American Tower (AMT) Risk Analysis

Our industries are highly competitive and our customers have numerous alternatives in leasing communications infrastructure assets. Competition due to pricing or alternative contractual arrangements from peers could materially and adversely affect our lease rates. We may not be able to renew existing customer leases or enter into new customer leases, or if we are able to renew or enter into new leases, they may be at rates lower than our current rates or on less favorable terms than our current terms, resulting in an adverse impact on our results of operations and growth rate. During the year ended December 31, 2025, churn was approximately 2% of our tenant billings. An increase in our future churn rate resulting from non-renewal, or renegotiations at less favorable terms than our current rates, from one or more of our larger customers could materially and adversely impact our growth rate and revenue. In addition, some of our data center competitors may have significant advantages over us, including greater name recognition, longer operating histories, lower operating costs, lower levels of leverage, pre-existing relationships with current or potential customers, greater financial, marketing and other resources, access to better networks and access to less expensive power. These advantages could allow our data center competitors to respond more quickly or effectively to strategic opportunities and, as a result, we may lose existing or potential data center customers, incur costs to improve our data centers or be forced to reduce our rental rates. These risks are compounded by the fact that a significant percentage of our data center customer leases expire every year.

Significant consolidation among our customers could reduce demand for our communications infrastructure and may materially and adversely affect our growth and revenues. Certain combined companies have rationalized duplicative parts of their networks or modernized their networks, and these and other customers could determine not to renew, or attempt to cancel, avoid or limit leases or related payments with us. Additionally, some of our international customers may use consolidation and/or restructuring to address financial or other competitive pressures, which could in turn result in the sale of wireless assets. In the event a customer terminates, consolidates or restructures its business, or separately sells its spectrum or wireless assets, we may experience increased churn as a result. Our ongoing contractual revenues and our future results may be negatively impacted if a significant number of these leases are terminated or not renewed. In addition, extensive sharing of site infrastructure through RAN sharing, roaming or resale arrangements among wireless service providers, including due to increases in advanced network technology such as 5G, as an alternative to leasing our communications sites, without compensation to us, may cause new lease activity to slow if carriers utilize shared equipment rather than deploy new equipment, or may result in the decommissioning of equipment on certain existing sites because portions of the customers' networks may become redundant.

As part of our normal business activities, including in our data centers, we rely on energy systems, cooling systems, communication networks, information technology and other computing resources, and collect, store, manage and otherwise process third-party data, including our customers' data, our vendors' data and our own data. We are vulnerable to physical or cybersecurity breaches, attacks, computer viruses, ransomware, malware, fraud, worms, adverse impacts of artificial intelligence, social engineering, denial-of-service attacks, malicious software programs, insider threats, unauthorized access and other cybersecurity incidents that could disrupt our, our customers' or our vendors' operations, expose us to liability and have a material adverse effect on our financial performance and operating results. These threats may result from human error, equipment failure, fraud or malice on the part of employees or third parties. A party who is able to compromise the security measures on our or our vendors' networks or the security of our communications infrastructure could misappropriate our proprietary information or the personal information of our customers, our vendors, our employees or management, or cause interruptions or malfunctions in our operations or our customers' operations. As we provide assurances to our customers that we provide a high level of security, such a compromise could be particularly harmful to our brand and reputation. We may be required to expend significant capital and resources to address any breaches, protect against such threats or to alleviate problems caused by security breaches. Globally, the frequency, severity and sophistication of cybersecurity incidents have increased, and these trends will likely continue, especially during times of geopolitical tension or instability among countries from which a number of recent cybersecurity events have been alleged to have originated. Such cyber-attacks could be in the form of espionage, phishing campaigns and otherwise. Additionally, the use of AI technologies has led to increased exposure to cybersecurity threats globally. AI systems may be used by threat actors to exploit vulnerabilities more efficiently or to facilitate increasingly sophisticated cyberattacks, any of which could result in data breaches, operational disruptions or liability. We are continuously evaluating and enhancing our cybersecurity and information security systems and creating new systems and processes. However, there can be no assurance that these measures are or will be effective in preventing or limiting the impact of future cybersecurity incidents. As techniques used to breach security grow in frequency and sophistication, and are generally not recognized until launched against a target, we, or our vendors, may not be able to promptly detect that a cyber breach has occurred or implement security measures in a timely manner. If and when implemented, we, or our vendors, may not be able to determine the extent to which these measures could be circumvented. Any breaches that may occur could expose us to increased risk of lawsuits, regulatory penalties, loss of existing or potential customers, damage relating to loss of proprietary information, harm to our reputation and increases in our security costs or related insurance, which could have a material adverse effect on our financial performance and operating results. We offer managed services in certain of our data centers where we provide "remote hands" services for our customers. The access to our customers' networks and data, which is gained from these services, creates some risk that our customers' networks or data will be improperly accessed. If we were held responsible for any such breach, it could result in a significant loss to us, including damage to our customer relationships, harm to our brand and reputation and legal liability. Additionally, while we maintain insurance coverage for cybersecurity incidents, we may not have adequate insurance to cover the associated costs in the event of a breach resulting in loss of data, such as personally identifiable information or other such data protected by data privacy or other laws, and we may be liable for damages, fines and penalties for such losses under applicable regulatory frameworks. Although we and our vendors have disaster recovery programs and security measures in place, if our computer systems and our backup systems are compromised, degraded, damaged, breached or otherwise cease to function properly, we could suffer interruptions in our operations, including our ability to correctly record, process and report financial information, our customers' network availability may be impacted or we could unintentionally allow misappropriation of proprietary or confidential information (including information about our customers or landlords, or customer information on our fiber, data center or managed networks businesses), which could result in a loss of revenue, damage to our reputation, damage to our customer and vendor relationships, litigation, regulatory investigations and penalties under existing or future data privacy laws and require us to incur significant costs to remediate or otherwise resolve these issues.

