Vita Coco Company (COCO) Risk Analysis

We rely on various independent third-party certifications, such as certifications of our products as "organic", to differentiate our products and Company from others. We must comply with the requirements of independent organizations or certification authorities in order to label our products as certified organic. For example, we can lose our "organic" certification if our manufacturing partners fail to source certified organic raw materials from local raw material suppliers. In addition, all raw materials must be certified organic. The loss of any independent certifications could adversely affect our market position as an organic and natural products company, which could harm our business.

There is growing concern that carbon dioxide and other greenhouse gases in the atmosphere may have an adverse impact on global temperatures, weather patterns and the frequency and severity of extreme weather and natural disasters. If such climate change has a negative effect on agricultural productivity, we may be subject to decreased availability or less favorable pricing for coconut water, oil, cream and other raw materials that are necessary for our current or any future products. Such climate changes may also require us to find manufacturing partners in new geographic areas if the location for best production of coconuts changes, which will require changes to our supply network and investing time and resources with new manufacturing partners, thereby potentially increasing our costs of production. In addition, there is no guarantee that we will be able to maintain the quality and taste of our products as we transition to sourcing coconuts in new geographic areas. Increasing frequency and severity of extreme weather and natural disasters could result in unusual weather patterns, which could affect the supply and demand for our products and lead to negative effects on our business, financial condition, results of operations and cash flow. Additionally, the increasing concern over climate change may also result in more federal, state, local and foreign legal requirements to reduce or mitigate the effects of greenhouse gases or to reduce packaging and improve recyclability. If such laws are enacted, we may experience significant increases in our costs of operations and delivery, which in turn may negatively affect our business, financial condition, results of operations and cash flows, and may incur increased liability for the accuracy of any public disclosures.

Our business is primarily focused on developing, manufacturing, marketing and distributing coconut water branded and Private Label products and other "better-for-you" beverages. Consumer demand for our products and interest in our offerings could change based on a number of possible factors, including changes in consumer preferences, dietary habits, refreshment and nutritional habits, concerns regarding the health effects of ingredients, the usage of single use packaging, the impact of our supply chain on our sourcing communities, shifts in preference for various product attributes or consumer confidence, trends within consumer age groups and perceived value and quality for our products relative to alternatives. Consumer trends that we believe favor sales of our products could change based on a number of possible factors. While we continually strive to improve our products through thoughtful, innovative research and development approaches to meet consumer needs, there can be no assurance that our efforts will be successful. If consumer demand for our products decreases, our business, financial condition, results of operations and cash flows may be adversely affected.

Our financial performance is largely dependent on our Americas operating segment, which accounted for approximately 83% of consolidated total net revenue in fiscal year 2025. Because the Americas segment is more mature and produces the majority of our operating cash flows, any slowdown or decline in this segment may adversely affect our business, financial condition, results of operations and cash flow. Our International segment may be unable to make up any significant shortfall if our Americas segment, specifically the U.S. market, were to slow or decline, and our business and financial results could be adversely affected.

