ysg-corresp.htm

This letter sets forth the Company’s responses to the comments contained in the letter dated June 7, 2022 from the staff (the “Staff”) of the Securities and Exchange Commission (the “Commission”) regarding the Company’s Form 20-F for the fiscal year ended December 31, 2021 filed with the Commission on April 22, 2022 (the “2021 Form 20-F”). The Staff’s comments are repeated below in bold and are followed by the Company’s responses thereto. All capitalized terms used but not defined in this letter shall have the meaning ascribed to such terms in the 2021 Form 20-F.

In response to the Staff’s comment, the Company respectfully proposes to include the following underlined disclosure in Item 3. Key Information in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed:

Yatsen Holding Limited is not an operating company in China but a Cayman Islands holding company with no equity ownership in the VIE. Our Cayman Islands holding company does not conduct business operations directly. We conduct our operations in China through (i) our PRC subsidiaries and (ii) the VIE with which we have maintained contractual arrangements. PRC laws and regulations impose certain restrictions or prohibitions on foreign ownership of companies that engage in certain value-added telecommunication services, internet audio-video program services and certain other businesses. Accordingly, we operate these businesses in China through the VIE and its subsidiaries, and rely on contractual arrangements among one of our PRC subsidiaries, the VIE and its nominee shareholders to control the business operations of the VIE, although our wholly foreign-owned subsidiaries still generate a significant majority of our revenues and hold a significant majority of our operational assets. The VIE structure provides contractual exposure to foreign investment in the companies which involve foreign investment restrictions. Main assets held by the VIE and its subsidiaries include the majority of the social platforms and content offering platforms we operate such as Weixin public accounts and mini-programs, which are registered and held by the VIE and its subsidiaries, and the ICP License and the Permit to Produce and Distribute Radio and Television Programs, which are critical to the online operation of our business. Revenues contributed by the VIE and its subsidiaries accounted for 8.2%, 17.1% and 8.9% of our total revenues for the years ended December 31, 2019, 2020 and 2021, respectively. As used in this annual report, “we,” “us,” “our company” and “our” refers to Yatsen Holding Limited, its subsidiaries, and, in the context of describing our operations and consolidated financial information, the VIE in China, which mainly refers to Huizhi Weimei (Guangzhou) Trading Co., Ltd. (including its subsidiaries), or Huizhi Weimei. Holders of our ADSs hold equity interest in Yatsen Holding Limited, our Cayman Islands holding company, and do not have direct or indirect equity interest in the VIE. The VIE structure involves unique risks to investors, and holders of our ADSs may never directly hold equity interests in the Chinese operating company. See “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Corporate Structure.”

Our corporate structure is subject to risks associated with our contractual arrangements with the VIE. ~~However, t~~he The contractual arrangements may not be as effective as direct ownership in providing us with control over the VIE and we may incur substantial costs to enforce the terms of the arrangements. As of the date of this annual report, our contracts with the VIE have not been tested in a court of law. Uncertainties in the PRC legal system may limit our ability, as a Cayman Islands holding company, to enforce these contractual arrangements. It is uncertain whether any new PRC laws or regulations relating to VIE structures will be adopted or if adopted, what they would provide. If we or the VIE is found to be in violation of any existing or future PRC laws or regulations, or fail to obtain or maintain any of the required permits or approvals, the relevant PRC regulatory authorities would have broad discretion to take action in dealing with such violations or failures. There are very few precedents as to whether contractual arrangements would be judged to form effective control over the relevant VIE through the contractual arrangements, or how contractual arrangements in the context of a VIE should be interested or enforced by the PRC courts. Should legal actions become necessary, we cannot guarantee that the court will rule in favor of the enforceability of the VIE contractual arrangements. In the event we are unable to enforce these contractual arrangements, or if we suffer significant delay or other obstacles in the process of enforcing those contractual arrangements, we may not be able to exert effective control over the VIE, and our ability to conduct our business and the financial performance of the VIE and our company as a whole may be materially adversely affected. In addition, the PRC regulatory authorities could disallow the VIE structure, which would likely result in a material adverse change in our operations, and our ADSs may decline significantly in value or become worthless. See “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Corporate Structure.””

Please revise page 3 to disclose prominently that there are legal and operational risks associated with having your operations in China. Your disclosure should make clear whether these risks could result in a material change in your operations and/or the value of your securities or could significantly limit or completely hinder your ability to offer or continue to offer securities to investors and cause the value of such securities to significantly decline or be worthless. Your disclosure should address how recent statements and regulatory actions by China’s government, such as those related to the use of variable interest entities and data security or anti-monopoly concerns, have or may impact the company’s ability to conduct its business, accept foreign investments, or list on a U.S. or other foreign exchange.

