Gen Digital (GEN) Risk Analysis

Our solutions are subject to a high degree of regulation, including a wide variety of international and U.S. federal, state, and local laws and regulations, such as the Fair Credit Reporting Act, the GLBA, the Consumer Financial Protection Act, the Federal Trade Commission Act (the FTC Act), and comparable state laws that are patterned after the FTC Act, the U.S. Foreign Corrupt Practices Act of 1977, U.S. domestic bribery laws, U.S. consumer protection, consumer financial services and banking laws, and U.S. and foreign anti-corruption laws. We provide, facilitate or market consumer financial products and services, and in certain cases act as a service provider to regulated financial institutions. Therefore, we are subject to the supervisory, regulatory and enforcement authority of federal and state agencies, including the Consumer Financial Protection Bureau (CFPB), the FTC, state banking and consumer finance regulators and state attorneys general. These authorities may exercise authority with respect to our services, or the marketing and servicing of those services, through the oversight of our financial institution partners and suppliers, or by otherwise exercising their supervisory, regulatory or enforcement authority over consumer financial products and services. The regulatory frameworks applicable to our business continue to evolve, including with respect to earned wage access, lending, banking, digital financial services and related activities. If, for example, the CFPB were to expand its supervisory authority by promulgating new regulations or reinterpreting existing regulations, it is possible that the CFPB could be permitted to conduct periodic examination of our business, which may increase our risk of regulatory or enforcement actions. We maintain a compliance program designed to enable us to comply with all applicable anti-money laundering, anti-terrorism financing and economic sanctions laws and regulations, including the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act of 2001, and its implementing regulations. This compliance program includes policies, procedures, processes and other internal controls designed to identify, monitor, manage and mitigate the risk of money laundering and terrorist financing and prevent our platform from being used to facilitate business in countries or with persons or entities that are the subject of sanctions administered by Office of Foreign Assets Control and equivalent international authorities or that are otherwise the target of sanctions. These controls include procedures and processes to detect and report potentially suspicious transactions, perform customer due diligence, respond to requests from law enforcement and meet all recordkeeping and reporting requirements related to particular transactions involving currency or monetary instruments. Certain of our subsidiaries may be "financial institutions" under the BSA that are required to establish and maintain a BSA/AML compliance program. Additionally, we are required to maintain a BSA/AML compliance program under our agreements with our third-party partners, and certain state regulatory agencies have intimated they expect such program to be in place and followed. Additionally, we are regulated by many state regulatory agencies through licensing and other supervisory or enforcement authority, which includes regular examination by state governmental authorities. For a more detailed description of licensing, see "-- If we fail to operate in compliance with state or local licensing requirements, it could adversely affect our business, financial condition, results of operations and cash flows." Our wholly-owned subsidiary, ML Wealth, is registered as an investment adviser under the Investment Advisers Act of 1940 (the Advisers Act) and is subject to regulation by the SEC. The Advisers Act, together with related regulations and interpretations of the SEC, impose numerous obligations and restrictions on investment advisers, including requirements relating to the safekeeping of client funds and securities, limitations on advertising, disclosure and reporting obligations, prohibitions on fraudulent activities, restrictions on agency cross and principal transactions between an adviser and its advisory clients and other detailed operating requirements, as well as general fiduciary obligations. U.S. federal regulators, state attorneys general or other state enforcement authorities and other governmental agencies have in the past and may in the future take formal or informal actions against us, which could cause reputational and financial harm to our business, financial condition, results of operations and cash flows. These formal and informal actions may involve inquiries, subpoenas, exams, pending investigations, enforcement matters and litigation by state and federal regulators, cease and desist orders, fines, civil penalties, criminal penalties or other disciplinary action or force us to adopt new compliance programs or policies, remove personnel including senior executives, provide remediation or refunds to customers, or undertake other changes to our business operations, such as limits or prohibitions of our ability to offer certain products and services, or suspension or revocation of one or more of our licenses. Any weaknesses in our compliance management system may also subject us to penalties or enforcement action by the CFPB or state regulators. We have in the past, and may again in the future, enter into settlements, consent decrees and similar arrangements with the FTC, the CFPB, state attorneys general and other state regulators, and other sovereign regulators and competition authorities such as the United Kingdom's Competition and Markets Authority (CMA). In addition, certain products we offer, including loans or advance products facilitated through our platform, could be rendered void or unenforceable in whole or in part, which could adversely affect our business, financial condition, results of operations and cash flows. If we fail to manage our legal and regulatory risk in the jurisdictions in which we operate, our business could suffer, our reputation could be harmed and we would be subject to additional legal and regulatory risks. This could, in turn, increase the size and number of claims and damages asserted against us and/or subject us to regulatory investigations, enforcement actions or other proceedings, or lead to increased regulatory concerns. We may also be required to spend additional time and resources on remedial measures and conducting inquiries, beyond those already initiated and ongoing, which could have an adverse effect on our business. Additionally, the highly regulated environment in which our third-party financial institution partners operate may subject us to regulation, which could have an adverse effect on our business, financial condition, results of operations and cash flows. We rely on bank partners, payment processors and other institutions with licensures we do not have to facilitate offerings. For a discussion of specific legal and regulatory proceedings, inquiries and investigations to which we are currently subject, see Note 15 of the Notes to the Condensed Consolidated Financial Statements included in this Quarterly Report on Form 10-Q.

