A.History and Development of the Company We are a Cayman Islands holding company and conduct our operations mainly through our operating subsidiaries in the UAE and China. We commenced our business and launched our Yalla mobile application in April 2016 through FYXTech Limited, or FYXTech BVI, which was established under the laws of the British Virgin Islands, and Shenzhen Yale Technology Co., Ltd, or Shenzhen Yale, which was established under the laws of the PRC. We undertook a reorganization in 2018, or the Reorganization, to streamline our organizational structure. We established FYXTECH CORPORATION, or FYXTech Cayman, under the laws of the Cayman Islands in February 2018 as our current ultimate holding company and changed its name to Yalla Group Limited in November 2019. After the establishment of the ultimate holding company, we established FYXTECH Group Limited in the British Virgin Islands in March 2018 to hold FYXTECH HK Limited, our Hong Kong subsidiary established in March 2018. FYXTECH HK Limited in turn became the holding company of two operating subsidiaries in the PRC, namely Shenzhen Moov Technology Co., Ltd, or Shenzhen Moov, and Hangzhou Yale Information Technology Co., Ltd., or Hangzhou Yale Information (which is directly held by PARCHIS HK Limited, our Hong Kong subsidiary established in July 2022), which were established in October 2019 and December 2022, respectively. We also established FYXTECH YALLA LIMITED in the British Virgin Islands in June 2018 to hold an operating subsidiary in the UAE, namely Yalla Technology FZ-LLC, or Yalla UAE, which was established in July 2018. Yalla UAE holds an operating subsidiary in the UAE, namely Waha Technology FZ-LLC, or Waha UAE, which was established in September 2021. As part of the Reorganization, FYXTech Cayman issued shares to the co-founders of FYXTech BVI and Shenzhen Yale. Upon the issuance of such shares, the equity structure of FYXTech Cayman was substantially identical to that of FYXTech BVI and Shenzhen Yale on a fully-diluted basis. In addition, from May 2018 to December 2018, FYXTech BVI and Shenzhen Yale transferred their business operations, including assets and employees, to Yalla UAE and Hangzhou Yale Technology Co., Ltd., respectively. Upon the completion of the Reorganization in December 2018, FYXTech BVI and Shenzhen Yale ceased to be consolidated within our group. In addition, we established FYXTECH Play Limited in the British Virgin Islands in August 2021 to hold 60% of interests of Yalla Game Limited, which was established under the laws of the Cayman Islands in August 2021. Yalla Game Limited holds Yalla Play Limited, which was established under the laws of the British Virgin Islands in September 2021. Yalla Play Limited in turn became the holding company of two operating subsidiaries established in November 2021, namely Desert HK Limited, or Desert HK, in Hong Kong and YG Technology FZ-LLC, or YG Technology, in the UAE. Desert HK holds an operating subsidiary in the PRC, namely Shenzhen Moojo Technology Co., Ltd., or Shenzhen Moojo, which was established in March 2022; YG Technology holds Shenzhen Moojoyo Technology Co., Ltd., or Shenzhen Moojoyo, a PRC operating subsidiary established in May 2022. 39 We further established FYXTECH WAHA Limited in the British Virgin Islands in June 2022 to hold an operating subsidiary in the UAE, namely Metaverse Technology FZ-LLC, or Meta UAE, which was established in June 2022. We currently operate our business mainly through Yalla UAE, Waha UAE, Meta UAE, Shenzhen Moov, Hangzhou Yale Information, YG Technology, Shenzhen Moojo and Shenzhen Moojoyo. Yalla UAE and its subsidiary Waha UAE function as our primary business operation center and engages in sales, marketing, customer service and other business operations. Meta UAE and Hangzhou Yale Information both perform technology and product development functions. Shenzhen Moov primarily performs marketing and financial reporting functions. YG Technology performs game launching functions. Shenzhen Moojo and Shenzhen Moojoyo both perform gaming operational support functions. Our ADSs, each representing one of our Class A ordinary share, have been listed on the New York Stock Exchange since September 30, 2020 under the symbol “YALA.” B.Business Overview Overview We operate two flagship mobile applications, Yalla, a voice-centric group chat platform, and Yalla Ludo, a casual gaming application featuring online versions of board games popular in MENA, with in-game voice chat and localized majlis functions. Social gatherings for group chatting and other casual entertainment have been a long-standing tradition in MENA. A common example is majlis, a gathering event of friends and neighbors to socialize, exchange gifts and play casual games. Majlis is deeply ingrained in the cultures of many countries in MENA and has remained popular for centuries. Since the founding of our business, we have been helping the local people in MENA to bring their traditions online and continue their social enjoyment in the mobile Internet era. Our products mirror what people enjoy doing in majlis, cafés and other offline leisure and entertainment settings and make social interactions more convenient. Leveraging our cultural insights, we identified voice chats to be uniquely suitable for online social networking and gaming in MENA and pioneered the development of a social networking and gaming platform in the region. Building on the success of Yalla and Yalla Ludo, we continue to add engaging new content, creating a regionally-focused, integrated ecosystem dedicated to fulfilling MENA users’ evolving online social networking and gaming needs. Through our subsidiary, Yalla Game Limited, we have expanded our capabilities in mid-core and hard-core games in the MENA region, leveraging our local expertise to bring innovative gaming content to our users. In addition, our growing Yalla ecosystem includes YallaChat, an instant message, or IM, product tailored for Arabic users, WeMuslim, a product that supports Arabic users in observing their customs, and casual games such as Yalla Baloot and 101 Okey Yalla, developed to sustain vibrant local gaming communities in MENA. We are also actively exploring outside of MENA with Yalla Parchis, a Ludo game designed for the South American markets. Our mobile applications deliver a seamless experience that fosters a sense of loyalty and belonging, establishing highly devoted and engaged user communities through close attention to details and localized appeal that profoundly resonates with our users. Leveraging the above advantages, we have built a large and vibrant Yalla community and are the largest MENA-based online social networking and gaming company in terms of revenue in 2022 according to Frost and Sullivan. In the fourth quarter of 2025, approximately 44.8 million users visited our platform on average each month, and the number of paying users on our platform reached 10.4 million during the same period. Why Users Love Us We believe “Yalla” has become synonymous with fun and enjoyable mobile social experience in MENA. Users love our platform for the following reasons: •Superior Social Experience We provide a mobile platform for users to enjoy superior social experience online. Our mobile applications were inspired by offline social leisure activities in MENA. We bring such activities to the mobile Internet to make them more convenient. Our flagship mobile application, Yalla, primarily features Yalla rooms, which may be viewed as the online version of majlis or cafés, where people spend their leisure time in casual chats. On the other hand, Yalla Ludo resembles a family living room where family members and friends play simple board games that are highly popular in MENA, such as Ludo, Domino and Snakes & Ladders. We carefully preserve the traditional features and tastes of these popular games so that our users can easily apply their offline experience to our mobile platform. 40 Leisure is a mentally beneficial experience, and we believe that leisure activities should be done for their own sake. Our users gather on our platform for a relaxing social leisure experience. Whether their time is spent on an hour of casual chatting or a few rounds of casual games, social interactions and companionships are what our users cherish. We aim to provide our users with a pure social leisure experience. While our users may receive virtual gifts and accumulate virtual currencies on our platform, none of the virtual gifts and virtual currencies are convertible into real money under any circumstance and our users are unable to sell such virtual items to other users through our platform. Instead, users send virtual gifts to express their appreciation of contributions by other users or gain recognition within the community. •Localized Appeal We have developed the leading social networking and gaming platform tailored to the local cultures of our target markets, particularly MENA. We believe localizing is much more than using the local language in user interfaces. Leveraging our insights into MENA culture and local user preferences, we infuse our user interfaces with local cultural elements. For non-English versions of Yalla, we update the user interface with color themes and logos related to specific local holidays to celebrate with our users, and virtual gifts are typically designed based on local customs. As a result of our close attention to detail, our mobile applications deliver a seamless user experience and foster a strong sense of belonging among users. Such localized appeal resonates with users and allows us to build a highly loyal and engaging user community. Our ability to faithfully preserve the traditional flavors of local offline social life also differentiates us from other platforms. •Highly Interactive User Community Our platform is designed to maintain users’ equal status, thereby encouraging all of them to freely communicate and interact with each other. There are no differences of influencers and followers, or gurus and newbies. Instead of passively consuming content, users come to our platform in order to actively participate in the social leisure activities we offer. We believe these social interactions foster a sense of community among users and enable our platform to attract and retain users more effectively compared to other platforms. Our Financial Performance We have experienced continued revenue growth in recent years. We primarily generate our revenue by providing group chatting and games services. Individual users consume virtual currencies to purchase virtual items and upgrade services or play games on our platform. Virtual items primarily consist of various virtual gifts and privileges in chat rooms or games. Upgrade services primarily consist of VIP rights or premium membership on our platform. Our revenues increased by 6.5% from US$318.9 million in 2023 to US$339.7 million in 2024 and further increased by 0.7% to US$341.9 million in 2025. Our innovative business model focuses on users’ interactions and social networking experience on our platform. Therefore, we do not incur significant content acquisition cost, such as incentive fees to key users or costs for acquiring media content. Our user acquisition channels have been cost-effective. As a result, we are able to achieve high profitability. Our Business The Yalla Community We have built a loyal and highly interactive Yalla community by offering superior user experience tailored to local cultures. A substantial number of our users are Arabic-speaking, and activities on our platform mirror popular offline social leisure activities in MENA. Furthermore, we have been working on expanding our product portfolio to serve MENA users’ evolving needs in online social networking and gaming as well as to explore oversea markets. Besides our two flagship mobile applications Yalla and Yalla Ludo, we have also established Yalla Game Limited to focus on mid-core and hard-core game business in MENA. In addition, we launched three more casual game mobile applications targeting different regions, namely Yalla Baloot, a card game designed for Saudi Arabian users, 101 Okey Yalla, a board game designed for Turkish users, and Yalla Parchis, a South American version of Yalla Ludo. We also launched YallaChat, which is an IM product designed specifically for Arabic users, as we firmly believe that in the digital era, an IM product with features tailored to local users’ preferences addresses a fundamental need. In addition, we have launched WeMuslim, a product that supports Arabic users in observing their customs. Though we expect that these various new products will enable us to further diversify our revenue streams in the future, currently our flagship mobile applications, Yalla and Yalla Ludo, still contribute to the majority of our revenues. 41 The chart below illustrates ways for users to leisurely gather, enjoy social entertainment and build social networks in the Yalla community. As a core feature of our platform, Yalla rooms enable voice-based, real-time, many-to-many interactions. The key additional forms of interactions available on our platform are casual games, messaging and moments, each offering differentiated value propositions to users. Casual games, such as Ludo, Domino and Snakes & Ladders, cater to users’ instincts for playing and fun. Messaging allows users to build friendships through in-depth conversations. Moments satisfy users’ desire for self-expression. These interactive features are self-reinforcing and help to enhance user engagement and promote a sense of community among our users. A Refreshing and Fun-filled Journey into the Yalla Community We have developed the leading social networking and gaming platform tailored for MENA. For Arabic-speaking users, the journey into the Yalla community is both familiar and refreshing. The Yalla community is familiar to a newcomer, because our platform faithfully preserves the traditional flavors of offline social life in MENA. The vibrant Yalla rooms resemble majlis and cafés, where people spend their leisure time in casual chats. The experience is also refreshing, since we are different from other mobile platforms that use local languages without incorporating local cultures. Users find our localized features heart-warming and develop a sense of belonging towards the Yalla community. By way of illustration, the following paragraphs describe the refreshing and fun-filled journey of an Arabic-speaking new user into the Yalla community, as such user explores the interactive features on our platform. These interactive features play a critical role in our efforts to enhance user engagement and monetize user base. We call this exemplar user Amir to simplify the description below. Welcoming Experience For Newcomers To convert a new user into a loyal user, we endeavor to quickly familiarize a newcomer like Amir with our platform, especially Yalla rooms. Through this welcoming experience, we help Amir integrate into the Yalla community. •Welcoming Page. When launching Yalla for the first time, Amir is presented with a welcoming page. To make Amir feel at home, the page is customized based on his language setting. The style of our user interface is casual, fun and refreshing, which reflects the spirit of the Yalla community. •Room Recommendations. Yalla rooms are a core feature of our platform. After Amir launches Yalla, our platform automatically recommends rooms for him. He may choose a room based on its interest tags, its number of users or other information displayed on the screen. Our room recommendations feature is user friendly and allows Amir to explore a broad variety of options. 42 Set forth below are screenshots of the welcoming page and room recommendations. Vibrant Yalla Rooms Yalla rooms provide a virtual meeting place for our users to leisurely gather and enjoy voice-based, many-to-many social interactions. After Amir enters a Yalla room, he may participate in voice chats, non-voice chats, gifting and other interactive features, all of which are designed to foster a lively online community. The screenshot of a Yalla room is set forth below. •Voice Chats. Among the first things that capture Amir’s attention are the lively voice chats. The other users in the room notice Amir and warmly greet him, which makes him more interested in the conversations. He is then invited to speak on a microphone. A Yalla room can have up to ten microphones, which allow ten users to speak at the same time and have their voice heard by others in the room. Given its leisure nature, voice chats can cover any topic and may spontaneously wander from one topic to another. We believe this is one of the main reasons why users are attracted to our Yalla app—they can chat freely, which is a very enjoyable and relaxing social experience. 