Vita Coco Company (COCO) Risk Analysis

We rely on various independent third-party certifications, such as certifications of our products as "organic", to differentiate our products and Company from others. We must comply with the requirements of independent organizations or certification authorities in order to label our products as certified organic. For example, we can lose our "organic" certification if our manufacturing partners fail to source certified organic raw materials from local raw material suppliers. In addition, all raw materials must be certified organic. The loss of any independent certifications could adversely affect our market position as an organic and natural products company, which could harm our business.

There is growing concern that carbon dioxide and other greenhouse gases in the atmosphere may have an adverse impact on global temperatures, weather patterns and the frequency and severity of extreme weather and natural disasters. If such climate change has a negative effect on agricultural productivity, we may be subject to decreased availability or less favorable pricing for coconut water, oil, cream and other raw materials that are necessary for our current or any future products. Such climate changes may also require us to find manufacturing partners in new geographic areas if the location for best production of coconuts changes, which will require changes to our supply network and investing time and resources with new manufacturing partners, thereby potentially increasing our costs of production. In addition, there is no guarantee that we will be able to maintain the quality and taste of our products as we transition to sourcing coconuts in new geographic areas. Increasing frequency and severity of extreme weather and natural disasters could result in unusual weather patterns, which could affect the supply and demand for our products and lead to negative effects on our business, financial condition, results of operations and cash flow. Additionally, the increasing concern over climate change may also result in more federal, state, local and foreign legal requirements to reduce or mitigate the effects of greenhouse gases or to reduce packaging and improve recyclability. If such laws are enacted, we may experience significant increases in our costs of operations and delivery, which in turn may negatively affect our business, financial condition, results of operations and cash flows, and may incur increased liability for the accuracy of any public disclosures.

Efficient inventory planning and management is a key component of our success and profitability. To be successful, we must maintain sufficient inventory levels to meet our customers' demands without allowing those levels to increase to such an extent that the costs of holding the products unduly impact our financial results or create obsolete inventory, while ensuring we have adequate inventory to fulfill their needs, if their demand changes unexpectedly. Maintaining adequate inventory requires significant attention to and monitoring of: market trends, local market demands; performance of our raw material suppliers and manufacturers, our logistics suppliers and distributors; the impact of tariffs and trade restrictions; and the collection of data to enable efficient forecasting and inventory management. Although we seek to forecast and plan our product needs sufficiently in advance of anticipated requirements to facilitate reserving production time at our manufacturing and co-packing partners, and arranging for the availability and supply of packaging and ingredient materials, our product takes many weeks to arrive at our warehouses from our manufacturing partners, which reduces our flexibility to react to short term or unexpected consumer demand changes, or changes in transit times, as it can require planning as much as six months in advance to coordinate all materials for production. As we expand our operations, it may be more difficult to effectively manage our inventory as the complexity increases. In any cases where consumers might not have access to our products, our reputation and brands could be harmed, and consumers may be less likely to recommend our products in the future. If we are not successful in managing our inventory balances, it could have a material adverse effect on our business, financial conditions, results of operations and cash flows.

Our financial performance is largely dependent on our Americas operating segment, which accounted for approximately 83% of consolidated total net revenue in fiscal year 2025. Because the Americas segment is more mature and produces the majority of our operating cash flows, any slowdown or decline in this segment may adversely affect our business, financial condition, results of operations and cash flow. Our International segment may be unable to make up any significant shortfall if our Americas segment, specifically the U.S. market, were to slow or decline, and our business and financial results could be adversely affected.