We generally conduct our international operations through wholly-owned subsidiaries and are or may be required to report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Our intercompany relationships are subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. The amount of taxes we pay in different jurisdictions may depend on a variety of factors including the application of the tax laws of those various jurisdictions (including the U.S.) to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The relevant taxing authorities have in the past and may in the future disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

Our decisions to provide many of our products and services to customers are based partly on information that they provide to us or authorize us to receive from third party sources. To the extent that these customers or third parties provide information to us in a manner that we are unable to verify or if such information is incorrect or fraudulent, our decisioning process may not accurately reflect the associated risk. In addition, data provided by third-party sources, including consumer reporting agencies, is a component of our credit decisions and this data may contain inaccuracies. This may result in the inability to either approve otherwise qualified applicants or reject otherwise unqualified applicants through our platform or accurately analyze credit data, which may adversely impact our business and negatively impact our reputation. In addition, there is risk of fraudulent activity associated with our business, including as a result of the service providers and other third parties who handle customer information on our behalf. We use identity and fraud prevention tools to analyze data provided by external databases to authenticate the identity of each applicant that signs up for our first-party products and services. However, these checks have failed from time to time and may again fail in the future, and fraud, which may be significant, has and may in the future occur. The level of fraud-related charge-offs on the first-party products and services facilitated through our platform could be adversely affected if fraudulent activity were to significantly increase. We may not be able to recoup funds associated with our first-party products and services made in connection with inaccurate statements,omissions of fact or fraud, in which case our revenue, results of operations, profitability and cash flows will be harmed. High profile fraudulent activity or significant increases in fraudulent activity could also lead to regulatory intervention, negative publicity and the erosion of trust from our customers, which could negatively impact our results of operations, brand and reputation, and require us to take steps to reduce fraud risk, which could increase our costs.

Third parties have claimed and additional third parties may claim in the future that we have infringed their intellectual property rights, including claims regarding patents, copyrights and trademarks. For additional information on such claims, please refer to Note 15 of the Notes to the Condensed Consolidated Financial Statements included in this Quarterly Report on Form 10-Q. Because of constant technological change in the segments in which we compete, the extensive patent coverage of existing technologies, and the rapid rate of issuance of new patents, it is possible that the number of these claims may grow. In addition, former employers of our former, current or future employees may assert claims that such employees have improperly disclosed to us confidential or proprietary information of these former employers. Any such claim, with or without merit, could result in costly litigation, management distraction and reputational harm. If we are not successful in defending such claims, we could be required to stop selling, delay shipments of, or redesign our solutions, pay monetary amounts as damages, enter into royalty or licensing arrangements, or satisfy indemnification obligations that we have with some of our partners. We cannot assure you that any royalty or licensing arrangements that we may seek in such circumstances will be available to us on commercially reasonable terms or at all. We license and use software from third parties in our business and generally must rely on those third parties to protect the licensed rights and avoid infringement. Such licenses may terminate, expire or become unavailable on acceptable terms, and licensed technology may become obsolete, defective or incompatible with future versions of our offerings. Failure to comply with license terms could result in termination of rights, damages or operational disruption. If we are unable to obtain or maintain necessary third-party licenses, or if licensors impose more restrictive terms or higher fees or royalties, we may be required to modify our products, obtain alternative technology, incur increased costs or limit certain offerings. Furthermore, incorporating intellectual property or proprietary rights in our products or services licensed from or otherwise made available to us by third parties on a non-exclusive basis could limit our ability to protect the intellectual property and proprietary rights in our products and services and our ability to restrict third parties from developing, selling or otherwise providing similar or competitive technology using the same third-party intellectual property or proprietary rights.

Certain of our products are distributed with software licensed by its authors or other third parties under so-called "open source" licenses. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software (which could include our proprietary source code or AI models) if we combine our proprietary software with open source software in a certain manner. Some open source software may include Gen AI software which may expose us to risks as the intellectual property ownership and license rights, including copyright, of Gen AI software and tools has not been fully interpreted by U.S. courts or been fully addressed by federal, state, or international regulations. In addition to risks related to license requirements, using open source software, including open source software that incorporates or relies on Gen AI, can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on origin of the software. We cannot be sure that all open source, including open source that incorporates or relies on Gen AI, is submitted for approval prior to use in our products. In addition, many of the risks associated with usage of open source, including open source that incorporates or relies on Gen AI, may not or cannot be eliminated and could, if not properly addressed, negatively affect our business. These claims could result in litigation and if portions of our proprietary AI models or software are determined to be subject to an open-source license, or if the license terms for the open-source software that we incorporate change, we could be required to publicly release all or affected portions of our source code, purchase a costly license, cease offering the implicated products or services unless and until we can re-engineer such source code in a manner that avoids infringement, discontinue or delay the provision of our offerings if re-engineering could not be accomplished on a timely basis or change our business activities, any of which could negatively affect our business operations and potentially our intellectual property rights and help third parties, including our competitors, develop products and services that are similar to or better than ours. In addition, the re-engineering process could require us to expend significant additional research and development resources, and we may not be able to complete the re-engineering process successfully. If we were required to publicly disclose any portion of our proprietary models, it is possible we could lose the benefit of trade secret protection for our models. Use of open-source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on open-source software. Any of these risks associated with the use of open-source software could be difficult to eliminate or manage and, if not addressed, could materially and adversely affect our business, financial condition, results of operations and cash flows.

Many of our customers rely on our customer support services to resolve issues, including technical support, billing and subscription issues, that may arise. If demand increases, or our resources decrease, we may be unable to offer the level of support our customers expect. Any failure by us to maintain the expected level of support could reduce customer satisfaction and negatively impact our customer retention and our business.