43 •Text Chats. The Yalla room interface contains a section that displays non-voice chats. This section is also very lively, and users may send texts, emojis or pictures. •Gifts. After Amir tells a good joke, he receives a virtual gift from another user. He feels delighted by the gift and wishes to send gifts as well. After he opens the list of available gifts, he is immediately impressed by the beautiful designs. As part of our localized appeal, the virtual gifts offered to Arabic-speaking users are based on local customs in MENA. Users send virtual gifts to express their appreciation of contributions by other users or gain recognition within the community. To incentivize gifting, we have created rankings to recognize users who have given the most gifts, as well as users who have received the most gifts, and we refresh these rankings on a real-time basis. •Additional Interactive Features. Amir also explores other interactive features that make Yalla rooms lively. Users can upload photos to share with others in a room. Various simple game tools, such as rock-paper-scissors, are available for users to integrate with the small games they play in Yalla rooms. A user can also share virtual currencies with others under the “Lucky Golds” feature to bring excitement to the room. A screenshot of these interactive features is set forth below. Room recommendations among friends are an effective way for users to find interesting rooms, thereby making these rooms more lively. Amir can recommend Yalla rooms to his friends by sending them room invitations. He can also view the rooms that his friends are currently in and enter the room that interests him the most. As Amir becomes more involved in the Yalla community and establishes his own social circle, he wants to create his own room and take the center of the stage. As the room chair, Amir is able to set interest tags of the room, which reflect his preferred topics for conversations. After creating his Yalla room, Amir is able to meet more people of similar interest or backgrounds. With more like-minded friends in the Yalla community, Amir spends more time on our platform. Messaging and Moments To foster social connections in the Yalla community and enhance user stickiness, we offer additional features for users to interact and access entertaining content. •Messaging. We provide a two-way messaging function on Yalla. After Amir adds another user as a friend, they can exchange private text messages directly without entering a Yalla room or experiencing any interruption by other users. Therefore, they can engage in more in-depth conversations to bond further. Besides texts, Amir is also able to send voice clips and gifts on the messaging page. 44 •Moments. Moments are a mini-blog feature on our platform. Besides his friends’ moments, Amir is also able to “follow” users who cover topics that interest him. We have embedded interactive features in moments to facilitate user interactions. When Amir finds a moment that he enjoys, he can share with friends, comment on it or “like” it. He can also give a virtual gift to the user who created the moment. Gifts allow Amir to express appreciation for good content, thereby building social connections with like-minded users. Gifts also incentivize users to post high quality content, which will in turn make the moments feature more attractive to users. In addition, Amir can explore “featured” and “topics” sections to find more interesting content. In the “featured” section, we select moments that are popular among users. The “topics” section presents moments based on their topics. The “topics” section helps users find friends with common interest, while also facilitating the creation of more in-depth content in the Yalla community. Screenshots of a messaging page and a moments page are set forth below. 45 Casual Games A friend invites Amir to play three casual games on our platform, Ludo, Domino and Snakes & Ladders, and he eagerly checks out these games on Yalla Ludo, as these games are highly popular board games in MENA and can be learned by beginners with relative ease. Screenshots for Ludo, Domino and Snakes & Ladders games are set forth below. We offer casual games to enrich the entertainment options on our platform and further enhance user interactions. These games help Amir make more friends by serving as icebreakers. While playing games, he can voice-chat and bond with other players. Our system provides two options for player matching in a game. Amir can choose to be assigned with a player that our system selects based on certain criteria, such as language setting, and meet new friends through this function. He can also play the games with friends. Amir needs to spend virtual currencies in order to start a game on Yalla Ludo, and the winner of the game can keep a portion of the virtual currencies paid by the other player. He can also use virtual currencies to gain certain advantages in games. In addition, Amir may socialize with other users through chat rooms on Yalla Ludo. •Joyful Yalla Ludo Chat Rooms. Yalla Ludo chat rooms provide players a virtual gathering place to socialize and discuss all kinds of topics while playing Ludo, Domino and Snakes & Ladders. With diverse functions to easily interact with other players in the chat room, Amir can choose to participate in voice-chat or text-chat, send virtual gifts as well as use other interactive functions, all of which aim to bring more fun to our players when playing Yalla Ludo in the Yalla community. 46 Set forth below are screenshots of the chat room recommendations and chat rooms on Yalla Ludo. Localized Online Events We organize localized online events, most of which are based on traditional holidays, to further enhance user engagement and interactions. In 2025, we organized 84 online events in Yalla and 133 online events in Yalla Ludo, all of which were based on Islamic traditional festivals or localized Arabic designs to enhance user engagement and interaction. For example, after Eid al-Fitr (March 29, 2025), Amir joined online celebrations while keeping up with his religious routines. He voice-chatted with friends in Yalla rooms, shared photos on Yalla Moments, sent and received activity gifts to earn shining points on the ranking list, making his festival even brighter. Before sleep, Amir switched to Yalla Ludo, played Ludo games under the festival event guidelines, completed the activity tasks and received the exclusive Ludo chessboard theme for Eid al-Adha. From June 4 to June 19, 2025, our users celebrated Eid al-Adha on our platform by sending customized gifts and participating in online tasks. Approximately 3.4 million users participated in the event. Monetization We primarily generate our revenue by providing group chatting and games services. Individual users consume virtual currencies to purchase virtual items and upgrade services or play games on our platform. Virtual items primarily consist of various virtual gifts and privileges in chat rooms or games. Upgrade services primarily consist of VIP rights or premium membership on our platform. Users buy our virtual currencies through third-party payment platforms. Our virtual currencies are non-refundable and do not have expiration date. We believe our users come to our platform primarily for an enjoyable social experience, and not to make money. We have designed our platform settings to ensure that our users cannot use our platform for money-making purposes. On Yalla, while our users may receive gifts from other users, such gifts cannot be redeemed into real money. Similarly, on Yalla Ludo, while our users may win virtual currencies from other users that they play games with, they can only use such virtual currencies to play more games and/or gain advantages in games. Our users are not allowed to convert any of our virtual currencies into real money or sell our virtual currencies to other users under any circumstances. 47 Customer Service Our customer service is available on a 24/7 basis. We engage third-party service providers to perform customer service tasks. Our in-house customer services and operations staff is responsible for managing the customer service representatives employed by the third-party service providers and providing customer services to certain high-paying users, as well as other aspects of operating our online platform. Our users may submit inquiries, feedbacks or complaints by sending messages via Yalla rooms and the “FAQ & Feedback” portals in our mobile applications at any time. Upon receipt of complaints or inquiries, our customer service representatives will conduct investigations and promptly provide users with explanations and solutions for the issues they report. We also utilize an automated system to address certain common questions from users. We require complaints to be attended to within one business day. In addition to the routine customer service that is available to all users on our platform, we also provide premium customer service to certain high-paying users. We identify and contact these users and offer them 24/7 access to customer service representatives, which allows the users to receive responses and services in a more timely manner. Content Management and Monitoring An engaged and interactive user community is key to our success and we strive to cultivate and maintain a healthy and inviting culture. Our terms of service set out types of content strictly prohibited on our platform, and we have also developed a content monitoring system that utilizes primarily automation, as well as manual screening, to filter inappropriate content. Our operations staff is responsible for reviewing and handling content on our platform to maintain a healthy ecosystem and promote a positive user experience. They are aided by software and technologies to screen text and images that users upload to our system. We also encourage users to assist us with content monitoring. Room chairs and ministers are incentivized to maintain a healthy environment in their rooms to attract and retain members. They have the ability to remove users from their rooms for rule violations. Other users are able to conveniently notify us about inappropriate behavior on our platform. Branding and Marketing We believe that our interactive community culture and large user base have led to repeated user visits and a strong word-of-mouth effect that strengthens awareness of our brand among users. As a supplement to word-of-mouth marketing, we often promote our brand and platform through online marketing. We market our platform through advertisements on app stores, Google Ads and various social media applications, such as Facebook, Twitter and Snapchat. We also collaborate with social media influencers to promote our platform. Technology Our advanced and stable technology infrastructure and capabilities allow us to provide users with reliable access to our platform and ensure superior user experience. Our platform incorporates the following features: •Live audio streaming capabilities. We implement third-party audio streaming solutions from industry-leading providers on our platform. We also strive to adopt the latest industry standards for mobile audio interactions. Our platform enables real-time multi-cast audio interactions among users, which provides our users with a superior experience. Our mobile applications are designed to run smoothly on all mobile phones, with minimum bandwidth requirements of approximately 512 kilobytes per Yalla room user per second. •Content recommendation engine. We have been developing and implementing an individualized content recommendation engine. We established this engine based on the user behavior data that we have accumulated from 1,037.3 million registered users as of December 31, 2025, analyzed through our proprietary algorithms to achieve accurate user profiling. Such accurate user profiling in turn allows our content recommendation engine to match users with their favorite content. 48 •Cloud-based network infrastructure. We have deployed a cloud-based network infrastructure, which can handle multi-party real-time online audio interactions. We currently use servers provided by industry-leading cloud service providers that are hosted mainly in data centers in Germany, the United States, Ireland and Mexico. Our cloud-based network infrastructure provides high quality data delivery and allows multiple users to interact online from anywhere in the world conveniently in real time. Our customized and proprietary systems are highly automated and designed to ensure scalability and reliability to support growth in our large user base. The number of servers contributes significantly to our fast streaming speed and reliable services, and can be expanded with comparative ease, given the relative convenience of renting data centers to host additional servers in any high traffic region in our network. Product Development We believe that our ability to develop mobile applications, product features, functions and services tailored to the needs of our user base has contributed to the success of our business. We have been able to rapidly scale our product development output and deliver an increasing range of products and services to fulfill the needs of our expanding user base and optimize the quality of user experience. Our technology and product development team works on both back-end and front-end development of our products and services, including (i) the enhancement of network and server structures, as well as data distribution and transfer technologies to achieve lower latency and reduce interruptions, and (ii) the creation of new features and functions to meet the diverse needs of our users. We plan to continue to invest in technology and product development in order to reinforce and solidify our industry-leading position. Intellectual Property Intellectual property is an important aspect of our business, and our practice is to seek protection for our intellectual property as appropriate. We safeguard our proprietary technologies through contractually requiring our employees to keep all our proprietary technologies confidential, as well as seeking to protect our technologies through patents and copyrights. Our trademarks, including “Yalla,” “Yalla Ludo,” “Yalla Parchis,” “101 Okey Yalla” and “YallaChat,” are a critical component of the value of our business. As of December 31, 2025, we had 177 registered trademarks, 29 pending trademark applications and 223 registered copyrights in 52 jurisdictions, including a number of jurisdictions in MENA. As of December 31, 2025, we had 340 domain names, including yalla.com, and two invention patents. We face certain risks relating to our intellectual property. For further information, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry—Our intellectual property may not provide adequate protection to us, and we may not be able to prevent others from unauthorized use of our intellectual property, which could harm our business and competitive position” and “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry—We may be subject to intellectual property or other third-party rights infringement claims, which could be time-consuming and costly to defend and may result in diversion of our financial and management resources.” Data Privacy and Protection We consider the protection of the personal privacy of each of our users to be of paramount importance. We believe it is crucial that our users understand how we handle their information so that they feel comfortable while accessing our platform. To this end, we have developed a company-wide policy on data collection and use practices to preserve individual privacy rights in all respects, the key principles of which include: (i) providing adequate notice to users as to how their data is being collected and used, (ii) encrypting user data stored on our system, (iii) limiting access of user data to authorized employees and (iv) making reasonable efforts to prevent loss or leakage of user data. We believe the measures we take with respect to data privacy and protection are consistent with industry standards. For risks relating to data privacy and protection, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry—Concerns about collection, use, retention, transfer, disclosure, processing and security of personal data could damage our reputation and deter current and potential users from using our platform and services, or subject us to significant compliance costs or penalties, which could materially and adversely affect our business, financial condition and results of operations.” 49 Competition We operate an innovative business model of building a social networking and gaming community. As one of the few players in this market, we directly compete with other social networking and gaming platforms for users. In addition, we compete with other social networking and gaming platforms. Some of our larger competitors have substantially broader service offerings and more working capital to support heavy spending on sales and marketing. We believe that our ability to compete effectively for users depends on many factors, including user experience on our platform, preservation of our vibrant community culture, effectiveness of content monitoring and review, our marketing efforts and reputation of our brands. In addition, as our business continues to grow, we face significant competition for highly skilled personnel, including management, engineers, product managers and sales and marketing personnel. The success of our growth strategy depends in part on our ability to retain our existing personnel and recruit additional highly skilled employees. Insurance We maintain the statutory social insurance as required by the relevant local laws and regulations. In addition, we maintain commercial healthcare insurance for all full-time employees and enhanced healthcare insurance for senior management. However, we do not maintain product liability insurance or insurance policies for our properties. We believe that our existing insurance coverage of our business is consistent with what we believe to be customary for business of our size and type and in line with the standard commercial practice in our industry. Regulation This section sets forth a summary of the most significant rules and regulations that affect our business activities in the UAE and China. United Arab Emirates Overview of the Emirate of Dubai Introduction The UAE is a federation of seven emirates made up of Abu Dhabi, Dubai, Sharjah, Ajman, Umm Al Quwain, Fujairah and Ras Al Khaimah. The UAE has one of the most liberal business environments in the Middle East focused around economic liberalization and promoting the role of the private sector. There are currently no exchange controls on the remittance of profits or repatriation of capital. Additionally, the UAE enjoys low tariffs, and there are virtually no restrictions on foreign trade. Legal system There are three primary sources of law in the UAE: federal laws and decrees, local laws and Sharia (Islamic law). The secondary source of law is trade custom or practice. In the absence of federal legislation on areas specifically reserved to federal authority, the ruler or local government of each emirate will apply his or its own rules, regulations and practices. Pursuant to its right under the federal constitution (established between the emirates on the creation of the UAE and permanently adopted in July 1996), or the UAE Constitution, the Emirate of Dubai has elected to maintain its own court system, separate from that of the federation, and the courts of Dubai have sole jurisdiction to hear cases brought in Dubai. Although both federal and Dubai courts have a similar three-tier structure (Court of First Instance, Court of Appeal and Court of Cassation/Supreme Court), Dubai has retained complete autonomy over its courts in all matters, including the appointment of judges. In accordance with the UAE Constitution, however, the Dubai courts will first apply federal law where this exists and, in its absence, the laws of Dubai. There are federal codes of law which apply in Dubai and the other emirates dealing with the most important and fundamental principles of law, including civil, commercial, civil