and nine copyrights of works in China. We are also the registered holder of 80 domain names in China and three domain names outside of China. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy or otherwise obtain and use our technology. Monitoring unauthorized use of our technology is difficult and costly, and we cannot be certain that the steps we have taken will prevent misappropriation of our technology. From time to time, we may have to resort to litigation to enforce our intellectual property rights, which could result in substantial costs and diversion of our resources. In addition, third parties may initiate litigation against us alleging infringement of their proprietary rights or declaring their non-infringement of our intellectual property rights. In the event of a successful claim of infringement and our failure or inability to develop non-infringing technology or license the infringed or similar technology on a timely basis, our business could be harmed. Even if we are able to license the infringed or similar technology, license fees could be substantial and may adversely affect our results of operations. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We may not be able to prevent others from unauthorized use of our intellectual property, which could harm our business and competitive position” and “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We may be subject to intellectual property infringement claims, which may be costly to defend and may disrupt our business and operations.” Regulation This section sets forth a summary of the most significant rules and regulations that affect our business activities in China or our shareholders’ rights to receive dividends and other distributions from us. Regulations on Foreign Investment Restrictions The Company Law and The PRC Foreign Investment Law Companies established and operating in the PRC shall be subject to the Company Law of the PRC, which was promulgated by the Standing Committee of the National People’s Congress on December 29, 1993, came into effect on July 1, 1994, and last revised on December 29, 2023 and became effective on July 1, 2024. The Company Law provides for the establishment, corporate structure and corporate management of companies, which also applies to foreign-invested enterprises in the PRC. Unless otherwise provided in the PRC foreign investment laws, the provisions in the Company Law shall prevail. The main amendments in the PRC Company Law involve improving the company’s establishment and exit system, optimizing the company’s organizational structure, detailing exercise of shareholder rights, perfecting the company’s capital system and strengthening the responsibilities of controlling shareholders and management personnel, among others. The PRC Company Law provides for the establishment, corporate structure and corporate management of companies, which also applies to foreign-invested enterprises. On March 15, 2019, the National People’s Congress approved the Foreign Investment Law, which came into effect on January 1, 2020, replaces the trio of existing laws regulating foreign investment in the PRC, namely, the Sino-Foreign Equity Joint Venture Enterprise Law, the Sino-Foreign Cooperative Joint Venture Enterprise Law and the Wholly Foreign-Invested Enterprise Law, and has become the legal foundation for foreign investment in the PRC. 93 Table of Contents The Foreign Investment Law sets out the basic regulatory framework for foreign investments and proposes to implement a system of pre-entry national treatment with a negative list for foreign investments, pursuant to which (i) foreign entities and individuals are prohibited from investing in the areas that are not open to foreign investments, (ii) foreign investments in the restricted industries must satisfy certain requirements under the law, and (iii) foreign investments in business sectors outside of the negative list will be treated equally with domestic investments. The Foreign Investment Law also sets forth necessary mechanisms to facilitate, protect and manage foreign investments and proposes to establish a foreign investment information report system, through which foreign investors are required to submit information relating to their investments to the Ministry of Commerce or its local branches. The Implementing Regulation for the Foreign Investment Law of the PRC (Decree No. 723 of the State Council), adopted at the 74th executive meeting of the State Council on December 12, 2019 and effective on January 1, 2020, provides implementing measures and detailed rules to ensure the effective implementation of the Foreign Investment Law. Regulations on foreign investment industries Pursuant to the Special Administrative Measures (Negative List) for the Access of Foreign Investment (2024), or the Negative List (2024), jointly promulgated by the NDRC and MOFCOM on September 6, 2024 and came into effect on November 1, 2024, limitations were stipulated for foreign investments in different industries in the PRC. The 2024 Negative List (2024) is further classified into “Catalog of Industries Limited for Foreign Investment” and “Catalog of Industries Prohibited for Foreign Investment”. Industries which do not fall within the “Special Management Measures (Negative List) for the Access of Foreign Investment” are industries permitted for foreign investment. On December 30, 2019, the Ministry of Commerce and the State Administration for Market Regulation jointly issued the Measures on Reporting of Foreign Investment Information, which replaced the existing filing and approval procedures regarding the establishment and change of foreign-invested companies with new procedures. On December 31, 2019, the Ministry of Commerce issued the Announcement on Matters Relating to Foreign Investment Information Reporting which emphasizes the information reporting requirements provided by the Measures on Reporting of Foreign Investment Information, and stipulates the forms for information reporting. Regulations on value-added telecommunications services The Telecommunications Regulations of the PRC issued by the PRC State Council in September 2000, as amended in February 2016, set out a regulatory framework for telecommunications service providers in the PRC. Under these regulations, telecommunications service providers are required to procure operating licenses for basic telecommunications services and licenses for value-added telecommunications services. In July 2017, the Ministry of Industry and Information Technology issued the Administrative Measures for the Telecommunications Business Operating Permit which took effect in September 2017 and invalidated the prior telecommunications permit measures issued in 2009. The Administrative Measures for the Telecommunications Business Operating Permit regulate that a commercial operator of value-added telecommunications services must first obtain the VATS License and conduct its business in accordance with the specifications listed in the license, thereby providing more detailed requirements and procedures for the value-added telecommunications services industry. In September 2000, the PRC State Council promulgated the Administrative Measures on Internet Information Services, which was amended in December 2024 and effective in January 2025. The Administrative Measures on Internet Information Services define “internet information services” as the services providing information through the internet to online users and further divide such services into “commercial internet information services” and “non-commercial internet information services.” internet content provider is considered as a sub-set of value-added telecommunications business. In accordance with the Administrative Measures on Internet Information Services, commercial internet information services operators must obtain a VATS License with the business scope of Internet information service, namely, the ICP License from competent government authorities before engaging in any commercial internet information services business in the PRC. The Provisions on the Administration of Foreign-Invested Telecommunications Enterprises, issued by the PRC State Council in December 2001 and amended in September 2008, February 2016 and March 2022, respectively, and the Circular on Lifting Restrictions on the Proportion of Foreign Equity in Online Data Processing and Transaction Processing Business (Operating E-commerce) issued by the Ministry of Industry and Information Technology on June 19, 2015, clarify that foreign-invested value-added telecommunications enterprises may only be Sino-foreign equity joint ventures, whose foreign equity ownership may not exceed 50%, except for online data processing and transaction processing businesses (operating e-commerce businesses) which may be wholly owned by foreign investors. Historically, foreign investors having equity ownership in those foreign-invested value-added telecommunications enterprises are required to have a good track record and operational experience in value-added telecommunications businesses. On March 29, 2022, the State Council promulgated the Decision of the State Council on Amending or Abolishing Certain Administrative Regulations, effective on May 1, 2022, which stipulate that the requirements of the aforementioned operational experience and good track record on foreign investors of a value-added telecommunications service provider are no longer required. 94 Table of Contents Additionally, in July 2006, the Ministry of Industry and Information Technology issued the Circular on Strengthening the Administration of Foreign Investment in and Operation of Value-added Telecommunications Businesses, which stipulates that foreign investors can only operate telecommunications businesses in China through telecommunications enterprises with valid telecommunications business operation licenses and prohibits a domestic company that holds a VATS License from leasing, transferring or selling such license to foreign investors in any form, and from providing any assistance, including providing resources, sites or facilities to foreign investors that conduct a value-added telecommunications business illegally in China. We provide Credit-Tech services for which a VATS License is required. Shanghai Qiyu, one of the VIEs, obtained its ICP License, a type of VATS License, in April 2021. The subsidiary of Shanghai Qiyu, Fuzhou Microcredit, obtained an ICP License in April 2023. Regulation on Online Finance Services Industry General regulations on internet finance service In July 2015, the Guidelines on Promoting the Healthy Growth of Internet Finance, were promulgated by ten PRC regulatory agencies, including the People’s Bank of China, the Ministry of Industry and Information Technology and the China Banking Regulatory Commission, or the CBRC, and provide the definition of “online lending.” Online lending under the guidelines includes peer-to-peer online lending, meaning the direct loans transacted through the internet between individual lenders and borrowers, and online micro-lending, meaning the small-sum loans transacted through the internet and offered by online micro-lending companies. In April 2016, the General Office of the PRC State Council issued the Implementing Proposal for the Special Rectification of Internet Financial Risk, which emphasizes the goal to ensure legitimacy and compliance of the internet finance service industry and specifies the rectification measures for non-compliance regarding the operations of internet finance business and by institutions engaged in the internet finance business. Regulations on private lending According to the PRC Civil Code, promulgated in May 2020 and effective on January 1, 2021, the interest rates charged under a loan agreement must not violate applicable provisions of the PRC laws and regulations. The PRC Civil Code also provides that the interest on a loan shall not be deducted from the principal in advance, and if the interest is deducted from the principal in advance, the loan shall be repaid and the interest shall be calculated according to the actual amount of loan provided. In August 2015, the Supreme People’s Court issued the Provisions on Several Issues Concerning Laws Applicable to Trials of Private Lending Cases, which took effect in September 2015 and most recently revised on December 29, 2020. The provisions define private lending as financing between and among individuals, legal entities and other organizations. They establish that private lending contracts are to be upheld as valid in the absence of (i) relending of funds to a borrower who knew or should have known that the funds were fraudulently obtained from a financial institution; (ii) relending of funds to a borrower who knew or should have known that the funds were borrowed from other enterprises or raised by the company’s employees; (iii) lending of funds to a borrower wherein the investor knew or should have known that the borrower intended to use the borrowed funds for illegal or criminal purposes; (iv) violations of public orders or good morals; or (v) violations of mandatory provisions of laws or administrative regulations. In addition, pursuant to the provisions, lending agreements between private lenders and borrowers with annual interest rates below 24% are valid and enforceable. As to the loans with annual interest rates between 24% (exclusive) and 36% (inclusive), if the interest on the loans has already been paid to the lender voluntarily, and so long as such payments have not damaged the interest of the state, the community and any third party, the People’s Court will turn down the borrower’s request to demand the return of the excess interest payments. If the annual interest rate of a private loan is higher than 36%, the agreement on the excess part of the interest is invalid, and if the borrower requests the lender to return the part of interest exceeding 36% of the annual interest that has been paid, the People’s Court will support such requests. In addition, on August 4, 2017, the Supreme People’s Court issued the Circular of Several Suggestions on Further Strengthening the Judicial Practice Regarding Financial Cases, which provides that (i) the claim of the borrower under a financial loan agreement to adjust or cut down the part of interest exceeding 24% per annum on the basis that the aggregate amount of interest, compound interest, default interest, liquidated damages and other fees collectively claimed by the lender is obviously high shall be supported by the PRC courts and (ii) in the context of internet finance disputes, if the online lending information intermediaries and the lender evade the maximum interest rate protected under the law by charging an intermediary fee, the lender’s claim shall be held as invalid. 95 Table of Contents On December 29, 2020, the Supreme People’s Court issued the Judicial Interpretation Amendment, which was revised on January 1, 2021 and amended several provisions of the 2015 Judicial Interpretation including the upper limit of judicial protection for private lending interest rates. The Judicial Interpretation Amendment provides that where the lender requests the borrower to pay interest in accordance with the interest rate agreed upon in the agreement, the People’s Court shall support such request, except where the interest rate agreed by both parties exceeds the Quadruple LPR Limit. The one-year Loan Prime Rate refers to the one-year loan market quoted interest rate issued by the National Bank Interbank Funding Center, an institution authorized by the People’s Bank of China, on the 20th of each month since August 20, 2019. According to the amendment, the upper limits of interest rates of 24% and 36% provided in the 2015 Judicial Interpretation, are replaced by the Quadruple LPR Limit. Moreover, if the lender and the borrower agree on both the overdue interest rate and the liquidated damages or other fees, the lender may choose to claim any or all of them, but the excess of the aggregate amount over the Quadruple LPR Limit shall not be supported by the People’s Court. On December 29, 2020, the Supreme People’s Court issued the Reply to Issues Concerning the Scope of Application of the New Judicial Interpretation on Private Lending, which clarifies that seven types of local financial organizations, including micro-lending companies, financing guarantee companies, regional equity markets, pawnshops, financing lease companies, commercial factoring companies and local asset management companies under the regulation of local financial regulatory authorities, are financial institutions established upon approval by financial regulatory authorities. The Judicial Interpretation Amendment is not applicable to disputes arising from foregoing organizations’ engagements in financial service businesses. Although the Judicial Interpretation Amendment and the Reply to Issues Concerning the Scope of Application of the New Judicial Interpretation on Private Lending provide that they do not apply to licensed financial institutions including micro-lending companies that conduct loan businesses, there are uncertainties in the interpretation and implementation of the Judicial Interpretation Amendment, including whether licensed financial institutions may be subject to it pursuant to under Circular 141 or in certain circumstances, the basis of the formula used to determine the interest rate limit, the scope of inclusion of related fees and insurance premiums and inconsistencies in the standard applied and enforcement actions taken by different PRC courts. On March 3, 2026, the National Financial Regulatory Administration and the People’s Bank of China promulgated the Provisions on Explicitly Disclosing Comprehensive Financing Costs for Personal Loan Business, which will take effect on August 1, 2026 and require that: (i) lenders and their cooperative partners must present a “Comprehensive Financing Cost Disclosure Table” to borrowers, which shall list all cost items including interest, installment fees, and credit enhancement fees, as well as penalty interest; (ii) for online loan facilitation, such disclosure must be made through a pop-up window with a mandatory reading time; and (iii) no fees other than those explicitly disclosed in the table shall be charged. Furthermore, the 2026 Disclosure Provisions emphasize the lenders’ responsibility to supervise their cooperative partners, including Credit-Tech platforms, to ensure full compliance with these disclosure requirements. We conduct loan facilitation services through our Credit-Tech platform. We charge service fees from financial institution partners for loans funded by them, and charge borrowers interest fees for loans funded by Fuzhou Microcredit, which is a subsidiary of the VIEs and is licensed to conduct micro-lending business in China. Our financial institution partners and Fuzhou Microcredit are permitted to charge interests for the loans they fund pursuant to PRC laws and regulations. Regulations on illegal fund-raising On January 26, 2021, the State Council promulgated the Regulation on the Prevention and Disposition of Illegal Fund-raising Practices which came into effect on May 1, 2021 and replaces the Measure for the Banning of Illegal Financial Institution and Illegal Financial Business Operations promulgated by PRC State Council in July 1998 and amended in 2011, which explicitly prohibits illegal public fund-raising. In accordance with the aforementioned regulations, the following description is deemed to detail the key features of illegal public fund-raising: (i) soliciting and raising funds from the general public by means of issuing stocks, bonds, lotteries or other securities without the required approval, (ii) promising or guaranteeing a return of interest or profits or investment returns in cash, properties or other forms, or (iii) using a legitimate form to disguise the unlawful purpose. In December 2010, the Supreme People’s Court promulgated the Judicial Interpretations to Issues Concerning Applications of Laws for Trial of Criminal Cases on Illegal Fund-Raising which was amended on March 1, 2022 and sets forth the criteria, criminal charges and the punishment on illegal fund-raising. We operate a Credit-Tech platform to facilitate loans between borrowers and our financial institution partners, and we do not fund the loans facilitated through our platform, other than the loans funded by Fuzhou Microcredit, a subsidiary of the VIEs licensed to conduct micro-lending business in China. We do not raise funds from our financial institution partners to provide loans to borrowers. 