“We face various legal and operational risks and uncertainties related to doing business in China that could result in a material change in our operations and the value of our ADSs. All of our current business operations are conducted in China, and we are subject to complex and evolving PRC laws and regulations. For example, we face risks associated

with regulatory approvals on offshore offerings and listings, anti-monopoly regulatory actions, and oversight on cybersecurity and data privacy. PRC government’s significant authority in regulating our operations and its oversight and control over offerings conducted overseas by, and foreign investment in, China-based issuers could significantly limit or completely hinder our ability to offer or continue to offer securities to investors. Implementation of industry-wide regulations in this nature may cause the value of such securities to significantly decline or be worthless. For more details, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China—The PRC government’s significant oversight and discretion over our business operation could result in a material adverse change in our operations and the value of our ADSs.”

For example, the recently promulgated Data Security Law and the Personal Information Protection Law in 2021 posed additional challenges to our cybersecurity and data privacy compliance. The Revised Measures for Cybersecurity Review issued by the Cyberspace Administration of China, or the CAC and several other PRC governmental authorities in December 2021, as well as the Regulations on the Network Data Security (Draft for Comments), or the Draft Regulations, published by the CAC for public comments in November 2021, imposed potential additional restrictions on China-based overseas-listed companies like us. If the Revised Measures for Cybersecurity Review and the enacted version of the Draft Regulations mandate clearance of cybersecurity review and other specific actions to be taken by issuers like us, we face uncertainties as to whether these additional procedures can be completed by us timely, or at all, which may subject us to government enforcement actions and investigations, fines, penalties, or suspension of our non-compliant operations, and materially and adversely affect our business and results of operations and the price of our ADSs. See “Item 3. Key Information—Risk Factors—Risks Relating to Our Business and Industry—We collect, store, process and use a variety of customer data and information for analysis of the changing consumer preferences and fashion trends, and we are required to comply with PRC and other applicable laws relating to privacy, personal information, data security and cybersecurity. The improper use or disclosure of data could have a material and adverse effect on our business and prospects” for additional details.

In addition, on December 24, 2021, the China Securities Regulatory Commission, or the CSRC, released a draft of the Provisions of the State Council on the Administration of Overseas Securities Offering and Listing by Domestic Companies (Draft for Comments), or the Draft Provisions, and the CSRC issued a draft of Administration Measures for the Filing of Overseas Securities Offering and Listing by Domestic Companies (Draft for Comments), or the Draft Administration Measures, for public comments. According to the Draft Provisions and the Draft Administration Measures, an overseas offering and listing by a domestic company, whether directly or indirectly, shall be filed with the CSRC. As of the date of this annual report, the Draft Provisions and the Draft Administration Measures were released for public comment only. There are uncertainties as to whether the Draft Provisions and the Draft Administration Measures would be further amended, revised or updated. Substantial uncertainties exist with respect to the enactment timetable and final content of the Draft Provisions and the Draft Administration Measures. However, assuming the Draft

Provisions and the Draft Administration Measures were to be adopted as-is, if we fail to obtain the relevant approval or complete other review or filing procedures for any future offshore offering or listing, our PRC operations may face sanctions by the CSRC or other PRC regulatory authorities, which may include a warning and a fine between RMB1 million to RMB10 million. In serious circumstances, our PRC operations may be ordered to suspend their businesses or suspend their businesses pending rectification, or their permits or business licenses may be revoked, each of which could have a material and adverse effect on our business, financial condition, results of operations, reputation and prospects, as well as the trading price of our ADSs. See “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China— The approval of and filing with the CSRC or other PRC government authorities may be required in connection with our offshore offerings under PRC law, and, if required, we cannot predict whether or for how long we will be able to obtain such approval or complete such filing.”

Furthermore, the PRC anti-monopoly regulators have promulgated new anti-monopoly and competition laws and regulations and strengthened the enforcement under these laws and regulations. There remain uncertainties as to how the laws, regulations and guidelines recently promulgated will be implemented and whether these laws, regulations and guidelines will have a material impact on our business, financial condition, results of operations and prospects. We cannot assure you that our business operations comply with such regulations and authorities’ requirements in all respects. If any non-compliance is raised by relevant authorities and determined against us, we may be subject to fines and other penalties.

Risks and uncertainties arising from the legal system in China, including risks and uncertainties regarding the enforcement of laws and quickly evolving rules and regulations in China, could result in a material adverse change in our operations and the value of our ADSs. For more details, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China—Uncertainties with respect to the PRC legal system could adversely affect us” and “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China——We may be adversely affected by the complexity, uncertainties and changes in PRC regulation of internet-related business and companies, including limitations on our ability to own key assets.”

These risks, if materialized, could result in a material adverse change in our operations and the value of our ADSs, significantly limit or completely hinder our ability to continue to offer securities to investors, or cause the value of such securities to significantly decline or be worthless. For a detailed description of risks related to doing business in China, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China.””