procedure, companies, intellectual property, immigration, maritime, industrial, banking and employment law. In contrast, many of the laws enacted by the ruler of the Emirate of Dubai, or the Ruler, relate to matters which are more administrative in nature, such as the establishment and operation of government affiliated entities. In addition, free zones have been created in Dubai. Such free zones have, to varying degrees, different rules and regulations compared to the rest of the emirate. For example, the financial free zones in Dubai are independent of the civil and commercial laws of the UAE, but remain subject to UAE criminal law. Other types of free zones are still subject to the civil, commercial and criminal laws applicable in the UAE, provided that such laws do not contradict the rules and regulations of the relevant free zone. Our UAE subsidiaries are not incorporated in a financial free zone and therefore remain subject to civil, commercial and criminal laws in the UAE. 50 Article 5 in the Federal Law No (32) of 2021 on Commercial Companies, or the UAE Companies Law, which is the federal law governing commercial companies established in the UAE mainland, states that the provisions of the UAE Companies Law shall not apply to companies established in the free zones if a special provision to this effect is contained in the laws or regulations of the relevant free zone. With the exception of the financial free zones, which require a federal decree, the creation of separate legal systems for each free zone is primarily authorized by local laws or decrees which are issued by the ruler of each concerned emirate. Free Zone Regulations Our subsidiaries in the UAE are located in the Dubai Development Authority free zone, or the DDA free zone, in the Dubai Internet City cluster, and are therefore governed by the Dubai Creative Clusters Private Companies Regulations 2016, or the DDA Regulations. In addition to the DDA Regulations, the DDA free zone authority, or the DDA, which is the authority that governs the DDA free zone has issued several rules and regulations governing companies set up in the DDA free zone, concerning employment matters, broadcasting and publishing regulations, fit-out guidelines, etc. which are to be adhered to by companies set up in the DDA free zone. The free zone, now known as the DDA free zone, was initially established in 2000 pursuant to Law No. (1) of 2000 on Establishing the Dubai Technology, Electronic Commerce and Media Free Zone issued by the Ruler of Dubai. The DCC free zone was initially known as Dubai Technology and Media Free Zone. Pursuant to Dubai Law No. (1) of 2006 amending the Dubai Technology and Media Free Zone Law No. (1) of 2000, the free zone was renamed as Dubai Technology and Media Free Zone and the free zone authority governing the free zone was named Dubai Technology and Media Free Zone Authority. In accordance with Law No. (15) of 2014 concerning the Creative Clusters in the Emirate of Dubai, the Dubai Technology and Media Free Zone was renamed as Dubai Creative Clusters free zone while the authority governing the free zone was renamed as the Dubai Creative Clusters Authority. Finally, pursuant to Law No. (10) of 2018, amending the Dubai Creative Clusters Authority, Dubai Creative Clusters free zone was renamed as the DDA free zone and consequently the authority governing it was renamed as the DDA. The DDA is the primary regulator of the DDA free zone, which comprises numerous clusters including Dubai Internet City. The DDA is responsible for issuing licenses for all companies incorporated in the DDA free zone. Businesses that have been incorporated in the DDA free zone are subject to the regulations of the DDA, together with the federal laws of Dubai and the UAE (to the extent applicable). Regulations Relating to Companies The principal legislation governing companies incorporated in the DDA free zone, such as our UAE subsidiaries, is the DDA Regulations. The DDA Regulations exempt companies incorporated any of the clusters in the DDA free zone from the ambit of the UAE Companies Law, save for specific provisions concerning liquidation terms. In cases where the DDA Regulations do not explicitly address certain terms, recourse is made to the UAE Companies Law. Regulations Relating to Commercial Activities The provisions of Federal Law No. 50 of 2022 as amended, on commercial transactions, or the Commercial Code, generally apply to companies incorporated in the DCC free zone. The Commercial Code covers a broad range of commercial and banking transactions and contains provisions relating to, among other things, commercial obligations, commercial pledges, commercial agency, commercial papers and bankruptcy and liquidation. The provisions of Federal Law No. 15 of 2025 as amended, regarding civil transactions, or the Civil Code, generally apply to commercial transactions to the extent they do not conflict with the corresponding provisions of the Commercial Code. The Civil Code governs, among other things, basic contract law principles, property rights and the creation of various security interests. The Civil Code also contains general provisions imposing liability arising from intentional and negligent acts. Such provisions are derived from the disciplines and principles of Sharia. The Civil Code further provides for a distinction between direct and indirect (or consequential) harm, but does not define these terms. 51 Regulations Relating to Employment UAE Federal Law No. (33) of 2021 regulating labor relations, as amended, together with Cabinet Resolution No. (1) of 2022 on the Executive Regulations to UAE Federal Law No. (33) of 2021, and Ministerial Resolution No. (27) of 2023, or collectively the Labor Law, applies to all private-sector employees working in the UAE, except for those working in the Dubai International Financial Centre or the Abu Dhabi Global Market free zones, and therefore applies to our subsidiaries. The Labor Law governs, among other things, minimum employee leave entitlements (for example, sick leave, annual leave and maternity leave), working hours and overtime, work-related injuries and safety standards. The Labor Law also sets out specific instances where compensation may be awarded to an employee who is found to have been unlawfully dismissed (essentially, circumstances of victimization), as defined under the Labor Law. Such compensation, if awarded, would be awarded by the courts and may not exceed the equivalent of three months’ fixed salary. The Labor Law also provides for compensation payable to workers for injuries sustained during the course of their employment. The Labor Law also provides for a mandatory end-of-service gratuity to be paid to non-qualifying UAE or GCC-national employees upon termination of their employment, subject to the employee having completed at least one year’s continuous employment with their employer and capped at the equivalent of two years’ full pay (basic salary plus allowance). End-of-service gratuity is calculated based on basic salary with reference to a statutory formula. Essentially, it equates to 21 calendar days’ basic salary for each of the first 5 years of service and 30 calendar days’ basic salary for each year of service after that, with a pro-rated amount for part-years of service. Under the current Labor Law, there is no longer any provision for forfeiture or reduction of end-of-service gratuity entitlement in certain termination circumstances. As such, provided an employee has completed the requisite one year’s employment, any non-qualifying UAE or GCC-national employee will be entitled to an end of service gratuity payment on termination of employment, whatever the reason for termination. UAE nationals and nationals of other GCC countries are entitled to be registered in the state pension. The UAE state pension scheme (excluding the Emirates of Abu Dhabi and Sharjah) is run by the General Pension and Social Security Authority. Employers and employees may not contract out of these minimum standards of employment established by the Labor Law, but they may agree to more generous contractual provisions. Trade unions and collective bargaining are not recognized under the Labor Law. In addition to the Labor Law, all companies operating within Dubai Internet City, or the DIC, which is within the remit of the DDA, are also subject to the Dubai Technology and Media Free Zone Employment Regulations 2004 as amended and/or supplemented by way of further decisions implemented by the DDA, hereinafter, the Employment Regulations. The Employment Regulations authorize the DDA to sponsor employees’ residence visas, and contain provisions relating to the identity cards and passports of employees, the provision of medical care, as well as health and safety standards for employees. While applications for visas within the DIC are made to the DDA, it is ultimately the federal immigration authority that grants these visas to the employees of companies in the DIC. The DDA (as well as the immigration authority) is also authorized to impose fines on companies for failure to comply with the Labor Law or the Employment Regulations. Additionally, in the event of employment disputes, the DDA will hear both parties’ positions and, if no resolution is reached, will refer the matter to the UAE Labor Court or the Ministry of Human Resources and Emiratisation (whichever is applicable). The Labor Law and the Employment Regulations are applicable to all employees working for private sector companies within the DDA, including foreign nationals. Regulations Relating to Technology Media and Telecommunications General content standards Federal Law No. 55 of 2023 Regarding Media Regulation, which came into force on December 1, 2023, has repealed and replaced Federal Law No. 15 for 1980 Concerning Press and Publications as the key source for content regulations. Further, the Executive Regulations to Federal Law No. 55 of 2023 were issued by Cabinet Resolution No. (68) of 2024. Federal Law No. 55 of 2023 Regarding Media Regulation applies to all media activities, including the production, circulation, printing or publishing of media content, of individuals, organizations, media outlets, and free zones dedicated to media in the UAE. All media produced, circulated, printed or published in the UAE is subject to the media content standards contained in Article 17 of the Federal Law No. 55 of 2023 and Article 28 of the Executive Regulations. These standards require, amongst other things, that there is no criticism of any of the rulers of the individual emirates that constitute the UAE; no instigation against Islam or the system of ruling; no harm to the interest of the state or values of society; no opinions that violate public interest and moral; no instigation of criminal activity or incitement of hatred; no publication of confidential communications without permission; no blemishing of a president of, or agitating relations with, an Arab, Islamic or friendly state; no article defaming Arabs and their civilization and heritage; no information about an individual’s private life, if such information is meant to disgrace the individual; no false news (with bad faith); nothing inconsistent with public order, or that is misleading to the public. 52 Also of importance is the operation of the Telecommunications Annex 1-IAM Regulatory Policy, under Federal Law No 3 of 2003 regarding the organization of the Telecommunications Sector. The IAM regulatory policy grants the TDRA the broad ability to block websites and digital content (including games). In particular, the TDRA has the ability to have the local licensed telecommunication network operators block a website that contains content that is “contrary to the public interest, public morality, public order, public and national security, Islamic morality or is otherwise prohibited by any applicable UAE law, regulation, procedure, order or requirement.” As a result, the TDRA has the authority to require the blocking of any website involving inappropriate content, such as pornography, nudity, illegal drugs or gambling. Finally, Federal Decree Law No. 34 of 2020 concerning the Fight Against Rumours and Cybercrimes, criminalizes certain online behaviour and could, if a complaint is raised, result in criminal charges being laid against the entities and people involved with the offending content (such as authors, editors, publishers). Offending content may include pornography, gambling, defamation, breach of privacy, sedition and similar incitements, and promotion of weapons. Advertising and commercial content Advertising is primarily regulated under the Federal Law No. 55 of 2023 Regarding Media Regulation and its Executive Regulations. Advertisement is defined as “showing, visual, audio, or printed content, whether electronic or paper, by any means, to the public for the purpose of marketing a product or service, or without compensation.” Media circulated for marketing purposes is also included under the definition of “media content.” Irrespective of their form or the manner in which they are circulated, all advertisements must adhere to the media content standards listed under Federal Law No. 55 of 2023 Regarding Media Regulation and its Executive Regulations. The Executive Regulations also prescribe specific terms and controls of advertising. Individuals, entities and media institutions, including those operating within media free zones, must comply with controls, which include, amongst other things that advertisements must not be ambiguous, unclear, or lacking in definitive meaning; advertisements must be clearly identified, distinct, and separate from other editorial and media content; and advertisements have to be delineated by clear boundaries, including during broadcasts, to differentiate them from other materials and time slots. In cases where advertisements directly or indirectly promote, advertise, or endorse a specific product or service, the advertiser needs clearly disclose any material return or commercial relationship with the person or entity that owns the advertised product or service. Advertisements cannot include the promotion of alcoholic beverages, prohibited narcotic substances, tobacco, or smoking, whether directly or indirectly. Approval from the concerned authority is required, together with compliance with the requirements imposed by such authorities, in the case of advertisements for real estate; advertisements for medical products, clinics, hospitals, health services, or pharmaceutical products; advertisements related to securities and financial services; advertisements concerning providing educational services; and food-related advertisements. Non–compliance with the above media content standards or the terms and controls of advertising may result in administrative sanctions, which include a fine not less than AED1,000 (US$273) and not more than AED1,000,000 (US$272,480), closure of establishment for a period of six months or cancellation of licenses, permits and approvals issued to the establishment. Online content licensing and standards Electronic and digital media activities are considered as part of “media activities” under Federal Law No. 55 of 2023 Regarding Media Regulation. Generally, licenses are required to carry out media activities. Any natural or legal person who wishes to practice such media activities must obtain a license for the UAE Media Council that permits promotional and advertisement services, for or without compensation, on social media and other modern technical means. Defamation and slander In the UAE, defamation is a criminal matter. The UAE’s criminal defamation provisions are contained in different legislations. The most prominent one is the UAE Penal Code, Federal Decree Law No. (31) of 2021, or the UAE Penal Code. In case defamation occurred verbally in the presence of others or through physical letters/publications, the provisions of Article 425 and 427 of the UAE Penal Code will apply. If the defamation occurred using electronic tools or platforms, it is covered by Federal Decree-Law No. (34) of 2021 On Countering Rumors and Cybercrimes (“CCL”). 53 Article 43 of the CCL addresses defamation and slander, and states that anyone who insults another person or attributes to him an event that may render him subject to punishment or contempt by others, by using information network, information technology method or information system shall be sentenced to detention and/or to pay fine of not less than AED 250,000 and not more than AED 500,000. Additionally, if either of the acts occurs against a public servant or public service incumbent because or due to the performance of his job, this shall be deemed aggravating circumstances of the crime. In both cases of offline defamation and online defamation, complaint is filed at the UAE Police that has jurisdiction. After the Police authorities satisfies all requirements (e.g., conduct investigation, take witness statements, etc.), it will refer the full file with the complaint to the Public Prosecutor to decide on the same. The Public Prosecution is the higher authority that entertains initial standing to decide on criminal proceedings. The UAE’s Public Prosecution have a wide discretionary power to decide on whether or not a criminal complaint should be accepted. They will study the file and reach a conclusion (either to dismiss the complaint for different possible reasons (e.g., lack of evidence) or issue an indictment order against the accused party (ies) and refer the matter to the UAE Criminal Court. Privacy—the publishing of private information by a user Article 31 of the UAE Constitution states that “freedom of communication by post, telegraph or other means of communication and the secrecy thereof shall be guaranteed in accordance with law.” Nonetheless, the scope of the term “privacy” is not actually determined or set out in any law, meaning that it is almost entirely subjective and therefore can be complex in application. Article 431 of the Federal Decree Law No. 31 of 2021, or the UAE Penal Code, states: “A person shall be punished by detention and the fine if he prejudices the privacy of the individual or family life by committing any of the following acts other than in the events as permitted by law or without the consent of the victim: 1. To eavesdrop, record or transmit by any device of any kind whatsoever conversations in a private place or by way of telephone or any other device. 