96 Table of Contents Regulations on the business of loan facilitation In April 2017, the P2P Online Lending Working Group issued the Notices on Cash Loans. The Notices on Cash Loans require the local branches of the P2P Online Lending Working Group to conduct a comprehensive review and inspection of the cash loan business on online lending platforms and require such platforms to take necessary improvements and remediation measures within a specific period of time to comply with the requirements under applicable PRC laws and regulations. The Notices on Cash Loans aim to eliminate non-compliance in the operations of online lending platforms, including fraudulent activities, loans with excessive interest rates, and forced loan collection practices. Notice on Regulating and Rectifying “Cash Loan” Business, or Circular 141, issued by the Special Rectification of Internet Financial Risks Working Group and the P2P Credit Risks Rectification Working Group on December 1, 2017, introduces the regulating guidance on cash loan businesses including online micro-lending companies, P2P platforms and banking financial institutions. According to Circular 141, activities offering cash loans, which are characterized by the lack of specific consumption scenarios, designated purposes, targeted users or mortgages, are subject to inspections and rectifications to prohibit excessive borrowing and granting credits repeatedly to individual borrowers, collecting interests at abnormally high interest rates and violating privacy. Circular 141 clarifies that no organization or individual shall start a loan business without the required qualifications and approved licenses. The synthetic fund cost charged by various institutions on borrowers in the form of interest rates and other fees must comply with the requirements of private lending by the Supreme People’s Court. The loan shall not be collected through violence, intimidation or insult. Circular 141 also sets out requirements and limitations for various entities involved in internet finance services and banking financial institutions involved in cash loan operations. Circular 141 further requires P2P lending information intermediaries not to outsource their core operations such as borrower information collection, borrower selection, credit evaluation and accounts opening. The banking financial institutions shall also comply with the regulations relating to cash loans, including: (i) not extending loan funded by its own capital and funding from unqualified institutions; (ii) not outsourcing credit review and approval, risk management or other core operations in the provision of credit services to third-party collaborators; including not accepting credit enhancement services, loss-bearing commitments or other credit enhancement services provided in a disguised form by any third party that does not have the qualifications to provide guarantees; (iii) making sure that the third party with which it cooperates will not charge any interests or fees from borrowers; and (iv) not directly investing or investing in a disguised form in asset-backed securitization products or other products backed by cash loans, campus loans or down payment loans. In addition, according to Circular 141, all the relevant local authorities should submit the regulation plan and monthly working progress to the Special Rectification of Internet Financial Risks Working Group and the P2P Credit Risks Rectification Working Group, which indicates gradual rectification for compliance with Circular 141 is allowed. The Interim Measures for Administration of Internet Loans Issued by Commercial Banks, promulgated by the China Banking and Insurance Regulatory Commission, came into effect on July 12, 2020 and was amended on June 21, 2021, which apply to the institutions cooperating with commercial banks to develop internet loan businesses and their existing business models. Pursuant to these measures, commercial banks shall evaluate their cooperating institutions and implement processes to manage these institutions. Commercial banks shall not accept direct and disguised credit enhancement services from unqualified cooperation agencies, nor entrust third-party agencies with records of violent collection or other illegal records to collect loans. The measures also provide that, except for cooperating institutions that contribute funding to the loans, commercial banks shall not completely delegate the cooperating institutions to perform core operations, such as loan disbursement, principal and interest collection, and stop payment. Pursuant to the measures, commercial banks shall independently carry out risk assessment and credit approval for the loans they fund, and shall bear primary responsibility for post-loan management. Regional banks that carry out Internet lending business shall mainly serve local customers, prudently conduct business across administrative regions of registration, and effectively identify and monitor the development of business across administrative regions of registration. As we operate a Credit-Tech platform and collaborate with financial institution partners in the loan lifecycle, pursuant to the measures, we shall not participate in the independent risk management and credit approval processes for the loans funded by commercial banks. We are not involved in financial institutions’ independent credit review and approval and risk management operations. We assist in financial institutions’ post-loan management as instructed or delegated by them and the financial institutions still bear the primary responsibility, among others, in compliance with the measures. 97 Table of Contents In accordance with the above measures, the Circular of the General Office of the China Banking and Insurance Regulatory Commission on Further Standardizing the Internet Loans Business of Commercial Banks was issued and took effect on February 19, 2021, setting detailed rules on strengthening risk management of the banking financial institutions and strictly controlling cross-regional operations. Furthermore, on July 12, 2022, the China Banking and Insurance Regulatory Commission issued the Notice on Strengthening the Management of Commercial Banks’ Internet Loan Business and Improving the Quality and Efficiency of Financial Services, which further requires commercial banks to: (i) effectively conduct security assessments on the cooperating institutions which provide and process personal information; (ii) strengthen loan fund management, take effective measures to monitor loan usage, ensure safety of the loan funds, and prevent cooperating institutions from intercepting, pooling, or misappropriating fund; (iii) standardize the Internet loan cooperation business with third-party institutions, and restrict or refuse to cooperate with those that are in violation of the regulations on Internet loans; and (iv) strengthen the protection of consumer rights and interests, strengthen the compliance management of the marketing and publicity behaviors of cooperating institutions, and clearly stipulate prohibited behaviors in the cooperation agreement. The Notice on Strengthening the Management of Commercial Banks’ Internet Loan Business and Improving the Quality and Efficiency of Financial Services mainly regulates the conducts of commercial banks. We will closely monitor the regulatory requirements, seek guidance from regulatory authorities and take applicable measures in a timely manner to maintain our cooperation with the commercial banks and ensure compliance with laws and regulations applicable to us. On January 30, 2024, the National Financial Regulatory Administration of the PRC issued the Administrative Measures for Fixed Asset Loans, the Administrative Measures for Working Capital Loans, and the Administrative Measures for Personal Loans, which took effect on July 1, 2024. The Administrative Measures for Personal Loans further require banks and other financial institutions to strengthen their own channel construction and independent risk control: (i) the lender shall not entrust the core matters of risk control in the loan investigation involving the borrower’s true intention, income level, debt situation, source of own funds and access to external evaluation institutions to a third party; (ii) the lender can interview the borrower through video according to business needs (excluding loans for personal housing purposes). The video interview shall be conducted on the lender’s own platform, and the image shall be recorded and saved; (iii) the lender shall require the borrower to sign the loan contract and other documents in person, or sign contracts and documents through electronic banking channels (excluding loans for personal housing purposes). The Administrative Measures for Personal Loans also regulate that where the China Banking and Insurance Regulatory Commission stipulates otherwise on other special types of loans such as Internet loans, such provisions shall prevail. In April 2025, the National Financial Regulatory Administration promulgated the Notice on Strengthening the Management of Internet Loan Facilitation Business of Commercial Banks and Improving the Quality and Efficiency of Financial Services. The notice primarily focuses on the following aspects: (i) the establishment of a “whitelist” management system for loan facilitation platforms requiring commercial banks to conduct comprehensive due diligence and continuous evaluation of their partners; (ii) the requirement that the comprehensive financing costs paid by borrowers for a single loan shall comply with the relevant provisions of the Supreme People’s Court, which in judicial practice effectively caps such costs at an annualized rate of 24%; and (iii) commercial banks shall terminate cooperation with agencies that fail to meet compliance standards or engage in improper collection practices. In addition, we have taken various measures to comply with Circular 141, the Interim Measures for Administration of Internet Loans Issued by Commercial Banks and other laws and regulations that are applicable to our loan facilitation business operations. For details about the various measures we have taken to comply with Circular 141, please refer to “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We are subject to uncertainties surrounding regulations and administrative measures of the loan facilitation business. If any of our business practices are deemed to be non-compliant with applicable laws and regulations, our business, financial condition and results of operations would be adversely affected.” Given that the laws and regulations governing the loan facilitation business are evolving, and substantial uncertainties exist with respect to their interpretation and implementation, we cannot assure you that our existing practices would not be challenged by governmental authorities under any existing or future rules, laws and regulations. See also “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We are subject to uncertainties surrounding regulations and administrative measures of the loan facilitation business. If any of our business practices are deemed to be non-compliant with applicable laws and regulations, our business, financial condition and results of operations would be adversely affected.” If institutions violate the aforementioned provisions, the regulatory authorities may impose business suspensions, compulsory enforcements or cancelation of business qualifications, or supervise the rectifications. If the circumstances are extremely serious, the business licenses of such institutions may be revoked. 98 Table of Contents Regulations on online lending information intermediaries In August 2016, the CBRC, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Internet Information Office jointly issued the Interim Lending Measures on Administration of Business Activities of Online Lending Information Intermediaries, which introduced online lending information intermediaries as financing information enterprises specifically engaged in the business of lending information intermediation services connecting investors and borrowers. Pursuant to that, online lending information service providers must complete registration with local financial regulatory departments, apply for appropriate telecommunication business licenses in accordance with the rules issued by competent telecommunication authorities and specify the “online lending information intermediary” in its business scope. In accordance with these measures, the CBRC, the Ministry of Industry and Information Technology and the State Administration for Industry and Commerce jointly issued the Circular on Printing and Distribution the Guidelines on the Filing-based Administration of the Online Lending Information Intermediaries in October 2016, setting forth the rules on the filing-based administrative regime of online lending information intermediaries which requires local financial regulators to register, publicize and archive the basic information of online lending information intermediaries within their respective jurisdictions. In November 2019, the Special Rectification of Internet Financial Risks Working Group and the P2P Credit Risks Rectification Working Group issued the Guiding Opinions on the Transformation of Online Lending Information Intermediaries into Pilot Micro-Lending Companies, or Circular 83. Circular 83 allows qualified online lending information intermediaries to transform into micro-lending companies in order to proactively deal with and resolve the existing business risks of online lending information intermediaries industry. The online lending information intermediaries to be transformed must comply with certain requirements including strong shareholder backgrounds and a registered capital of RMB50 million. Regulations on online marketing of financial products On April 24, 2026 the People’s Bank of China and seven other departments jointly issued the Measures for Administration of Online Marketing of Financial Products, which shall come into force on September 30, 2026. These measures clarify the rights and responsibilities boundaries between financial institutions and third-party online platforms. However, given the measures were recently promulgated, there are uncertainties as to their interpretation, application and enforcement. We will closely monitor the regulatory development and adjust our business operations from time to time to comply with laws and regulations applicable to us. See also “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—Our access to sufficient and sustainable funding at reasonable costs cannot be assured. If we fail to maintain collaboration with our financial institution partners or to maintain sufficient capacity to facilitate loans to borrowers, our reputation, results of operations and financial condition may be materially and adversely affected.” Regulations on microcredit business In May 2008, Guidance on the Pilot Establishment of Micro-Lending Companies was jointly promulgated by the CBRC and the People’s Bank of China, authorizing provincial governments to approve the establishment of micro-lending companies on a test basis. The establishment of a micro-lending company is subject to the approval of the competent government authority at the provincial level. The major sources of funds for a micro-lending company are limited to capital paid by shareholders, donated capital and capital borrowed from up to two financial institutions. Furthermore, the balance of the capital borrowed by a micro-lending company from financial institutions must not exceed 50% of the net capital of such micro-lending company. The interest rate and terms of the borrowed capital is required to be determined by the company with the banking financial institutions upon consultation, and the interest rate must be determined by using the Shanghai Inter-bank Offered Rate as the base rate. With respect to the grant of credit, micro-lending companies are required to adhere to the principle of “small sum and decentralization.” The outstanding balance of the loans granted by a micro-lending company to one borrower cannot exceed 5% of the net capital of such company. The interest ceiling used by a micro-lending company may be determined by such companies but in no circumstance shall they exceed the restrictions prescribed by the judicatory authority. The interest floor is 0.9 times the base interest rate published by the People’s Bank of China. Micro-lending companies have the flexibility to determine the specific interest rate within the range depending on certain market conditions. In addition, according to the aforementioned guidance, micro-lending companies are required to establish and improve their corporate governance structures, the loan management systems, the financial accounting systems, the asset classification systems, the provision systems for accurate asset classification and their information disclosure systems, and such companies are required to make adequate provisions for impairment losses. Micro-lending companies are also required to accept public scrutiny supervision and are prohibited from carrying out illegal fund-raising in any form. 99 Table of Contents In November 2017, the Online Finance Working Group issued the Notice on the Immediate Suspension of Approvals for the Establishment of Online Micro-Lending Companies, requiring all relevant regulatory authorities of micro-lending companies to suspend the approval of the establishment of any online micro-lending companies and the approval of any micro-lending business conducted across provinces. Circular 141 further confirms to suspend the approval of the establishment of online micro-lending companies and the approval of any micro-lending business across provinces and enhances the regulation of online micro-lending companies by stipulating that (i) the relevant regulatory authorities must suspend the approval for the establishment of any new online micro-lending companies and the conduct of offline business of any micro-lending companies across provinces (districts or cities); (ii) online micro-lending companies must not extend loans to any borrowers without income, such as students; (iii) online micro-lending companies must suspend the funding of online micro-lending with no specific consumption scenarios or specified uses of loan proceeds, and gradually reduce the volume of the existing business relating to such loans and take rectification measures in a period to be specified by authorities. On December 8, 2017, the P2P Credit Risks Rectification Working Group promulgated the Implementation Plan of Specific Rectification for Risks in Micro-Lending Companies Conducting Online Micro-Lending Business, or Circular 56. Pursuant to Circular 56, “online micro-lending” is defined as micro-lending provided through the internet by online micro-lending companies. Circular 56 emphasizes several material aspects subject to inspection and rectification, which include but not limited to (i) online micro-lending companies must be approved by the competent authorities in accordance with the applicable regulations promulgated by the State Council, and approved online micro-lending companies that operate in violation of any regulatory requirements must be re-examined; (ii) whether the qualification and funding source of the shareholders of online micro-lending companies are in compliance with the applicable laws and regulations; (iii) whether the “integrated actual interest” (namely, the aggregated costs of borrowing charged to borrowers in the form of interest and various fees) are annualized and subject to the limit on interest rates of private lending set forth in the Provisions on Several Issues Concerning Laws Applicable to Trials of Private Lending Cases and, whether any interest, handling fee, management fee or deposit are deducted from the principal of loans provided to the borrowers in advance; (iv) whether campus loans, or online micro-lending with no specific scenario or designated use of loan proceeds are granted; (v) with respect to the loan business conducted in collaboration with third-party institutions, whether micro-lending companies cooperate with internet platform without website filing or telecommunications business license to provide online micro-lending, whether the online micro-lending companies outsource their core business (including the credit assessment and risk management), or accept any credit enhancement service provided by any third-party institutions with no guarantee qualification; or whether any applicable third-party institution collects any interest or fee from the borrowers; and (vi) whether there are any entities conducting online micro-lending business without the approval or license for lending business. On December 31, 2024, National Financial Regulatory Administration of the PRC issued the Interim Administrative Measures for Micro-Lending Companies, which aims to regulate the operation of micro-lending companies, prevent and resolve relevant risks and promote the healthy growth of micro-lending companies. The measures impose requirements on micro-lending companies, including, without limitation, (i) micro-lending companies engaging in micro-lending business shall be approved by the provincial local financial regulatory administration institutions; (ii) the financing balance of the micro-lending company funding by bank loans, shareholder loans and other nonstandard financing instruments shall not exceed its net assets at the end of the previous year; (iii) the financing balance of the micro-lending company funding by issuance of bonds, asset securitization products and other instruments of standardized debt assets shall not exceed four times of its net assets at the end of the previous year; (iv) the balance of loans offered to one borrower shall not exceed 10% of the net assets of the micro-lending company at the end of the previous year, and the balance of loans offered to one borrower and such borrower’s related parties shall not exceed 15% of the net assets of the micro-lending company at the end of the previous year; (v) the balance of loans to one borrower for consumption shall not exceed RMB200,000, and the balance of loans to one borrower for production and business shall not exceed RMB10 million; (vi) micro-lending companies shall conduct business in the administrative area at the county level where the company is domiciled in principle, except as otherwise provided for the operation of online micro-lending business; and (vii) the micro-lending companies and third-party loan collection agencies entrusted shall not collect loans by violence, threats of violence, or other ways that intentionally cause harm, infringe personal freedom, illegally occupy property, or interfere with day-to-day life through insulting, slandering, harassing, or disseminating private personal information, or other illegal methods. 