Credo Technology Group Holding Ltd (CRDO) Risk Analysis

Within the data infrastructure industry, our target markets include networking OEMs, optical module OEMs, hyperscalers, 5G communications, IoT, HPC and artificial intelligence markets. Any deterioration in our target customer or product markets or reduction in capital spending to support these markets could lead to a reduction in demand for our products, which would adversely affect our business, financial condition and results of operations. Further, these markets are relatively new and still developing, and if our target customer markets do not grow or develop in ways that we currently expect, demand for our products and solutions may not materialize as expected, which would also negatively impact our business, financial condition and results of operations. We may be unable to predict the timing or development of trends in our target markets with any accuracy. If we fail to accurately predict market requirements or market demand for these products and solutions, our business will suffer. A market shift towards an industry standard that we may not support could significantly decrease the demand for our products and solutions. Our future revenue growth, if any, will depend in part on our ability to expand within our existing markets, our ability to continue to penetrate emerging markets, such as the 5G communications market, and our ability to enter into new markets. Each of these markets presents distinct and substantial challenges and risks and, in many cases, requires us to develop new customized solutions to address the particular requirements of that market. Meeting the technical requirements and securing design wins in any of these new markets will require a substantial investment of our time and resources. We cannot assure you that we will secure design wins from these or other new markets, or that we will achieve meaningful revenue from sales in these markets. If any of these markets do not develop as we currently anticipate or if we are unable to penetrate them and scale in them successfully, our revenue may not increase or could decline.