Certain of our products are advertised with claims as to their origin, ingredients or health, wellness, environmental or other potential benefits, including, by way of example, the use of the terms "natural", "organic", "clean", "non-toxic", "sustainable", "no added sugars," or similar synonyms or implied statements relating to such benefits. Although the FDA and the USDA each have issued statements and adopted policies regarding the appropriate use of the word "natural," there is no single, universal definition of the term "natural" for various categories we sell, which is true for many other adjectives common in the healthy or sustainable products industry. The resulting uncertainty has led to consumer confusion, distrust and legal challenges. In addition, the FDA has consistently enforced its regulations with respect to nutrient content claims, unauthorized health claims (claims that characterize the relationship between a food or food ingredient and a disease or health condition) and other claims that impermissibly suggest therapeutic benefits of certain foods or food components, or that misrepresent or improperly characterize the nutrient content in conventional food products. Moreover, the FTC has articulated a robust substantiation standard for health claims on foods and dietary supplements and has pursued investigations and litigation against companies where the FTC has concern that the claims being made are not properly substantiated. Examples of causes of action that may be asserted in a consumer class action lawsuit include fraud, unfair trade practices and breach of state consumer protection statutes. The FTC and/or state attorneys general may bring legal action that seeks removal of a product from the marketplace and impose fines and penalties. Further, consumer class action false advertising litigation relating to terms such as "natural," "non-toxic," "non-GMO" and other claims remain a persistent threat in our industry. Even when unmerited, class action claims, action by the FTC or state attorneys general enforcement actions can be expensive to defend and adversely affect our reputation with existing and potential customers and consumers and our corporate and brand image, which could have a material and adverse effect on our business, financial condition, results of operations or cash flows. The USDA enforces federal standards for organic production and use of the term "organic" on product labeling. These laws prohibit a company from selling or labeling products as organic unless they are produced and handled in accordance with the applicable federal law. By definition, organic products are not genetically modified or do not include genetically modified (bioengineered) ingredients. We use suppliers and manufacturing partners who can certify that they meet the standards needed for each applicable product or ingredient specification. Our failure, or failure on the part of our suppliers or manufacturing partners to comply with these ingredient and product specifications, to maintain appropriate certifications, or to label organic products in compliance with federal or state laws, may subject us to liability or regulatory enforcement. Consumers may also pursue state law claims as to our labelling practices on this and other matters, challenging our labels as being intentionally mislabeled or misleading or deceptive to consumers. The cost of defending or settling these suits may be material to our business. The regulatory environment in which we operate could also change significantly and adversely in the future. New or changing regulations could impact the way consumers view our products, such as potential new labeling regulations or enforcement of a standard of identity for terms used to market our products that would require us to list certain ingredients by specific names that could confuse our consumers into thinking we may use different types of ingredients than they originally thought or that the quality of our ingredients is different to what they anticipated. Any loss of confidence on the part of consumers in the truthfulness of our labeling, advertising or ingredient claims would be difficult and costly to overcome and may significantly reduce our brand value. In addition, packaging has to be suitable to distributor and retail handling and scanning, and any failures of the packaging to meet these expectations could cause recall or product destruction. Any of these events could adversely affect our brands, increase our costs, and decrease our sales, which could have an adverse effect on our business, financial condition, results of operations and cash flows.

The Copra acquisition represents a change to our operating model because we have not historically owned or operated any manufacturing facilities. Through the acquisition of Copra, we now own and operate a manufacturing facility and related real property in Ratchaburi, Thailand, and now will be sourcing coconuts from farmers and coconut collectives. The ownership and operation of manufacturing facilities involves risks and challenges that we have not historically faced under our asset-light supply chain model. These risks include, among others: significant capital expenditure requirements to maintain, upgrade or expand our facility and equipment; fixed cost obligations that may not be fully offset by revenue in periods of reduced demand or production disruptions; the risk that our facility may be damaged or rendered inoperable by natural disasters, fire, equipment failure, power outages, labor disputes or other events; environmental, health and safety liabilities and compliance costs associated with owning and operating a manufacturing plant; the need to recruit, train and retain a skilled manufacturing workforce in a foreign jurisdiction; and idle capacity costs if production volumes do not meet expectations. Unlike our historical reliance on third-party manufacturers and co-packers, where we could reallocate production among multiple partners, the concentration of production in a single owned facility for the Copra acquisition products limits our flexibility to shift volume in the event of a disruption. In addition, operating a manufacturing facility requires capabilities and expertise that differ from those required to manage