100 Table of Contents On November 2, 2020, the China Banking and Insurance Regulatory Commission and the People’s Bank of China published the Interim Measures for the Administration of Online Micro-Lending Business (Draft for Comments), adding new requirements on Online Micro-Lending Business. In particular, the draft interim measures, among other things, strengthens the legal approval, license and access conditions of online micro-lending business. Pursuant to the draft interim measures, to the extent a micro-lending company engages in online micro-lending business, the said business shall mainly be carried out within the provincial-level administrative region to which its place of registration belongs, and shall be not operated beyond such region without the approval of the banking regulator under the State Council. The draft interim measures provide the following requirements with respect to micro-lending companies that engage in online micro-lending business, including, without limitation; the registered capital of a micro-lending company which engages in online micro-lending business shall not be less than RMB1 billion and shall be paid in lump-sum in the form of cash; the registered capital of a micro-lending company which engages in online micro-lending business across provincial-level administrative regions shall not be less than RMB5 billion and shall be paid in lump-sum in the form of cash; and the capital contribution of a micro-lending company’s controlling shareholder shall not be higher than 35% of its net assets in the previous fiscal year. The draft interim measures also provide that the controlling shareholder of a micro-lending company which engages in online micro-lending business shall have a good financial position and be profitable consecutively in the last two fiscal years while having cumulative tax liabilities of not less than RMB12 million (as per the standard of consolidated accounting statement). In addition, an investor, its related parties and persons acting in concert shall not be the major shareholders of more than two micro-lending companies that engage in online micro-lending business across provincial level administrative regions, or hold controlling interests in more than one micro-lending company that engage in online micro-lending business across provincial-level administrative regions. Fuzhou Microcredit complies with such requirement. On December 19, 2025, the People’s Bank of China and the National Financial Regulatory Administration further issued the Guidelines on the Management of Comprehensive Financing Costs of Micro-lending Companies. The guidelines impose requirements on micro-lending companies, including: (i) prohibition on the issuance of new loans with comprehensive financing costs exceeding an annualized rate of 24%; (ii) a requirement that by the end of 2026, the proportion of newly issued loans with comprehensive financing costs exceeding the Quadruple LPR Limit shall decline significantly, and in principle, by the end of 2027, the comprehensive financing costs of all new loans issued by micro-lending companies shall be reduced to within the Quadruple LPR Limit. We operate online micro - lending business through one of the subsidiaries of the VIEs, Fuzhou Microcredit, which is approved by the local government authority to conduct micro - lending business in China. Fuzhou Microcredit has obtained the approval from a competent supervising authority to operate online micro-lending business. Currently, Fuzhou Microcredit can conduct cross-province business with its valid license. As of the date of this annual report, the draft interim measures are yet to be formally promulgated and adopted and it is uncertain when the final regulations will be issued and take effect and how they will be enacted, interpreted and implemented. If the draft interim measures take effect in its current form, Fuzhou Microcredit may need to obtain the legal approval of the banking regulator under the State Council in order to engage in online micro-lending business across provincial-level administrative regions. As of the date of this annual report, Fuzhou Microcredit has increased its registered capital to RMB5 billion, which has been fully paid, to meet the requirements as stated in the draft interim measures and would proactively apply for the license to engage in online micro-lending business across provincial-level administrative regions when the relevant rules are officially formulated. If we fail to obtain the license to engage in online micro-lending business across provincial-level administrative regions, we may not be able to obtain sufficient funding to fulfill our future growth needs. As the regulatory regime and practice with respect to online micro-lending companies are evolving, there is uncertainty as to how the requirements in the above rules will be interpreted and implemented and whether there will be new rules issued which would establish further requirements and restrictions on online micro-lending companies. We will closely monitor the regulatory development and adjust our business operations from time to time to comply with laws and regulations applicable to us. See also “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We are subject to uncertainties surrounding regulations and administrative measures of micro-lending business and financing guarantee business. If any of our business practices are deemed to be non-compliant with such laws and regulations, our business, financial condition and results of operations would be adversely affected.” Regulations on Financing Guarantee In March 2010, seven government authorities, including the CBRC, the Ministry of Commerce and the Ministry of Finance, promulgated the Interim Administrative Measures for Financing Guarantee Companies which require an entity or individual to obtain a prior approval from the government authorities before engaging in the financing guarantee business. Financing guarantee is defined as an activity whereby the guarantor and the creditor, such as a financial institution in the banking sector, agree that the guarantor shall bear the guarantee obligations in the event that the secured party fails to perform its financing debt owed to the creditor. 101 Table of Contents On August 2, 2017, the PRC State Council promulgated the Regulations on the Supervision and Administration of Financing Guarantee Companies, which became effective on October 1, 2017. The Regulations on the Supervision and Administration of Financing Guarantee Companies define “financing guarantee” as a guarantee provided for the debt financing, including, but not limited to the extension of loans or issuance of bonds, and set out that the establishment of a financing guarantee company or engagement in the financing guarantee business without approval may result in several penalties, including, but not limited to an order to cease business operation, confiscation of illegal gains, fines of up to RMB1,000,000 and criminal liabilities. The Regulations on the Supervision and Administration of Financing Guarantee Companies also provide that the outstanding guarantee liabilities of a financing guarantee company shall not exceed ten times of its net assets, and that the ratio of the balance amount of outstanding guarantee liabilities of a financing guarantee company for the same guaranteed party shall not exceed 10%, while the ratio of the balance amount of outstanding guarantee liabilities of a financing guarantee company for the same guaranteed party and its affiliated parties shall not exceed 15%. On October 9, 2019, nine government authorities including the China Banking and Insurance Regulatory Commission, the NDRC and the Ministry of Industry and Information Technology promulgated the Supplementary Financing Guarantee Provisions, which, as advised by our PRC legal counsel, for the first time, explicitly require that institutions providing services of customer recommendation and credit assessment to various lending institutions, including us as a Credit-Tech company, shall not provide, directly or in a disguised form, financing guarantee services without the approvals of relevant government authorities. For the companies that do not have the financing guarantee licenses but engage in the financing guarantee business, the regulatory authorities shall suspend such operations and cause these companies to properly settle the existing business contracts. On July 14, 2020, the China Banking and Insurance Regulatory Commission issued the Guidelines for Off-Site Supervision of Financing Guarantee Companies, which took effect on September 1, 2020. The guidelines stipulate the guidelines for the competent regulatory authorities to continually analyze and evaluate the risk of financing guarantee companies and the financing guarantee industry, by way of collecting report data and other internal and external data of the financing guarantee companies and by carrying out corresponding measures. Pursuant to these guidelines, financing guarantee companies shall establish and implement an off-site supervision information report system and submit related data and non-data information in accordance with the requirements of the competent regulatory authorities. The guidelines note that the corporate governance, internal control, risk management capabilities, guarantee business, associated guarantee risks, asset quality, liquidity indicators and investment conditions of financing guarantee companies shall be the key areas subject to off-site supervisions. On December 31, 2021, the People’s Bank of China issued the Regulations on Local Financial Supervision and Administration (Draft for Comments), which regulate all types of local financial organizations including financing guarantee companies. Pursuant to the regulations, local financial organizations are required to operate business within the area approved by the local financial regulatory authority, and are not allowed to conduct business across provinces in principle. The rules for cross-province business carried out by local financial organizations shall be formulated by the State Council or by the financial regulatory department of the State Council as authorized by the State Council. The financial regulatory department of the State Council will specify a transition period for local financial organizations that have carried out businesses across provincial administrative regions to maintain compliance. Fuzhou Financing Guarantee, through which we provide guarantee services to our financial institution partners, has obtained the financing guarantee certificate granted by competent government authorities to conduct financing guarantee business in June 2018. Shanghai Financing Guarantee (before its financing guarantee license was canceled upon its voluntary application), through which we provided guarantee services to our financial institution partners, obtained the financing guarantee certificate granted by competent government authorities to conduct financing guarantee business in January 2019. Shanghai Financing Guarantee applied, and permission was granted by the PRC authority, to have its financing guarantee certificate canceled, and such certificate had been returned to the PRC authority for cancellation. If the Regulations on Local Financial Supervision and Administration (Draft for Comments) were to be adopted in its current form, Fuzhou Financing Guarantee may need to obtain the legal approval of the financial regulatory department of the State Council in order to engage in Financing Guarantee business across provincial-level administrative regions. However, given the Regulations on Local Financial Supervision and Administration (Draft for Comments) have not come into effect as of the date of this annual report, there are uncertainties as to their interpretation, application and enforcement. We will closely monitor the legislative process, seek guidance from regulatory authorities and take applicable measures in a timely manner to ensure our compliance with laws and regulations applicable to us. See also “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We are subject to uncertainties surrounding regulations and administrative measures of micro-lending business and financing guarantee business. If any of our business practices are deemed to be non-compliant with such laws and regulations, our business, financial condition and results of operations would be adversely affected.” 102 Table of Contents Regulations On Credit Reporting Business The PRC government has adopted several regulations governing personal and enterprise credit reporting businesses. These regulations include the Regulation for the Administration of Credit Reporting Industry, enacted by the State Council and effective in March 2013, and the Management Rules on Credit Agencies, issued by the People’s Bank of China, in the same year. The Regulation for the Administration of Credit Reporting Industry defines “credit reporting business” and “credit reporting agency” for the first time. According to the Regulation for the Administration of Credit Reporting Industry, “credit reporting business” means the activities of collecting, organizing, storing and processing “credit-related information” of individuals and enterprises, as well as providing such information to others, and a “credit reporting agency” refers to a duly established agency whose primary business is credit reporting. Besides, the Regulation for the Administration of Credit Reporting Industry and the Management Rules on Credit Agencies stipulate that the establishment of a credit reporting agency to engage in individual credit reporting business shall be subject to the approval of the People’s Bank of China, and the requirements for such establishment. Such requirements include: (i) the credit reporting agency’s major shareholders shall have a good reputation and do not have any record of major violation of law or non-compliance in the past three years; (ii) the credit reporting agency’s registered capital shall not be less than RMB50 million; (iii) the credit reporting agency shall have facilities, equipment, systems and measures in place for the protection of information security which comply with the provisions of the People’s Bank of China; (iv) the candidates for the credit reporting agency’s director, supervisor and senior management positions shall be familiar with laws and regulations relating to credit reporting business, shall possess the work experience and management capabilities in the credit reporting business required for performance of their duties, shall not have any record of major violation or non-compliance during the past three years, and shall have obtained the appointment qualifications approved by the People’s Bank of China; (v) the credit reporting agency shall have a proper organizational structure; (vi) the credit reporting agency shall have proper internal control systems for, among others, business operation, information security management and compliance management; (vii) the credit reporting agency’s individual credit information system shall satisfy the standard of National Information System Security Level Protection Level 2 or above; and (viii) the credit reporting agency shall satisfy any other prudential requirements of the People’s Bank of China. Establishment of a credit reporting agency to engage in enterprise credit reporting business shall complete filing with the responsible branch of the People’s Bank of China. To complete the filing, a company must submit to the People’s Bank of China (i) its business license; (ii) an explanation on equity structure and organization structure; (iii) a description of its scope of business, business rules and basic information on business system; and (iv) its information security and risk prevention measures. Entities engaged in individual/enterprise credit reporting business without such approval/completing filing formality may be subject to fine or criminal liabilities. Given that the People’s Bank of China is a subordinate authority under the State Council, the Management Rules on Credit Agencies enacted by the People’s Bank of China is based on the Regulation for the Administration of Credit Reporting Industry, and further details the rules with respect to the administration for credit reporting agencies, including rules to establish, change and deregister a credit reporting agency and the rules for the daily operation of a credit reporting agency. On September 27, 2021, the People’s Bank of China issued the Credit Reporting Measures, effective on January 1, 2022. The measures define “credit information” to include “basic information, borrowing and lending information and other relevant information collected pursuant to the law to provide services for financial and other activities for identifying and judging the credit standing of businesses and individuals, as well as analysis and evaluation formed based on the aforesaid information.” They apply to entities that carry out credit reporting business and “activities relating to credit reporting business” in China. Separately, entities providing “services with credit reporting function” in the name of “credit information service, credit service, credit evaluation, credit rating, credit repair and other services” are also subject to the Credit Reporting Measures. The measures require that whoever engages in personal credit reporting business shall obtain permit from the People’s Bank of China’s personal credit reporting agency and whoever engages in enterprise credit reporting business shall complete filing formalities pursuant to the law; and whoever engages in credit rating business shall complete filings as a credit rating agency pursuant to the law. The Credit Reporting Measures provide rules on credit reporting business and credit reporting agencies, including that (i) the credit reporting agencies shall collect credit information following the “minimum and necessary” principle and must not collect, compile, store and process credit information by unlawful means, and must not alter original data, (ii) information user shall not abuse credit information, and the credit reporting agencies shall comply with business rules when they provide credit information for credit inquiry, credit evaluation, credit rating and anti-fraud services, (iii) credit reporting agencies shall take measures to ensure the credit information security, and establish an emergency and report system for incidents, and (iv) credit reporting agencies shall comply with related laws and regulations when providing credit information to overseas. The measures provide an 18-month grace period from their effectiveness date for organizations that engage in credit reporting business to obtain the credit reporting business license and comply with its other provisions. 