The Staff's comment is duly noted. In response to the Staff’s comment, the Company respectfully undertakes to thoroughly review the disclosure throughout the Form 20-F and implement the referenced updates to the disclosure in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed.

In this section, disclose each permission or approval that you, your subsidiaries, or the VIEs are required to obtain from Chinese authorities to operate your business and to offer securities to foreign investors, and revise to remove the "material" qualifier contained in the third sentence under the heading. Revise to explain how you determined that permissions are not required by China Securities Regulatory Commission (CSRC), Cyberspace Administration of China (CAC) or other governmental agencies, and state affirmatively whether you have received all requisite permissions or approvals and whether any permissions or approvals have been denied. Please also describe the consequences to you and your investors if you, your subsidiaries, or the VIEs: (i) do not receive or maintain such permissions or approvals, (ii) inadvertently conclude that such permissions or approvals are not required, or (iii) applicable laws, regulations, or interpretations change and you are required to obtain such permissions or approvals in the future.

In response to the Staff’s comment, the Company respectfully proposes to include the following underlined disclosure in Item 3. Key Information and file the consent of its PRC legal counsel in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed:

“Permissions or Filings Required from the PRC Authorities for Our Operations and Offshore Offerings

We conduct our business primarily through our subsidiaries and the VIE in China. Our operations in China are governed by PRC laws and regulations. As of the date of this annual report, our PRC subsidiaries and the VIE are required to obtain, and have obtained the following requisite permissions ~~licenses and permits~~ from the PRC government authorities that are ~~material~~ necessary for the business operations of our holding company, our subsidiaries and the VIE in China~~, including among others,~~: value-added telecommunication business operation license for provision of internet information services, or the ICP License, the Permit to Produce and Distribute Radio and Television Programs, Record Filing Certificate for Operation of Class II Medical Devices for medical facial masks sales, Registration Certificate for Operation of Class III Medical Devices for color contact lens sales, Qualification for Drug Information Services over the Internet, and the Permit for the Food Trade for our sale of health-care food and snacks as well as operating a café. In

addition, we have completed the foreign trade business operator registration and the export goods consignor/consignee registration for our sales of products to Southeast Asia and other overseas markets. Given the uncertainties of interpretation and implementation of relevant laws and regulations and the enforcement practice by relevant government authorities, we may be required to obtain additional licenses, permits, filings or approvals for the functions and services of our business in the future, and may not be able to maintain or renew our current licenses, permits, filings or approvals. For more detailed information, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry—If the content we produce and distribute through online social and content platforms, or content available on our website, is deemed to violate PRC laws or regulations, our business and results of operations may be materially and adversely affected.”

The PRC governmental authorities have recently promulgated PRC laws and regulations relating to cybersecurity review and overseas listings. Furthermore, under current PRC laws, regulations and regulatory rules, we, our PRC subsidiaries and the VIE may be required to obtain permissions from the China Securities Regulatory Commission, or the CSRC, and may be required to go through cybersecurity review by the Cyberspace Administration of China, or the CAC, in connection with any future offering and listing in an overseas market. In connection with our previous issuance of securities to foreign investors, under current PRC laws, regulations and regulatory rules, as of the date of this annual report, we, our PRC subsidiaries and the VIE, (i) are not required to obtain permissions from the CSRC, as advised by our PRC legal counsel, (ii) have not received any requirement from competent PRC governmental authorities to go through cybersecurity review by the CAC, and a phone consultation dated July 19, 2022 conducted by our PRC legal counsel with the China Cybersecurity Review Technology and Certification Center further confirmed that the requirement for cybersecurity review before certain public offerings on a foreign stock exchange under the Revised Measures for Cybersecurity Review would not apply to previous issuances of securities to foreign investors that occurred before the adoption of the Revised Measures for Cybersecurity Review, and (iii) have not received or were denied such requisite permissions by any PRC authority. However, if the governmental authorities subsequently disagree with our conclusion that such approvals were not required, or if applicable laws, regulations or interpretations change in a way that requires us to obtain such approvals in the future, we may be unable to obtain such necessary approvals in a timely manner, or at all, and such approvals may be rescinded even if obtained. Any such circumstance could subject us to penalties, including fines, suspension of business and revocation of required licenses, significantly limit or completely hinder our ability to continue to offer securities to investors and cause the value of such securities to significantly decline or be worthless. Furthermore, in connection with any future offering and listing in an overseas market, under current PRC laws, regulations and regulatory rules, we, our PRC subsidiaries and the VIE may be required to obtain permissions from the China Securities Regulatory Commission, or the CSRC, and may be required to go through cybersecurity review by the Cyberspace Administration of China, or the CAC. If we fail to obtain the relevant approval or complete other review or filing procedures for any future offshore offering or listing, we may face sanctions by the CSRC or other PRC regulatory authorities, which may include fines and penalties on our operations in China, limitations on our