an outsourced supply chain, and we may encounter difficulties in developing and maintaining these operational capabilities. Becoming a purchaser of whole coconuts exposes us more directly to fluctuations in coconut prices and local growing conditions which might effect supply. The Copra factory uses the coconuts for coconut water and for other coconut products, which helps share the overhead and coconut costs across multiple products. Any failure to successfully optimize usage of the whole coconut might increase our costs for our Copra's coconut water business, Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Our supply chain is heavily reliant on third-party partners, and our success is dependent upon our ability to maintain our relationships with existing partners and enter into new arrangements in the future. Any changes to the relationships with our existing partners, including deprioritizing or experiencing delays in our production, or terminating the relationship could adversely affect our business. Furthermore, if we need to find an alternative or new manufacturing or co-packing partner, we would need to spend a significant amount of time and resources to ensure the new partner can meet our standards for quality control and have the necessary capabilities, responsiveness, high-quality service and financial stability, among other things, that align with our values and mission. We may need to assist that manufacturing or co-packing partner in purchasing and installing packaging and processing capability which may further delay and increase the financial costs of including them in our supply network and increase the financial risk of that relationship. Although we do not rely on our co-packing partners for the sourcing of raw materials, we face similar risks related to the operations and quality of services provided by such partners. Continued growth in demand could require the addition of new capacity and partners and there is no guarantee that such additions will be as cost competitive as our current suppliers. If we are unable to manage our supply chain effectively and ensure that our products are available to meet consumer demand, we may not have the ability to pursue our growth strategy, our sales may decrease, and our business, financial condition, results of operations and cash flows may be materially adversely affected. Our independent shipping partners transport our products from the country of origin or from our domestic co-packing partners, which are then received by, and subsequently distributed from, our third party warehousing and fulfillment service providers to our distributors and retail-direct customers by our third party transportation partners or customer pickup. We depend in large part on the orderly operation of this receiving and distribution process from these third party partners, which depends, in turn, on timely arrival of products from ports or co-packers, availability of outbound and inbound shipping, real-time tracking information on our products location, and effective operations at the warehouses or distribution centers and the ports through which our products flow. Any increase in transportation costs (including increases in fuel costs), increased shipping costs or shipping transit times, increased warehouse costs, issues with overseas shipments or port or supplier-side delays, reductions in the transportation capacity of carriers, labor strikes or shortages in the transportation industry, disruptions to the national and international transportation infrastructure, decreased warehouse availability including due to labor shortages, and unexpected delivery interruptions or delays may increase the cost of, and adversely impact, our logistics, and our ability to provide quality and timely service to our distributors or retail-direct customers. The inability to fulfill or any delays in processing customer or consumer orders from the warehousing or fulfillment centers of our providers, or any quality issues could result in the loss of consumers, retail partners or distributors, or the issuances of penalties, refunds or credits, and may also adversely affect our reputation. Additionally, external events beyond our control may affect and cause interruptions or delays in our supply chain. Disruptions in operations due to natural or man-made disasters, inclement weather conditions, accidents, system failures, power outages, political instability, physical or cyber break-ins, server failure, work stoppages, slowdowns or strikes by employees, acts of terrorism, the outbreak of viruses, widespread illness, infectious diseases, contagions and the occurrence of unforeseen epidemics and other unforeseen or catastrophic events could damage the facilities of our supply chain partners or render them inoperable, effect the flow of product to and from these centers, or impact our ability to manage our partners, making it difficult or impossible for us to process customer or consumer orders for an extended period of time. We could also incur significantly higher costs and longer lead times during the time it takes for our supply chain to react and normalize. Furthermore, international instability, including volatility in global oil markets, ongoing geopolitical tensions or ongoing trade tensions, including the imposition of tariffs, may affect our supply chain, impacting our costs and our capacity to timely supply our products. It is hard to predict where ocean freight rates and capacity will be in the future and what long-term rates could be. Most of our business relies on shipping prepackaged coconut water from sourcing countries to our countries of sale so we are very dependent on shipping container prices and service levels and cost increases in shipping and the imposition of tariffs have materially impacted our financial results in recent years. Due to the price sensitivity of our products, we may not be able to pass such increases on to our customers. Any such disruption or unanticipated event may cause significant interruptions or delays in our business and the reduction or loss of inventory may render us unable to fulfill customer orders in a timely manner, or at all, which could materially adversely affect our business, financial condition, results of operations and cash flows.