103 Table of Contents In addition, on July 7, 2021, the Credit Information System Bureau of People’s Bank of China further issued the Notice Relating to Disconnecting Direct Connection to 13 internet platforms including us, requiring the internet platforms to achieve a complete “disconnected direct connection” in terms of personal information with financial institutions, meaning that the direct flow of personal information from internet platforms that collect such information to financial institutions is prohibited. Historically, we provided preliminary credit assessment assistance directly to financial institution partners which mainly depended on the evaluation of information regarding personal credit status. Such practice may be deemed as engaging in credit reporting business or credit reporting function services by the PRC authorities. To ensure compliance, we have involved three licensed credit reporting institutions and have substantially completed our business adjustments with respect to disconnecting direct connection for credit reporting as of the date of this annual report. In particular, we have entered into collaboration agreements with three licensed credit reporting institutions to ensure the flow of personal information complies with the requirements of the Credit Reporting Measures and the Notice Relating to Disconnecting Direct Connection. We will closely monitor the regulatory requirements, seek guidance from regulatory authorities and take applicable measures in a timely manner to ensure our compliance with laws and regulations applicable to us. Regulations on Consumer Protections The Law on Protection of Consumers’ Rights and Interests of the PRC, or the Consumer Protection Law, which was promulgated by the Standing Committee of the National People’s Congress on October 31, 1993 and last amended on October 25, 2013 and effective from March 15, 2014, sets out the obligations of business operators and the rights and interests of the consumers. Business operators must guarantee the quality, function, usage and term of validity of the goods or services they sell or provide. The consumers whose interests have been damaged due to their purchase of goods or acceptance of services on online platforms may claim damages from the sellers or service providers. Online platform operators may be subject to liabilities if the lawful rights and interests of consumers are infringed in connection with consumers’ purchase of goods or acceptance of services on online platforms, and the platform operators fail to provide consumers with authentic contact information of the sellers or service providers. In addition, platform operators may be jointly and severally liable with the sellers and service providers if they are aware or should be aware that the sellers or the service providers are using the online platform to infringe upon the lawful rights and interests of consumers and fail to take measures necessary to prevent or stop this activity. The Consumer Protection Law also provides principles of legality, appropriateness and necessity for collecting or using consumers’ personal data. In particular, businesses operators should disclose the purposes, methods and scopes of collecting and using personal data and obtain consumers’ consent. Business operators should also disclose the terms for its data collection and use and should not collect or use information in violation of laws, regulations or agreements with consumers. Businesses operators should maintain confidentiality of the personal data collected from consumers and should not leak or sell personal data and should not provide personal data in violation of laws to third parties. They should also adopt technical and other necessary measures to ensure security of personal data, and to safeguard against information leak and loss. In case of information leak or loss, remedial measures should be taken by the business operators. On December 12, 2022, the China Banking and Insurance Regulatory Commission issued the Measures for the Administration of the Protection of Consumer Rights and Interests by Banking and Insurance Institutions, which came into effect on March 1, 2023. These measures mainly require banking and insurance institutions to establish and improve systems and mechanisms for the protection of consumers’ rights and interests, including mechanisms for review, disclosure, consumer appropriateness management, traceability of sales practices, protection of consumers’ information, list-based management of partners and complaint processing, among others. These measures further require banking and insurance institutions: (i) to establish a list-based management mechanism for their partners, set the access and exit standards for partners for cooperation matters involving consumers’ rights and interests, and strengthen the continuous management of partners. The cooperation agreement shall specify the responsibilities and obligations of both parties concerning the protection of consumers’ rights and interests, including, but not limited to information security control, service price management, service continuity, information disclosure, dispute resolution mechanism, assumption of liability for breaches of contract and emergency response; (ii) not to allow a third-party partner to promote or sell products and services to consumers in the name of the banking or insurance institution at its business outlets or on the network platforms that it operates itself; (iii) to handle the personal information of consumers together with their partners on the basis of the authorization and consent of consumers, and the cooperation agreement shall stipulate clauses on data protection responsibility, confidentiality obligation, default liability, contract termination and emergency response; and (iv) to urge and regulate the Internet platform enterprises cooperating with them to protect the personal information of consumers effectively, and the personal information of consumers shall not be transmitted between different platforms without the consent of consumers, unless otherwise stipulated by laws and regulations. There are uncertainties with respect to the application and enforcement of the newly published measures. We will closely monitor the regulatory development and adjust our business operations from time to time to comply with the regulations over the course of our cooperation with banking institutions. 104 Table of Contents On March 15, 2024, the State Council promulgated the Implementation Regulations on the PRC Consumer Rights and Interests Protection Law, which took effect on July 1, 2024. These implementation regulations refine and supplement the provisions on operator obligations, and improve the provisions related to the online consumption. For example, (i) operators shall not use standard clauses to unreasonably exempt or reduce their liabilities, aggravate consumers’ liabilities, or restrict consumers’ rights to change or terminate contracts in accordance with the law, choose litigation or arbitration to resolve disputes, or choose goods or services from other operators; (ii) operators shall not excessively collect consumers’ personal information, and shall not force or covertly force consumers to consent to the collection and use of personal information that is not directly related to business activities by means of a general authorization, default authorization, or other methods; (iii) without the consent of consumers, operators shall not send commercial information or make commercial phone calls to consumers; if consumers agree to receive such information or calls, operators shall provide clear and convenient cancellation methods; if consumers choose to cancel, operators shall immediately stop sending such information or making such calls; and (iv) operators shall use an easy-to-understand method to provide consumers with information related to goods or services truly and comprehensively, and shall not set different prices or charging standards for the same goods or services under the same conditions without the knowledge of consumers. Regulations on Issuances of Asset-Backed Securities According to the Administrative Measures on Asset Securitization of Securities Companies and Subsidiaries of Fund Management Companies and their supportive documents, Guidelines for Securities Companies and Subsidiaries of Fund Management Companies on Asset Securitization and Guidelines for Securities Companies and Subsidiaries of Fund Management Companies on Due Diligence for Asset Securitization all of which were adopted by the CSRC on November 19, 2014, asset securitization shall mean business activities of issuance of asset-backed securities paid and supported by cash flows generated by the underlying assets, and credit enhancement through structuring, among others. Underlying assets broadly refer to property rights such as an enterprise’s accounts receivable, creditor’s rights under a lease, credit assets and beneficial rights to a trust, immovable property or usufruct such as infrastructure and commercial properties, and other properties or property rights recognized by the CSRC. The assets of the ABS plan shall be placed under custody of a commercial bank with the appropriate business qualifications, or an asset custodian organization recognized by the CSRC. The issuer (originator) shall not encroach upon or cause damage to the underlying assets, and shall perform the following duties: (i) transfer underlying assets pursuant to the provisions of laws, administrative regulations, the company’s articles of association and the relevant agreement; (ii) cooperate with and support performance of duties by the manager, custodian and any other organization providing services for asset securitization; and (iii) any other duties agreed in the legal documents of the ABS plan. Regulations on Anti-Money Laundering The PRC Anti-Money Laundering Law, initially issued by the Standing Committee of the National People’s Congress in October 2006 and last amended on November 8, 2024 with effect on January 1, 2025, sets forth the principal anti-money laundering requirements applicable to financial institutions as well as non-financial institutions with anti-money laundering obligations, including the adoption of precautionary and supervisory measures, the establishment of various systems for client identification, the retention of clients’ identification information and transactions records, and the reporting obligation on material transactions and suspicious transactions. The People’s Bank of China and other government authorities issued a series of administrative rules and regulations to specify the anti-money laundering obligations of financial institutions and certain non-financial institutions. The Guidelines on Promoting the Healthy Growth of Internet Finance clarify, among other things, internet financial service provider requirements to comply with certain anti-money laundering provisions, including the establishment of a customer identification program, the monitoring and reporting of suspicious transactions, the preservation of customer information and transaction records, and the provision of assistance to the public security department and judicial authority in investigations and proceedings in relation to anti-money laundering matters. The People’s Bank of China will formulate implementing rules to further specify the anti-money laundering obligations of internet financial service providers. On September 29, 2018, the People’s Bank of China, the China Banking and Insurance Regulatory Commission and the CSRC jointly promulgated the Administrative Measures for Anti-money Laundering and Counter-terrorism Financing by Internet Finance Service Agencies (for Trial Implementation), effective as of January 1, 2019, which specify the anti-money laundering obligations of internet finance service agencies and regulate that the internet finance service agencies (i) shall adopt continuous customer identification measures; (ii) shall implement the system for reporting large-value or suspicious transactions; (iii) shall conduct real-time monitoring of the lists of terrorist organizations and terrorists; and (iv) shall properly keep the information, data and materials such as customer identification and transaction reports, among others. 105 Table of Contents Pursuant with the aforementioned regulations, we have implemented various policies and procedures, such as internal controls and “know-your-customer” procedures, for anti-money laundering purposes. However, our policies and procedures may not be completely effective in preventing other parties from using us for money laundering without our knowledge. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—If our financial institution partners fail to comply with applicable anti-money laundering and anti-terrorist financing laws and regulations, our business and results of operations could be materially and adversely affected.” Regulations on Anti-monopoly The Anti-Monopoly Law promulgated by the Standing Committee of the National People’s Congress on August 30, 2007, which became effective on August 1, 2008 and was amended on June 24, 2022, and the Provisions on the Review of Concentrations of Undertakings promulgated by the State Administration for Market Regulation on March 10, 2023, which became effective on April 15, 2023 require that transactions which are deemed concentrations and involve parties with specified turnover thresholds must be cleared by the State Administration for Market Regulation before they can be completed. Where the participation in concentration of undertakings by way of foreign-funded merger and acquisition of domestic enterprises or any other method which involves national security, the examination of concentration of undertakings shall be carried out pursuant to the provisions of this law and examination of national security shall be carried out pursuant to the provisions of the State. The revised Anti-monopoly Law provides, among others, that business operators shall not use data, algorithms, technology, capital advantages and platform rules to exclude or limit competition, and also requires government authorities to strengthen the examination of concentration of undertakings in areas related to national welfare and people’s well-being, and enhances penalties for violation of the regulations regarding concentration of undertakings. On February 7, 2021, the Anti-monopoly Commission of the State Council issued the Anti-Monopoly Guidelines for the Internet Platform Economy Sector, which specifies that any concentration of undertakings involving variable interest entities (VIE structure) shall fall within the scope of anti-monopoly review. If a concentration of undertakings meets the criteria for declaration as stipulated by the State Council, an operator shall report such concentration of undertakings to the anti-monopoly law enforcement agency under the State Council in advance. Regulations on Information Security and Privacy Protection On June 22, 2007, the Ministry of Public Security, National Administration of State Secrets Protection and other governmental authorities issued the Administrative Measures for the Graded Protection of Information Security, which regulates that the security protection of an information system may be graded into five. For a newly built information system of Grade II or above, its operator or user shall, within 30 days after it is put into operation, complete the record filing procedures at the local public security organ at the level of municipality divided into districts or above. In recent years, PRC government authorities have enacted laws and regulations on internet use to protect personal information from any unauthorized disclosure. Under the Several Provisions on Regulating the Market Order of Internet Information Services, issued by the Ministry of Industry and Information Technology in December 2011 and effective as of March 2012, an internet information service provider may not collect any user personal information or provide any such information to third parties without the specific consent of the user. An internet information service provider must expressly inform the users of the method, content and purpose of the collection and processing of such user personal information, and may only collect such information necessary for the provision of its services. In addition, pursuant to the Decision on Strengthening the Protection of Online Information issued by the Standing Committee of the National People’s Congress in December 2012, which seeks to enhance the legal protection of information security and privacy on the internet, and the Order for the Protection of Telecommunication and Internet User Personal Information issued by the Ministry of Industry and Information Technology in July 2013, which regulates the collection and use of users’ personal information in the provision of telecommunications services and internet information services in China, any collection and use of user personal information must be subject to the consent of the user, abide by the principles of legality, rationality and necessity and be within the specified purposes, methods and scopes. The State Internet Information Office issued the Administrative Provisions on Mobile Internet App Information Services in June 2016, effective on August 2016 and amended on June 14, 2022, to implement the regulations of the mobile app information services. The provisions regulate the APP information service providers and the Internet application store service providers, while the CAC and local offices of cyberspace administration shall be responsible for the supervision and administration of nationwide or local APP information respectively. The APP information service providers shall acquire qualifications required by laws and regulations and implement the information security management responsibilities strictly and fulfill their obligations provided by the provisions. 106 Table of Contents In addition, the Guidelines on Promoting the Healthy Growth of Internet Finance require internet financial service providers, including Credit-Tech service providers, among other things, to improve technology security standards, and safeguard customer and transaction information. They also prohibit Credit-Tech service providers from illegally selling or disclosing customers’ personal information. The People’s Bank of China and other regulatory authorities will jointly adopt the implementing rules and technology security standards. Pursuant to the Ninth Amendment to the Criminal Law issued by the Standing Committee of the National People’s Congress, effective as of November 2015, any internet service provider that fails to fulfill the obligations related to internet information security administration as required by applicable laws and refuses to rectify upon administrative orders is subject to criminal penalty as a result of (i) any dissemination of illegal information on a large scale; (ii) any severe effect due to the leakage of customers’ information; (iii) any serious loss of criminal evidence; or (iv) other severe situation. Moreover, any individual or entity that (i) sells or provides personal information to others in a way that violates applicable law, or (ii) steals or illegally obtains any personal information, is subject to criminal liabilities in severe situations. Moreover, on May 8, 2017, the Supreme People’s Court and the Supreme People’s Procuratorate released the Interpretations of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Infringement of Citizens’ Personal Information, which became effective on June 1, 2017. The Interpretations determine the scope of citizens’ personal information under the Criminal Law of the People’s Republic of China, and explain other issues related to criminal offenses involving the infringement of personal information. The Cybersecurity Law is formulated to maintain network security, safeguard cyberspace sovereignty, national security and public interest, protect the lawful rights and interests of citizens, legal persons and other organizations, and requires a network operator, which includes, among others, Internet information services providers, to take technical measures and other necessary measures in accordance with the provisions of applicable laws and regulations as well as the compulsory requirements of the national and industrial standards to safeguard the safe and stable operation of the networks, effectively respond to the network security incidents, prevent illegal and criminal activities, and maintain the integrity, confidentiality and availability of network data. The Cybersecurity Law emphasizes that any individual and organization that uses networks is required to comply with the PRC Constitution and laws, abide by public order and cannot endanger network security or make use of networks to engage in unlawful activities such as endangering national security, economic order and social order, and infringing the reputation, privacy, intellectual property rights and other lawful rights and interests of other people. The Cybersecurity Law reaffirms the basic principles and requirements as specified in other existing laws and regulations on personal information protections, such as the requirements on the collection, use, processing, storage and disclosure of personal information, and internet service providers being required to take technical and other necessary measures to ensure the security of the personal information they have collected and prevent personal information from being divulged, damaged or lost. Any violation of the provisions and requirements under the Cybersecurity Law may subject the Internet service provider to warnings, fines, confiscation of illegal gains, revocation of licenses, cancelation of filings, closedown of websites or even criminal liabilities. On December 29, 2017, the Information Security Technology Personal Information Security Specification (GB/T 35273-2017) was issued by the General Administration of Quality Supervision, Inspection and Quarantine of the PRC and the Standardization Administration and was replaced by the 2020 Specification issued by the State Administration for Market Regulation and the Standardization Administration jointly, which came into effect on October 1, 2020. Pursuant to the specification, product and service providers should take technical and other necessary measures to ensure the safety of personal information, clearly demonstrate the purpose, approaches and scope of processing of the personal information to the individual and obtain the requisite authorization. In addition, according to the 2020 Specification, the original personal biometric information should not, in principle, be stored and, in any event, should be stored separately from personal identity information. It further requires that the privacy policy disclose the scope and rules of personal information collection and use by the personal information controller, which should not be regarded as a contract signed by the subject of personal information. 