Ethos Technologies Inc. Class A (LIFE) Risk Analysis

Our success depends on individual agent engagement. Agent-level adoption of our platform is not guaranteed and may vary significantly across agencies. If agents are slow to adopt our platform, choose to deprioritize it, or lack sufficient support or training, the anticipated benefits of a given agency or agent relationship may not materialize. Agent acceptance of our platform also depends on its perceived quality, effectiveness, and usability compared to alternative selling methods. Moreover, agent behavior can be affected by factors beyond our control, such as changes in agency compensation structures, internal agency incentives, or technical issues that disrupt agent workflows or compensation accuracy, which factors may be influenced or directed by agencies as part of their own competitive strategies. These dynamics have in the past, and may in the future, reduce agents' platform engagement and impact the volume of policies sold. Some of the agents that activate policies using our platform, or provide additional services on our platform, may have relationships with or influence over our consumers, and therefore we risk the loss of such consumers if agents choose not to engage with our platform or prioritize our products.

It is critical to our success that consumers, agents, and carriers be able to access our platform at all times. Our systems, or those of third parties upon which we rely, may experience service interruptions or degradation or other performance problems because of data breaches or data security incidents (for additional information on this risk, see the section titled "Risk Factors-Risks Related to Intellectual Property, Artificial Intelligence, Data Privacy, and Security-If our information technology systems or those of third parties with whom we work or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of consumers or sales, and other adverse consequences"), infrastructure changes, human error, earthquakes, hurricanes, floods, fires, other natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, or other attempts to infiltrate or harm our systems or platform. It has become increasingly difficult and expensive to maintain and improve the performance of our systems and the availability of our platform, especially during peak usage times, as our operations grow and the usage of our platform increases. Some of our systems are not fully redundant, and our disaster recovery planning may not be sufficient for all eventualities. We may experience system failures and other events or conditions that interrupt the availability or reduce or affect the speed or functionality of our platform. These events could result in significant losses of revenue and could harm our brand and reputation. Affected users could seek monetary recourse from us for their losses and such claims, even if unsuccessful, would likely be time-consuming and costly for us to address. In addition, such breaches have in the past required, and may in the future require notification to governmental agencies, the media, or individuals pursuant to various federal and state privacy and security laws and regulations. Further, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. A prolonged interruption in the availability or reduction in the availability, speed, or other functionality of our platform could adversely affect our business and reputation and could result in the loss of consumers. Our business interruption insurance may not be sufficient to cover all of our losses that may result from interruptions in our service as a result of system failures, cyber attacks, and similar events.

Our future success depends, in part, on our ability to anticipate and respond effectively to the threat of, and the opportunity presented by, digital disruption and other technology changes. These may include new applications or insurance-related services based on AI or machine learning technologies. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants (for example, through disintermediation) or new entrants such as technology companies, Insurtech start-up companies, and others. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, customer preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis, and our ideas may not be accepted in the marketplace. Additionally, the effort to gain technological expertise and develop new technologies in our business requires us to incur significant expenses. Our technological development projects may also not deliver the benefits we expect once they are completed or may be replaced or become obsolete more quickly than expected, which could result in the accelerated recognition of expenses. If we cannot offer new technologies as quickly as our competitors, or if our competitors develop more cost-effective technologies or product offerings, we could experience a material adverse effect on our operating results, consumer relationships, growth, and compliance programs.

Our success depends on our ability to attract and retain skilled and experienced personnel. There is significant competition from within the insurance industry and from businesses outside the industry for exceptional employees, especially in key positions. Our competitors may be able to offer a work environment with higher compensation or more opportunities than we can. Any new personnel we hire may not be or become as productive as we expect, as we may face challenges adequately or appropriately integrating them into our workforce culture. Our effort to retain and develop personnel may also result in significant additional expenses, which could adversely affect our profitability. If we are unable to successfully attract, retain, and motivate our employees, whether as a result of an insufficient number of qualified applicants, difficulty in recruiting new employees, or inadequate resources to train, integrate, and retain qualified employees, our business, financial condition, results of operations, and reputation could be materially and adversely affected. If any of our key professionals were to join an existing competitor or form a competing company, some of our carriers, agency counterparties, and consumers could choose to use the services of that competitor instead of our services. In addition, we could be adversely affected if we fail to adequately plan for the succession of our senior management, including our founders, executives, and key personnel. We currently do not maintain key person insurance on these individuals. Although we operate with a decentralized management system, the loss of our senior management or other key personnel in any circumstance, including any limitation on the performance of their duties or short- or long-term absence as a result of an acute illness, or our inability to continue to identify, recruit, and retain such personnel, could materially and adversely affect our business, financial condition, and results of operations. While we have employment contracts with members of senior management, as well as our key employees, they may terminate employment without notice and without cause or good reason. The members of our senior management are not subject to non-competition agreements. Accordingly, the adverse effect resulting from the loss of certain members of senior management could be compounded by our inability to prevent them from competing with us.