2. To take or transmit by any device of any kind whatsoever a photo of a person in a private place. If such acts as set forth in the preceding cases during a meeting in front of those present at the meeting, the consent of such persons shall be presumed. The same penalty shall apply if a person publishes by any means of publicity news, photos or comments related to the private life or family life secrets of individuals, even if they are true.” There is limited guidance as to what “private life or family life secrets of individuals” might be, but it would be fair to surmise that if the person themselves had not made a matter public, a third party should not do so. The disclosure of a matter by that person would remove any element of secrecy and render the Article unavailable as the basis for a claim by the supposedly injured party. In that respect, the UAE’s position might be more restrictive than some other jurisdictions. The UAE Penal Code allows corporate entities to be held criminally liable for offences committed through their directors, agents, or representatives. A company may face a fine of up to AED20,000 (US$5,446) for defamation and slander, and up to AED5,000,000 (US$1,361,229) for other offences under the Penal Code, in addition to any penalties that may be imposed on the individuals involved. Article 44 of the CCL also addresses the concept of privacy and states that any person who used an Information Network, Electronic Information System or any of the Information Technology Tools in assaulting the privacy of a person shall be punished by imprisonment for at least six months and/or a fine between AED150,000 (US$40,844) and AED500,000 (US$136,147). Additionally, any person who uses an Electronic Information System or an Information Technology Tool to perform any amendment or processing on a recording, picture or scene for the purpose of defamation or insulting another person or assaulting or violating his or her privacy shall be punished by imprisonment for at least one year and/or a fine between AED250,000 (US$68,074) and AED500,000 (US$136,147). This is in addition to the fine payable under the UAE Penal Code. There is no guidance as to what “assaulting the privacy of a person” might mean. The Court has determined that a breach of privacy to simply show a person on a television program without obtaining written consent (and in another case, verbal consent was given but was judged to be imperfect as a consent). Further, by way of example, a man who took a photo of two people fighting in public was found to have breached privacy when he published the photo. Given this subjectivity and the heavy emphasis placed on privacy by the authorities, anything that is intrinsically “personal” or “sensitive” to another person could be considered private. 54 Potential safe harbor defense and third-party liability While ordinarily safe harbor defenses would be found in laws relating to copyright in other jurisdictions, the Federal Law No. 7 of 2002 Pertaining to Copyrights and Neighboring Rights, or the Copyright Law, does not contain “safe harbor” provisions designed to immunize intermediaries from liability for copyright damage. In fact, the Copyright Law contains no provision dealing expressly with secondary liability at all. There are no safe harbor defenses in UAE law. Similarly, the CCL is directed at both owner and operators of an electronic site or information network, so a safe harbor would not be generally available under the CCL either. Article 53 provides that “Everyone who uses a website or an electronic account in the commission of any of the following acts shall be sentenced to pay fine of not less than (300,000) three hundred thousand Dirhams (US$81,689) or more than (10,000,000) ten million Dirhams (US$2,722,785): 1. Stores, makes available or publishes illegal content and fails to remove or block access to such content during the period specified in the issued orders set out in this Decree-Law. 2. Abstains from compliance with one of the issued orders described in this Decree-Law, in whole or in part, without accepted excuse.” Further, Article 58 of the CCL provides that “the person in charge of de facto management of the juristic person shall be subject to the same penalties prescribed for the actions committed in breach of the provisions of this Decree-Law, if his knowledge thereof is evident, and the breach of his duties assigned by the management contributed in the commission of the crime. The juristic person shall be jointly held liable for the judged fines or remedies, if the offence is committed by an employee, in name and in favor of the juristic person.” As such, the CCL may apply to either a party that hosts user uploaded content or the party that creates and uploads the content within a chat room or an online voice communication application, or both.” Further, Article 59 of the CCL authorizes a competent authority to issue a takedown notice, and any party that has received such notice is required to respond to the relevant authority. Such takedown requirements are similar to those in other jurisdictions, albeit in practice, takedown notices have not been often issued in the UAE. The above laws only require a party to assist claimants in relation to infringing material once the party receives a takedown notice from a competent UAE authority or a UAE Court order. Where such a notice is issued, the notice will specify the period within which the takedown must be done, or the period within which the party must respond, if that option is provided. Data protection laws The United Arab Emirates issued Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, or the UAE DP Law, which came into effect on January 2, 2022. The Executive Regulations, or the Regulations, were due to be issued within six months of the date of issuance of the UAE DP Law. Any company that the UAE DP Law applies to will then have six months from the issuance of those Regulations to comply with the UAE DP Law (although that period can be extended by the Minister of Cabinet Affairs). Despite this grace period, there is no express transition between the “old” law and the UAE DP Law. In fact, the UAE DP Law repeals any provision that is “contrary to or in conflict with the provisions of this Decree Law.” Accordingly, the position appears to be that controllers and processors should seek to comply with the UAE DP Law provisions to the extent they can now in absence of the Regulations, but there will only be legal consequences under the UAE DP Law for failing to do so six months after the Regulations have been issued. However, in the interim period, it is likely that the UAE courts would, if needed, apply the UAE Penal code (Federal Law No. 31 of 2021) provisions that restrict the disclosure or use of personal information without consent or other legal rights. In tandem with the Law, UAE Federal Decree-Law No. 44 of 2021 Creation of the UAE Data Office was also issued on September 20, 2021. The UAE Data Office, or the Data Office, will act as the data protection regulatory authority, operationalizing the UAE DP Law’s requirements. The UAE DP Law does not apply to government data, government authorities that control or process personal data, or personal data processed by the security and judicial authorities. It does not cover personal health data and information, or personal banking and credit data and information where there is separate legislation covering such personal data and information. Finally, the UAE DP Law does not apply to the use of personal data for personal purposes by a data subject. 55 Personal data can only be processed with the consent of the data subject except in certain limited circumstances. These prescribed circumstances include: processing where necessary to implement a contract with a data subject or to conclude, amend or terminate any such contract; where the data subject has made the personal data public; to protect the interests of the data subject; where processing is necessary for claiming legal rights or as part of judicial or security procedures; for archival purposes or for scientific, historical and statistical studies (in accordance with relevant legislation); and/or for a controller or data subject meeting obligations and exercising employment/social protection rights. Controllers will need to be able to establish the consent of the data subject where consent is used as the lawful basis for processing the data subject’s personal data. The consent should be clear, simple, unambiguous and easily accessible. It should be made through a statement or clear affirmative action and can be writing or provided electronically. Controllers have a number of key obligations. These include taking appropriate technical and organizational measures to protect personal data (and manage automatic processing to ensure it is limited to its intended purpose); maintaining a “special record” of personal data (and making it available to the Data Office on request along with any other information the Data Office requires); and ensuring processors provide sufficient guarantees and implement technical and organizational measures necessary to meet the requirements of the UAE DP Law. Similar to other global data protection laws, data subjects have various rights: the right to data portability; right to the rectification or erasure of personal data (i.e. the right to be forgotten); the right to restrict personal data processing; the right to object to personal data processing (e.g. for marketing purposes); and the right to object to decisions resulting from automated processing (including profiling) that have legal consequences or seriously affect the data subject. Data subjects can file complaints with the Data Office if they have reason to believe there has been a breach of the UAE DP Law in relation to the processing of their personal data. The UAE DP Law places certain limitations on the exercise of several of these data subject rights. Controllers must put in place clear and simple means by which the data subject can contact the controller and exercise their rights. The UAE DP Law allows for the transfer of personal data to countries approved by the Data Office as having an “adequate level of protection.” These cover countries that either have “special legislation” in place for the protection of personal data or where the specific country has acceded to bilateral or multilateral agreements relating to the protection of personal data. While it is not expressly stated in the UAE DP Law to be the case, it is expected the Regulations to include details of the approved countries. For countries not approved by the Data Office as having an adequate level of protection, the UAE DP Law provides various options to enable the transfer of personal data. These include transferring personal data under a contract that applies the requirements of the UAE DP Law (similar, we assume, to the standard contract clauses used under other global data protection laws); securing the data subject’s express consent to such transfer (where such consent does not conflict with public and security interests of the UAE); if the transfer is necessary for the execution of a contract between the controller and the data subject (or as part of a contract between the controller and a third party that achieves the interests of a data subject); if the transfer is necessary for international judicial cooperation, or if the transfer is necessary to protect the public interest. More details are expected in the Regulations. Controllers must, on becoming aware of any personal data breach that would “prejudice the privacy, confidentiality and security of a data subject’s personal data” inform the Data Office of the breach and any investigation conducted into the breach.” The UAE DP Law sets out details to be included in any notification and the Regulations will add further details, including any reporting period. The controller must also notify the data subject of the breach and there is no higher threshold (e.g. high risk) for any such data subject notification than that which is set for notifying the Data Office. Processors must inform the controller of any breach as soon as they become aware of it. Administrative penalties can be imposed as part of a decision by the Council of Ministers in response to a breach of the Law or the Regulations and based on a proposal from the Data Office’s Director General. The Law does not specify the range of potential administrative penalties, but details in this regard are expected to be set out in the Regulations. Data subjects can file a complaint with the Data Office if they have reason to believe that the Law has been breached by a controller or processor. It is only mandatory for a controller or the processor to appoint a data protection officer (DPO) in respect of certain processing of personal data. The UAE DP Law requires both the controller and the processor to appoint a DPO where the processing creates a high risk to the privacy of the personal data through either the adoption of new technologies or the volume of personal data processed. A DPO will also be required where processing involves the assessment of sensitive personal data as part of profiling or automated processing or where large volumes of sensitive personal data are processed. The Regulations will provide more specifics to assist in determining whether “high risk” processing is taking place and a DPO is, as a result, required. A DPO can be located outside the UAE. 56 Telecommunications Law Voice Over Internet Protocol, or VoIP, services are specifically regulated under Voice over Internet Protocol Policy, or VoIP Policy, issued by the TDRA on December 30, 2009. “VoIP Services” are defined for the purposes of the VoIP Policy as “all of the services and technologies that allow transmitting, receiving, delivering and routing of voice telecommunications by means of Internet Protocol (IP).” Based on a strict interpretation of laws and regulations, VoIP services can only be used in the UAE in limited circumstances where: •the VoIP service is provided between users of a “Closed Group Network” where the relevant calls originate and terminate in the UAE in accordance with the TDRA’s VoIP Policy; •the VoIP service is a paid service provided through the local public telecommunications service providers licensed by the TDRA under Federal Law No 3 Of 2003 Regarding The Organization of The Telecommunications Sector, as amended; or •the VoIP service is provided by a third party in collaboration with the licensees or by obtaining an exemption approval from TDRA to provide the service. The sale or supply of telecommunications services to subscribers in the UAE is a regulated activity under the Telecoms Law. No individual or organization is permitted to conduct any regulated activity unless authorized by a license or exempted in accordance with the Telecoms Law. There are currently only two licensed public telecommunications network operators and service providers in the UAE. The granting of any further public telecommunications licenses is unlikely at this time due to state policy. Importantly, the licensees are expressly permitted to block VoIP services over their networks which are provided by a person not licensed to do so under the Telecoms Law unless instructed by the TDRA to do otherwise. The TDRA issued a statement in March 2015 clarifying that “Voice over Internet Protocol (VoIP) are considered part of the UAE’s regulated activities. The TDRA has granted licensed operators the eligibility to provide such services across their networks. Companies wishing to provide such services should coordinate with the UAE’s licensed service providers in this regard.” The TDRA’s website states that the TDRA, at its sole discretion, may provide a VoIP exemption approval to allow VoIP applications in the UAE, taking into consideration the users and market demands and needs. Applicants may request the “ VoIP exemption” by sending an official letter addressed to TDRA. Aside from this statement, no formal process or criteria for obtaining the exemption approval has been publicly issued. The TDRA website indicates that the likes of Microsoft Teams, Zoom, Blackboard, Google Meet (Meeting only), Cisco Webex, Avaya Spaces, BlueJeans, and Slack are VoIP applications that are allowed in the UAE. Currently the TDRA have paused the acceptance and approvals of exemption approval requests and do not have a specific timeline for when they will resume accepting applications. However, there are uncertainties in the UAE market regarding the use of VoIP services, as despite the apparently strict legal position concerning the use of VoIP services and the blocking of certain well-known international VoIP service brands in the UAE, many users in the UAE can in fact use various other VoIP applications, such as certain online gaming platforms. Under the Telecoms Law, it is a criminal offense that may be penalized by a fine between AED50,000 (US$13,615) and AED1,000,000 (US$272,294) and/or imprisonment of up to two years to provide regulated telecommunication services without being licensed to do so. It is the supplier, rather than the user, that commits this offense. In practice, the main enforcement action taken against unlicensed VoIP service providers is for the Licensees to block the VoIP service in the UAE. Our mobile applications, which enable voice-based, real-time communications on the Internet, may be deemed to be VoIP services. Our mobile applications have been on the market in the UAE since April 2016. See “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry—We may be required to obtain and maintain licenses and approvals relating to Internet or telecommunications services in certain jurisdictions.” 