Our success depends in part upon our ability to obtain and maintain patent and other intellectual property protection with respect to our products and the technology we develop. To accomplish this, we rely on a combination of intellectual property rights, including patents, copyrights and trademarks in the United States and in selected foreign countries where we believe filing for such protection is appropriate. We also rely on trade secret laws, as well as confidentiality and non-disclosure and other contractual protections, to protect our proprietary know-how. We cannot assure that any patents from any pending or future patent applications will be issued, and even if our pending patent applications are granted, the scope of the rights granted to us may not be meaningful, may not provide us with a commercial advantage and may be subject to reinterpretation after issuance. The patent prosecution process is expensive, time-consuming and complex, and we may not be able to file, prosecute, maintain, enforce or license all necessary or desirable patent applications at a reasonable cost or in a timely manner. It is also possible that we will fail to identify patentable aspects of our research and development output in time to obtain patent protection. Failure to timely seek patent protection on products or technologies generally precludes us from seeking future patent protection on these products or technologies. Even if we do timely seek patent protection, the coverage claimed in a patent application can be significantly reduced before a patent is issued, and its scope can be reinterpreted after issuance. We cannot guarantee that: - any of our present or future patents or patent claims will not lapse or be invalidated, narrowed, circumvented, challenged or abandoned;- our intellectual property rights will provide competitive advantages to us;- our ability to assert our intellectual property rights against others (including potential competitors) or to settle current or future disputes will not be limited by our agreements with third parties;- any of our pending or future patent applications will be issued or have the coverage originally sought;- our intellectual property rights will be enforced in jurisdictions where competition may be intense or where legal protections may be weak;- any of the trademarks, copyrights, trade secrets or other intellectual property rights that we presently employ in our business will not lapse or be invalidated, narrowed, circumvented, challenged, abandoned or otherwise diminished or eliminated; or - we will not lose the ability to assert our intellectual property rights against or to license our technology to others and collect royalties or other payments. In addition, our competitors or others may design around our protected patents or other intellectual property rights. Effective intellectual property protection may be unavailable or more limited in foreign jurisdictions relative to those protections available in the United States, or may not be applied for in one or more relevant jurisdictions. Even if foreign patents are granted, effective enforcement in foreign countries may not be available. The failure of our patents to adequately protect our technology might make it easier for our competitors to offer similar products or technologies, and our business, financial condition and operations could be adversely affected. Monitoring unauthorized use of our intellectual property is difficult and costly. Unauthorized use of our intellectual property may have occurred or may occur in the future. Although we have taken steps to minimize the risk of this occurring, any such failure to identify unauthorized use and otherwise adequately protect our intellectual property would adversely affect our business. From time to time, we may need to commence litigation or other legal proceedings in order to: - assert claims of infringement of our intellectual property rights;- defend our products from piracy;- protect our trade secrets or know-how; or - determine the enforceability, scope and validity of the propriety rights of others. Lawsuits or other proceedings that we initiate to protect or enforce our patents or other intellectual property rights could be expensive, time consuming and unsuccessful. Any claims we assert against perceived infringers could provoke these parties to assert counterclaims against us alleging that we infringe their intellectual property or alleging that our intellectual property is invalid or unenforceable. Moreover, if we are required to commence litigation, whether as a plaintiff or defendant, we would also be forced to divert our attention and the efforts of our employees, which could, in turn, result in lower revenue and higher expenses. If we pursue litigation to assert our intellectual property rights, an adverse decision in any of these legal actions could limit our ability to assert our intellectual property rights, limit the value of our technology or otherwise negatively impact our business, financial condition and results of operations. Legal fees related to such litigation will increase our operating expenses and may reduce our net income. In addition to patent protection, we also rely on other proprietary rights, including protection of trade secrets, and other proprietary information that is not patentable or that we elect not to patent. However, trade secrets can be difficult to protect and some courts are less willing or unwilling to protect trade secrets. We rely on contractual protections with our customers, suppliers, employees and consultants, and we implement cybersecurity measures designed to protect our trade secrets. We cannot guarantee that we have entered into such agreements with each party that may have or have had access to our trade secrets or proprietary technology and processes. The semiconductor industry is generally subject to high turnover of employees, so the risk of trade secret misappropriation may be amplified. Unauthorized copying or other misappropriation of our trade secrets and other intellectual property could enable third parties to benefit from our technologies without paying us for doing so, which could harm our business. We cannot assure you that our contractual protections and cybersecurity measures have not been or will not be breached or that we will have adequate remedies for any such breach. Accordingly, we cannot guarantee that we have secured, or will be able to secure, effective protections for all of our trade secrets or other proprietary information that we use or claim rights to. Many of our products include intellectual property licensed from third parties, and we are party to a number of third-party intellectual property license agreements. Some of these license agreements require us to make one-time payments or ongoing royalty payments. We cannot guarantee that the third-party patents and technology we license will not be licensed to our competitors or others in the semiconductor industry. As a result, we may not be able to prevent competitors from developing and commercializing competitive products in territories included in all of our licenses. In the future, we may need to obtain additional licenses, renew existing license agreements or otherwise replace existing technology. We are unable to predict whether these license agreements can be obtained or renewed or the technology can be replaced on acceptable terms, or at all. In that event, we may be required to expend significant time and resources to redesign our technology, products or the methods for manufacturing them or to develop or license replacement technology, all of which may not be feasible on a technical or commercial basis. Any disputes with our licensing partners with respect to such agreements could narrow what we believe to be the scope of our rights to the relevant intellectual property, increase our obligations under such agreements or restrict our ability to develop and market our current or new products and services. Any of these events could negatively impact our business, financial condition and results of operations. Further, certain of our agreements contain provisions permitting the other party to become a party to, or a beneficiary of, a source code escrow agreement under which we place certain proprietary source code in escrow with a third party. Under these source code escrow agreements, our source code may be released to the party upon the occurrence of specified events, such as in situations of our bankruptcy or insolvency or our failure to support or maintain our source code. Disclosing the content of our source code may limit the intellectual property protection we can obtain or maintain for our source code or our software containing such source code and may facilitate intellectual property infringement, misappropriation or other violation claims against us. In addition, from time to time, we enter into agreements with select customers, vendors and others to customize and otherwise develop technologies and intellectual property, and we expect to enter into new, similar arrangements from time to time in the future. Some of these agreements contain terms that allocate ownership of, and rights to use and enforce, technologies and intellectual property rights. As a result of these agreements, we may be required to limit use of, or refrain from using, certain of such related technologies and intellectual property rights in parts of our business. Determining inventorship and ownership of technologies and intellectual property rights resulting from development activities can be difficult and uncertain. Disputes may arise with customers, vendors and other third parties regarding ownership of and rights to use and enforce these technologies and intellectual property rights or regarding interpretation of our agreements with these third parties, and these disputes may result in claims against us or claims that intellectual property rights, which we believe we own, are not owned by us, are not enforceable, or are invalid. The cost and effort to resolve these types of disputes, or the loss of intellectual property rights if we lose these types of disputes, could harm our business and financial condition.