In addition to our direct channel, we rely on our third-party channel, consisting primarily of contractual relationships with independent agents and agencies, to generate a significant and growing portion of our revenue. Our revenue from sales of policies on our platform through our third-party channel is driven by a limited number of agencies. In each of the years ended December 31, 2024 and 2025, approximately 25% and 31%, respectively, of our revenue was generated through three of our most significant agency relationships. We anticipate that we will continue to derive a significant portion of our revenue from sales of policies on our platform through agents from a limited number of agencies for the foreseeable future, and in some cases, the portion of our revenue attributable to certain agencies may increase in the future. We may not be able to maintain or increase revenue associated with such agencies for a variety of reasons, including if the agencies or affiliated agents no longer perceive our platform to be accretive to or cost-effective for activating new policies, or agents determine that alternative platforms, other methods of selling policies or products not offered by us are preferable. Our contractual arrangements with agencies have no minimum term or engagement commitments. As a result, the agencies with whom we work may disengage from or abandon use of our platform or services at any time at their discretion. We have in the past experienced, and may in the future experience, decreases or gaps in agent engagement with our platform, including as directed by agencies, for various reasons, whether related to or unrelated to Ethos or our platform or products. These agencies facilitate our access to a broader consumer base, including those who prefer purchasing insurance through traditional advisory channels. If we are unable to attract, retain, or maintain productive relationships within this channel, or if agents choose to offer competing products instead of or in addition to ours, our revenue and growth could be adversely affected. Additionally, regulatory changes, shifts in consumer behavior, shifts in demand for particular product offerings, or increased competition from other similar platforms could further impact our ability to sustain these partnerships and maintain our revenue growth. In recent years, private equity sponsors have acquired numerous independent insurance agencies, including certain of our current agency counterparties. This consolidation may continue or accelerate in the future, resulting in fewer independent agencies and more agencies under common ownership. In addition, while we maintain distinct contractual relationships with agencies, certain agencies are or may in the future be consolidated under common control. As a result, the ultimate control parties may seek to restructure or renegotiate the agencies' contractual terms with us, including to shift contractual relationships to control parties, to modify the terms of their liabilities or make other changes, which has happened recently and may happen in the future. Failure by us to maintain a positive relationship with the ultimate control parties for these agencies may result in termination of our commercial relationships with these parties and affiliated agencies or the restructuring of the commercial relationships in a manner unfavorable to us. Further, we may experience loss of engagement from agents at such agencies or disengagement by such agencies from our platform. This shift towards consolidation could impact our ability to initiate new or maintain existing agency relationships, as has happened in the past and may occur in the future, and could also heighten the risks relating to agency and affiliated agent engagement with our platform described above. We incur marketing and incentive expenses when onboarding a new agency or engaging with agents at an agency with whom we already work. The effectiveness of such marketing and incentive efforts, and as a result, their return on investment, may not materialize or be known for several quarters due to the time it takes for new agents to be fully ramped up on our platform. In addition, our agencies may seek to exert leverage to negotiate for higher compensation, which, if granted, could negatively affect our margins. Maintaining and growing our agency relationships generally require us to continually improve our platform, which may involve significant technological and design challenges, and agencies have placed and are expected to continue to place considerable pressure on us to improve. Accordingly, we expect to devote a substantial amount of our resources to our agency relationships, which could detract from or delay other strategic initiatives. Moreover, it is possible that agencies with whom we work may develop their own infrastructure that may compete with our services or partner with a competitor's infrastructure. If we are unable to retain these key relationships or if agencies reduce their activity on our platform, our revenue would be adversely impacted and our business, operating results, financial condition, and future prospects would be materially and adversely affected.