57 Child Digital Safety The UAE Federal Decree-Law No. 26 of 2025 On Child Digital Safety Law came into force on January 1, 2026. Despite this, the law is not yet effective as all persons subject to the law have one year from the date of its entry into force to become compliant and that compliance period can be extended by a decision of the UAE Cabinet. As of March 31, 2026, the UAE Cabinet has yet to issue any decisions needed to implement the law. The law applies to our platform and mobile applications as it applies to digital platforms operating within the UAE or targeting users in the UAE whenever it involves children’s use of digital platforms or their exposure to the platforms’ content or services. Digital platforms include, but are not limited to, smart applications, messaging apps, and forums; electronic games' platforms and social media platforms. All digital platforms operating in the UAE or targeting users in the UAE must, in accordance with their classification which is to be based on risk assessment under the law, and has yet to be implemented, develop and implement enhanced child protection measures, procedures, and controls to ensure children’s digital safety and protect them from harmful content in the digital environment. This includes such matters as implementing privacy and personal data protection features for children in accordance with their age group, activating blocking and filtering tools, age classification tools for content, the controls over targeted electronic advertisements, and tools to disable features related to excessive interaction and engagement by the child, in accordance with their age group. The UAE Cabinet has not yet issued the administrative penalties regulation for acts that violate the provisions of this law and the enforcement mechanisms. Consumer Protection Law Federal Law No. (15) of 2020 on Consumer Protection aims to protect the rights and interests of consumers in the UAE, especially in relation to the quality, safety, information and choice of commodities and services. The law applies to all commodities and services inside the UAE, including the free zones, and the operations related to them that are carried out by the provider, advertiser or commercial agent, whether through e-commerce or otherwise, and imposes obligations and penalties on the providers, advertisers and commercial agents who violate the provisions of the law. The law stipulates that consumers have the right to: •right to safety: to be protected from products, production processes and services that may cause harm to health and safety. The law requires providers to ensure the conformity of the commodities or services to the standard specifications, terms and controls related to health and safety and the relevant existing legislation in the state. The law also obliges providers to inform the Ministry of Economy or the competent authority immediately of any defects or risks in the commodities or services that may harm to consumers, and to withdraw the commodities from the market or to declare them. In addition, the law authorizes the Ministry of Economy or the competent authority to prohibit, detain or withdraw any harmful or risky commodities from the market. •right to know: to know accurate information about the commodities and services. The law requires providers to place clear and legible labels on the commodities or their package, showing their components, maintenance, storage, expiry date and other information in accordance with the existing legislation in the state. The law also requires providers to write the price of the commodities or services clearly on them or on their invoices, and to provide consumers with detailed invoices containing provider’s name, address, commodities or services type, price, quantity and other information. Furthermore, the law prohibits providers, advertisers and commercial agents from describing the commodities or services in a manner containing false information or from advertising them in a misleading way. •right to choose: to have multiple options of items and services at competitive prices and quality. The law states that consumers have the right to choose the most suitable products and services available on the market according to their desire. The law also prohibits providers from concealing the commodities, refraining from selling them or from not providing the services to consumers for the purpose of controlling the price, monopolizing the commodities or obliging consumers to purchase certain quantities of the commodities, or adding certain terms for using the service or selling a commodity or another service with it, or charging a price higher than the declared price. 58 •right to representation: to express opinions to develop the goods, services, prices and availability. Consumers have the right of having their opinions listened to, their interests represented by official or non-official entities and their opinions shall be taken into consideration during the process of developing the commodities and services. The law states that consumers have the right to a fair and speedy settlement for their disputes and to obtain fair compensation for damages caused to them or their property as a result of purchasing or using the commodities or receiving the services. The law also establishes a Supreme Committee for Consumer Protection, which includes representatives from the competent authorities, Consumer Protection Associations, and experts and specialists, to formulate general policies on consumer protection, study reports and proposals related to consumer rights, and issue recommendations thereon. The law also allows consumers and the Consumer Protection Associations to submit complaints to the Ministry of Economy or the competent authority and to appeal the resolutions and procedures taken against them. •right to be informed: to acquire knowledge, skill and awareness of consumer rights and responsibilities through continuous awareness programs. The law states that consumers have the right to obtain true information on the commodities purchased, used or consumed or the services received, and to be educated and raised their awareness of their rights and obligations. The law also mandates the Ministry of Economy, in cooperation with the competent authorities, to supervise the implementation of the general policy for consumer protection, especially by raising awareness and educating consumers in contribution to their protection from the risks of certain commodities and services, including the e-commerce services, and by publishing the resolutions and recommendations that contribute to raising consumer awareness. •right to not be exposed to false or misleading advertising: The law prohibits providers, advertisers and commercial agents from describing the commodities or services in a manner containing false information or from advertising it in a misleading way. The law also defines misleading advertising as advertising a commodity or service based upon misleading information or omitting fundamental or core information related to the commodity or the service, which affects consumers and leads them to contract whereas they would not have contracted were it not for such information, or advertising fake or untrue prizes or discounts. The law also requires the providers to obtain a prior license from the competent authorities before promoting the commodities or services or making general discounts to the prices or advertising them in any way. Cabinet Resolution No. (66) of 2023 on Federal Law No. (15) of 2020 Concerning Consumer Protection contains the executive Regulations to the Consumer Protection Law and defines the roles and responsibilities of the Ministry of Economy and other relevant authorities in coordinating and enforcing the consumer protection measures. It also specifies the obligations and rights of providers and consumers of goods and services in various aspects, such as labelling, pricing, warranty, maintenance, advertisement, e-commerce, and monopoly. It further outlines the procedures and penalties for handling consumer complaints, testing goods in laboratories, and seizing defective or harmful goods. The Ministry of Economy deals with consumer rights issues and implement plans and procedures related to Consumer Protection Laws. It receives consumer complaints and raises consumers’ awareness about their rights and duties. Regulations Relating to Intellectual Property Copyright law Copyrights are currently regulated in the UAE under the Federal Law No. 38 of 2021 on Copyright and Neighbouring Rights, or the Copyrights Law. The Copyright Law protects original expressions of creative works in the fields of literature, art, or the sciences, regardless of the kind or manner of its expression, and regardless of its importance or its purpose. Importantly, the Copyright Law does not protect ideas, but rather the original material produced by virtue of a creative process. There are 12 categories of protected works listed by the Copyright Law, as examples: •books, pamphlets, essays, and other written works: •smart applications, computer programs and applications, databases, and any other similar works to be determined by a Ministerial decision; •lectures and similar works; •dramatic, musical works; •musical composition with or without words; •sound and audio-visual works; 59 •architectural works, engineering plans and layouts; •works of drawing, painting, sculpture, lithography (fabric, metal, stones, wood) and engravings or any similar works in the scope of fine arts; •photographic works and works analogous to photography; •works of applied art and plastic art; •illustrations, geographical maps, sketches, three-dimensional works related to geography, topography, and architectural designs, etc.; and •derivative works, without prejudice to the protection conferred upon the works from which they have been derived. The protection includes the title of the work, if innovated, and the innovative idea written for a broadcasting program. The Copyright Law provides for the protection of copyright for a duration of the life of the author plus 50 years after his or her death (in which case the rights pass on to his or her next of kin). Registration is not a prerequisite to legal protection under the Copyright Law. Legal protection is automatic upon the creation of the work. In the event of enforcement of copyright against a third party, the Administrative Authorities will require a certificate of registration to be submitted alongside any complaint. For this, the copyright is recommended to be registered with the UAE Ministry of Economy. Authors derive both economic and moral rights in their work. Economic rights are those rights through which the author can reap material benefit, including the exclusive right to reproduce the work, broadcast or rebroadcast the work, publicly perform the work, translate, modify, alter, lease, rent, lend or publish the work. Whereas moral rights are those rights that vest exclusively in the author of a work, and unlike economic rights, they cannot be waived, transferred or assigned. The Copyright Law recognizes four moral rights, namely: •right of integrity: the author shall have the right to object to any distortion, mutilation or other modification, or other derogatory action in relation to the relevant work. This is to protect the honor and reputation of the author. •right of attribution/paternity: the author has the right to claim authorship of the work. •right of retraction: the author shall have the right to withdraw the work from circulation if there are serious justifications behind this. Authors of smart applications and software and its applications, are excluded from this right. In other words, smart applications and software and its applications would not be subject to withdrawal from circulation. •right of divulgation: the author has the right to determine the first publication of his work. The Copyright Law also covers neighboring rights; namely, rights over performances, sound recordings, broadcastings, with neighboring rights holders also holding their own economic and moral rights, outlined under the Copyright Law. The Copyright Law permits the transfer or license of all or part of his or her economic right. In order for such action to take an effect, it shall: (i) be made in writing; (ii) specify the grant clause or scope (for example, to reproduce, translate, adapt and/or display); and (iii) specify the utilization place and duration. Copyright infringement exposes the infringer to criminal (including, fine and/or imprisonment, seizure, confiscation and destruction of infringing goods), civil (such as compensation) and/or administrative actions (including, seizure, confiscation and destruction of infringing goods, fines, closure of business premise). 60 Trademark law Trademarks are currently regulated in the UAE under Federal Law Number 36 of 2021, or the Trademark Law. The Trademark Law defines a trademark as anything that takes a distinctive form, whether composed of words, names, symbols, images, advertisements, colour, sound, smell or any other marks or combination of marks. Trademarks can be registered for goods as well as services. A trademark must be: •Distinctive: trademarks that lack distinctiveness or are otherwise descriptive or generic cannot be registered. •Used as a form of identification: a trademark must be used as a form of identification to allow consumers to distinguish goods, products or services as to their origin. Trademarks are protected for a period of ten (10) years upon registration with the UAE Ministry of Economy, commencing on the date of first filing; protection can be renewed for a further period of ten (10) years indefinitely. In the event that the registration is not renewed, protection will lapse and the owner will lose all rights in the trademark. The Trademark Law determines that any person who registers a mark shall be deemed its sole owner. The ownership of such a mark may not be disputed if a registrant uses it uninterruptedly for a period of five (5) years, unless the registration was made in bad faith. Importantly, the owner of a registered trademark can prevent any third party from using an identical or confusingly similar mark to distinguish products that are identical, similar or correlated to those for which he has registered his own trademark. Trademark owners may license their rights to third parties, indicating the duration of the license, quality control provisions, exclusivity and any formalities. A trademark owner may also assign his or her trademark to a third party with or without consideration. The transfer must be recorded with the UAE Ministry of Economy as proof of consent to the rights being assigned. Trademark infringements expose the infringer to criminal (including, fine and/or imprisonment, seizure, confiscation and destruction of infringing goods), civil (compensation) and/or administrative actions (including, seizure, confiscation and destruction of infringing goods, fines and closure of business premises). Industrial property rights: patents, utility models, industrial designs, integrated circuits, and undisclosed information Federal Law No. (11) of 2021 on the Regulation and Protection of Industrial Property Rights Patents, Industrial Drawings, and Designs, or the UAE Industrial Property Law, and its Executive Regulations issued by Cabinet of Ministers Resolution No. (6) of 2022 repealed the former Federal Law No. (17) of 2002. The Industrial Property Law applies to patents, integrated circuits, industrial designs, undisclosed information (trade secrets) and utility certificates (or models). The Industrial Property Law attempts to harmonize the UAE's industrial property law with international legislation. The Industrial Property Law is administered by the UAE Ministry of Economy (which also deals with filing, prosecution and registration under the UAE Industrial Property Law). Patents and utility models Requirements Under the UAE Industrial Property Law, a patent can be granted for inventions that are new or novel, inventive, industrially applicable, and do not fall within any of the exclusions. The term of protection for patents is twenty (20) years from the filing date or from the international filing date (in case of a PCT national phase application). A patent holder is required to pay annual fees throughout the duration of protection of a patent. Utility models, on the other hand, require lesser thresholds of inventiveness but are subject to the same novelty requirement as patents and must be industrially applicable. The life of a utility certificate is ten (10) years from the date of grant and are also subject to annual fees. The UAE Industrial Property Law provides a means of converting a granted utility model certificate into a patent application (and vice versa) at the request of the inventor or patent holder provided it meets the requirements for the right that is being sought. 61 Exclusions The UAE Industrial Property Law sets out exclusions from patentability (and registration of utility models) which include: •plant and animal species (including research into such), and biological methods for the production of animals and plants, excluding microbiological methods and their products resulting from such processes; •diagnostic methods, therapeutic and surgical operations needed for humans and animals; •scientific and mathematical principles, discoveries and methods; •guidelines, rules, computer programs or methods followed to conduct business, perform mental activities or play games; •natural materials from the environment (those substances that are purified or isolated from the natural environment); and •inventions that may lead to violation of public order or morals, or harmful to the health and life of humans and the environment. Grace period The UAE Industrial Property Law provides a grace period of twelve (12) months. An application submitted within this grace period will still meet the novelty criteria if, for example, an inventor’s own publication is cited as prior art, it will have no effect on the novelty requirement for the corresponding UAE patent application provided the publication occurred within twelve (12) months of filing the application. Urgent applications and accelerated examination procedures Applicants may request accelerated examination before the UAE Patent Office for “urgent applications,” provided that adequate justification is submitted. In practice, the UAE Patent Office has increasingly adopted mechanisms to expedite examination. Notably, MOE may take into account search and examination reports issued by recognized international patent office’s when assessing corresponding UAE applications. While the UAE does not operate a formal Patent Prosecution Highway (PPH) program, the MOE may rely on foreign examination outcomes to streamline its review process. This operates as a quasi-PPH mechanism and can significantly reduce examination timelines where corresponding applications have already undergone substantive examination in jurisdictions such as the United States. Accordingly, applicants seeking expedited examination are advised to align their UAE filings with parallel applications in major jurisdictions and to submit relevant foreign search and examination reports in support of acceleration. Patent filing Prior to 2021, there were two primary routes to patent protection in the UAE, a national route, and a regional route. The national route required the filing of a national application at the UAE Patent Office (this remains the current, standard procedure of filing all patent applications in the UAE). In addition, applicants may also enter the UAE via the Patent Cooperation Treaty (PCT) by filing an international application and subsequently entering the UAE national phase within the prescribed timelines. The UAE is also a member of the Paris Convention, allowing applicants to claim priority from an earlier-filed application in another member country within twelve (12) months. Previously, applicants had the option of the filing a Gulf Cooperation Council, or the GCC, patent application. A GCC patent offered protection in the 6 GCC countries. However, the Patent Office of the Gulf Cooperation Council, or the GCCPO stopped accepting new GCC patent applications on January 6, 2021. All patent applications, which have been filed at the GCCPO prior to January 6, 2021, will be processed and examined as normal and the GCC Patent Office will continue to provide patent grants. It is worth noting that, although the GCCPO has stopped accepting new patent applications as of January 6, 2021, it is still possible to file divisional applications for all patent applications filed before January 6, 2021. 