107 Table of Contents On January 23, 2019, the Office of the Central Cyberspace Affairs Commission, the Ministry of Public Security, the State Administration for Market Regulation and the Ministry of Industry and Information Technology jointly issued the Announcement of Launching Special Crackdown Against Illegal Collection and Use of Personal Information by Apps. According to the announcement, from January to December 2019, the four aforementioned authorities would conduct a nationwide crackdown on the illegal collection and use of personal information. App operators shall strictly fulfill their obligations pursuant to the Cybersecurity Law of the PRC when collecting and using personal information, and shall be responsible for the security of personal information obtained and take effective measures to strengthen personal information protection. The App operators shall follow the principles of lawfulness, legitimacy and necessity, refrain from collecting personal information that is not related to the services provided; when collecting personal information, shall display the rules for the collection and use of personal information in an easy-to-understand, simple and clear manner, and personal information subjects shall independently choose consents; app operators shall not force users to provide authorization through the use of default setting, bundling and stopping installation and use, among others, and may not collect personal information in violation of laws and regulations or against the agreements with users. App operators are asked to provide users with the options of refusing to receive targeted pushes when app operators push news, current affairs and advertisements to targeted users. On March 13, 2019, the State Administration for Market Regulation and the Office of the Central Cyberspace Affairs Commission jointly issued the Announcement on Launching the Security Certification of Apps, which encourages app operators to voluntarily pass the security certification of apps, and encourages operators of search engines and app stores to clearly identify and give priority to recommending those certified Apps. On November 28, 2019, the CAC and other three authorities jointly issued the Announcement on Identification Method of App Collecting and Using Personal Information in Violation of Laws and Regulations, which provides further guidance for determining conduct that qualifies as the unlawful collection and usage of personal information via Apps. On April 10, 2019, the Ministry of Public Security issued the Guide for Internet Personal Information Security Protection, which sets out the management mechanism, security technical measures and business processes for personal information security protection. This Guide is applicable to personal information holders in carrying out their security protection work during personal information life cycle processing. It is applicable to enterprises that provide services through the Internet, as well as to organizations or individuals who use a private or non-networked environment to control and process personal information. On February 13, 2020, the People’s Bank of China issued the Personal Financial Information Protection Technical Specification, which is an industry standard, specifying the security protection requirements for all aspects of personal financial information life cycle processing, including collection, transmission, storage, use, deletion and destruction. This standard is applicable to institutions in the financial industry in the provision of financial products and services, and also provides guidance for security assessment agencies in conducting security inspections and assessments. Based on the potential impact caused by unauthorized viewing or unauthorized change of financial information, this standard classifies personal financial information into three categories of C3, C2, and C1 from high to low sensitivity, and different requirements apply to information classified under different categories. On May 28, 2020, the National People’s Congress adopted the PRC Civil Code, which came into effect on January 1, 2021. Pursuant to the Civil Code, the personal information of a natural person shall be protected by the law. Any organization or individual shall legally obtain such personal information of others when necessary and ensure the safety of such information, and shall not illegally collect, use, process or transmit personal information of others, or illegally purchase or sell, provide or disclose personal information of others. On March 12, 2021, the CAC, Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation promulgated the Provisions on the Scope of Necessary Personal Information Required for Common Types of Mobile Internet Applications, which became effective on May 1, 2021. The Provisions on the Scope of Necessary Personal Information Required for Common Types of Mobile Internet Applications clarify the scope of necessary information required for certain common types of mobile apps and stipulate that mobile app operators shall not deny users’ access to basic functions and services of the app in the event that the users disagree with collection of unnecessary personal information. ​ 108 Table of Contents On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the Data Security Law of the PRC, which came into effect on September 1, 2021. The law introduces a data classification and hierarchical protection system based on the materiality of data in economic and social development, as well as the degree of harm to national security, public interests, or legitimate rights and interests of persons or entities if such data is tampered with, destroyed, divulged, or illegally acquired or used. It also provides for a security review procedure for the data activities that may affect national security. Violation of the law may subject entities or individuals to warnings, fines, suspension of operations, revocation of permits or business licenses, or even criminal liabilities. On August 20, 2021, the Standing Committee of the National People’s Congress promulgated the Personal Information Protection Law of the PRC, which became effective on November 1, 2021. The Personal Information Protection Law stipulates certain important concepts with respect to personal information processing, including that: (i) “personal information” refers to all kinds of information relating to identified or identifiable natural persons recorded by electronic or other channel and methods, excluding information processed anonymously; (ii) “processing of personal information” includes the collection, storage, use, processing, transmission, provision, disclosure and deletion of personal information; and (iii) “personal information processor” refers to an organization or individual that independently determines the purpose and method of processing personal information. Except as otherwise provided in the Personal Information Protection Law, a personal information processor may only process personal information under the circumstances where the individuals’ consents have been obtained or where certain contractual arrangements, employment relationships, public emergencies, performance of statutory duties or obligations or publishing of press release for public interests so require. On April 13, 2020, the Measures on Cybersecurity Review were issued, which took effect on June 1, 2020. They provide detailed rules regarding cyber security review, and further provide that any operator found in violation of the measures will be penalized in accordance with Article 65 of the Cybersecurity Law of the PRC. The measures for Cybersecurity Review (2021 Revision), which came into effect on February 15, 2022, provide that, to ensure the security of the supply chain of critical information infrastructure and safeguard national security, a cybersecurity review is required when national security has been or may be affected where critical information infrastructure operators purchase network product or service and network platform operators process data. When an operator in possession of personal information of over one million users applies for a listing abroad, it must apply to the CAC for a cybersecurity review. These measures further elaborate the factors to be considered when assessing national security risks, including, among others, (i) the risks of illegal control, interference or destruction of critical information infrastructure brought about by the use of products and services; (ii) the harm caused by supply interruption of products and services to the business continuity of critical information infrastructure; (iii) security, openness, transparency and diversity of sources of products and services, reliability of supply channels, and risks of supply interruption due to political, diplomatic, trade or other factors; (iv) information on compliance with Chinese laws, administrative regulations and departmental rules by product and service providers; (v) risks of theft, disclosure, damage, illegal use or cross-border transfer of core data, important data or large amounts of personal information; (vi) risks of influence, control or malicious use of critical information infrastructure, core data, important data or large amounts of personal information by foreign governments after listing on a foreign stock exchange; and (vii) other factors that may endanger critical information infrastructure security and national data security. 109 Table of Contents On July 7, 2022, the CAC published Outbound Data Transfer Security Assessment Measures that took effect on September 1, 2022 and outline the potential security assessment process for outbound data transfer. Under the Outbound Data Transfer Security Assessment Measures, data processors that provide important data and personal information outbound that are collected or produced through operations within the territory of the PRC, where a security assessment shall be conducted according to the law, shall apply to the provisions of these Measures. Under the Outbound Data Transfer Security Assessment Measures, data processors providing outbound data shall apply for outbound data transfer security assessment with the CAC in any of the following circumstances: (i) where a data processor provides important data abroad; (ii) where a critical information infrastructure operator or a data processor processing the personal information of more than one million individuals provides personal information abroad; (iii) where a data processor has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals in total abroad since January 1 of the previous year; and (iv) other circumstances prescribed by the CAC for which declaration for security assessment for outbound data transfers is required. The Outbound Data Transfer Security Assessment Measures also provide procedures for security assessment and submissions, important factors to be considered in conducting assessment, and legal liabilities of a data processor for failure to apply for assessment. In addition, on February 22, 2023, the CAC promulgated Measures for the Standard Contract for Outbound Transfer of Personal Information, which came into effect on June 1, 2023. Pursuant to the measures, personal information processor transferring personal information abroad shall conclude a standard contract if all the following conditions are met: (i) the data processor who intends to transfer personal information abroad is not a critical information infrastructure operator; (ii) the data processor processes personal information of less than one million individuals; (iii) the data processor has cumulatively transferred abroad the personal information of less than 100,000 individuals since January 1 of the previous year; and (iv) the data processor has cumulatively transferred abroad the sensitive personal information of less than 10,000 individuals since January 1 of the previous year. On March 22, 2024, the CAC promulgated the Regulations on Promoting and Regulating Cross-border Data Flow, which further clarified the implementation and connection of the existing data outbound security assessment, personal information cross-border standard contract and personal information protection certification regarding data outbound activities. The regulations, among other things, provide relaxed conditions for cross-border data flow and narrowed scope of security assessment for data outbound activities. Among them, the two types of data outbound activity conditions that should be reported for data outbound security assessment are (i) the operator of critical information infrastructure provides personal information or important data overseas and (ii) data processors other than critical information infrastructure operators provide important data overseas, or provide personal information of more than 1 million people (excluding sensitive personal information) or more than 10,000 sensitive personal information overseas since January 1 of the year. The Measures for the Certification of Personal Information Outbound Transfer were jointly issued by the Cyberspace Administration of China (CAC) and the State Administration for Market Regulation (SAMR) on October 14, 2025, and came into effect on January 1, 2026. These measures regulate certification activities for outbound transfer of personal information, specifying the qualifications of certification bodies, procedures, and validity periods of certificates. In addition, the Ministry of Industry and Information Technology promulgated the Measures for Data Security Management in the Industrial and Information Technology Sector (Trial) on December 8, 2022, which came into effect on January 1, 2023. The measures stipulate that industrial and telecoms data processors shall implement hierarchical management of industrial and telecoms data, which will be classified into three levels: general data, important data and core data. The measures also stipulate certain obligations of industrial and telecoms data processors in relation to the implementation of data security systems, key management, data collection, data storage, data usage, data transmission, data provision, data disclosure, data destruction, security audits and contingency planning. Industrial and telecoms data processors shall file their catalogues of important data and core data with the local industrial regulatory authorities for the record. On February 6, 2023, the Ministry of Industry and Information Technology promulgated the Notice on Further Improving the Service Capabilities of Mobile Internet Applications, effective on the same date. The notice stipulates that users shall be informed of personal information processing rules in a concise, clear and easy-to-understand way, and in case of changes, users shall be informed of the latest development in time. The data processors shall highlight the purpose, method and scope of sensitive personal information processing activities, and establish a list of personal information that has been collected, and should not induce users to agree to personal information processing rules with default check, small prints or lengthy texts. On July 21, 2023, the Ministry of Industry and Information Technology issued the Notice on Carrying out the Filing of Mobile Internet Applications, requiring App operators engaging in Internet information services within the territory of the PRC to complete filing procedures in accordance with the Anti-Telecommunications Network Fraud Law of the PRC and the Measures for the Administration of Internet Information Services. App operators shall complete filing procedures with the provincial-level communications administration bureau where they are domiciled, and their network access service providers and app distribution platforms (including the distribution platforms of mini programs, quick applications and others) shall submit such applications online for inspection and review through the “National Internet Basic Resources Management System.” 110 Table of Contents On September 24, 2024, the State Council promulgated the Data Security Regulations, which is applicable to network data processing activities and the security supervision and administration thereof conducted within the territory of the People’s Republic of China and took effect on January 1, 2025. The Data Security Regulations stipulate that data processors engaging in data processing activities that affect or may affect national security shall be subject to national security review in accordance with relevant laws and regulations. Furthermore, the Data Security Regulations include, but are not limited to, the following provisions: (i) specific guidelines to clarify the Personal information Protection Law regarding notification, consent, and individuals’ rights; (ii) requirements for establishing an important data catalog and stipulate the responsibilities of network data processors to identify and report important data; (iii) optimization of regulations for cross-border data security management, specifying conditions under which network data processors may provide personal information abroad in accordance with international treaties or agreements; these regulations clarify that data not identified or publicly disclosed as important data by relevant regions or departments need not undergo cross-border security assessments for important data; and (iv) network data security protection requirements for network platform service providers, third-party product and service providers, and other relevant entities. On December 27, 2024, the National Financial Regulatory Administration of the PRC issued the Measures for the Administration of Data Security in Banking and Insurance Institutions, which took effect immediately upon release. The main provisions include: (i)the party committee (or leading party group) and the board of directors (or council) of banking and insurance institutions are responsible for the data security of their respective organizations and the principal leader of the institution is the primary responsible person for data security, while the leader in charge of data security is the direct responsible person; (ii)banking and insurance institutions are required to designate a dedicated data security department as the main body responsible for data security within the organization and such department is tasked with formulating data security management systems and standards, establishing and maintaining data catalogs, promoting the classification and tiered protection of data and organizing risk monitoring, early warning, and response efforts; (iii) banking and insurance institutions must define clear management processes, proactively assess risks, and effectively monitor data security risks to prevent incidents such as data breaches, leaks, or unauthorized use. The risk management, internal control, compliance, and audit departments are required to conduct regular audits, inspections, and evaluations of data security practices; (iv) banking and insurance institutions must conduct security assessments before engaging in data processing activities. These assessments should analyze data security risks, the impact on the rights of data subjects, the necessity, compliance, and effectiveness of risk prevention and control measures; and (v) data security should be incorporated into the network security multi-level protection system of the banking and insurance institutions, and the banking and insurance institutions shall enhanced protection measures for data centers and networks that store or transmit sensitive-level or higher data, take access control measures throughout the data lifecycle and adopt secure transmission methods to ensure data integrity, confidentiality, and availability. Additionally, the Measures for the Administration of Data Security in Banking and Insurance Institutions stipulate that financial organizations established with the approval of local financial regulatory authorities shall also comply with these provisions. On February 12, 2025, the CAC issued the Administrative Measures for the Compliance Audit of Personal Information Protection, which took effect on May 1, 2025. According to the Administrative Measures for the Compliance Audit of Personal Information Protection, the term “compliance audit of personal information protection” refers to supervisory activities that review and evaluate whether the personal information processing activities of personal information processors comply with laws and administrative regulations. Personal information processors that process personal information of more than 10 million individuals shall carry out the compliance audit of personal information protection at least every two years. Personal information processors in any of the following circumstances may be required by the CAC and other departments performing personal information protection duties to entrust a professional agency to conduct a compliance audit of their personal information processing activities: (i) where significant risks are identified in the personal information processing activities that severely impact individual rights or lack adequate security measures; (ii) where the personal information processing activities may infringe upon the rights and interests of a large number of individuals; (iii) in the event of a personal information security incident resulting in the leakage, tampering, loss, or destruction of personal information of more than 1 million individuals or sensitive personal information of more than 100,000 individuals. On March 13, 2025, the CAC and the Ministry of Public Security jointly issued the Regulations on the Security Management of Facial Recognition Technology Applications, which came into effect on June 1, 2025. The regulations apply to activities within the territory of the PRC that use facial recognition technology to process facial information. However, the regulations do not apply to activities within the territory of the PRC that use facial recognition technology to process facial information for the purpose of developing facial recognition technology or training algorithms. The regulations specify the basic requirements and processing rules for using facial recognition technology to process facial information and the security standards and the responsibilities for supervision and management for facial recognition technology applications. They require that activities using facial recognition technology to process facial information must comply with laws and regulations, respect social ethics and morals, adhere to business ethics and professional ethics, act in good faith, fulfill obligations to protect personal information, assume social responsibilities, and must not endanger national security, harm public interests, or infringe upon the legitimate rights and interests of individuals. 