Our business, and that of our customers, is subject to federal, state, local and foreign laws, treaties and regulations and administrative and judicial decisions. In certain jurisdictions, these regulations, laws and treaties could be applied or be enforced retroactively. Zoning authorities and community organizations are sometimes opposed to the construction of communications sites in their communities, which can delay, prevent or increase the cost of new tower or data center construction, modifications, additions of new antennas to a site or site upgrades, thereby limiting our ability to respond to customer demands. Existing or new regulatory policies, regulations or laws may materially and adversely affect the timing, cost or completion of our communications sites or result in changes in the competitive landscape that may negatively affect our business. Noncompliance could result in the imposition of fines or an award of damages to litigants or result in decreased revenue or the potential loss of our sites. In addition, in certain jurisdictions, we and certain of our customers are required to pay annual licenses, fees or taxes, which may be subject to substantial increases by the government, or new fees may be enacted and applied retroactively. In some instances, government regulation restricting foreign ownership of our customers could result in loss of revenue or penalties. Governmental licenses may also be subject to periodic renewal and additional conditions to receive or maintain such license. Additionally, we have government customers for several of our communications sites and data centers, which subjects us to risks including early termination, audits, investigations, sanctions and penalties. Our data centers segment is also subject to various federal, state and local environmental and health and safety laws and regulations in the United States, as set forth in Item 1A of this Annual Report under the caption "Risk Factors- Our data center segment contains certain operational differences from our tower leasing operations resulting in different operational risks. If we do not successfully operate our data center segment or identify or manage the related operational risks, such operations may produce results that are lower than anticipated." Furthermore, the tax laws, regulations, applicable license terms and conditions, and interpretations governing our business, and that of our customers, in jurisdictions where we operate, may change at any time, potentially with retroactive effect. The evolving nature of global tax laws and regulations and compliance approaches could have an impact on our financial results. This includes changes in tax laws, transfer pricing regulations, spectrum use terms, administrative compliance guidance or judicial interpretations thereof. In recent years, there have been some legislative proposals regarding tax laws applicable to REITs. Any increases in tax liability could reduce the amount of cash available for other purposes. In addition, as of January 1, 2024, we and our subsidiaries, in principle, became subject to the Organization for Economic Cooperation and Development (the "OECD") Global Anti-Base Erosion Rules (the "Pillar 2 Rules") as promulgated by jurisdictions. The Pillar 2 Rules can potentially lead to additional taxes ("Top-Up Tax") when the effective tax rate (as defined by the Pillar 2 Rules) in a jurisdiction is below 15%. The Pillar 2 Rules, however, do not apply to "Excluded Entities" and certain subsidiaries of Excluded Entities. We believe we qualify as an Excluded Entity as a "Real Estate Investment Vehicle." In the event certain subsidiaries do not qualify as Excluded Entities, available "Safe Harbor" rules could apply that would exempt the entities from any Top-Up Tax. For 2025, the Under-Taxed Payments Rule (UTPR) Safe Harbor excludes all US income from the Pillar 2 Rules. In addition, substantially all of our non-excluded, non-U.S. jurisdictions qualify for other Safe Harbors. The remaining jurisdictions that may not qualify would have immaterial Top-Up Taxes. Beginning in fiscal year 2026, the U.S. income of non-excluded entities may result in material Top-Up Taxes; however, on January 5, 2026, the OECD announced a comprehensive Side-by-Side Safe Harbor that, if enacted, would exempt U.S.-parented multinational companies from certain Top-Up Taxes under the Pillar 2 Rules beginning January 1, 2026. The Side-by-Side Safe Harbor is not an exemption from any qualified domestic minimum Top-Up Tax. The Side-by-Side Safe Harbor has yet to be enacted in any jurisdiction where we operate that has already implemented the Pillar 2 Rules. Additionally, the Pillar 2 Rules are still yet to be enacted in many of the jurisdictions in which we operate.

Our operations are subject to various federal, state, local and foreign environmental and occupational safety and health laws and regulations, including those relating to the management, use, storage, disposal, emission and remediation of, and exposure to, hazardous and non-hazardous substances, materials and wastes. As the owner, lessee or operator of real property and facilities, including generators, we may be liable for substantial costs of investigation, removal or remediation of soil and groundwater contaminated by hazardous materials, and for damages and costs relating to off-site migration of hazardous materials, without regard to whether we, as the owner, lessee or operator, knew of, or were responsible for, the contamination. We may also be liable for certain costs of remediating contamination at third-party sites to which we sent waste for disposal, even if the original disposal may have complied with all legal requirements at the time. Many of these laws and regulations contain information reporting and record keeping requirements. We may not be at all times in compliance with all environmental requirements. Further, our data center properties are subject to various federal, state and local regulations, such as state and local fire and life safety regulations and ADA federal requirements. We may be subject to potentially significant fines or penalties if we fail to comply with any of these requirements. The requirements of the environmental and occupational safety and health laws and regulations are complex, change frequently and could become more stringent in the future. In certain jurisdictions, these laws and regulations could be applied retroactively or be broadened to cover situations or persons not currently considered. It is possible that these requirements will change or that liabilities will arise in the future in a manner that could have a material adverse effect on our business, results of operations or financial condition. While we maintain environmental and workers' compensation insurance, we may not have adequate insurance to cover all costs, fines or penalties.