62 Furthermore, the GCCPO recently announced that it would partially resume its services for filing and examining new patent applications for Bahrain, Kuwait and Qatar. Applicants will have the option of filing a single application directly to the GCCPO which will carry out the formality and substantive examination on behalf of the three national offices. Following examination, the application is then forwarded to the respective national offices for grant or rejection. It is yet to be announced when or if patent filing and examination in the UAE patent office will be handled through the GCCPO. Industrial designs Under the UAE Industrial Property Law, an industrial design must be, new (there is a twelve (12) month grace period where a design will not be considered “disclosed to the public” if such disclosure is made within one year prior to the filing date) and not contrary to public order or morality. Industrial designs are valid for a period of twenty (20) years (with payment of applicable annual fees). Publication of granted patents and industrial designs. In the UAE, accepted patent applications are published in the UAE Official Gazette after an opposition period of sixty (60) days from the publication date. For industrial designs, the Ministry of Economy announces the approval of applications in the Industrial Property Bulletin. Integrated circuits Layout-designs of integrated circuits can be protected under the UAE Industrial Property Law provided it is original (i.e., the result of its creator’s own intellectual effort) and is not commonplace among professionals of the relevant industrial art. Layout-designs will be considered “original” if the combination of its elements and interconnections are themselves original, notwithstanding any elements that are otherwise commonly present in the industrial art. The term of protection is ten (10) years from the filing date of the application or the date of first commercial exploitation (whether in the UAE or abroad), whichever is earlier. Undisclosed information (trade secrets) Undisclosed information will generally qualify for protection under the UAE Industrial Property Law if: such information is not generally known or readily accessible to people who typically deal with the kind of information in question; its secrecy has commercial value; and reasonable steps have been taken to keep the information secret. A breach of confidence is actionable under the UAE Industrial Property Law as an “unfair commercial practice.” Regulations Relating to Tax Value-added tax VAT was introduced at the UAE federal level effective from January 1, 2018. VAT is imposed on the supply of goods and services and on imports of goods and services in the UAE, at the standard rate of 5%, unless the supply or import is subject to the VAT zero rate or exempt from VAT. The general rule is that the place of supply of services is in the UAE if the place of residence of the supplier for VAT purposes is in the UAE. However, the UAE VAT legislation sets out several exceptions concerning the place of supply. Amongst these exceptions, the VAT legislation provides that the place of supply of electronic services that are automatically delivered over the Internet, an electronic network or an electronic marketplace is in the UAE to the extent of the use of enjoyment of the services is inside the UAE, whereas the place of supply is outside the UAE to the extent of the use or enjoyment of the services is outside of the UAE. The Federal Tax Authority has released detailed guidance setting out relevant factors to be considered when determining the place of use or enjoyment of an electronic service. Corporate income tax The UAE has implemented a federal-level corporate tax, which became applicable to financial years beginning on or after June 1, 2023. Furthermore, certain Emirates in the UAE, such as Dubai, have a corporate income tax at the Emirates level. Under these Emirate-level decrees, CIT is imposed on the net income generated by bodies corporate and branches operating in the Emirate, at progressive rates of up to 55%. However, in practice the Emirate-level CIT has only been imposed on companies engaged in upstream oil and gas activities and branches of foreign banks. Free zones in the UAE, including the DCC free zone, provide for an exemption from certain Emirate-level corporate taxes for 15 to 50 years depending on the free zone. 63 Introduction of federal corporate tax in 2023 Notwithstanding the above, the UAE has issued the CT Law, pursuant to which a federal corporate tax applies to taxable persons in respect of their financial periods starting on or after June 1, 2023. Corporate tax applies to (amongst other categories) all legal persons in the UAE at a rate of 9% on taxable income above AED375,000. However, entities incorporated or registered in free zones that are considered qualifying free zone persons are subject to 0% tax on their qualifying income. In order to be deemed a qualifying free zone person, the free zone person must generate qualifying income, comply with transfer pricing requirements, maintain adequate substance in the UAE, prepare and maintain audited financial statements, and comply with any other conditions that may be set under future Cabinet Decisions. Cabinet Decisions have been issued defining qualifying income and setting out layered conditions governing its classification. Notwithstanding the above, pursuant to Federal Decree-Law No. 60 of 2023 (which amended the CT Law), and Cabinet Decision No. 142 of 2024, effective since January 1, 2025, a top-up-tax has been implemented for entities that are part of certain large multinational enterprises, such that the effective tax rate applicable to them becomes 15%. The top-up-tax generally applies to constituent entities that are members of a multinational enterprise group that has annual global consolidated revenues of 750 million Euros or more in at least two out of the four fiscal years immediately preceding the tested fiscal year. Separately, certain categories of UAE-sourced income generated by non-residents persons without a permanent establishment in the UAE will be subject to withholding tax, currently set at the rate of 0%. Under the CT Law, the UAE has also introduced transfer pricing rules and requirements that largely follow the OECD guidelines. China Regulations Related to Foreign Investment Foreign Investment Law The establishment, operation and management of corporate entities in the PRC is governed by the Company Law of the PRC, or the Company Law, which was promulgated by the Standing Committee of the National People’s Congress, or the SCNPC, on December 29, 1993 and last amended and became effective July 1, 2024. A foreign-invested company is also subject to the Company Law unless otherwise provided in the foreign investment laws. On March 15, 2019, the National People’s Congress, or the NPC approved the Foreign Investment Law, which became effective on January 1, 2020. On December 26, 2019, the State Council issued the Implementation Rules of the Foreign Investment Law, which became effective on January 1, 2020. The Foreign Investment Law and the Implementation Rules of the Foreign Investment Law replaced three existing laws on foreign investments in China, namely, the PRC Equity Joint Venture Law, the PRC Cooperative Joint Venture Law and the Wholly Foreign-owned Enterprise Law, together with their implementation rules and ancillary regulations. The Foreign Investment Law establishes the basic framework for the access to, and the promotion, protection and administration of foreign investments in view of investment protection and fair competition. The Foreign Investment Law establishes a management system of pre-establishment national treatment which includes a negative list to foreign investment. It stipulates that the government will not expropriate foreign investment, except under special circumstances, in which case it will provide fair and reasonable compensation to foreign investors. The Special Administrative Measures (Negative List) for the Access of Foreign Investment (2024 Version), or the 2024 Negative List, was published under the authority of the MOFCOM and the NDRC on September 6, 2024 and became effective on November 1, 2024, replaced and abolished the Special Administrative Measures for Entrance of Foreign Investment (2021 Edition) regulating the access of foreign investors to China. Foreign investors are barred from investing in prohibited industries in the negative list and must comply with the specified requirements when investing in restricted industries in that list. When a license is required to enter a certain industry, the foreign investor must apply for one, and the government must treat the application the same as one by a domestic enterprise, except where laws or regulations provide otherwise. In addition, foreign investors or foreign-invested enterprises are required to file information reports and foreign investment is subject to the national security review. In addition, the Implementation Rules of the Foreign Investment Law, effective on January 1, 2020, clarifies that the Foreign Investment Law and its implementation rules also apply to investments by FIEs in China. 64 In addition, the Foreign Investment Law also provides several protective rules and principles for foreign investors and their investments in the PRC, including, among others, that local governments shall abide by their commitments to the foreign investors; foreign-invested enterprises are allowed to issue stocks and corporate bonds; except for special circumstances, in which case statutory procedures shall be followed and fair and reasonable compensation shall be made in a timely manner, expropriation or requisition of the investment of foreign investors is prohibited; mandatory technology transfer is prohibited; and the capital contributions, profits, capital gains, proceeds out of asset disposal, licensing fees of intellectual property rights, indemnity or compensation legally obtained, or proceeds received upon settlement by foreign investors within China, may be freely remitted inward and outward in RMB or a foreign currency. Also, foreign investors or the foreign investment enterprise should be imposed legal liabilities for failing to report investment information in accordance with the requirements. The Implementation Rules of the Foreign Investment Law provides that foreign-invested enterprises and other domestic enterprises shall be equally treated with respect to, among others, the allocation of governmental funding, land supply, tax treatment, licensing and permits. On December 19, 2020, the NDRC and the Ministry of Commerce jointly promulgated the Measures on the Security Review of Foreign Investment, which came into effect on January 18, 2021, establishing a working mechanism for the security review of foreign investments. Foreign investments involving in (i) military industry, military industrial supporting and other fields relating to the security of national defense, and investments in areas surrounding military facilities and military industry facilities; and (ii) important agricultural products, important energy and resources, important equipment manufacturing, important infrastructure, important transport services, important cultural products and services, important information technology and Internet products and services, important financial services, key technologies, and other important fields relating to national security, and obtaining the actual controlling stake in the investee enterprise, must take the initiative to declare to the office of the working mechanism and obtain the approval from the office prior to implementation of the investments. The circumstances of “obtaining the actual controlling stake” includes that (i) the foreign investor holds more than 50% of the equity of an enterprise; or (ii) the foreign investor holds less than 50% of the equity of an enterprise, but the voting rights held by it can have significant impact on the resolutions of the board of directors, the board of shareholders, or the general meeting of shareholders; or (iii) other circumstances where the foreign investor may have significant impact on the enterprise’s business decision-making, human resources, finance, technology, among other things. Foreign Investment Industrial Policy Investment activities in China by foreign investors are principally governed by the Catalogue for the Encouragement of Foreign Investment Industries (2025 Edition), and the 2024 Negative List. The catalogue and the 2024 Negative List set forth the industries in which foreign investments are encouraged, restricted, and prohibited. Industries that are not listed in any of these three categories are generally open to foreign investment, unless otherwise specifically restricted by other PRC rules and regulations. Regulations Related to Dividend Distribution The principal regulations governing the distribution of dividends by wholly foreign-owned enterprises include the Company Law, the Foreign Investment Law, the Implementation Rules of the Foreign Investment Law, and the EIT Law and its implementation rules. Under these regulations, wholly foreign-owned enterprises in the PRC may pay dividends only out of their accumulated profits, if any, as determined in accordance with the PRC accounting standards and regulations. In addition, a wholly foreign-owned enterprise in the PRC is required to set aside at least 10% of its after-tax profit, as calculated using the PRC accounting standards, each year to its general reserves until its cumulative total reserve funds reach 50% of its registered capital. A company must not distribute any profits until any losses from prior fiscal years have been offset. Regulations Related to Foreign Exchange Regulations related to foreign currency exchange According to the Foreign Exchange Administration Regulations as last amended on August 5, 2008, the foreign exchange income and expenditure and foreign exchange business operations of Chinese institutions and individuals, as well as the foreign exchange income and expenditure and foreign exchange business operations conducted within the territory of the PRC by overseas institutions and individuals, shall be subject to foreign exchange administration. Renminbi is convertible for payments of current account items such as trade and service-related foreign exchange transactions and dividend payments, but the conversion of Renminbi into other currencies and remittance of the converted foreign currency outside the PRC for capital account items such as direct equity investment, loans or repatriation of investment requires prior approval from the SAFE, or its local counterpart. 