111 Table of Contents The Measures for the Management of Data Security in the Business Areas were issued by the People’s Bank of China on May 1, 2025, and became effective on June 30, 2025. The measures stipulate matters of data security management in business areas where the People’s Bank of China undertakes supervision and management responsibilities based on laws, administrative regulations, decisions of the Party Central Committee, and the State Council. The main contents include data classification and grading, full-process security management, technical security requirements, risk monitoring, and legal responsibilities. The Administrative Measures for Reporting Cybersecurity Incidents in the Business Areas were issued by the People’s Bank of China on May 23, 2025, and came into effect on August 1, 2025. These measures establish the classification standards for cybersecurity incidents in the PBOC’s business areas (categorized into four levels: extremely serious, serious, relatively serious, and general), reporting procedures (covering three stages: incident occurrence, incident handling, and post-incident), content and time limit requirements, and specify legal liabilities and penalty measures. To ensure compliance with the above laws and regulations, in providing our Credit-Tech service, we collect certain personal information from our consumers and SMEs, and also are required to share the information with our financial institution partners for the purpose of facilitating credit to our borrowers. We have obtained consent from borrowers for us to collect, use and share their personal information, and have also established information security systems to protect user information and to abide by other network security requirements under such laws and regulations. However, there is uncertainty as to the interpretation application and enforcement of such laws which may be interpreted and applied in a manner inconsistent with our current policies and practices or require changes to the features of our system. Any non-compliance or perceived non-compliance with these laws, regulations or policies may lead to warnings, fines, investigations, lawsuits, confiscation of illegal gains, revocation of licenses, cancelation of filings, closedown of websites or apps or even criminal liabilities against us by government agencies or other individuals. While we have taken measures to protect the personal information to which we have access, our security measures could be breached, resulting in leaks of such confidential personal information. Security breaches or unauthorized access to confidential information could also expose us to liability related to the loss of the information, time-consuming and expensive litigation and negative publicity. Regulations on Artificial Intelligence Services On September 17, 2021, the CAC, together with eight other government authorities, jointly issued the Guidelines on Strengthening the Comprehensive Regulation of Algorithms for Internet Information Services. On December 31, 2021, the Ministry of Industry and Information Technology, the CAC, the Ministry of Public Security and the State Administration for Market Regulation jointly issued the Provisions on the Administration of Algorithm Recommendation for Internet Information Services, which became effective on March 1, 2022. Application of algorithm recommendation refers to the use of algorithmic technologies such as generation and synthesis, personalized push, sorting and selection, retrieval and filtering, scheduling decision-making to provide information to users. Algorithm recommendation service providers with public opinion attribute or social mobilization ability shall go through record-filing formalities within 10 business days from the date of provision of services. Algorithm recommendation service providers that have completed record-filing shall indicate their record-filing numbers and provide links to the publicized information on their websites and/or applications. ​ 112 Table of Contents On November 25, 2022, the Ministry of Industry and Information Technology issued the Provisions on the Administration of Deep Synthesis of Internet Information Services, which became effective on January 10, 2023. These provisions apply to the use of deep synthesis technologies to provide internet information services and activities providing technical support to deep synthesis services within the territory of the PRC. Pursuant to the provisions, the “deep synthesis technology” refers to the technology using generative and synthesizing algorithms, with deep learning and virtual reality as representative examples, to produce text, images, sound, video, virtual settings and other such information. Deep synthesis service providers shall (i) establish and improve control systems with regard to user registration, algorithm review, technological ethic review, information public review, statistics security, personal information protection, anti-telecom and online fraud, emergency disposal, etc. and take safe and controlled technical protection measures; and (ii) formulate and publicize related management rules and platform pacts, improve service agreements, perform the management responsibilities in accordance with laws and agreements, and inform with explicit methods the technical supporters and users of the in-depth integration of their respective information safety obligations. Where deep synthesis service providers and technology providers provide models or templating tools with the capability to edit facial generation, human voice or other distinguishing biological information, such providers shall conduct security assessments. Where deep synthesis service providers and technology providers provide editing functions for facial, vocal information or other distinguishing biological information, they shall prompt deep synthesis service users and notify them and obtain separate consent from the edited personal information subjects. In addition, as for deep synthesis service providers that provide certain deep synthesis services, such as smart dialogue, smart writing and other such textual generation or editing services simulating natural persons, and synthesized voices, imitated voices and other such speech generation or editing services that significantly change individual identifying characteristics, such providers shall use prominent methods to label deep synthesis information content, and effectively point out to the public the synthesized nature of the information content. Deep synthesis service providers with public opinion attribute or social mobilization ability shall conduct filing formalities in accordance with the Provisions on the Administration of Algorithm Recommendation for Internet Information Services. On July 10, 2023, the CAC promulgated the Provisional Measures for the Administration of Generative Artificial Intelligence Services, or the Measures on Generative AI Services, which took effect on August 15, 2023. The Measures on Generative AI Services defines the generative artificial intelligence as the models and technology to generate such contents as texts, pictures, sound, videos. The Measures on Generative AI Services requires generative AI service providers to take effective measures to enhance the accuracy and reliability of the content created by the generative artificial intelligence. Pursuant to the Measures on Generative AI Services, generative AI service providers shall (i) assume the responsibilities of content producers and perform network information security obligations; (ii) assume the responsibilities of processors of personal information to protect personal information; and (iii) process training data such as conducting pre-training and optimization training in accordance with the laws and regulations, including, among others, (a) the training shall use data and models from lawful sources; (b) if intellectual properties are involved, it shall not contain any contents that infringe upon the intellectual property rights of other parties; (c) if such data contains personal information, the providers shall obtain consent of personal information subjects or comply with relevant laws and regulations; and (d) take effective measures to improve the quality of training data and enhance the quality, authenticity, objectivity and diversity of training data. In addition, the service providers that provide generative artificial intelligence services with public opinion attribute or social mobilization ability are required to apply for security assessment with the national cybersecurity administration authorities in accordance with the Provisions on the Security Assessment of Internet Information Services with Public Opinion Attribute or Social Mobilization Ability and complete the filing formalities of algorithms in accordance with the Provisions on the Administration of Algorithm Recommendation for Internet Information Services. On September 7, 2023, the Ministry of Science and Technology, together with other relevant departments, jointly promulgated the Measures for Ethical Review of Science and Technology (for Trial Implementation), or the Ethical Review Measures, which came into effect on December 1, 2023, according to which, any universities, scientific research institutions, medical and health institutions, and enterprises engaged in “ethically sensitive” science and technology activities in certain areas, including AI, must establish a science and technology ethical review committee. The Appendix of the Ethical Review Measures set out a special list of science and technology activities that shall be subject to (i) the preliminary review by the ethical review committee; and (ii) the additional expert review by the local or relevant industry-competent department. Science and technology activities that fall under such special list include, among other things, the research and development of algorithm models, applications and systems with public sentiment attributes or social mobilizing capability, and the research and development of automated decision-making systems with a high degree of autonomy for scenarios with safety or personal health risks. In addition, the obligor is required to complete certain registration requirements, such as to register (i) its ethical review committee within 30 days after establishment; and (ii) its science and technology activities that require additional expert review within 30 days after clearance of ethical review, in each case on the National Science and Technology Ethics Management Information Registration Platform to be established by the Ministry of Science and Technology. The registration should be updated in time when the relevant contents change. ​ 113 Table of Contents On February 28, 2025, the State Administration for Market Regulation and the Standardization Administration issued the mandatory national standard Cybersecurity Technology - Methods for Identifying Artificially Generated Synthetic Content (GB 45438-2025). This standard came into effect on September 1, 2025, and sets specific requirements for the methods of identifying content by service providers of artificially generated synthetic content and network information dissemination services. On March 14, 2025, the CAC, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration jointly issued the Measures for the Identification of Artificial Intelligence Generated Synthetic Content, or the Identification Measures, which came into effect on September 1, 2025. The Identification Measures apply to online information service providers that meet the conditions specified in the Regulations on the Provisions on the Administration of Algorithm Recommendation for Internet Information Services, the Provisions on the Administration of Deep Synthesis of Internet Information Services, and the Provisional Measures for the Administration of Generative Artificial Intelligence Services. The Identification Measures clarifies that service providers must add explicit identifiers to generated synthetic content such as text, audio, images, videos, and virtual scenes. When providing functions such as downloading, copying, and exporting generated synthetic content, they must ensure that the files contain explicit identifiers that meet the requirements. They must also add implicit identifiers to the file metadata of generated synthetic content, which include attributes of the generated synthetic content, service provider name or code, content number, and other production element information. Additionally, they must clearly explain the methods and styles of identifying generated synthetic content in their user service agreements and remind users to carefully read and understand the relevant identifier management requirements. On March 20, 2026, the Ministry of Industry and Information Technology (MIIT), together with nine other departments, jointly promulgated the Measures for the Review and Service of Artificial Intelligence Ethics (Trial), which took effect on the date of promulgation. These Measures apply to artificial intelligence scientific research, technology development, and other activities conducted within the territory of the People’s Republic of China that may pose risks and challenges to scientific and technological ethics in respect of human dignity, public order, life and health, ecological environment, and sustainable development, as well as other scientific and technological activities subject to artificial intelligence ethics review pursuant to laws, administrative regulations, and relevant provisions of the State. The Measures specify that entities conducting such scientific and technological activities are the responsible parties for the administration of artificial intelligence ethics review, and shall establish ethics review committees in accordance with law to conduct ethics review activities. For artificial intelligence scientific and technological activities included in the “List of Artificial Intelligence Scientific and Technological Activities Requiring Expert Re-review of Ethics” formulated and published by MIIT, the Ministry of Science and Technology, and other relevant departments, an expert re-review shall be conducted in accordance with law following the ethics review. Regulations on Foreign Exchange Pursuant to the Foreign Exchange Administration Regulations, as issued in January 1996 and amended in January 1997 and August 2008, Renminbi is freely convertible for current account items, including the trade and service-related foreign exchange transactions, the distribution of dividends, interest payments but not for capital account items, such as direct investments, loans, repatriation of investments and investments in securities outside of China, unless prior approval from SAFE is obtained and prior registration with SAFE is made. In June 2015, SAFE promulgated the Notice of the State Administration of Foreign Exchange on Reforming the Administration of Foreign Exchange Settlement of Capital of Foreign-invested Enterprises, or SAFE Circular 19. SAFE further promulgated the Notice of the State Administration of Foreign Exchange on Reforming and SAFE Circular 16 on June 9, 2016, which, among other things, amends certain provisions of SAFE Circular 19. Pursuant to SAFE Circular 19 and SAFE Circular 16, the flow and use of Renminbi capital converted from foreign currency denominated registered capital of a foreign-invested company shall not be used for business beyond its business scope, or to provide loans to persons other than affiliates unless otherwise permitted under its business scope. Violations of SAFE Circular 19 or SAFE Circular 16 could result in administrative penalties. In February 2015, SAFE promulgated the Notice on Further Simplifying and Improving the Foreign Exchange Management Policies for Direct Investment, or SAFE Circular 13, which took effect in June 2015. SAFE Circular 13 delegates the power to enforce the foreign exchange registration in connection with inbound and outbound direct investments under the SAFE rules from local branches of SAFE to banks, thereby further simplifying the foreign exchange registration procedures for inbound and outbound direct investments. 