We use information technology systems, infrastructure and data in substantially all aspects of our business operations. Our ability to effectively manage our business and coordinate the manufacturing, sourcing, distribution and sale of our products depends significantly on the reliability and capacity of these systems. We are critically dependent on the integrity, security and consistent operations of these systems. We also collect, process and store numerous classes of sensitive, personally identifiable and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees and financial and strategic information about us and our business partners. The secure processing, maintenance and transmission of this information is critical to our operations. As discussed above under, "If we encounter problems or interruptions with our supply chain, our costs may increase and our or our customers' ability to deliver our products to market could be adversely affected, impacting our business and profitability," our systems and those of our third party vendors, service providers, and business partners may be subject to damage or interruption from power outages or damages, telecommunications problems, data corruption, software errors, network failures, acts of war, or terrorist attacks, fire, flood, global pandemics and natural disasters; our existing safety systems, data backup, access protection, user management and information technology emergency planning may not be sufficient to prevent data loss or long-term network outages. In addition, we and our third party vendors, service providers, and business partners may upgrade our existing information technology systems or choose to incorporate new technology systems from time to time in order for such systems to support the increasing needs of our expanding business. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology or with maintenance or adequate support of existing systems could disrupt our business and result in transaction errors, processing inefficiencies and loss of production or sales, causing our business and reputation to suffer. Further, our systems and those of our third-party vendors, service providers, and business partners may be vulnerable to, and have experienced attempted security incidents, attacks by hackers (including ransomware attacks, phishing attacks and other third-party intrusions), acts of vandalism, computer viruses, misplaced or lost data, human errors or other similar events. If unauthorized parties gain access to our networks or databases, or those of our third-party vendors or business partners, they may be able to commit financial fraud, publish, delete, use inappropriately or modify our private and sensitive third-party information, including credit card information and other personally identifiable personal information. In addition, employees may intentionally or inadvertently cause data or security incidents that result in unauthorized payments, and/or release of personally identifiable or confidential information. Because the techniques used to circumvent security systems can be highly sophisticated, change frequently, are often not recognized until launched against a target (and even, in many cases, until after having been successfully launched for some time) and may originate from less regulated and remote areas around the world, we may be unable to proactively address all possible techniques or implement adequate preventive measures for all situations. Security incidents compromising the confidentiality, integrity and availability of our sensitive information and our systems and those of our third party vendors and business partners could result from cyber-attacks, computer malware, viruses, social engineering (including spear phishing and ransomware attacks), supply chain attacks, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, errors or malfeasance of our personnel, including human error and bad actors, and security vulnerabilities in the software or systems on which we, or our third party vendors or business partners, rely. Cybercrime and hacking techniques are constantly evolving. We and/or our third-party vendors, service providers, and/or business partners may be unable to stop all attempted security breaches, react in a timely manner, or implement adequate preventative measures, particularly given the increasing use of hacking techniques designed to circumvent controls, avoid detection, and remove or obfuscate forensic artifacts. We anticipate that these threats will continue to grow in scope and complexity over time and such incidents may occur in the future, and could result in unauthorized, unlawful, or inappropriate access to, inability to access, disclosure of, or loss of the sensitive, proprietary and confidential information (including personal information) that we collect, receive and process. We employ multiple methods at different layers of our systems designed to defend against intrusion and attack, to protect our systems and to resolve and mitigate the impact of any incidents. Despite our efforts to keep our systems secure and to remedy identified vulnerabilities, future attacks could be successful and could result in substantial liability or business risk. We expect that third parties will continue to attempt to gain unauthorized access to our systems or facilities through various means, including hacking into our systems or facilities, or those of our customers or vendors, or attempting to fraudulently induce our employees, customers, vendors or other users of our systems into disclosing sensitive information, which may in turn be used to access our IT systems. Our cybersecurity programs and efforts to protect our systems and data, and to prevent, detect and respond to data security incidents, may not prevent these threats or provide adequate security. We may experience breaches of our security measures due to human error, malfeasance, system errors or vulnerabilities, or other irregularities including attempts by former, current or future employees