65 On November 19, 2012, SAFE promulgated the Circular of Further Improving and Adjusting Foreign Exchange Administration Policies on Foreign Direct Investment, which substantially amends and simplifies the current foreign exchange procedure and became partially invalid according to the Circular on Repealing and Invalidating Five Normative Documents Concerning Administration of Foreign Exchange and some Articles of Seven Normative Documents Concerning Administration of Foreign Exchange (the “Circular on Repealing and Invalidating”) promulgated by the SAFE on December 30, 2019. Pursuant to Circular on Repealing and Invalidating, the opening of various special purpose foreign exchange accounts, such as pre-establishment expenses accounts, foreign exchange capital accounts and guarantee accounts, the reinvestment of Renminbi proceeds by foreign investors in the PRC, and remittance of foreign exchange profits and dividends by a foreign-invested enterprise to its foreign shareholders no longer require the approval or verification of SAFE, and multiple capital accounts for the same entity may be opened in different provinces, which was not possible previously. In addition, SAFE promulgated the Circular on Printing and Distributing the Provisions on Foreign Exchange Administration over Domestic Direct Investment by Foreign Investors and the Supporting Documents, or the Circular 21, in May 2013, which specifies that the administration by SAFE or its local branches over direct investment by foreign investors in the PRC shall be conducted by way of registration and banks shall process foreign exchange business relating to the direct investment in the PRC based on the registration information provided by SAFE and its branches. Circular 21 was partially invalid according to Circular on Repealing and Invalidating. SAFE promulgated the Notice of the State Administration of Foreign Exchange on Reforming the Administration of Foreign Exchange Settlement of Capital of Foreign invested Enterprises, or the SAFE Circular 19 which was partly amended by the Notice of the State Administration of Foreign Exchange on Reforming and Standardizing the Foreign Exchange Settlement Management Policy of Capital Account, or the SAFE Circular 16, effective on June 9, 2016, and partly amended on December 4, 2023. According to SAFE Circular 19 and SAFE Circular 16, the flow and use of the Renminbi capital converted from foreign currency denominated registered capital of a foreign-invested company is regulated such that Renminbi capital may not be used for business beyond its business scope or to provide loans to persons other than affiliates unless otherwise permitted under its business scope. Violations of SAFE Circular 19 or SAFE Circular 16 could result in administrative penalties. Regulations related to foreign exchange registration of overseas investment by PRC resident SAFE promulgated the Circular on Relevant Issues Relating to Domestic Resident’s Investment and Financing and Roundtrip Investment through Special Purpose Vehicles, or SAFE Circular 37, in July 2014. SAFE Circular 37 regulates foreign exchange matters in relation to the use of special purpose vehicles, or SPVs, by PRC residents or entities to seek offshore investment and financing or conduct round trip investment in China. Under SAFE Circular 37, an SPV refers to an offshore entity established or controlled, directly or indirectly, by PRC residents (including individuals and entities) for the purpose of seeking offshore financing or making offshore investment, using legitimate onshore or offshore assets or interests, while “round trip investment” refers to direct investment in China by PRC residents through SPVs, namely, establishing foreign-invested enterprises to obtain the ownership, control rights and management rights. SAFE Circular 37 provides that, before the establishment or control of an SPV, PRC residents are required to complete foreign exchange registration with SAFE or its local branch. Following the initial registration, any change in basic information of the SPV or any material change with respect to the capital of the SPV, shall be registered with SAFE in time. SAFE promulgated the Notice on Further Simplifying and Improving the Administration of the Foreign Exchange Concerning Direct Investment in February 2015, which took effect on June 1, 2015, and partly amended in December 2019. This notice has amended SAFE Circular 37 requiring PRC residents or entities to register with qualified banks rather than SAFE or its local branch in connection with their establishment or control of an offshore entity established for the purpose of overseas investment or financing. However, remedial registration applications made by PRC residents that previously failed to comply with the SAFE Circular 37 continue to fall under the jurisdiction of the relevant local branch of SAFE. 66 Regulations Related to Tax Enterprise income tax On March 16, 2007, the NPC issued the EIT Law, which was last amended by the SCNPC on December 29, 2018. The Regulation on the Implementation of the Enterprise Income Tax Law, or the EIT Regulation, was issued by the State Council on December 6, 2007 and became effective on January 1, 2008, and was last amended on December 6, 2024 and became effective on January 20, 2025. Pursuant to the EIT Law and the EIT Regulation, both domestic and foreign-invested enterprises established under the laws of foreign countries or regions whose “de facto management bodies” are located in the PRC are considered resident enterprises. The defined term “de facto management bodies” are “establishments that carry out substantial and overall management and control over production and operations, personnel, accounting, and properties” of the enterprise. In April 2009, the SAT issued the Circular of the SAT on Issues Relating to Identification of PRC-Controlled Overseas Registered Enterprises as Resident Enterprises in Accordance With the De Facto Standards of Organizational Management, or SAT Circular 82, which became partially invalid on December 29, 2017, and provides certain specific criteria for determining whether the “de facto management body” of a PRC-controlled enterprise that is incorporated offshore is located in China. If an enterprise is considered a PRC resident enterprise under the above definition, its global income will be subject to enterprise income tax at the rate of 25%. The Notice on Issues about the Determination of Chinese-Controlled Enterprises Registered Abroad as Resident Enterprises on the Basis of Their Body of Actual Management issued by the State Administration of Taxation, or the SAT, on April 22, 2009 and effective on January 1, 2008 and partly amended on December 29, 2017 and effective on the same date, sets up a more specific definition of the “de facto management bodies” standard. According to SAT Circular 82, an offshore incorporated enterprise controlled by a PRC enterprise or a PRC enterprise group will be regarded as a PRC tax resident by virtue of having its “de facto management body” in the PRC only if all of the following conditions are met: (i) the senior management and core management departments in charge of daily production and operations are located mainly in the PRC; (ii) decisions relating to the enterprise’s financial and human resource matters are made or are subject to approval by organizations or personnel in the PRC; (iii) the enterprise’s primary assets, accounting books and records, company seals, and board and shareholder resolutions, are located or maintained in the PRC; and (iv) at least 50% of voting board members or senior management habitually reside in the PRC. Value-added tax The State Council issued the Interim Regulation on Value Added Tax, or the VAT, on December 13, 1993, which was last amended on November 19, 2017 and shall be replaced by Value Added Tax Law published by SCNPC on December 25, 2024 that will become effective on January 1, 2026. The Detailed Rules for the Implementation of the Interim Regulation on VAT was issued by the Ministry of Finance, or the MOF, on December 25, 1993 and last amended on October 28, 2011. According to the Interim Regulation on VAT and Detailed Rules for the Implementation of the Interim Regulation on VAT, entities and individuals selling goods in the PRC or providing processing services, repair services and importation services should be subject to VAT, and the payable tax amount shall be calculated by deducting input tax for the current period from output tax for the current period. The VAT rates generally applicable are simplified as 17% on the sale of goods, 11% on the imports of goods, and 6% on services, and the VAT rate applicable to the small-scale taxpayers is 3%. The Notice of Taxation on Implementing the Pilot Program of Replacing Business Tax with VAT in an All-round Manner was issued jointly by the MOF and SAT on March 23, 2016, partly amended by the MOF, SAT and the General Administration of Customs on March 20, 2019 and became effective on April 1, 2019, according to which the countrywide pilot practice of levying VAT in lieu of business tax, or the Pilot Practice, has been carried out since May 1, 2016. According to the specific regulatory documents for the Pilot Practice, including the Implementation Measures for the Pilot Practice of Levying VAT in lieu of Business Tax, the VAT rates vary from 17%, 11%, 6%, 3% to 0% for taxpayers incurring taxable activities. According to the Notice of the MOF and SAT on Adjusting the Value-added Tax Rate effective on May 1, 2018 and the Announcement of the Ministry of Finance, the SAT and the General Administration of Customs on Relevant Policies for Deepening the Value-Added Tax Reform promulgated on March 20, 2019, which came into effect on April 1, 2019 and became partially invalid on September 1, 2025, the VAT rates on sales activities and import of goods that were previously 17% and 11%, respectively, were adjusted to 13% and 9%, respectively. 67 Withholding income tax According to the Arrangement between the Mainland of China and the Hong Kong Special Administrative Region for the Avoidance of Double Taxation and the Prevention of Fiscal Evasion with respect to Taxes on Income issued by the SAT on August 21, 2006 and that came into effect on December 8, 2006, if the shareholders of a PRC company are Hong Kong residents holding at least 25% of the registered capital of the PRC company, a withholding tax rate of 5% applies to any dividends declared by the PRC company, or if the shareholders of a PRC company are Hong Kong residents holding less than 25% of registered capital, a withholding income tax rate of 10% applies. According to the Announcement of SAT on Issuing the Measures for the Administration of Non-Resident Taxpayers’ Enjoyment of Treaty Benefits issued on October 14, 2019 and effective on January 1, 2020, the withholding tax rate of 5% does not automatically apply. To enjoy the treatment of the dividend clause of a tax treaty, an enterprise shall apply to the local competent tax authorities for approval. On February 3, 2018, the SAT issued the Announcement on Matters Concerning “Beneficial Owners” in Tax Treaties, which became effective on April 1, 2018, according to which, when determining an applicant’s “beneficial owner” status regarding tax treatments in connection with dividends, interests or royalties in tax treaties, several factors set forth below will be taken into account, although the actual analysis will be fact-specific: (i) whether the applicant is obligated to pay more than 50% of his or her income in 12 months to residents in a third country or region; (ii) whether the business operated by the applicant constitutes a substantial business operation; and (iii) whether the counterparty country or region to the tax treaties does not levy any tax or grants tax exemption on relevant income or levies tax at an extremely low rate. The applicants shall submit relevant documents to the competent tax authorities to prove his or her “beneficial owner” status. Regulations Related to Employment On July 5, 1994, the SCNPC promulgated the Labor Law, which was last amended on December 29, 2018 and became effective on the same date. The Labor Law provides that employees are entitled to equal opportunities in employment, selection of occupations, receiving labor remuneration, rest days and holidays, protection of occupational safety and healthcare, social insurance and welfare. On June 29, 2007, the SCNPC adopted the Labor Contract Law, which was last amended on December 28, 2012 and came into effect on July 1, 2013. The Labor Contract Law requires every employer to enter into a written contract of employment with each of its employees. The employer shall not force the employees to work beyond the time limit and each employer must pay overtime compensation to its employees. The Social Insurance Law was issued by the SCNPC on October 28, 2010, last amended on December 29, 2018 and effective on the same date. Under the Social Insurance Law, an employee shall participate in five types of social insurance funds, including pension insurance, medical insurance, unemployment insurance, maternity insurance and occupational injury insurance. If the employer fails to fully contribute to social insurance funds on time, the collection agency for such social insurance may demand the employer to make full payment or to pay the shortfall within a set period and collect a late charge. If the employer fails to pay after the due date, the relevant government administrative body may impose a fine on the employer. In accordance with the Regulation on the Administration of Housing Funds issued by the State Council on April 3, 1999 and last amended on March 24, 2019 and came into effect on the same date, enterprises must register with the competent managing center for housing funds and shall contribute to the Housing Fund for any employee on its payroll. Where an employer fails to pay up housing funds within the prescribed time limit, the employer may be fined and ordered to make payment within a certain period. 68 Regulations related to employee stock incentive plan SAFE promulgated the Circular of the State Administration of Foreign Exchange on Issues concerning the Administration of Foreign Exchange Used for Domestic Individuals’ Participation in Equity Incentive Plans of Companies Listed Overseas, or the Stock Option Rules in February 2012. Under the Stock Option Rules and other relevant rules and regulations, domestic individuals, which means the PRC residents and non-PRC citizens residing in China for a continuous period of not less than one year, subject to a few exceptions, who participate in a stock incentive plan in an overseas publicly-listed company are required to register with SAFE or its local branches and complete certain other procedures. Participants of a stock incentive plan who are PRC residents must retain a qualified PRC agent, which could be a PRC subsidiary of the overseas publicly-listed company or another qualified institution selected by the PRC subsidiary, to conduct the SAFE registration and other procedures with respect to the stock incentive plan on behalf of its participants. The participants must also retain an overseas entrusted institution to handle matters in connection with their exercise of stock options, the purchase and sale of corresponding stocks or interests and fund transfers. In addition, the PRC agent is required to amend the SAFE registration with respect to the stock incentive plan if there is any material change to the stock incentive plan, the PRC agent or the overseas entrusted institution or other material changes. The PRC agents must, on behalf of the PRC residents who have the right to exercise the employee share options, apply to SAFE or its local branches for an annual quota for the payment of foreign currencies in connection with the PRC residents’ exercise of the employee share options. The foreign exchange proceeds received by the PRC residents from the sale of shares under the stock incentive plans granted and dividends distributed by the overseas listed companies must be remitted into the bank accounts in the PRC opened by the PRC agents before distribution to such PRC residents. In addition, SAFE Circular 37 provides that PRC residents who participate in a share incentive plan of an overseas unlisted special purpose company may register with SAFE or its local branches before exercising rights. Regulations Related to M&A Rules and Overseas Listings On August 8, 2006, six PRC regulatory agencies jointly issued the Regulations on Mergers and Acquisitions of Domestic Enterprises by Foreign Investors, or the M&A Rules, which became effective on September 8, 2006 and was amended on June 22, 2009. The M&A Rules, among other things, require that (i) PRC entities or individuals obtain the MOFCOM’s approval before they establish or control an SPV overseas, provided that they intend to use the SPV to acquire their equity interests in a PRC company at the consideration of newly issued share of the SPV, or Share Swap, and list their equity interests in the PRC company overseas by listing the SPV in an overseas market; (ii) the SPV obtains the MOFCOM’s approval before it acquires the equity interests held by the PRC entities or PRC individual in the PRC company by Share Swap; and (iii) the SPV obtains CSRC approval before it lists overseas. In addition, on February 3, 2011, the General Office of the State Council promulgated a Notice on Establishing the Security Review System for Mergers and Acquisitions of Domestic Enterprises by Foreign Investors, or Circular 6, which officially established a security review system for mergers and acquisitions of domestic enterprises by foreign investors. Further, on August 25, 2011, the MOFCOM promulgated the Regulations on Implementation of Security Review System for the Merger and Acquisition of Domestic Enterprises by Foreign Investors, or the MOFCOM Security Review Regulations, which became effective on September 1, 2011, to implement Circular 6. Under Circular 6 and the MOFCOM Security Review Regulations, if the MOFCOM decides that a specific merger or acquisition is subject to security review, it will submit it to the Inter-Ministerial Panel, an authority established under the Circular 6, to carry out the security review. The regulations prohibit foreign investors from bypassing the security review by structuring transactions through trusts, indirect investments, leases, loans, control through contractual arrangements or offshore transactions. On February 17, 2023, the CSRC released the Trial Administrative Measures of Overseas Securities Offering and Listing by Domestic Companies, or the Overseas Listing Trial Measures, which came into effect on March 31, 2023. As a supplement to the Overseas Listing Trial Measures, on February 24, 2023, the CSRC, together with other authorities, jointly revised the Provisions on Strengthening Confidentiality and Archives Administration for Overseas Securities Offering and Listing, collectively with the Overseas Listing Trial Measures, the Overseas Listing Regulations, which came into effect on March 31, 2023. The Overseas Listing Regulations set out new filing requirements, report obligations and guidance for confidentiality and achieve administration with the CSRC for PRC domestic companies seeking direct or indirect listings and offerings in overseas markets. An overseas listing will constitute an “indirect listing” where the issuer meets both of the following conditions: (i) 50% or more of the issuer’s operating revenue, total profit, total assets or net assets for the most recent accounting year is accounted for by its PRC subsidiaries; and (ii) main parts of the business activities are conducted within mainland China, or main place of business are located in mainland China, or a majority of the senior managers in charge of business operation and management are Chinese citizens or domiciled in mainland China. 