We rely on our information technology systems, and those of our vendors, suppliers and customers, including hardware, software, cloud services, infrastructure, networks and systems, for the effective operation of our business and for secure maintenance and storage of confidential data relating to our business. We also utilize AI tools to support process automation and improve operational efficiencies. The use of AI may increase exposure to cybersecurity risks, including through unauthorized or malicious use of AI tools, the inadvertent introduction of malicious code or vulnerabilities into AI generated outputs, and other security weaknesses arising from AI enabled systems. Further, AI technologies may be leveraged by threat actors to conduct or enhance cybersecurity attacks, potentially increasing the complexity and severity of security incidents. Additionally, in the ordinary course of business we collect, store and otherwise process sensitive data, including intellectual property and proprietary business information as well as personal information of our customers and employees, in data centers and on information technology systems, including systems that may be controlled or maintained by third parties. The secure operation of these information technology systems, and the processing and maintenance of the information processed by these systems, is critical to our business operations. To mitigate these risks, we maintain an AI policy that standardizes acceptable and safe use of AI tools and incorporates monitoring, data loss prevention, and user specific controls. These measures are designed to prevent security incidents, data leakage, or exploitation related to the use of AI technologies. While we and others have implemented various controls and defenses, cybersecurity attacks and threats have continued to become more prevalent and sophisticated. These threats are constantly evolving, making it increasingly difficult to successfully defend against or implement adequate preventive measures. Geopolitical tensions or conflicts have in the past led to, and may in the future lead to, increased risk of cybersecurity attacks. Notwithstanding defensive measures, experienced programmers, hackers, state actors or others may be able to penetrate our security controls, or those of our vendors, suppliers or customers, through attacks such as, but not limited to, phishing or other forms of social engineering, impersonating authorized users, ransomware, spyware, viruses, worms and other malicious software programs, software supply chain attacks, exploitation of compromised commercial software, bugs and other cybersecurity weaknesses and vulnerabilities, and covert introduction of malware to computers and networks. Any attack on the information technology systems of us or one of our vendors, suppliers or customers may be difficult to detect, designed to remain dormant until a triggering event or may continue undetected for an extended period of time. In addition, our information technology systems and those of our vendors, suppliers, and customers may be vulnerable to damage, disruptions or shutdowns due to errors, negligence or malfeasance by employees, contractors, or others who have access to these systems. Security breaches, cyberattacks and other disruptions to our information technology systems or those of our vendors, suppliers or customers could compromise the confidentiality, operational integrity, and accessibility of our information technology systems, or those of our vendors, suppliers or customers, which could result in the compromise, unauthorized publication, or loss of proprietary data, intellectual property, or personal information, as well as interruptions or delays in our business operations, loss of existing or future customers and damage to our reputation, which could adversely affect our business, reputation and financial results. In addition, such events could result in violations of privacy or other laws or regulations, increase the risk of litigation or regulatory investigation, or cause us to incur direct losses if attackers initiate wire transfers or access our bank or investment accounts. We expect ongoing and increasing costs related to investments in technology, controls, processes and practices, however these investments may not be sufficient to shield us from significant losses or liability in the event of security breaches, cyberattacks or other disruptions to our information technology systems.

Certain of our software, as well as that of our customers and vendors, may be derived from so-called "open source" software that is generally made available to the public by its authors and/or other third parties. Open-source software is made available under licenses that impose certain obligations on us in the event we were to distribute derivative works of the open-source software. These obligations may require us to make source code for the derivative works available to the public and/or license such derivative works under a particular type of license, rather than the forms of license we customarily use to protect our intellectual property. In the event that the copyright holder of any open-source software were to successfully establish in court that we had not complied with the terms of a license for a particular work, we could be required to release the source code of that work to the public and/or stop distribution of that work if the license is terminated, which could adversely impact our business and results of operations. While we take steps to monitor the use of all open-source software in our products, processes and technology and try to ensure that no open-source software is used in such a way as to require us to disclose the source code to the related product, processes or technology when we do not wish to do so, such use could inadvertently occur. Additionally, if a third party software provider has incorporated certain types of open-source software into software we license from such third party for our products, processes or technology, we could, under certain circumstances, be required to disclose the source code to our products, processes or technology. This could harm our intellectual property position and have a material adverse effect on our business, results of operations and financial condition. Further, although some open-source vendors provide warranty and support agreements, it is common for such software to be available "as-is" with no warranty, indemnity or support. Although we monitor our use of such open-source code to avoid subjecting our products to unintended conditions, such use, under certain circumstances, could materially adversely affect our business, financial condition and operating results and cash flow, including if we are required to take remedial action that may divert resources away from our development efforts.

