(Bloomberg) -- Chinese regulators are considering serious, perhaps unprecedented, penalties for Didi Global Inc. after its controversial initial public offering last month, according to people familiar with the matter.

Regulators see the ride-hailing giant’s decision to go public despite pushback from the Cyberspace Administration of China as a challenge to Beijing’s authority, the people said, asking not to be named because the matter is private. Officials from the CAC, the Ministry of Public Security, the Ministry of State Security, the Ministry of Natural Resources, along with tax, transport and antitrust regulators, began an investigation on-site at the company’s offices, the cyberspace watchdog said in a statement.

Regulators are weighing a range of potential punishments, including a fine, suspension of certain operations or the introduction of a state-owned investor, the people said. Also possible is a forced delisting or withdrawal of Didi’s U.S. shares, although it’s unclear how such an option would play out.

Deliberations are at a preliminary phase and the outcomes are far from certain. Beijing is likely to impose harsher sanctions on Didi than on Alibaba Group Holding Ltd., which swallowed a record $2.8 billion fine after a months-long antitrust investigation and agreed to initiate measures to protect merchants and customers, the people said.

“It’s hard to guess what the penalty will be, but I’m sure it will be substantial,” said Minxin Pei, a professor of government at Claremont McKenna College in California.

Didi’s stock dropped more than 3% in premarket trading.

Didi, the CAC, the China Securities Regulatory Commission and the Ministry of Industry and Information Technology didn’t respond to requests for comment.

Didi’s IPO looked at first like a great success, raising $4.4 billion after several troubled years. It turned co-founder Cheng Wei into a billionaire and rewarded long-time backers SoftBank Group Corp., Tiger Global Management and Temasek Holdings Pte.

But the CAC pounced just days later, announcing a cybersecurity review because of the company’s data practices and then banning Didi’s app from the country’s app stores. Its shares quickly plunged below the offering price.

China’s regulators largely supported the idea of an IPO, but they expressed concerns about Didi’s data security practices since at least April, the people said. In one example of concern, Didi had disclosed statistics on taxi trips taken by government officials, one of the people said, although it’s not clear whether that specific issue was raised with the company.

Regulators urged Didi to ensure the security of its data before proceeding with the IPO or to shift the location to Hong Kong or mainland China where disclosure risks would be lower, the people said. Regulators didn’t explicitly forbid the company from going public in the U.S., but they felt certain Didi understood the official instructions, they said.

One person involved in the meetings, when asked why Didi didn’t act on suggestions from regulators, referred to a proverb that you can’t wake a person pretending to sleep.

The CAC itself has come under scrutiny because of the Didi IPO, with a top Party official having questioned why the agency hadn’t blocked the company’s offering, one of the people said.

Some regulatory officials expressed in private that they think Didi may have rushed its IPO out before China unveiled a new web security law, which could have hurt its valuation, one of the people said. Just days after the offering, China proposed new rules that would require nearly all companies seeking to list in foreign countries to undergo a CAC cybersecurity review.

“Beijing wants the internet sector to understand that cybersecurity and data security are now among the government’s top priorities, and individual companies’ profit can be sacrificed when cybersecurity and data security may be exposed to risks,” said Feng Chucheng, an analyst with consultancy Plenum in Beijing.

Xi Jinping’s government is trying to strike a delicate balance between reining in the power of China’s tech giants without inflicting serious damage on a critical sector that has bolstered economic growth. The crackdown began last year when Beijing forced Jack Ma’s Ant Group Co. to call off what would have been the world’s largest-ever IPO.

That was followed by antitrust investigations into giants from food-delivery pioneer Meituan to Alibaba, also founded by Ma. Beijing has said it wants to stop powerful tech companies from abusing their power and crushing innovative upstarts.

Didi began discussing IPO plans with its bankers at Goldman Sachs Group Inc., Morgan Stanley and JPMorgan Chase & Co. late last year, said people directly involved. The company weighed whether to go public in Hong Kong or the U.S., and was seeking a valuation of as much as $100 billion.

By March, they had homed in on the U.S. because the listing rules were more amenable and the company expected a better valuation from investors familiar with its American counterpart, Uber Technologies Inc. The Hong Kong exchange also questioned Didi’s compliance with Chinese regulations. It didn’t have licenses to operate in certain cities and many of its drivers lacked a household registration, or hukou, for the cities where they lived, part of municipal requirements for providing on-demand ride-hailing services there.

The process turned unusually chaotic in June as Didi and its bankers raced to the finish line, said people directly involved. As the company prepared to make its first public filing with the Securities & Exchange Commission, its own bankers weren’t sure when the documents would land. The filing ultimately hit about 3:45 a.m. China time the morning of June 11.

Didi’s government relations team handled discussions with the CAC and its regulators, and management relayed the content of those talks to its bankers, the people said. Didi knew the CAC had concerns about its data practices, but executives did not think the agency had forbidden them to proceed, the people said.

Cheng, President Jean Liu, investors and their bankers faced the choice of erring on the side of caution or proceeding with an offering that would fill the company’s coffers and enrich all of them. On June 28, they gave the green light.

Didi told its bankers it was allowed to go public provided the company keep a very low profile, one of the people said, adding that the bookrunners were told by the company there would be no press release to announce the IPO. Didi didn’t even publicize to its own employees its impending New York listing -- a landmark for the still-young company -- until the last minute. Near midnight on June 30, the company posted an announcement on an internal forum, another person said.

On Thursday, July 1, Didi’s shares surged about 16%, signaling robust investor demand. By Friday, Didi’s management began to relax and celebrate.

That evening, after 7 p.m. China time, the CAC posted a notice on its website: The agency would begin an investigation into Didi to safeguard national security and protect the public interest.

Later that night, Didi issued a public statement saying it would fully cooperate with the government review.

(Updates with Didi shares in the sixth paragraph)

©2021 Bloomberg L.P.