114 Table of Contents Regulations on dividend distribution The principal regulations governing distribution of dividends of foreign-invested enterprises include PRC Company Law, PRC Wholly Foreign-owned Enterprise Law, and Implementation Rules of the PRC Wholly Foreign-owned Enterprise Law, of which the Wholly Foreign-invested Enterprise Law together with its implementation regulations was replaced by 2019 PRC Foreign Investment Law from January 1, 2020. Under these laws and regulations, wholly foreign-owned enterprises in China may pay dividends only out of their accumulated after-tax profits, if any, determined in accordance with PRC accounting standards and regulations. In addition, wholly foreign-owned enterprises in China are required to allocate at least 10% of their respective accumulated profits each year, if any, to fund certain reserve funds until these reserves have reached 50% of the registered capital of the enterprises. Wholly foreign-owned companies may, at their discretion, allocate a portion of their after-tax profits based on PRC accounting standards to staff welfare and bonus funds. These reserves are not distributable as cash dividends. Under our current corporate structure, our Cayman Islands holding company may rely on dividend payments from Shanghai Qiyue Information Technology Co., Ltd., which is a wholly foreign-owned enterprise incorporated in China, to fund any cash and financing requirements we may have. Limitation on the ability of the VIEs to make remittance to our wholly foreign owned enterprise and on the ability of our wholly foreign owned enterprise to pay dividends to us could limit our ability to access cash generated by the operations of those entities. See “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—We may rely on dividends and other distributions on equity paid by our PRC subsidiaries to fund any cash and financing requirements we may have, and any limitation on the ability of our PRC subsidiaries to make payments to us could have a material adverse effect on our ability to conduct our business.” Regulations on foreign exchange registration of overseas investment by PRC residents In July 2014, SAFE promulgated SAFE Circular 37 in the replacement of Notice on Issues relating to Foreign Exchange Administration for Financing and Roundtrip Investments by Domestic Residents through Overseas Special-purpose Companies in October 2005, requiring PRC residents or entities to register with SAFE or its local branch in connection with their establishment or control of an offshore entity established for the purpose of overseas investment or financing. In addition, such PRC residents or entities must update their SAFE registrations when the offshore special purpose vehicle undergoes material events relating to any change of basic information (including change of such PRC citizens or residents, name and operation term), increases or decreases in investment amount, transfers or exchanges of shares, or mergers or divisions. SAFE further enacted SAFE Circular 13, which allows PRC residents or entities to register with qualified banks in connection with their establishment or control of an offshore entity established for the purpose of overseas investment or financing. In the event that a PRC shareholder holding interests in a special purpose vehicle fails to fulfill the required SAFE registration, the PRC subsidiaries of that special purpose vehicle may be prohibited from distributing profits to the offshore parent and from carrying out subsequent cross-border foreign exchange activities. In addition, the special purpose vehicle may be restricted in its ability to contribute additional capital into its PRC subsidiaries. Moreover, failure to comply with the various SAFE registration requirements described above could result in liability under PRC law for evasion of foreign exchange controls. These aforementioned regulations apply to our direct and indirect shareholders who are PRC residents and may apply to any offshore acquisitions and share transfer that we make in the future if our shares are issued to PRC residents. See “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—PRC regulations relating to offshore investment activities by PRC residents may limit our PRC subsidiaries’ ability to increase their registered capital or distribute profits to us or otherwise expose us or our PRC resident beneficial owners to liability and penalties under PRC law.” ​ 115 Table of Contents Regulations on stock incentive plans In February 2012, SAFE promulgated the Notice on Foreign Exchange Administration of PRC Residents Participating in Share Incentive Plans of Offshore Listed Companies, replacing the previous rules issued by SAFE in March 2007 and in January 2008. Under such stock option rules and other rules and regulations, PRC residents who participate in a stock incentive plan in an overseas publicly listed company are required to register with SAFE or its local branches and complete certain other procedures. Participants of a stock incentive plan who are PRC residents must retain a qualified PRC agent, which could be a PRC subsidiary of the overseas publicly listed company or another qualified institution selected by the PRC subsidiary, to conduct SAFE registration and other procedures with respect to the stock incentive plan on behalf of its participants. The participants must also retain an overseas entrusted institution to handle matters in connection with their exercise of stock options, the purchase and sale of corresponding stocks or interests and fund transfers. In addition, the PRC agent is required to amend SAFE registration with respect to the stock incentive plan if there is any material change to the stock incentive plan, the PRC agent or the overseas entrusted institution or other material changes. The PRC agents must, on behalf of the PRC residents who have the right to exercise the employee share options, apply to SAFE or its local branches for an annual quota for the payment of foreign currencies in connection with the PRC residents’ exercise of the employee share options. The foreign exchange proceeds received by the PRC residents from the sale of shares under the stock incentive plans granted and dividends distributed by the overseas listed companies must be remitted into the bank accounts in the PRC opened by the PRC agents before distribution to such PRC residents. In addition, SAFE Circular 37 provides that PRC residents who participate in a share incentive plan of an overseas unlisted special purpose company may register with SAFE or its local branches before exercising rights. If the PRC optionees fail to comply with the Individual Foreign Exchange Rule and the Stock Option Rules, we and our PRC optionees may be subject to fines and other legal sanctions. In May 2018 and November 2019, we adopted the 2018 Share Incentive Plan and the 2019 Share Incentive Plan, respectively, to attract and retain the best available personnel, provide additional incentives to employees, directors and consultants and promote the success of our business. We will also advise the recipients of awards under our 2018 Share Incentive Plan to handle foreign exchange matters in accordance with the Notices on Issues Concerning the Foreign Exchange Administration for Domestic Individuals Participating in Stock Incentive Plan of Overseas Publicly Listed Company. However, we cannot guarantee that all employee awarded equity-based incentives can successfully register with SAFE in full compliance with the notices. See “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—Any failure to comply with PRC regulations regarding the registration requirements for employee stock incentive plans may subject the PRC plan participants or us to fines and other legal or administrative sanctions” and “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—PRC regulations relating to offshore investment activities by PRC residents may limit our PRC subsidiaries’ ability to increase their registered capital or distribute profits to us or otherwise expose us or our PRC resident beneficial owners to liability and penalties under PRC law.” Laws and Regulations relating to Intellectual Property Copyright and software products The Standing Committee of the National People’s Congress adopted PRC Copyright Law in 1990 and most recently amended in 2020, with its implementing rules adopted in 1991 and most recently amended in 2013 by PRC State Council, and the Regulations for the Protection of Computer Software promulgated by the PRC State Council in 2001 and most recently amended in 2013. These rules and regulations extend copyright protection to internet activities, products disseminated over the internet and software products. In addition, there is a voluntary registration system administered by the China Copyright Protection Center. According to the aforementioned laws and regulation, the term of protection for copyrighted software is fifty years. Trademarks PRC Trademark Law was promulgated by the Standing Committee of the National People’s Congress in August 1982 and most recently amended in April 2019, and the Implementation Regulations on the PRC Trademark Law was promulgated by PRC State Council in August 2002 and amended in April 2014. These laws and regulations provide the basic legal framework for the regulations of trademarks in the PRC. In the PRC, registered trademarks include commodity trademarks, service trademarks, collective trademarks and certificate trademarks. The Intellectual Property Office under the State Administration for Market Regulation is responsible for the registration and administration of trademarks throughout the country. Trademarks are granted on a term of ten years. Applicants may apply for an extension 12 months prior to the expiration of the 10-year term. 116 Table of Contents Domain names Internet domain name registration and related matters are primarily regulated by the Measures on Administration of Internet Domain Names, which were issued by Ministry of Industry and Information Technology and effective as of November 1, 2017. Domain name registrations are handled through domain name service agencies, and the applicants become domain name holders upon successful registration. We have adopted necessary mechanisms to register, maintain and enforce intellectual property rights in China. However, we cannot assure you that we can prevent our intellectual property from all the unauthorized use by any third party, neither can we promise that none of our intellectual property rights would be challenged by any third party. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We may not be able to prevent others from unauthorized use of our intellectual property, which could harm our business and competitive position” and “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We may be subject to intellectual property infringement claims, which may be costly to defend and may disrupt our business and operations.” M&A Rules In August 2006, six PRC governmental agencies jointly promulgated the M&A Rules as most recently amended in 2009. The M&A Rules establish procedures and requirements that could make certain acquisitions of PRC companies by foreign investors more time-consuming and complex, including requirements in some instances that the Ministry of Commerce be notified in advance of any change-of-control transaction in which a foreign investor takes control of a PRC domestic enterprise. According to the Provisional Measures on Administration of Filing for Establishment and Change of Foreign Investment Enterprises, the merger and acquisition of domestic non-foreign-invested enterprises by foreign investors shall, if not involving special access administrative measures and affiliated mergers and acquisitions, be subject to the record filing measures. Furthermore, the Ministry of Commerce and the State Administration of Market Regulation issued the Measures for the Reporting of Foreign Investment Information on December 30, 2019, which came into effect on January 1, 2020 and replaced Provisional Measures on Administration of Filing for Establishment and Change of Foreign Investment Enterprises. Since January 1, 2020, for foreign investors carrying out investment activities directly or indirectly in China, the foreign investors or foreign-invested enterprises shall submit investment information to the commerce authorities pursuant to such measures. For detailed analysis, see “Risk Factors—Risks Related to Doing Business in China—The M&A Rules and certain other PRC regulations establish complex procedures for some acquisitions of Chinese companies by foreign investors, which could make it more difficult for us to pursue growth through acquisitions in China.” Overseas Listings On July 6, 2021, PRC government authorities issued Opinions on Strictly Cracking Down Illegal Securities Activities in Accordance with the Law. These opinions emphasize the need to strengthen the administration over illegal securities activities and the supervision on offshore listings by China-based companies and proposed to take effective measures, such as promoting the construction of regulatory systems, to deal with the risks and incidents faced by China-based offshore-listed companies. On February 17, 2023, the CSRC released the Trial Administration Measures of Overseas Securities Offering and Listing by Domestic Companies, and five supporting guidelines, which came into effect on March 31, 2023. The measures regulate both direct and indirect overseas offering and listing of PRC domestic companies’ securities by adopting a filing-based regulatory regime. According to the measures, companies in China will be required to submit the filing with respect to its overseas initial public offering and listing with the CSRC within 3 working days after submitting listing application materials to overseas regulators, and such filing shall be completed before the companies are permitted to be listed and offering securities overseas. 117 Table of Contents In addition, pursuant to these measures, an overseas offering and listing of a PRC company is prohibited under any of the following circumstances, if (i) such securities offering and listing is explicitly prohibited by provisions in laws, administrative regulations and state rules; (ii) the intended securities offering and listing may endanger national security as reviewed and determined by competent authorities under the State Council in accordance with law; (iii) the domestic company intending to make the securities offering and listing, or its controlling shareholder(s) and the actual controller, have committed crimes such as corruption, bribery, embezzlement, misappropriation of property or undermining the order of the socialist market economy during the latest three years; (iv) the domestic company intending to make the securities offering and listing is currently under investigations for suspicion of criminal offenses or major violations of laws and regulations, and no conclusion has yet been made thereof; or (v) there are material ownership disputes over equity held by the domestic company’s controlling shareholder(s) or by other shareholder(s) that are controlled by the controlling shareholder(s) and/or actual controller. At a press conference held for these new regulations, officials from the CSRC clarified that the domestic companies that have already been listed overseas on or before the effective date of the measures (i.e., March 31, 2023) shall be deemed as existing issuers. Existing issuers are not required to complete the filling procedures immediately, and they shall be required to file with the CSRC when subsequent matters such as refinancing are involved. On February 24, 2023, the CSRC published the revised Provisions on Strengthening Confidentiality and Archives Administration of Overseas Securities Offering and Listing by Domestic Companies. The provisions require that, in relation to the overseas listing activities of domestic enterprises, such domestic enterprises, as well as securities companies and securities service institutions providing securities services, are required to strictly comply with the requirements on confidentiality and archives management, establish a sound confidentiality and archives system, and take necessary measures to implement their confidentiality and archives management responsibilities. According to the provisions, if during the course of an overseas offering and listing, if a PRC company needs to publicly disclose or provide to securities companies, accounting firms or other securities service providers and overseas regulators, any materials that contain state secrets or that have a sensitive impact, the PRC company should complete the relevant approval/filing and other regulatory procedures. However, there remain uncertainties regarding the further interpretation and implementation of the rules. Laws and Regulations Relating to Labor Pursuant to PRC Labor Law, promulgated by the Standing Committee of the National People’s Congress in July 1994 and revised in August 2009 and December 2018, and the Labor Contract Law of PRC, promulgated by the Standing Committee of the National People’s Congress in June 2007 and amended in December 2012, and the Implementing Regulations of the Labor Contract Law, employers must execute written employment contracts with full-time employees. All employers must compensate their employees with wages equal to at least the local minimum wage. Violations of the Labor Law and the Labor Contract Law may result in fines and other administrative sanctions, and serious violations may result in criminal liabilities. Under PRC laws, rules and regulations, including the PRC Social Insurance Law promulgated by the Standing Committee of the National People’s Congress in October 2010, which became effective in July 2011 and amended in December 2018, the Interim Measures on the Collection and Payment of Social Security Funds in January 1999 and amended in March 2019, the Regulations on Work Injury Insurance issued by PRC State Council in April 2003, and amended in December 2010, the Regulations on Unemployment Insurance promulgated by PRC State Council in January 1999 and the Regulations on the Administration of Housing Accumulation Funds released by PRC State Council in April 1999 and last amended in March 2019, employers are required to contribute, on behalf of their employees, to a number of social security funds and implement certain employee benefit plans, including funds for basic pension insurance, unemployment insurance, basic medical insurance, occupational injury insurance, maternity leave insurance and housing accumulation funds. These payments are made to local administrative authorities and any employer who fails to contribute may be fined and ordered to pay the deficit amount. According to the PRC Social Insurance Law, an employer that fails to make social insurance contributions may be ordered to rectify the non-compliance and pay the required contributions within a stipulated deadline and be subject to a late fee of 0.05% per day, as the case may be. If the employer still fails to rectify the failure to make social insurance contributions within the deadline, it may be subject to a fine ranging from one to three times the amount overdue. According to the Regulations on the Administration of Housing Accumulation Funds, an enterprise that fails to make housing fund contributions may be ordered to rectify the noncompliance and pay the required contributions within a stipulated deadline; otherwise, an application may be made to a local court for compulsory enforcement. We have caused all of our full-time employees to enter into written employment contracts with us and have provided and currently provide our employees with proper welfare and employee benefits as required by the PRC laws and regulations. 118 Table of Contents Regulations related to Tax Enterprise income tax Under the Enterprise Income Tax Law, effective in January 2008 and amended in February 2017 and December 2018, and its implementing rules, enterprises are classified as resident enterprises and non-resident enterprises. PRC resident enterprises typically pay an enterprise income tax at the rate of 25% while non-PRC resident enterprises without any branches in the PRC should pay an enterprise income tax in connection with their income from the PRC at the tax rate of 10%. An enterprise established outside of the PRC with its “de facto management bodies” located within the PRC is considered a “resident enterprise,” which means that it can be treated in a manner similar to a PRC domestic enterprise for enterprise income tax purposes. The implementing rules of the law define a de facto management body as a managing body that in practice exercises “substantial and overall management and control over the production and operations, personnel, accounting, and properties” of the enterprise. The Enterprise Income Tax Law and the implementation rules provide that an income tax rate of 10% will normally be applicable to dividends payable to investors that are “non-resident enterprises,” and gains derived by such investors, which (i) do not have an establishment or place of business in the PRC or (ii) have an establishment or place of business in the PRC, but the income is not effectively connected with the establishment or place of business to the extent such dividends and gains are derived from sources within the PRC. Such income tax on the dividends may be reduced pursuant to a tax treaty between China and other jurisdictions. Pursuant to the Arrangement between the Mainland China and the Hong Kong Special Administrative Region for the Avoidance of Double Taxation and Tax Evasion on Income and other applicable PRC laws, if a Hong Kong resident enterprise is determined by the competent PRC tax authority to have satisfied the conditions and requirements under such Double Tax Avoidance Arrangement and other applicable laws, the 10% withholding tax on the dividends the Hong Kong resident enterprise receives from a PRC resident enterprise may be reduced to 5% upon receiving approval from in-charge tax authority. However, based on the Notice on Certain Issues with Respect to the Enforcement of Dividend Provisions in Tax Treaties, issued in February 2009 by the State Taxation Administration if the PRC tax authorities determine, in their discretion, that a company benefits from such reduced income tax rate due to a structure or arrangement that is primarily tax-driven, such PRC tax authorities may adjust the preferential tax treatment; and the Announcement on Issues concerning “Beneficial Owners” in Tax Treaties issued on February 3, 2018 by the State Taxation Administration, when determining the status of “beneficial owners,” a comprehensive analysis may be conducted through materials such as articles of association, financial statements, records of capital flows, minutes of board of directors, resolutions of board of directors, allocation of manpower and material resources, the relevant expenses, functions and risk assumption, loan contracts, royalty contracts or transfer contracts, patent registration certificates and copyright certificates, among others. However, even if an applicant has the status as a “beneficiary owner,” the competent tax authority finds necessity to apply the principal purpose test clause in the tax treaties or the general anti-tax avoidance rules stipulated in domestic tax laws, the general anti-tax avoidance provisions shall apply. 