Credo Technology Group Holding Ltd is a holding company incorporated as an exempted company under the laws of the Cayman Islands. We conduct substantially all of our operations through our indirect, wholly-owned subsidiaries in the United States and internationally. As such, it may be difficult for investors to enforce judgments obtained in the United States courts against our directors or officers. The courts of the Cayman Islands are unlikely: (i) to recognize or enforce against the Company judgments of courts of the United States predicated upon certain civil liability provisions of the securities laws of the United States or any state; and (ii)    in original actions brought in the Cayman Islands, to impose liabilities against the Company predicated upon the civil liability provisions of the securities laws of the United States or any State, so far as liabilities imposed by those provisions are penal in nature. In those circumstances, although there is no statutory enforcement in the Cayman Islands of judgments obtained in the United States, the courts of the Cayman Islands will recognize and enforce a foreign money judgment of a foreign court of competent jurisdiction without retrial on the merits based on the principle that a judgment of a competent foreign court imposes upon the judgment debtor an obligation to pay the sum for which judgment has been given provided certain conditions are met. For a foreign judgment to be enforced in the Cayman Islands, such judgment must be final and conclusive and for a liquidated sum, and must not be in respect of taxes or a fine or penalty, inconsistent with a Cayman Islands judgment in respect of the same matter, impeachable on the grounds of fraud or obtained in a manner, and/or be of a kind the enforcement of which is, contrary to natural justice or the public policy of the Cayman Islands (awards of punitive or multiple damages may well be held to be contrary to public policy). A Cayman Islands Court may stay enforcement proceedings if concurrent proceedings are being brought elsewhere. As a result of all of the above, public shareholders may have more difficulty protecting their interests in the face of actions taken by management, members of the board of directors or controlling shareholders than they would as public shareholders of a U.S. company.

There is an increasing focus on corporate social and environmental responsibility in the semiconductor industry. A number of our customers have adopted, or may adopt, procurement policies that include social and environmental responsibility provisions or requirements that their suppliers should comply with, or they may seek to include such provisions or requirements in their procurement terms and conditions. An increasing number of investors are also requiring companies to disclose corporate social and environmental policies, practices and metrics. Legal and regulatory requirements, as well as investor expectations, on corporate social responsibility practices and disclosure, are subject to change, can be unpredictable, and may be difficult and expensive for us to comply with, given the complexity of our supply chain and our significant outsourced manufacturing. If we are unable to comply, or are unable to cause our suppliers to comply, with such policies or provisions or meet the requirements of our customers and our investors, it could harm our reputation, such customers may stop purchasing products from us, which would harm our revenue and results of operations, or such investors may sell their shares, which could cause the trading price of our ordinary shares to decline. In addition, as part of their corporate social and environmental responsibility programs, as well as the Dodd-Frank Wall Street Reform and Consumer Protection Act, which imposes disclosure requirements regarding the use in components of products of "conflict minerals" mined from the Democratic Republic of Congo and adjoining countries, whether the components of such products are manufactured by them or third parties, an increasing number of OEMs are seeking to source products that do not contain minerals sourced from areas where proceeds from the sale of such minerals are likely to be used to fund armed conflicts, such as in the Democratic Republic of Congo. This could adversely affect the sourcing, availability and pricing of minerals used in the manufacture of semiconductor devices, including our products. As a result, we may face difficulties in satisfying these customers' demands, which may harm our sales and operating results. In addition, there are additional costs to us associated with complying with these disclosure requirements and customer requests, such as costs related to our due diligence to determine the source of any conflict minerals used in our products. Compliance with these requirements could be expensive and we may face reputational challenges if we are unable to verify the origins for all "conflict minerals" used in products through the procedures we have implemented.