operating privileges in China, restrictions on or prohibition of the payments or remittance of dividends by our subsidiaries in China, restrictions on or delays to our future financing transactions offshore, or other actions that could have a material and adverse effect on our business, financial condition, results of operations, reputation and prospects, as well as the trading price of our ADSs. For more detailed information, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China—The approval of and filing with the CSRC or other PRC government authorities may be required in connection with our offshore offerings under PRC law, and, if required, we cannot predict whether or for how long we will be able to obtain such approval or complete such filing” and “Item 3. Key Information—D. Risk Factors—Risks Relating to Our Business and Industry— We collect, store, process and use a variety of customer data and information for analysis of the changing consumer preferences and fashion trends, which subjects us to laws and regulations related to privacy, information security and data protection. Any failure to comply with these law and regulations could materially and adversely harm our business, financial condition and results of operations.””

Please prominently disclose that the Public Company Accounting Oversight Board (“PCAOB”) has determined that it is unable to inspect or investigate completely the registered public accounting firm that you have retained because of a position taken by an authority in the foreign jurisdiction. In light of this determination, provide additional disclosure regarding how the Holding Foreign Companies Accountable Act (HFCAA) and related regulations has impacted or could impact your company in the future. Also, expand the disclosure to discuss the potential impact of the Accelerating Holding Foreign Companies Accountable Act ("AHFCAA"), which has been passed by the United States Senate, if enacted.

The Holding Foreign Companies Accountable Act, or the HFCAA, was enacted on December 18, 2020. The HFCAA states if the Securities and Exchange Commission, or the SEC, determines that we have filed audit reports issued by a registered public accounting firm that has not been subject to inspection by the Public Company Accounting Oversight Board (United States), or the PCAOB, for three consecutive years, or two consecutive years if the proposed changes to the law are enacted, beginning in 2021, the SEC shall prohibit our shares or ADSs from being traded on a national securities exchange or in the over-the-counter trading market in the United States. Since our auditor is located in China, a jurisdiction where the PCAOB has been unable to conduct inspections without the approval of the Chinese authorities, our auditor is not currently inspected by the PCAOB, which may impact our ability to remain listed on a United States or other foreign exchange. On

December 16, 2021, the PCAOB issued a report to notify the SEC of its determination that the PCAOB is unable to inspect or investigate completely registered public accounting firms headquartered in mainland China and Hong Kong, because of positions taken by PRC authorities in those jurisdictions. The PCAOB identified our auditor as one of the registered public accounting firms that the PCAOB is unable to inspect or investigate completely. If our shares and ADSs are prohibited from trading in the United States, there is no certainty that we will be able to list on a non-U.S. exchange or that a market for our shares will develop outside of the United States. Such a prohibition would substantially impair your ability to sell or purchase our ADSs when you wish to do so, and the ~~The~~ related risks and uncertainties could cause the value of our ADSs to significantly decline. Also, such a prohibition would significantly affect our ability to raise capital on terms acceptable to us, or at all, which would have a material adverse impact on our business, financial condition, and prospects.

On June 22, 2021, the U.S. Senate passed a bill which proposed to reduce the number of consecutive non-inspection years required for triggering the prohibitions under the HFCAA from three years to two. On February 4, 2022, the U.S. House of Representatives passed a bill which contained, among other things, an identical provision. Our ADSs will be prohibited from trading in the United States under the HFCAA, in 2024 if the PCAOB is unable to inspect or fully investigate auditors located in China, or in 2023 if proposed changes to the law are enacted. The delisting of our ADSs, or the threat of their being delisted, may materially and adversely affect the value of your investment. In May 2022, in connection with its implementation of the HFCAA, the SEC conclusively named the company as a “Commission-Identified Issuer” following the filing of the company’s 2021 Form 20-F with the SEC on April 22, 2022. For more details, see “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China—The PCAOB is currently unable to inspect our auditor in relation to their audit work performed for our financial statements and the inability of the PCAOB to conduct inspections over our auditor deprives our investors with the benefits of such inspections” and “Item 3. Key Information—D. Risk Factors—Risks Relating to Doing Business in China—Our ADSs will be prohibited from trading in the United States under the Holding Foreign Companies Accountable Act, or the HFCAA, in 2024 if the PCAOB is unable to inspect or fully investigate auditors located in China, or in 2023 if proposed changes to the law are enacted. The delisting of our ADSs, or the threat of their being delisted, may materially and adversely affect the value of your investment.””