69 Regulations Related to Leasing Pursuant to the Law on Administration of Urban Real Estate which took effect in January 1995 with the latest amendment in August 2019, lessors and lessees are required to enter into a written lease contract and both lessor and lessee are also required to register the lease with the real estate administration authorities. According to the PRC Contract Law which took effect in October 1999, the lessee may sublease the leased premises to a third party, subject to the consent of the lessor. Where the lessee subleases the premises, the lease contract between the lessee and the lessor remains valid. The lessor is entitled to terminate the lease contract if the lessee subleases the premises without the consent of the lessor. In addition, if the lessor transfers the premises, the lease contract between the lessee and the lessor should still remain valid. The PRC Civil Code amalgamated and replaced the PRC Contract Law and became effective on January 1, 2021. The rules on tort in the PRC Civil Code are generally consistent with the PRC Contract Law on the aforesaid circumstances. Regulations Relating to Personal Privacy and Data Protection On November 7, 2016, the SCNPC promulgated the PRC Cybersecurity Law, which took effect in June 2017. The PRC Cybersecurity Law requires, among other things, network operators to implement security measures to protect networks from interference, damage and unauthorized access and prevent data from being leaked, stolen or tampered with, and stipulates that, for the purpose of cybersecurity, network operators must collect and use personal information in line with the principles of legitimacy, properness and necessity, strictly within the scope authorized by data subjects unless otherwise stipulated by laws or regulations. On October 28, 2025, the Standing Committee of the National People’s Congress adopted amendments to the Cybersecurity Law, which took effect on January 1, 2026. The amendments introduce significantly increased penalties for non-compliance, reflecting a heightened enforcement landscape. In addition, they set forth enhanced liability provisions targeting overseas entities whose activities endanger China’s cybersecurity—such entities may face sanctions, including asset freezes, imposed by competent authorities such as the Ministry of Public Security. The amended law also incorporates recent regulatory developments by supporting AI technology innovation, strengthening AI security oversight, and refining the legal liability framework. On May 28, 2020, the National People’s Congress of the PRC approved the PRC Civil Code, which took effect on January 1, 2021. Pursuant to the PRC Civil Code, the collection, storage, use, process, transmission, provision and disclosure of personal information shall follow the principles of legitimacy, properness and necessity. On July 6, 2021, certain PRC regulatory authorities issued Opinions on Strictly Cracking Down on Illegal Securities Activities, which, among others, provides for improving relevant laws and regulations on data security, cross-border data transmission, and confidential information management. It stipulated that efforts will be made to revise the regulations on strengthening the confidentiality and file management relating to the offering and listing of securities overseas, to implement the responsibility on information security of overseas listed companies, and to strengthen the standardized management of cross-border information provision mechanisms and procedures. On February 24, 2023, CSRC and other PRC regulatory authorities jointly revised the Provisions on Strengthening the Confidentiality and Archives Management for Overseas Securities Offerings and Listings, which took effect on March 31, 2023. The provisions expand the scope to cover both direct and indirect overseas listings of domestic enterprises and set forth the following requirements: (i) companies must review and handle documents provided to overseas parties, including obtaining approval for documents involving state secrets. Service agreements with intermediaries must include explicit confidentiality clauses in compliance with Chinese laws; (ii) working papers and accounting records generated within China must be stored domestically and not transferred overseas without approval; and (iii) companies must report to the CSRC or competent authorities before cooperating with overseas investigations. 70 On December 28, 2021, the Cyberspace Administration of China, or the CAC, issued the Cybersecurity Review Measures 2021, which became effective on February 15, 2022 and replaced the Cybersecurity Review Measures 2020. The scope of review under the Cybersecurity Review Measures 2021 extends to critical information infrastructure operators that intend to purchase internet products and services and network platform operators engaging in data processing activities, which affect or may affect national security. According to Article 7 of the Measures, network platform operators who possess personal information of over a million users shall apply to the Cybersecurity Review Office for cybersecurity reviews before listing in a foreign country. Besides, the Cybersecurity Review Measures 2021 also provide that if the relevant authorities consider that certain network products and services and data processing activities affect or may affect national security, the authorities may initiate a cybersecurity review even if the operators do not have an obligation to report for a cybersecurity review under such circumstances. The Cybersecurity Review Measures 2021 also elaborate the factors to be considered when assessing the national security risks of the relevant activities, including among others, risks of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or illegally exited the country, risks of critical information infrastructure, core data, important data or a large amount of personal information data being affected, controlled and maliciously used by foreign governments after a listing, and risks associated with Internet information security. On July 30, 2021, the State Council issued the Regulations on Protection of Critical Information Infrastructure, or the Regulations. Pursuant to the Regulations, critical information infrastructure, or CIIO, shall mean the important network facilities or information systems of key industries or fields such as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, and important network facilities or information systems which may endanger national security, people’s livelihood and public interest once there occur damage, malfunctioning or data leakage to them. The Regulations provide that no individual or organization may carry out any illegal activity of intruding into, interfering with, or sabotaging any critical information infrastructures, or endanger the security of any critical information infrastructures. The Regulations also require that critical information infrastructure operators shall establish a cybersecurity protection system and accountability system and that the main responsible person of a critical information infrastructure operator shall take full responsibility for the security protection of the critical information infrastructures operated by it. In addition, relevant administrative departments of each important industry and sector shall be responsible for formulating the rule of critical information infrastructure determination applicable to their respective industry or sector and determining the critical information infrastructure operators in their industry or sector. On June 10, 2021, the SCNPC promulgated the PRC Data Security Law, which took effect in September 2021. The PRC Data Security Law requires, among other things, data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data security, data processing activities must be conducted based on data classification and hierarchical protection system.On August 20, 2021, the Standing Committee promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. The Personal Information Protection Law requires, among others, that (i) the processing of personal information should have a clear and reasonable purpose that should be directly related to the processing purpose and should be conducted in a method that has the minimum impact on personal rights and interests, and (ii) the collection of personal information should be limited to the minimum scope as necessary to achieve the processing purpose and avoid the excessive collection of personal information. Personal information processors shall adopt necessary measures to safeguard the security of the personal information they handle. The offending entities could be ordered to correct, or to suspend or terminate the provision of services, and face confiscation of illegal income, fines or other penalties. 71 On July 7, 2022, the CAC promulgated the Measures on Security Assessment of Cross-border Data Transfer, which took effect on September 1, 2022. According to those measures, data processors providing outbound data shall apply for outbound data transfer security assessment with CAC in any of the following circumstances: (i) where a data processor provides important data abroad; (ii) where a CIIO or a data processor processing the personal information of more than one million individuals provides personal information abroad; (iii) where a data processor has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals in total abroad since January 1st of the previous year; and (iv) other circumstances prescribed by the CAC for which declaration for security assessment for outbound data transfers are required. On February 22, 2023, the CAC promulgated the Measures for the Administration of Standard Contracts for Cross-Border Transfer of Personal Information (the “Standard Contract Measures”), which took effect on June 1, 2023. The Standard Contract Measures apply to personal information processors (excluding critical information infrastructure operators) that transfer personal information overseas and do not meet the conditions for applying for outbound data transfer security assessment. It requires, among other things, that personal information processors sign a standard contract formulated by the CAC with overseas receiving parties, conduct a personal information protection impact assessment before signing the contract, and complete the filing procedures with the competent authorities within the prescribed time limit, and stipulates that personal information processors shall not split data quantities to evade regulatory requirements. On March 22, 2024, the CAC promulgated Provisions on Promoting and Regulating Cross-border Data Flows, which took effect on March 22, 2024. According to the provisions, data processors providing outbound data shall apply for outbound data transfer security assessment with CAC in any of the following circumstances: (i) where a CIIO provides personal information or important data abroad; (ii) where any data processor other than a CIIO provides important data abroad or, as of January 1 of the current year, provides personal information (excluding sensitive personal information) of not less than 1 million people or sensitive personal information of not less than 10,000 people in aggregate to overseas parties. In case of any discrepancy between these provisions and the relevant provisions such as the Measures on Security Assessment of Cross-border Data Transfer and Standard Contract Measures, Provisions on Promoting and Regulating Cross-border Data Flows shall prevail. On September 24, 2024, the State Council issued the Regulations on Network Data Security Management, which took effective on January 1, 2025. The regulation reiterates and further clarifies key rules for data processing and cybersecurity: (i) a network data processor may transfer personal information abroad without applying for the security assessment if satisfying certain conditions, such as when the data transfer is necessary to perform statutory duties or obligations; and (ii) network data processors conducting network data processing activities that affect or may affect national security shall undergo a national security review in accordance with relevant national regulations. In addition, the Regulations on Network Data Security Management also require that network data processors processing important data shall conduct an annual risk assessment of their cyber data processing activities, and submit the risk assessment report of the previous year to the competent authorities at or above the provincial level. On February 12, 2025, the CAC, promulgated the Measures for the Administration of Personal Information Protection Compliance Audits (the “Compliance Audit Measures”), which took effect on May 1, 2025. The Compliance Audit Measures require personal information processors to conduct regular compliance audits of their personal information processing activities, including reviewing the lawfulness of the collection, storage, use, processing, transmission, provision, disclosure and deletion of personal information, as well as the implementation of data security safeguards. Specifically, personal information processors that process the personal information of more than 10 million individuals must conduct compliance audits at least once every two years. 72 On October 14, 2025, the CAC and the State Administration for Market Regulation jointly promulgated the Measures for the Administration of Certification for Cross-Border Transfer of Personal Information (the “Certification Measures”), which took effect on January 1, 2026. The Certification Measures, formulated in accordance with the PRC Personal Information Protection Law and other relevant laws and regulations, provide an alternative pathway for cross-border personal information transfer. It requires, among other things, that personal information processors applying for certification must be non-critical information infrastructure operators and meet the specified personal information transfer quantity requirements, and stipulates that qualified professional certification institutions shall conduct the certification in accordance with relevant rules, with the certification certificate valid for three years. There remains uncertainty as to how these Measures and Regulations if enacted as currently proposed will be interpreted or implemented and whether the PRC regulatory authorities may adopt new laws, regulations, rules, or detailed implementation and interpretation in relation. While we intend to closely monitor the evolving laws and regulations in this area and take all reasonable measures to mitigate compliance risks, we cannot guarantee that our business and operations will not be adversely affected by the potential impact of the laws and regulations related to privacy, data protection and information security in China. Others The GDPR, which came into effect on May 25, 2018, increased our burden of regulatory compliance and requires us to change certain of our privacy and data security practices in order to achieve compliance. The GDPR implements more stringent operational requirements for processors and controllers of personal data, including, for example, requiring expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities, expanded definition of personal data, higher consent standards for processing personal data, new individual rights to be forgotten, conducting data protection impact assessment (DPIA) to identify and reduce risks of a data processing activity, appointing data protection officer where applicable and additional obligations relating to contracting with service providers that may process personal data. The GDPR further provides that EU member states may make their own additional laws and regulations in relation to certain data processing activities, which could further limit our ability to use and share personal data and could require localized changes to our operating model. Under the GDPR, fines of up to Euro 20 million or up to 4% of an organization’s total worldwide annual turnover for the preceding financial year, whichever is higher, may be imposed by data protection supervisory authorities for non-compliance, which significantly increases our potential financial exposure for non-compliance. However, in the absence of relevant precedence, the application of GDPR to, and its enforcement on, Internet services providers without physical establishment in EU remains uncertain. Moreover, the implementation of the GDPR may require substantial amendments to our procedures and policies, and these changes could impact our business by increasing its operational and compliance costs. These regulations regarding data privacy are increasing in number, as well as levels of enforcement, as manifested in increased amounts of fines and the severity of other penalties. We expect that personal privacy and data protection will receive greater attention and focus from regulators, as well as public scrutiny and attention. While we have adopted certain policies and procedures pursuant to the GDPR, including but not limited to the privacy policy and certain internal data protection policy, these policies and procedures may need to be updated when additional information concerning the best practices is made available through guidance from regulators or published enforcement decisions and further detailed policies may need to be adopted in the future in order to ensure our compliance with the GDPR. 73 C.Organizational Structure The following diagram illustrates our corporate structure as of December 31, 2025. Certain entities that are immaterial to our results of operations, business and financial condition are omitted. We currently operate our business mainly through Yalla UAE, Waha UAE, Meta UAE, Shenzhen Moov, Hangzhou Yale Information, YG Technology, Shenzhen Moojo and Shenzhen Moojoyo. Yalla UAE and its subsidiary Waha UAE function as our primary business operation center and engages in sales, marketing, customer service and other business operations. Meta UAE and Hangzhou Yale Information both perform technology and product development functions. Shenzhen Moov primarily performs marketing and financial reporting functions. YG Technology performs game launching functions. Shenzhen Moojo and Shenzhen Moojoyo both perform gaming operational support functions. D.Property, plants and equipment Our headquarters are located at our offices in Dubai, the United Arab Emirates, where we manage our corporate affairs, as well as maintaining certain sales and marketing, technology and product development and customer service personnel. In 2024, we further launched our new research and development center in Dubai. In addition, certain of our technology and product development team is based in our offices in Hangzhou, China, and our marketing and financial reporting teams are based in our offices in Shenzhen, China. We currently lease and occupy approximately 6,015.9 square feet of office space in Dubai, approximately 327 square meters of office space in Riyadh, approximately 1,016 square meters of office space in Shenzhen, approximately 6,378 square meters of office space in Hangzhou, approximately 696 square meters of office space in Guangzhou, approximately 1,567 square feet of office space in Hong Kong, and approximately 2,131 square feet of office space in Singapore. These leases have terms of one year to five years. We also purchased two buildings of approximately 679 square meters in Shenzhen.