In fiscal 2026, we had two customers that accounted for 10% or more of our total revenue. In addition, in fiscal 2026, sales to our top 10 customers accounted for approximately 90% of our total revenue. We believe our operating results for the foreseeable future will continue to depend on sales to a relatively small number of customers. In the future, these customers may decide not to purchase our products or solutions at all, may purchase fewer products or solutions than they did in the past or may alter their purchasing patterns. In addition, our relationships with some customers may deter other potential customers who compete with these customers from buying our products. To attract new customers or retain existing customers, we may offer these customers favorable terms, including the right to terminate or delay orders on little notice, exclusivity or most favored nation pricing on our products. Such agreements could impair our operating results. In the event of pricing reductions or financial incentives for key customers, our average selling prices and gross margins would decline. The loss of a key customer, any reduction in sales to any key customer or our inability to attract new significant customers could negatively impact our revenue and materially and adversely affect our business or results of operations.

To the extent we rely on distributors, we may be unable to predict the extent to which these distributors will be successful in marketing and selling our products. Moreover, many of these distributors are also likely to market and sell competing products, which may affect the extent to which they would promote our products. Even where our relationships are formalized in contracts, distributors have the right to terminate their relationships with us at any time. Our future performance may also depend, in part, on our ability to attract distributors who would be able to market and support our products effectively, especially in markets in which we have not previously sold our products. If we cannot retain distributors or find replacement distributors, our business, financial condition and results of operations could be harmed. Moreover, because we do not control the sales representatives and other employees of our distributors, any actions by the sales representatives and other employees of our distributors that do not comply with our sales process or priorities or applicable regulatory requirements could harm the reputation of our company or our products, result in legal liability to us or result in sales that are below our expectations, any of which could have a material adverse effect on our business, financial condition and results of operations.

We generated 28% of our revenue in Hong Kong in fiscal 2026, and 2% of our assets (by book value) were held in Hong Kong as of fiscal 2026. Accordingly, political and economic conditions in Hong Kong and the surrounding region may directly affect our business. On May 28, 2020, the National People's Congress of the People's Republic of China approved a proposal to impose a new national security law for Hong Kong and authorized the Standing Committee of the National People's Congress to proceed to work out details of the legislation to be implemented in Hong Kong. On June 30, 2020, The Law of the People's Republic of China on Safeguarding National Security Law in the Hong Kong Special Administrative Region (the Hong Kong National Security Law) became effective. Among other things, it criminalizes separatism, subversion, terrorism and foreign interference in Hong Kong. As a result of the Hong Kong National Security Law, in July 2020, the U.S. government enacted the Hong Kong Autonomy Act, authorizing the U.S. administration to impose blocking sanctions against individuals and entities determined to "materially contribute" to the erosion of Hong Kong's autonomy. The Hong Kong Autonomy Act further authorizes secondary sanctions, including the imposition of blocking sanctions, against foreign financial institutions that knowingly conduct a significant transaction with foreign persons sanctioned under this authority. On the same day, the U.S. President also issued Executive Order 13936 pursuant to which existing license exceptions and preferential status for Hong Kong under relevant U.S. export control laws and regulations were revoked. The combined effect of the Hong Kong National Security Law, the Hong Kong Autonomy Act and Executive Order 13936 have caused, and may continue to cause, substantial market uncertainties for businesses operating in Hong Kong. It is difficult to predict the full impact of the Hong Kong National Security Law and the resulting sanctions and other measures by the U.S. and foreign governments against Hong Kong. We cannot rule out the possibility of additional sanctions or other forms of penalties by the U.S. and foreign governments against Hong Kong, which may impact our ability to business in Hong Kong. Hong Kong is a special administrative region of the PRC and the basic policies of the PRC regarding Hong Kong are reflected in the Basic Law (i.e., Hong Kong's constitutional document) which provides Hong Kong with a high degree of autonomy and ensures its executive and legislative systems and independent judicial powers under the principle of "one country, two systems". However, there is no assurance that there will not be any changes in the political arrangement between the PRC and Hong Kong, thereby affecting the economic, political and legal environment in Hong Kong in the future. We cannot rule out the possibility of such change, which may impact our ability to conduct business in Hong Kong.