Certain of our products are advertised with claims as to their origin, ingredients or health, wellness, environmental or other potential benefits, including, by way of example, the use of the terms "natural", "organic", "clean", "non-toxic", "sustainable", "no added sugars," or similar synonyms or implied statements relating to such benefits. Although the FDA and the USDA each have issued statements and adopted policies regarding the appropriate use of the word "natural," there is no single, universal definition of the term "natural" for various categories we sell, which is true for many other adjectives common in the healthy or sustainable products industry. The resulting uncertainty has led to consumer confusion, distrust and legal challenges. In addition, the FDA has consistently enforced its regulations with respect to nutrient content claims, unauthorized health claims (claims that characterize the relationship between a food or food ingredient and a disease or health condition) and other claims that impermissibly suggest therapeutic benefits of certain foods or food components, or that misrepresent or improperly characterize the nutrient content in conventional food products. Moreover, the FTC has articulated a robust substantiation standard for health claims on foods and dietary supplements and has pursued investigations and litigation against companies where the FTC has concern that the claims being made are not properly substantiated. Examples of causes of action that may be asserted in a consumer class action lawsuit include fraud, unfair trade practices and breach of state consumer protection statutes. The FTC and/or state attorneys general may bring legal action that seeks removal of a product from the marketplace and impose fines and penalties. Further, consumer class action false advertising litigation relating to terms such as "natural," "non-toxic," "non-GMO" and other claims remain a persistent threat in our industry. Even when unmerited, class action claims, action by the FTC or state attorneys general enforcement actions can be expensive to defend and adversely affect our reputation with existing and potential customers and consumers and our corporate and brand image, which could have a material and adverse effect on our business, financial condition, results of operations or cash flows. The USDA enforces federal standards for organic production and use of the term "organic" on product labeling. These laws prohibit a company from selling or labeling products as organic unless they are produced and handled in accordance with the applicable federal law. By definition, organic products are not genetically modified or do not include genetically modified (bioengineered) ingredients. We use suppliers and manufacturing partners who can certify that they meet the standards needed for each applicable product or ingredient specification. Our failure, or failure on the part of our suppliers or manufacturing partners to comply with these ingredient and product specifications, to maintain appropriate certifications, or to label organic products in compliance with federal or state laws, may subject us to liability or regulatory enforcement. Consumers may also pursue state law claims as to our labelling practices on this and other matters, challenging our labels as being intentionally mislabeled or misleading or deceptive to consumers. The cost of defending or settling these suits may be material to our business. The regulatory environment in which we operate could also change significantly and adversely in the future. New or changing regulations could impact the way consumers view our products, such as potential new labeling regulations or enforcement of a standard of identity for terms used to market our products that would require us to list certain ingredients by specific names that could confuse our consumers into thinking we may use different types of ingredients than they originally thought or that the quality of our ingredients is different to what they anticipated. Any loss of confidence on the part of consumers in the truthfulness of our labeling, advertising or ingredient claims would be difficult and costly to overcome and may significantly reduce our brand value. In addition, packaging has to be suitable to distributor and retail handling and scanning, and any failures of the packaging to meet these expectations could cause recall or product destruction. Any of these events could adversely affect our brands, increase our costs, and decrease our sales, which could have an adverse effect on our business, financial condition, results of operations and cash flows.

In addition to purchasing coconut materials and other ingredients, we negotiate the terms and specifications for the purchase of significant quantities of packaging materials and pallets by our manufacturers and co-packing partners from third parties. The majority of our products are produced and packaged with materials sourced from a single supplier, Tetra Pak. While we believe that we may be able to establish alternative supply relationships for some of these materials, we may be unable to do so in the short term, or at all, at prices or quality levels that are acceptable to us, or in packaging that is acceptable to consumers. Further, any such alternative supplier arrangements may lead to increased costs or delays. Volatility or inflation in the costs of our packaging materials and other supplies that we or our manufacturing partners purchase could increase our cost of sales and reduce our profitability. Moreover, we may not be able to implement price increases for our products to cover any increased costs, and any price increases we do implement may result in lower sales volumes or lost relationships. If we are not successful in managing our packaging costs, or if we are unable to increase our prices to cover increased costs or if such price increases reduce our sales volumes, then such increases in costs will adversely affect our business, financial condition, results of operations and cash flows. Further, changes in business conditions, pandemics, governmental regulations and other factors beyond our control that we do not presently anticipate could affect our manufacturing and co-packing partners' ability to receive components from our existing or future suppliers of such materials or the availability of such components generally. The unavailability of any components for our suppliers could result in production delays and idle manufacturing facilities which may increase our cost of operations and render us unable to fulfill customer orders in a timely manner. In addition, quality issues with packaging materials or packaging processes, could result in the need to replace inventory produced, resulting in increased costs.