119 Table of Contents The Enterprise Income Tax Law and its Implementation Rules permit certain “high and new technology enterprises strongly supported by the state” that hold independent ownership of core intellectual property and simultaneously meet a list of other criteria, financial or non-financial, as stipulated in the Implementation Rules and other regulations, to enjoy a reduced 15% enterprise income tax rate. The State Taxation Administration, the Ministry of Science and Technology and the Ministry of Finance jointly issued the Administrative Measures on the Recognition for High and New Technology Enterprise delineating the specific criteria and procedures for the “high and new technology enterprises” certification in April 2008, which was amended in January 2016. Shanghai Qiyu was accredited as a “high and new technology enterprises” in 2018, which was renewed in 2021 and 2024, therefore it was entitled to a reduced 15% enterprise income tax rate from 2018 to 2026. In 2020, our WFOE obtained “high and new technology enterprises” status, which was renewed in 2023. As a result, our WFOE is entitled to a reduced enterprise income tax rate of 15% from 2020 to 2025. We believe that we should not be treated as a “resident enterprise” for PRC tax purposes even if the standards for “de facto management body” are applicable to us. However, the tax resident status of an enterprise is subject to determination by the PRC tax authorities and uncertainties remain with respect to the interpretation of the term “de facto management body.” If our holding company in the Cayman Islands or any of our subsidiaries outside of China were deemed to be a “resident enterprise” under the Enterprise Income Tax Law, it would be subject to enterprise income tax on its worldwide income at a rate of 25%, which could materially reduce our net income. See “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—If we are classified as a PRC resident enterprise for PRC income tax purposes, such classification could result in unfavorable tax consequences to us and our non-PRC shareholders or ADS holders.” Value-added tax Pursuant to the Value-added Tax Law of the PRC, which was promulgated by the Standing Committee of the National People’s Congress on December 25, 2024 and came into effect on January 1, 2026, and the Regulations for the Implementation of the Value-added Tax Law issued on December 25, 2025 and implemented on January 1, 2026, entities and individuals (including individual industrial and commercial proprietors) selling goods, services, intangible assets, real estate and importing goods within the territory of the PRC are taxpayers of VAT and shall pay VAT in accordance with the provisions of the law. Unless stated otherwise, for payers who sell goods, and provide processing, repairs and replacement services and rental services of tangible movable assets as well as import goods, the tax rate shall be 13%, and be, in certain specified circumstances, 9%, 6% and 0%. ​ 120 Table of Contents C. Organizational Structure The following diagram illustrates our corporate structure, including our significant subsidiaries, the VIEs and the VIEs’ subsidiaries as of December 31, 2025: ​ (1) Each of Shanghai Qiyu and Fuzhou Financing Guarantee is wholly owned by Shanghai Qibutianxia, which was a related party of our company before December 2025. 121 Table of Contents Contractual Arrangements with the VIEs and Their Shareholders Agreements that provide us with effective control over the VIEs Voting Proxy Agreements. Pursuant to the voting proxy agreement entered into among our WFOE, Shanghai Qiyu and Shanghai Qibutianxia, Shanghai Qibutianxia would irrevocably authorize our WFOE or any person designated by our WFOE (including any director of its direct or indirect offshore parent company and liquidators exercising such directors’ powers or other successors) to act as its attorney-in-fact to exercise all of its rights as a shareholder of Shanghai Qiyu, including, but not limited to the right (i) to convene and participate in shareholders’ meetings pursuant to the constitutional documents of Shanghai Qiyu in the capacity of a proxy of Shanghai Qibutianxia, and to sign any and all written resolutions and meeting minutes for and on behalf of Shanghai Qibutianxia; (ii) to exercise the voting rights pursuant to the PRC laws and regulations and the articles of Shanghai Qiyu, on behalf of Shanghai Qibutianxia, and adopt resolutions, including, but not limited to dividend rights, sale or transfer or pledge or disposal of part or all of Shanghai Qiyu’s equity, and the right to appoint directors; (iii) to sign or submit any required document to any company registry or other authorities; (iv) to nominate, designate or appoint and remove the legal representative, directors, supervisors and other senior management of Shanghai Qiyu pursuant to the constitutional documents of Shanghai Qiyu; and (v) to raise lawsuits or other legal proceedings against the directors, supervisors and senior management of Shanghai Qiyu when their behaviors harm the interest of Shanghai Qiyu or its shareholder; and to instruct the directors and senior officers to act in accordance with our attention. Equity Interest Pledge Agreements. Pursuant to the equity interest pledge agreement entered into among our WFOE, Shanghai Qiyu and Shanghai Qibutianxia, Shanghai Qibutianxia agreed to pledge all of its equity interests in Shanghai Qiyu to our WFOE as a security interest to guarantee the performance of contractual obligations and the payment of outstanding debts under the Contractual Arrangements. Under the equity interest pledge agreement, Shanghai Qiyu and Shanghai Qibutianxia represent and warrant to our WFOE that appropriate arrangements have been made to protect our WFOE’s interests in the event of bankruptcy or any other event which causes Shanghai Qibutianxia’s inability to exercise its rights as a shareholder of Shanghai Qiyu to avoid any practical difficulties in enforcing the equity pledge agreement and shall procure or use its reasonable efforts to procure any successors of Shanghai Qibutianxia to comply with the same undertakings as if they were parties to the equity interest pledge agreement. In the event of a breach by Shanghai Qiyu or Shanghai Qibutianxia of contractual obligations under the Contractual Arrangements, our WFOE, as pledgee, will have the right to dispose of the pledged equity interests in Shanghai Qiyu. Shanghai Qibutianxia has undertaken to our WFOE, among other things, not to transfer its equity interests in Shanghai Qiyu and not to create or allow any pledge thereon that may affect the rights and interest of our WFOE without its prior written consent. We are in the process of registering the equity interest pledges described above with the competent office of the State Administration for Industry and Commerce in accordance with the PRC laws. Loan Agreements. Pursuant to the loan agreement among our WFOE, Shanghai Qiyu and Shanghai Qibutianxia, the shareholder of Shanghai Qiyu, our WFOE is entitled to provide interest-free loans, to the extent permitted by laws, regulations and industry policies of PRC, from time to time at such time and amount as it deems appropriate to Shanghai Qibutianxia for the purpose of Shanghai Qiyu’s business operation and development, including, but not limited to directly injecting such funds to the registered capital of Shanghai Qiyu. Each of the loans made under this loan agreement has no fixed term, and unless otherwise agreed, our WFOE shall unilaterally decide when to withdraw the loans, provided that our WFOE shall notify Shanghai Qibutianxia in writing one month in advance. The loan agreement shall remain in effect during Shanghai Qiyu’s term and the renewable period stipulated by the laws of the PRC, and shall automatically terminate after our WFOE and/or other entities designated by our WFOE fully exercise all their rights under the exclusive option agreement. 122 Table of Contents Agreement that allows us to receive economic benefits from the VIEs Exclusive Business Cooperation Agreements. Pursuant to the exclusive business cooperation agreement entered into between our WFOE and Shanghai Qiyu, our WFOE will have the exclusive right to provide Shanghai Qiyu with the consulting and technical services required by Shanghai Qiyu’s business. Without our WFOE’s prior written consent, during the term of the exclusive business cooperation agreement, with respect to the services subject to the exclusive business cooperation agreement and other matters, Shanghai Qiyu and its subsidiaries shall not accept the same or any similar services provided by any third party and shall not establish cooperation relationships similar to that formed by the exclusive business cooperation agreement with any third party. Our WFOE may appoint other parties, who may enter into certain agreements with Shanghai Qiyu, to provide Shanghai Qiyu with the services under the exclusive business cooperation agreement. Pursuant to the exclusive business cooperation agreement, in consideration of the services provided by our WFOE, Shanghai Qiyu shall pay services fees to our WFOE. The service fees, without contravening PRC laws, are equal to the entirety of the total consolidated net profit of the Shanghai Qiyu and its subsidiaries, after the deduction of any accumulated deficit in respect of the preceding financial year(s) (if applicable), operating costs, expenses, taxes and other payments required by the laws and regulations to be reserved or withheld. Notwithstanding the foregoing, our WFOE may adjust the scope and amount of services fees in its discretion taking into account, among other things, the complexity of the services, the exact content and business value of the services, as well as the market price of services of similar types. Unless otherwise agreed upon, the service fee shall be payable by Shanghai Qiyu within five working days after receiving the payment notice sent out by our WFOE. The exclusive business cooperation agreement also provides that our WFOE will have the exclusive ownership of all the intellectual property rights created as a result of the performance of the exclusive business cooperation agreement to the extent permitted by applicable PRC laws. Agreements that provide us with the option to purchase the equity interests in and assets of the VIEs Exclusive Option Agreements. Pursuant to the exclusive option agreement entered into among our WFOE, Shanghai Qiyu and Shanghai Qibutianxia, Shanghai Qibutianxia will irrevocably grant our WFOE an exclusive option to purchase or designate one or more persons to purchase, all or part of its equity interests in Shanghai Qiyu. Further, Shanghai Qiyu will irrevocably grant our WFOE an exclusive option to purchase all or part of its assets, subject to applicable PRC laws. Our WFOE or its designated person may exercise such options at the lowest price permitted under applicable PRC laws. Pursuant to the Exclusive Option Agreement, Shanghai Qibutianxia and Shanghai Qiyu have undertaken, amongst other things, that: (i)without our WFOE’s prior written consent, they shall not in any manner supplement, change or amend the constitutional documents of Shanghai Qiyu, increase or decrease their registered capital, or change the structure of their registered capital in other manner; (ii)they shall maintain Shanghai Qiyu’s corporate existence in accordance with good financial and business standards and practices, prudently and effectively operate its business and handle its affairs, procure Shanghai Qiyu to perform its obligations under the exclusive business cooperation agreement, and procure Shanghai Qiyu to obtain and/or maintain all necessary licenses and permits; (iii)without the prior written consent of our WFOE, they shall not at any time following the signing of the exclusive option agreement, sell, transfer, pledge or dispose of in any manner any assets of Shanghai Qiyu or interest in the business or revenues of Shanghai Qiyu, or allow the encumbrance thereon of any security interest; (iv)unless otherwise mandatorily required by PRC laws, Shanghai Qiyu shall not be dissolved or liquidated without prior written consent by our WFOE; (v)without the prior written consent of our WFOE, Shanghai Qiyu shall not incur, inherit, guarantee or assume any debt, except for (i) debts incurred in the ordinary course of business other than payables incurred by a loan and (ii) debts that have been disclosed to and consented to by our WFOE in writing; (vi)they shall operate all of Shanghai Qiyu’s businesses during the ordinary course of business to maintain its asset value and refrain from any action/omission that may adversely affect Shanghai Qiyu’s operating status and asset value; 123 Table of Contents (vii)without the prior written consent of our WFOE, they shall not cause Shanghai Qiyu to execute any material contract, except the contracts executed in the ordinary course of business or with our WFOE, its direct or indirect offshore parent companies or their direct or indirect subsidiaries; (viii)without the prior written consent of our WFOE, they shall not cause Shanghai Qiyu to provide any person with any loan, financial assistance, security, pledge or any other form of security, or permit any form of security to be created on its assets or equity interests, except those contracts executed in the ordinary and usual course of business; (ix)they shall provide our WFOE with information on Shanghai Qiyu’s business operations and financial condition within 10 days after the end of each quarter or at the request of our WFOE; (x)they shall procure and maintain insurance in respect of Shanghai Qiyu’s assets and business from an insurance carrier acceptable to our WFOE, at an amount and type of coverage typical for companies that operate similar businesses; (xi)without the prior written consent of our WFOE, they shall not cause or permit Shanghai Qiyu to merge, consolidate with, acquire or invest in any person; (xii)they shall immediately notify our WFOE of the occurrence or possible occurrence of any litigation, arbitration or administrative proceedings relating to Shanghai Qiyu’s assets, business or revenue, shall take all necessary actions pursuant to reasonable requests of our WFOE and shall only reach settlement in respect of such proceedings with the prior written consent of WFOE; (xiii)to maintain the ownership by Shanghai Qiyu of all of its assets, they shall execute all necessary or appropriate documents, take all necessary or appropriate actions and file all necessary or appropriate complaints or raise necessary and appropriate defenses against all claims; (xiv)without the prior written consent of our WFOE, Shanghai Qiyu shall not in any manner distribute dividends to its shareholder, provided that upon the written request of our WFOE, Shanghai Qiyu shall immediately distribute all distributable profits to its shareholders; (xv)at the request of our WFOE, they shall appoint any persons designated by our WFOE as the directors, supervisors and/or senior management of Shanghai Qiyu or terminate existing directors, supervisors and/or senior management of Shanghai Qiyu, and perform all relevant resolutions and filing procedures; and (xvi)if Shanghai Qiyu or its shareholder fails to perform the tax obligations under applicable laws, and hence obstructs our WFOE in exercising its exclusive option right, Shanghai Qiyu or its shareholder shall pay the taxes or pay the same amount to our WFOE so our WFOE may pay the taxes on behalf of Shanghai Qiyu or its shareholder. All of the two other VIEs, namely Fuzhou Financing Guarantee and Shanghai Financing Guarantee, and their respective nominee shareholders, have each entered into a set of contractual arrangements, including the voting proxy agreement, equity interest pledge agreement, loan agreement, exclusive business cooperation agreement, exclusive option agreement, with our WFOE, in terms that are substantially similar to the agreements described above. On April 29, 2021, Shanghai Qibutianxia, the sole shareholder of Fuzhou Microcredit, transferred all of its equity interest in Fuzhou Microcredit to Shanghai Qiyu, and Shanghai Qiyu became the sole shareholder of Fuzhou Microcredit. On April 30, 2021, our WFOE, Fuzhou Microcredit and Shanghai Qibutianxia entered into a termination agreement, which terminated the contractual arrangements entered into among our WFOE, Fuzhou Microcredit and Shanghai Qibutianxia. Therefore, Fuzhou Microcredit ceased to be the VIE, but a subsidiary of Shanghai Qiyu. In the opinion of our PRC legal counsel, Commerce & Finance Law Offices: ● the ownership structures of the VIEs in China and our WFOE are not in violation of applicable PRC laws and regulations currently in effect; and ● the proposed contractual arrangements between our company, our WFOE, the VIEs and their shareholders governed by PRC law are valid, binding and enforceable under PRC law, and will not result in any violation of applicable PRC laws currently in effect. 124 Table of Contents However, our PRC legal counsel has also advised us that there are substantial uncertainties regarding the interpretation and application of PRC laws, regulations and rules. Accordingly, the PRC regulatory authorities may take a view that is contrary to the opinion of our PRC legal counsel. It is uncertain whether any new PRC laws or regulations relating to variable interest entity structures will be adopted or if adopted, what they would provide. If we or the VIEs are found to be in violation of any existing or future PRC laws or regulations, or fail to obtain or maintain any of the required permits or approvals, the PRC regulatory authorities would have broad discretion to take action in dealing with such violations or failures. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Corporate Structure—If the PRC government deems that the contractual arrangements in relation to the VIEs do not comply with PRC regulatory restrictions on foreign investment in the relevant industries, or if these regulations or the interpretation of existing regulations change in the future, we could be subject to severe penalties or be forced to relinquish our interests in those operations” and “Item 3. Key Information—D. Risk Factors—Risks Related to Doing Business in China—Uncertainties in the interpretation and enforcement of PRC laws and regulations could limit the legal protections available to us.” D. Property, Plants and Equipment Our corporate headquarters is located in Shanghai, where we lease office space with an area of 11,726 square meters as of December 31, 2025. We also lease an area of 4,692 square meters in Beijing, an area of 4,290 square meters in Hefei, an area of 3,120 square meters in Shenzhen, an area of 2,011 square meters in Xi’an, an area of 1,855 square meters in Chengdu, an area of 1,169 square meters in Chongqing, an area of 1,410 square meters in Fuzhou, an area of 1,235 square meters in Beihai, an area of 797 square meters in Haikou, an area of 288 square meters in Zhuhai, an area of 204 square meters in Zhengzhou, an area of 188 square meters in Hong Kong, and an area of 40 square meters in the United Kingdom as of December 31, 2025 as office space. The lease term varies from one year to three years. Our servers are primarily hosted at internet data centers and located in Beijing, Shanghai and Luoyang. We expect to seek additional office space as needed to accommodate future growth. Qifu Changfeng is a joint venture company established in Shanghai, China to develop and build our regional headquarters and the affiliated industrial park. We and Shanghai Changfeng Investment (Group) Co., Ltd., or Changfeng, an independent third party, hold 70% and 30%, respectively, of the equity interests in Qifu Changfeng. The construction has been completed, and the new regional headquarters and industrial park have been officially put into use since January 2026, enabling us to consolidate all of our Shanghai-based facilities and employees from various departments into a single office space, which we expect will further save administrative costs and improve operating efficiency. As of December 31, 2025, shareholders of Qifu Changfeng had provided a total of RMB1.07 billion to acquire land use rights of the parcel of land on which our regional headquarters and affiliated industrial park stand and support the joint venture company’s operations, of which RMB0.32 billion was funded by Changfeng.