Revise the risk factor to clarify that if the PRC government determines that the contractual arrangements constituting part of the VIE structure do not comply with PRC regulations, or if these regulations change or are interpreted differently in the future, the securities you are registering may decline in value or become worthless if the determinations, changes, or interpretations result in your inability to assert contractual control over the assets of your PRC subsidiaries or the VIEs that conduct all or substantially all of your operations.

In response to the Staff’s comment, the Company respectfully proposes to include the following underlined disclosure in Item 3. Key Information—D. Risk Factors in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed:

Risks and uncertainties related to our corporate structure include, but are not limited to, the following:

• We are a Cayman Islands holding company with no equity ownership in the VIE and we conduct our operations in China primarily through (i) our subsidiaries in China and (ii) the VIE with which we have maintained contractual arrangements. Holders of our ADSs hold equity interest in Yatsen Holding Limited, our Cayman Islands holding company, and do not have direct or indirect equity interest in the VIE. If the PRC government ~~finds~~ determines that the contractual agreements constituting part of the VIE structure ~~that establish the structure for operating our business~~ do not comply with PRC laws and regulations, or if these regulations or their interpretations change in the future, we could be subject to severe penalties or be forced to relinquish our interests in those operations. If the determinations, changes, or interpretations result in our inability to assert contractual control over the VIE, which contributed to [8.9] % of our revenues in [2021]¹, our ADSs may decline in value or become worthless. Our holding company, the VIE, and investors of our company face uncertainty about potential future actions by the PRC government that could affect the enforceability of the contractual arrangements with the VIE and, consequently, significantly affect the financial performance of the VIE and our company as a whole; ”

We note your disclosure about the Holding Foreign Companies Accountable Act. Please expand your risk factors to disclose that the United States Senate has passed the Accelerating Holding Foreign Companies Accountable Act, which, if enacted, would decrease the number of “non-inspection years” from three years to two years, and thus, would reduce the time before your securities may be prohibited from trading or delisted. Update your disclosure to reflect that the Commission adopted rules to implement the HFCAA and that, pursuant to the HFCAA, the PCAOB has issued its report notifying the Commission of its determination that it is unable to inspect or investigate completely accounting firms headquartered in mainland China or Hong Kong.

We are also subject to risks and uncertainties relating to doing business in China in general, including, but not limited to, the following:

• On December 16, 2021, the PCAOB issued a report to notify the SEC of its determination that the PCAOB is unable to inspect or investigate completely registered public accounting firms headquartered in mainland China and Hong Kong. The PCAOB identified our auditor as one of the registered public accounting firms that the PCAOB is unable to inspect or investigate completely. On June 22, 2021, the U.S. Senate passed a bill which proposed to reduce the number of consecutive non-inspection years required for triggering the prohibitions under the HFCAA from three years to two. On February 4, 2022, the U.S. House of Representatives passed a bill which contained, among other things, an identical provision. In May 2022, in connection with its implementation of the HFCAA, the SEC conclusively named the company as a “Commission-Identified Issuer” following the filing of the company’s 2021 Form 20-F with the SEC on April 22, 2022. Our ADSs will be prohibited from trading in the United States under the Holding Foreign Companies Accountable Act, or the HFCAA, in 2024 if the PCAOB is unable to inspect or fully investigate auditors located in China, or in 2023 if proposed changes to the law are enacted. The delisting of our ADSs, or the threat of their being delisted, may materially and adversely affect the value of your investment; and”

The Company also respectfully proposes to revise the referenced risk factor and include the following underlined disclosure in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed:

“The Holding Foreign Companies Accountable Act, or the HFCAA, was signed into law on December 18, 2020. The HFCAA states if the SEC determines that we have filed audit reports issued by a registered public accounting firm that has not been subject to inspection for the PCAOB for three consecutive years beginning in 2021, the SEC shall prohibit our shares or ADS from being traded on a national securities exchange or in the over-the-counter trading market in the United States. On December 16, 2021, PCAOB issued a report to notify the SEC of its determination that the PCAOB is unable to inspect or investigate completely registered public accounting firms headquartered in mainland China and Hong Kong. The PCAOB identified our auditor as one of the registered public accounting firms that the PCAOB is unable to inspect or investigate completely. In May 2022, in connection with its implementation of the HFCAA, the SEC conclusively named

our company as a “Commission-Identified Issuer” following the filing of our company’s 2021 Form 20-F with the SEC on April 22, 2022. In March 2022, the SEC issued its first list of issuers identified under the HFCAA indicating that the companies on the list will be subject to the delisting provisions if they remain on the list for three consecutive years. After we file this annual report on Form 20-F, we expect to be identified by the SEC under the HFCAA as having filed audit reports issued by a registered public accounting firm that cannot be inspected or investigated completely by the PCAOB.”