We use information technology systems, infrastructure and data in substantially all aspects of our business operations. Our ability to effectively manage our business and coordinate the manufacturing, sourcing, distribution and sale of our products depends significantly on the reliability and capacity of these systems. We are critically dependent on the integrity, security and consistent operations of these systems. We also collect, process and store numerous classes of sensitive, personally identifiable and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees and financial and strategic information about us and our business partners. The secure processing, maintenance and transmission of this information is critical to our operations. As discussed above under, "If we encounter problems or interruptions with our supply chain, our costs may increase and our or our customers' ability to deliver our products to market could be adversely affected, impacting our business and profitability," our systems and those of our third party vendors, service providers, and business partners may be subject to damage or interruption from power outages or damages, telecommunications problems, data corruption, software errors, network failures, acts of war, or terrorist attacks, fire, flood, global pandemics and natural disasters; our existing safety systems, data backup, access protection, user management and information technology emergency planning may not be sufficient to prevent data loss or long-term network outages. In addition, we and our third party vendors, service providers, and business partners may upgrade our existing information technology systems or choose to incorporate new technology systems from time to time in order for such systems to support the increasing needs of our expanding business. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology or with maintenance or adequate support of existing systems could disrupt our business and result in transaction errors, processing inefficiencies and loss of production or sales, causing our business and reputation to suffer. Further, our systems and those of our third-party vendors, service providers, and business partners may be vulnerable to, and have experienced attempted security incidents, attacks by hackers (including ransomware attacks, phishing attacks and other third-party intrusions), acts of vandalism, computer viruses, misplaced or lost data, human errors or other similar events. If unauthorized parties gain access to our networks or databases, or those of our third-party vendors or business partners, they may be able to commit financial fraud, publish, delete, use inappropriately or modify our private and sensitive third-party information, including credit card information and other personally identifiable personal information. In addition, employees may intentionally or inadvertently cause data or security incidents that result in unauthorized payments, and/or release of personally identifiable or confidential information. Because the techniques used to circumvent security systems can be highly sophisticated, change frequently, are often not recognized until launched against a target (and even, in many cases, until after having been successfully launched for some time) and may originate from less regulated and remote areas around the world, we may be unable to proactively address all possible techniques or implement adequate preventive measures for all situations. Security incidents compromising the confidentiality, integrity and availability of our sensitive information and our systems and those of our third party vendors and business partners could result from cyber-attacks, computer malware, viruses, social engineering (including spear phishing and ransomware attacks), supply chain attacks, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, errors or malfeasance of our personnel, including human error and bad actors, and security vulnerabilities in the software or systems on which we, or our third party vendors or business partners, rely. Cybercrime and hacking techniques are constantly evolving. We and/or our third-party vendors, service providers, and/or business partners may be unable to stop all attempted security breaches, react in a timely manner, or implement adequate preventative measures, particularly given the increasing use of hacking techniques designed to circumvent controls, avoid detection, and remove or obfuscate forensic artifacts. We anticipate that these threats will continue to grow in scope and complexity over time and such incidents may occur in the future, and could result in unauthorized, unlawful, or inappropriate access to, inability to access, disclosure of, or loss of the sensitive, proprietary and confidential information (including personal information) that we collect, receive and process. We employ multiple methods at different layers of our systems designed to defend against intrusion and attack, to protect our systems and to resolve and mitigate the impact of any incidents. Despite our efforts to keep our systems secure and to remedy identified vulnerabilities, future attacks could be successful and could result in substantial liability or business risk. We expect that third parties will continue to attempt to gain unauthorized access to our systems or facilities through various means, including hacking into our systems or facilities, or those of our customers or vendors, or attempting to fraudulently induce our employees, customers, vendors or other users of our systems into disclosing sensitive information, which may in turn be used to access our IT systems. Our cybersecurity programs and efforts to protect our systems and data, and to prevent, detect and respond to data security incidents, may not prevent these threats or provide adequate security. We may experience breaches of our security measures due to human error, malfeasance, system errors or vulnerabilities, or other irregularities including attempts by former, current or future employees