Substantial new tariffs and other restrictive trade policies have created a dynamic and unpredictable trade landscape, which may adversely impact our business. Laws and regulations regarding tariffs and trade policies are continuously and rapidly evolving, and the scope and interpretation of the laws and regulations that are or may be applicable to us are often uncertain and may be conflicting. As a result, these laws and regulations may be interpreted and applied in a manner inconsistent with our practices or policies and we could face fines, lawsuits, regulatory investigations, and other claims and penalties, and we could be required to fundamentally change our practices, which could adversely affect our business and operating results. Complying with such laws and regulations may be time-consuming and require additional resources, and could therefore adversely affect our business and results of operations. Current or future tariffs or other restrictive trade measures may significantly raise the costs of raw materials, components or finished goods, which may adversely impact both our product offerings and our operational expenses. Such cost increases may reduce our margins and require us to increase prices, which could harm our competitive position, reduce customer demand and damage customer relationships. Our manufacturers, suppliers and distribution channels are also affected by the current trade environment, and we may experience supply chain disruptions as a result of increased costs and uncertainty.

Highly complex products such as ours may contain defects, errors and bugs when they are first introduced or as new versions are released. We have in the past and may in the future experience these defects, errors and bugs. If any of our solutions have reliability, quality or compatibility problems, we may not be able to successfully correct these problems in a timely manner or at all. In addition, if any of our proprietary features contain defects, errors or bugs when first introduced or as new versions of our products are released, we may be unable to timely correct these problems. Consequently, our reputation may be damaged and customers may be reluctant to buy our products, which could harm our ability to retain existing customers and attract new customers, and could adversely affect our financial results. In addition, these defects, errors or bugs could interrupt or delay sales to our customers. If any of these problems are not found until after we have commenced commercial production of a new product, we may incur significant additional development costs and product recall, repair or replacement costs. These problems may also result in claims against us by our customers or others. Generally, we attempt to limit our liability to the replacement of the part or to the revenue received for the product through our negotiated agreements, as well as our standard terms and conditions, but these limitations on liability may not be effective or sufficient in scope in all cases. If a customer's equipment fails in use, the customer may incur significant monetary damages including an equipment recall or associated replacement expenses, as well as lost revenue. The customer may claim that a defect in our products caused the equipment failure and assert a claim against us to recover monetary damages. The process of identifying a defective or potentially defective product in systems that have been widely distributed may be lengthy and require significant resources, and may divert the attention of our engineering personnel from our product development efforts. We may test the affected product to determine the root cause of the problem and to determine appropriate solutions. We may find an appropriate solution or a temporary fix while a permanent solution is being determined. If we are unable to determine the root cause, find an appropriate solution or offer a temporary fix, we may delay shipment to customers. As a result, we may incur significant replacement costs, customers may bring contract damage claims and our reputation may be harmed. In certain situations, we may incur costs or expenses related to a recall of one of our products in order to avoid the potential claims due to a design or manufacturing process defect. Defects in our products could harm our relationships with our customers and damage our reputation. Customers may be reluctant to buy our products, which could harm our ability to retain existing customers and attract new customers. In addition, the cost of defending these claims and satisfying any arbitration award or judicial judgment with respect to these claims could harm our business prospects and financial condition. Although we carry product liability insurance, we cannot be sure that we have obtained a sufficient amount of insurance coverage, that asserted claims will be within the scope of coverage of the insurance or that we will have sufficient resources to satisfy any asserted claims arising from defects in our products or otherwise.

We rely on third parties for technologies that are integrated into our products, such as wafer fabrication and assembly and test technologies used by our contract manufacturers, as well as licensed architecture technologies. If we are unable to continue to use or license these technologies on reasonable terms, or if these technologies fail to operate properly, we may not be able to secure alternatives in a timely manner or at all, and our ability to remain competitive would be harmed. In addition, if we are unable to successfully license technology from third parties to develop future products, we may not be able to develop such products in a timely manner or at all. The operation or security of our products could be impaired if errors or other defects occur in the third-party technologies we use, and it may be more difficult for us to correct any such errors and defects in a timely manner, if at all, because the development and maintenance of these technologies is not within our control. Any impairment of the technologies or of our relationship with these third parties could harm our business.