Given the Chinese government’s significant oversight and discretion over the conduct of your business, please revise to highlight separately the risk that the Chinese government may intervene or influence your operations at any time, which could result in a material change in your operations and/or the value of your securities. Also, given recent statements by the Chinese government indicating an intent to exert more oversight and control over offerings that are conducted overseas and/or foreign investment in China-based issuers, acknowledge the risk that any such action could significantly limit or completely hinder your ability to offer or continue to offer securities to investors and cause the value of your securities to significantly decline or be worthless.

We are also subject to risks and uncertainties relating to doing business in China in general, including, but not limited to, the following:

• The PRC government has significant oversight and discretion over the conduct of our business, and may intervene or influence our operations as the government deems appropriate to advance regulatory and societal goals and policy positions, which could result in a material adverse change in our operation and/or the value of our ADSs. The PRC government’s significant authority in regulating our operations and its oversight and control over offerings conducted overseas by, and foreign investment in, China-based issuers could significantly limit or completely hinder our ability to offer or continue to offer securities to investors. Implementation of industry-wide regulations in this nature may cause the value of such securities to significantly decline or be worthless;”

“The PRC government’s significant oversight and discretion over our business operation could result in a material adverse change in our operations and the value of our ADSs.

We conduct our business primarily in China. Our operations in China are governed by PRC laws and regulations. The PRC government has significant oversight and discretion over the conduct of our business, and may intervene or influence our operations as the government deems appropriate to advance regulatory and societal goals and policy positions, which could result in a material adverse change in our operation and/or the value of our ADSs. The PRC government has recently published new policies that significantly affected certain industries and we cannot rule out the possibility that it will in the future release regulations or policies that directly or indirectly affect our industry or require us to seek additional permission to continue our operations, which could also result in a material adverse change in our operation and/or the value of our ADSs. Therefore, investors of our company and our business face potential uncertainty from actions taken by the PRC government affecting our business.”

“We collect, store, process and use a variety of customer data and information for analysis of the changing consumer preferences and fashion trends, and we are required to comply with PRC and other applicable laws relating to privacy, personal information, data security and cybersecurity. The improper use or disclosure of data could have a material and adverse effect on our business and prospects.

We collect, store, process and use a variety of customer data and information for analysis of the changing consumer preferences and fashion trends to guide our product development and to improve our products and customer experience. We face risks inherent in handling and protecting customer data and information. In particular, we face a number of challenges relating to data from transactions and other activities on our platforms, including:

• Protecting the data in and hosted on our system, including against attacks on our system by outside parties or fraudulent behavior or improper use by our employees and third parties;

• addressing concerns related to personal information, data protection, cybersecurity and other factors; and

• complying with applicable laws, rules and regulations relating to the collection, use, storage, processing, transfer, provision, disclosure, deletion and security of data, including any requests from regulatory and government authorities relating to these data.

In general, we expect that data security and data protection compliance will receive greater attention and focus from regulators, both domestically and globally, as well as attract continued or greater public scrutiny and attention going forward, which could increase our compliance costs and subject us to heightened risks and challenges associated with data security and protection. If we are unable to manage these risks, we could become subject to penalties, including fines, suspension of business and revocation of required licenses, and our reputation and results of operations could be materially and adversely affected.

The PRC regulatory and enforcement regime with regard to data security and data protection is evolving and may be subject to different interpretations or significant changes. Moreover, different PRC regulatory bodies, including the SCNPC, the Ministry of Industry and Information Technology, or the MIIT, the CAC, the Ministry of Public Security and the State Administration for Market Regulation, have enforced data privacy and protections laws and regulations with varying standards and applications. See “Item 4. Information on the Company—B. Business Overview—Regulations—Regulations Relating to Internet Information Security and Privacy Protection.” The following are examples of certain recent PRC regulatory activities in this area:

• In June 2021, the SCNPC promulgated the Data Security Law, which took effect in September, 2021. The Data Security Law, among other things, provides for national security review procedure for data processing activities that affect or may affect national security. In July 2021, the state council promulgated the Security Protection Regulations for Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to this regulation, critical information infrastructure means key network facilities or information systems of critical industries or sectors, such as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, the damage, malfunction or data leakage of which may endanger national security, people’s livelihoods and the public interest. In December 2021, the CAC, together with other authorities, jointly promulgated the Revised Measures for Cybersecurity Review, which became effective on February 15, 2022 and replaces its predecessor regulation. Pursuant to the Revised Measures for Cybersecurity

Review, critical information infrastructure operators that procure internet products and services must be subject to the cybersecurity review if their activities affect or may affect national security. The Revised Measures for Cybersecurity Review further stipulates that network platform operators that hold personal information of over one million users shall apply with the Cybersecurity Review Office for a cybersecurity review before any public offering at a foreign stock exchange. As of the date of this annual report, no detailed rules or implementation rules have been issued by any authority and we have not been informed that we are a critical information infrastructure operator by any government authorities. Furthermore, the exact scope of “critical information infrastructure operators” under the current regulatory regime remains unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of the applicable laws. Therefore, it is uncertain whether we would be deemed to be a critical information infrastructure operator under PRC law. If we are deemed to be a critical information infrastructure operator under the PRC cybersecurity laws and regulations, we may be subject to obligations in addition to what we have fulfilled under the PRC cybersecurity laws and regulations.