to misuse their authorized access and/or gain unauthorized access to our systems. As we rely on a number of our third party vendors and business partners, we are exposed to certain security risks outside of our direct control resulting from our engagements with these parties, and our ability to directly monitor these third-party vendors' and business partners' data security is limited. While we take care to vet our vendors and business partners and contract with them to require levels of data security and best practices, and employ a number of security measures designed to prevent, detect, and mitigate potential for harm to our users and our systems from the theft of or misuse of user credentials on our network, these measures may not be effective in every instance. Moreover, we or our third-party vendors or business partners may be more vulnerable to such attacks in remote work environments, which have increased in recent years. Additionally, while we maintain cyber insurance that may help provide coverage for these types of incidents, we cannot ensure that our insurance will be adequate to cover costs and liabilities related to an incident. Previously, we have experienced spoofing and social engineering incidents and since then, we have taken measures, such as third-party forensic consultant reviews, to ensure that no compromises of our systems have occurred and to mitigate risks of future harm. However, the sophistication of cyber attacks continues to increase and there is no guarantee that the steps we have taken will be sufficient to prevent significant disruption and loss. Further, a failure to incorporate new technology, like artificial intelligence ("AI"), machine learning and automation, or adopt new marketing practices may reduce our ability to compete and operate efficiently, or increase risks of data security or result in suboptimal business decisions. If we do not sufficiently invest and evolve our business at sufficient speed and scale in response to such developments, or if we execute poorly on these investments, our products, results of operations and ability to compete and develop our business could be negatively affected. For example, we have begun the incorporation of AI and machine learning technology into our systems and business operations. When incorporating AI technologies into our business functions and operations, we are increasingly liable to new or existing risks due to increased governmental monitoring, compliance issues, data privacy risks, and potential litigation, all of which could negatively impact both financial performance and business reputation. Our ability to benefit from AI while managing the risks significantly relies on the effective selection of AI tools and platforms tailored to fit our specific business needs. Integrating ineffective AI technologies, or incorporating AI technologies without appropriate training, could lead to unintended consequences such as bias, discriminatory outputs, accuracy or data privacy issues. If we fail to successfully integrate AI, run afoul of developing regulations regarding AI, or otherwise cannot keep up with market demand when it comes to this new technology, our business may suffer. Any data security breach, attack, virus or other incident could result in additional financial losses, costly investigations and litigation exceeding applicable insurance coverage or contractual rights available to us, civil or criminal penalties, operational changes or other response measures, loss of consumer confidence in our security measures, and negative publicity that could adversely affect our business, reputation, financial condition, results of operations and cash flows. Furthermore, regulations and expectations for timely disclosing any cyber security events are evolving, and there are additional risks that in our response to such events, and in our disclosure, we will not meet the appropriate requirements, creating regulatory and litigation risks. In addition, if any such event resulted in access, disclosure or other loss or unauthorized use of information or data, such as customers' and suppliers' information, private information about employees and financial and strategic information about us and our business partners, whether actual or perceived, it could result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy laws and regulations, violations of which could result in significant penalties, fines, costs and litigation. The cost of investigating, mitigating and responding to potential security breaches and complying with applicable breach notification obligations to individuals, regulators, partners and others can be significant and the risk of legal claims in the event of a security breach is increasing. For example, certain of the recently enacted state and international comprehensive privacy laws create a private right of action for certain data breaches and for non-compliance. Further, defending a suit, regardless of its merit, could be costly, divert management attention and harm our reputation. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductibles or co-insurance requirements, could adversely affect our reputation, business, financial condition, results of operations and cash flows. Any material disruption or slowdown of our systems or those of our third-party vendors or business partners, could have a material adverse effect on our business, financial condition, results of operations and cash flows. Our risks are likely to increase as we continue to expand, grow our customer base, and process, store, and transmit increasing amounts of proprietary and sensitive data. In addition, although we seek to detect and investigate all data security incidents, security breaches and other incidents of unauthorized access to our information technology systems, it can be difficult to detect and determine the scope and impact of data security incidents. Any delay in identifying such breaches or incidents may lead to increased harm and legal exposure of the type described above.