to misuse their authorized access and/or gain unauthorized access to our systems. As we rely on a number of our third party vendors and business partners, we are exposed to certain security risks outside of our direct control resulting from our engagements with these parties, and our ability to directly monitor these third-party vendors' and business partners' data security is limited. While we take care to vet our vendors and business partners and contract with them to require levels of data security and best practices, and employ a number of security measures designed to prevent, detect, and mitigate potential for harm to our users and our systems from the theft of or misuse of user credentials on our network, these measures may not be effective in every instance. Moreover, we or our third-party vendors or business partners may be more vulnerable to such attacks in remote work environments, which have increased in recent years. Additionally, while we maintain cyber insurance that may help provide coverage for these types of incidents, we cannot ensure that our insurance will be adequate to cover costs and liabilities related to an incident. Previously, we have experienced spoofing and social engineering incidents and since then, we have taken measures, such as third-party forensic consultant reviews, to ensure that no compromises of our systems have occurred and to mitigate risks of future harm. However, the sophistication of cyber attacks continues to increase and there is no guarantee that the steps we have taken will be sufficient to prevent significant disruption and loss. Further, a failure to incorporate new technology, like artificial intelligence ("AI"), machine learning and automation, or adopt new marketing practices may reduce our ability to compete and operate efficiently, or increase risks of data security or result in suboptimal business decisions. If we do not sufficiently invest and evolve our business at sufficient speed and scale in response to such developments, or if we execute poorly on these investments, our products, results of operations and ability to compete and develop our business could be negatively affected. For example, we have begun the incorporation of AI and machine learning technology into our systems and business operations. When incorporating AI technologies into our business functions and operations, we are increasingly liable to new or existing risks due to increased governmental monitoring, compliance issues, data privacy risks, and potential litigation, all of which could negatively impact both financial performance and business reputation. Our ability to benefit from AI while managing the risks significantly relies on the effective selection of AI tools and platforms tailored to fit our specific business needs. Integrating ineffective AI technologies, or incorporating AI technologies without appropriate training, could lead to unintended consequences such as bias, discriminatory outputs, accuracy or data privacy issues. If we fail to successfully integrate AI, run afoul of developing regulations regarding AI, or otherwise cannot keep up with market demand when it comes to this new technology, our business may suffer. Any data security breach, attack, virus or other incident could result in additional financial losses, costly investigations and litigation exceeding applicable insurance coverage or contractual rights available to us, civil or criminal penalties, operational changes or other response measures, loss of consumer confidence in our security measures, and negative publicity that could adversely affect our business, reputation, financial condition, results of operations and cash flows. Furthermore, regulations and expectations for timely disclosing any cyber security events are evolving, and there are additional risks that in our response to such events, and in our disclosure, we will not meet the appropriate requirements, creating regulatory and litigation risks. In addition, if any such event resulted in access, disclosure or other loss or unauthorized use of information or data, such as customers' and suppliers' information, private information about employees and financial and strategic information about us and our business partners, whether actual or perceived, it could result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy laws and regulations, violations of which could result in significant penalties, fines, costs and litigation. The cost of investigating, mitigating and responding to potential security breaches and complying with applicable breach notification obligations to individuals, regulators, partners and others can be significant and the risk of legal claims in the event of a security breach is increasing. For example, certain of the recently enacted state and international comprehensive privacy laws create a private right of action for certain data breaches and for non-compliance. Further, defending a suit, regardless of its merit, could be costly, divert management attention and harm our reputation. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductibles or co-insurance requirements, could adversely affect our reputation, business, financial condition, results of operations and cash flows. Any material disruption or slowdown of our systems or those of our third-party vendors or business partners, could have a material adverse effect on our business, financial condition, results of operations and cash flows. Our risks are likely to increase as we continue to expand, grow our customer base, and process, store, and transmit increasing amounts of proprietary and sensitive data. In addition, although we seek to detect and investigate all data security incidents, security breaches and other incidents of unauthorized access to our information technology systems, it can be difficult to detect and determine the scope and impact of data security incidents. Any delay in identifying such breaches or incidents may lead to increased harm and legal exposure of the type described above.