• In November 2021, the CAC released the Regulations on the Network Data Security (Draft for Comments), or the Draft Regulations. The Draft Regulations provide that data processors refer to individuals or organizations that, during their data processing activities such as data collection, storage, utilization, transmission, publication and deletion, have autonomy over the purpose and the manner of data processing. In accordance with the Draft Regulations, data processors shall apply for a cybersecurity review for certain activities, including, among other things, (i) the listing abroad of data processors that process the personal information of more than one million users and (ii) any data processing activity that affects or may affect national security. However, there have been no clarifications from the relevant authorities as of the date of this annual report as to the standards for determining whether an activity is one that “affects or may affect national security.” In addition, the Draft Regulations requires that data processors that process “important data” or are listed overseas must conduct an annual data security assessment by itself or commission a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this annual report, the Draft Regulations was released for public comment only, and their respective provisions and anticipated adoption or effective date may be subject to change with substantial uncertainty. However, if such regulations were to be adopted in their current form, we would be subject to additional regulatory obligations with respect to data security and may face challenges in addressing their requirements and amending our internal data processing policies and practices to ensure compliance therewith.

• In August 2021, the SCNPC promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. We only collect basic user personal information that is necessary to provide the corresponding services. We update our privacy policies from time to time to meet the latest regulatory requirements of the CAC and other authorities and adopt technical measures to protect personal information and ensure cybersecurity in a systematic way. Nonetheless, the Personal Information Protection Law elevates the protection requirements for personal information processing, and many specific requirements of this law remain to be clarified by the CAC, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations.

Many of the data-related legislations are relatively new and certain concepts thereunder remain subject to interpretation by the regulators. If any data that we possess belongs to data categories that are subject to heightened scrutiny, we may be required to adopt stricter measures for protection and management of such data. The Revised Measures for Cybersecurity Review and the Draft Regulations remain unclear on whether the relevant requirements will be applicable to companies that are already listed in the United States, such as us. We cannot predict the impact of the Revised Measures for Cybersecurity Review and the Draft Regulations, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If the Revised Measures for Cybersecurity Review and the enacted version of the Draft Regulations mandate clearance of cybersecurity review and other specific actions to be taken by issuers like us, we face uncertainties as to whether these additional procedures can be completed by us timely, or at all, which may subject us to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our online stores from the relevant e-commerce platforms ~~app from the relevant application stores~~, and materially and adversely affect our business and results of operations and significantly limit or completely hinder our ability to continue to offer securities to investors, or cause the value of such securities to significantly decline.

Based on our internal data compliance assessment conducted with the assistance of our PRC legal counsel, as of [March 10, 2022]², our business operations are compliant with the regulations that have been issued by the CAC in all material respects. There have not been any material changes in our business operations concerning data security and personal information protection since then. We have been taking, and will continue to take, reasonable measures to comply with laws and regulations relating to privacy, personal information, data security and cybersecurity. Pursuant to PRC laws and regulations regarding data security and personal information protection, and in response to the current supervisory tendency from the CAC, we have taken certain

internal and external measures to ensure compliance with the legal obligation required by the supervisory authorities and to ensure data security concerning customers. With respect to external management, on the one hand, we have timely updated our personal information processing rules, and we have disclosed the updated personal information processing rules to our customers and obtained their consent to such update; on the other hand, we have executed data processing agreements with external logistic companies to clarify each party’s rights and obligations when assigning personal information processing tasks to such logistic companies. With respect to internal management, we have established an integrated data compliance management structure and enacted a series of data compliance policies such as the data security management policy (including the requirements for data compliance audit), the data classification and grading policy, the personal information protection impact assessment policy, the data storage and management policy, information security incidents and emergency response measures. We have also utilized a series of compliance tools to ensure proper implementation of the aforementioned policies. However, as the PRC governmental authorities have wide discretion in interpretation and implementation of the Revised Measures for Cybersecurity Review and related cybersecurity laws and regulations, it is uncertain whether the efforts undertaken by us so far will be sufficient to ensure full compliance with all applicable cybersecurity laws and regulations in the future. In addition, substantial uncertainties exist with respect to the enactment timetable, final content, interpretation and implementation of such regulations, and we are not certain whether the Draft Regulations, if enacted in their current form, or any future laws, rules or regulations of a similar nature will apply to us. As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the CAC on such basis. Based on the foregoing, our PRC legal counsel does not expect that, as of the date of this annual report, the current applicable PRC laws on data security and personal information protection would have a material adverse impact on our business.

In general, compliance with the existing PRC laws and regulations, as well as additional laws and regulations that PRC regulatory bodies may enact in the future, related to data security and personal information protection, may be costly and result in additional expenses to us, and subject us to negative publicity, which could harm our reputation and business operations. There are also uncertainties with respect to how such laws and regulations will be implemented and interpreted in practice.

In addition, regulatory authorities around the world have adopted or are considering a number of legislative and regulatory proposals concerning data protection. These legislative and regulatory proposals, if adopted, and the uncertain interpretations and application thereof could, in addition to the possibility of fines, result in an order requiring that we change our data practices and policies, which could have an adverse effect on our business and results of operations. The European Union General Data Protection Regulation (“GDPR”), which came into effect on May 25, 2018, includes operational requirements for companies that receive or process personal data of residents of the European Economic Area. The GDPR establishes new requirements applicable to the processing of personal data, affords new data protection rights to individuals and imposes penalties for serious data

breaches. Individuals also have a right to compensation under the GDPR for financial or non-financial losses. Although we do not conduct any business in the European Economic Area, in the event that residents of the European Economic Area access our website or our mobile platform and input protected information, we may become subject to provisions of the GDPR.”

10.

We note that the consolidated VIE constitute a material part of your consolidated financial statements. Please provide in tabular form a condensed consolidating schedule that disaggregates the operations and depicts the financial position, cash flows, and results of operations as of the same dates and for the same periods for which audited consolidated financial statements are required. The schedule should present major line items, such as revenue and cost of goods/services, and subtotals and disaggregated intercompany amounts, such as separate line items for intercompany receivables and investment in subsidiary. The schedule should also disaggregate the parent company, the VIE and its consolidated subsidiaries, the WFOEs that are the primary beneficiary of the VIE, and an aggregation of other entities that are consolidated. The objective of this disclosure is to allow an investor to evaluate the nature of assets held by, and the operations of, entities apart from the VIE, as well as the nature and amounts associated with intercompany transactions. Any intercompany amounts should be presented on a gross basis and when necessary, additional disclosure about such amounts should be included in order to make the information presented not misleading.

In response to the Staff’s comment, the Company respectfully advises the Staff that the requested disclosure has been provided in Item 3. Key Information—Financial Information Related to the VIE in the 2021 Form 20-F submitted with the Commission on April 22, 2022.

In response to the Staff’s comment, the Company respectfully proposes to include the following disclosure in Item 3. Key Information—Financial Information Related to the VIE in its future Form 20-F filings, subject to updates and adjustments to be made in connection with any material development of the subject matter being disclosed:

“Movements of investments in subsidiaries and VIE / (deficit of investments in subsidiaries and VIE) in Yatsen Holding Limited’s separate financial statements is as follows:


	RMB (In thousands)

As of January 1, 2020	683,002
Capital contribution to subsidiaries	624,978
Share-based compensation costs incurred on behalf of subsidiaries	1,900,588
Payments made by subsidiaries on behalf of the Company	(40,464)
Share of loss of subsidiaries and VIE	(2,683,245)
Share of changes in accumulated other comprehensive income of subsidiaries	100,187
Foreign currency translation	(58,464)
As of December 31, 2020	526,582
Capital contribution to subsidiaries	25,856
Share-based compensation costs incurred on behalf of subsidiaries	530,440
Share of loss of subsidiaries and VIE	(1,527,645)
Share of changes in accumulated other comprehensive income of subsidiaries	12,679
Foreign currency translation	(26,272)
As of December 31, 2021	(458,360)

The Staff's comment is duly noted. The Company respectfully advises the Staff that the terms “China” or “PRC” are intentionally defined, solely for purposes of the annual reports on Form 20-F and its historical disclosure documents, to exclude Hong Kong and Macau, as the Company’s operating metrics and all disclosures about China/PRC-specific laws and regulations are not intended to include Hong Kong and Macau. As a matter of fact, both Hong Kong and Macau enjoy a high degree of autonomy under the “one country, two systems” constitutional principle, and mingling disclosures of these two special administrative regions with that of the mainland China would prove to be unduly burdensome. Specifically, in terms of accounting and disclosures regarding taxes and movement of cash, Hong Kong is treated as a separate jurisdiction distinct from mainland China. Meanwhile, the proposed revision would be against how disclosure conventions have been developed in this regard among virtually all China-based foreign private issuers. Thus, the Company believes that it is advisable to keep the referenced definition as-is for purpose of disclosure simplicity and precision.