In the past, state regulators have scrutinized the manner in which insurance brokers are compensated. For example, in 2004, the Attorney General of the State of New York brought charges against members of the insurance brokerage community. These actions have created uncertainty concerning longstanding methods of compensating insurance brokers. Given that the insurance brokerage industry has faced scrutiny from regulators in the past over its compensation practices, and the transparency and discourse to consumers regarding brokers' compensation, it is possible that regulators may choose to revisit the same or other practices in the future. If they do so, compliance with new regulations along with any sanctions that might be imposed for past practices deemed improper could have an adverse impact on our future results of operations and inflict significant reputational harm on our business.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, or collectively, process, personal information (which may also be referred to as "personally identifiable information," "personal data," "individually identifiable health information," "consumer health data," or similar terms), including sensitive information, such as proprietary and confidential business data, trade secrets, intellectual property, sensitive personal information and sensitive third-party data, or collectively, sensitive data. For example, we process personal information (including sensitive data) of our current, prospective, and past customers, which includes health data, financial data, and other personal information and sensitive data (such as Social Security numbers) as disclosed in our public-facing privacy notices. Our data collection and processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. These requirements and obligations also apply to transfers of information among our affiliates, as well as to transactions we enter into with vendors and other third parties. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, comprehensive and sector-specific privacy laws and regulations, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). At the U.S. federal level, we are subject to, among other laws, the Gramm-Leach-Bliley Act, or GLBA, which requires financial institutions, including insurers, to, among other things, periodically disclose their privacy policies and practices relating to sharing "nonpublic personal information" and, in some cases, enables customers to opt out of the sharing of certain personal information with unaffiliated third parties. The GLBA also requires financial institutions to implement an information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. We are also subject to the rules and regulations promulgated under the authority of the U.S. Federal Trade Commission, or FTC. The FTC and state regulators enforce a variety of data privacy and cybersecurity issues, such as misrepresentations in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the FTC Act or similar state laws. While we are not directly subject to the federal Health Insurance Portability and Accountability Act of 1996, as amended, including as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and the regulations that implement such laws (collectively, HIPAA), HIPAA affects certain of our business operations. For example, we obtain individuals' medical and health information from their medical providers and other entities, which we then use for the purposes of determining applicants' eligibility for life insurance. Many medical providers and other entities cannot release such medical and health information to us unless the release authorizations signed by the individuals satisfy the applicable HIPAA requirements. We also represent in our contractual agreements with key vendors that we comply with HIPAA's requirements for authorizations to disclose protected health information. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information. As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, sales of personal information and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including sensitive personal information, such as conducting data privacy impact assessments and requiring individual's consent under certain circumstances. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and all regulations thereto, or collectively, CCPA, applies to personal information of consumers, business representatives, employees, and others who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights including the opt-out of "sales" and "sharing" (as such terms are defined by CCPA) of personal information. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA includes an exemption applicable to personal information collected, processed, sold or disclosed subject to the GLBA, and other comprehensive U.S. state privacy laws contain similar exemptions for GLBA-covered data or broader exemptions for GLBA-covered entities. However, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Similar laws have been passed and/or are being considered in additional states, as well as at the federal level, and we expect more states to pass similar laws in the future. We are subject to various state financial privacy laws such as the California Financial Information Privacy Act. These laws require, among other things, providing either an opt-in or opt-out, depending on the state, to the sharing of non-public personal information with unaffiliated third parties. They also require establishing a program of administrative, technical, and physical safeguards designed to protect the security and confidentiality of customer information. Additionally, in response to the growing threat of cyber-attacks in the insurance industry, certain jurisdictions, including New York, have begun to consider new cybersecurity measures, including the adoption of cybersecurity regulations. In March 2017, the New York State Department of Financial Services, or NYDFS, promulgated Cybersecurity Requirements for Financial Services Companies, which require covered financial institutions to establish and maintain a cybersecurity program and implement and maintain cybersecurity policies and procedures that meet specific requirements; the NYDFS adopted amendments to the cybersecurity regulation in 2023, the majority of which became effective in 2024. Additionally, in October 2017, the National Association of Insurance Commissioners, or NAIC, adopted its Insurance Data Security Model Law, intended to serve as model legislation for states to enact in order to govern cybersecurity and data protection practices of insurers, insurance agents, and other licensed entities registered under state insurance laws. Various states have adopted versions of the NAIC Insurance Data Security Model Law. Several states have also enacted new laws and regulations governing the privacy and security of consumer health data. For example, Washington's My Health My Data Act, or MHMDA, broadly defines consumer health data, places restrictions on collecting, processing, using, and sharing consumer health data (including imposing stringent requirements for affirmative consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. While the MHMDA includes an exemption applicable to GLBA-covered data, and a similar law in Nevada also exempts GLBA-covered entities, other states have passed, are considering and may adopt consumer health data privacy laws in the future. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal information. For example, some of our data processing practices have been and may in the future be subject to challenges or lawsuits under data privacy and communications laws, including for example under wiretapping laws, if we, as we have in the past and may in the future, share consumer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs for violations of laws such as the California Invasion of Privacy Act and other similar laws. Our inability or failure to obtain consent for these practices could result, and in certain cases has resulted, in adverse consequences, including class action litigation and mass arbitration demands. Regulators are increasingly scrutinizing the activities of third-party data suppliers, and laws in the United States (including the CCPA and California's Delete Act) and other jurisdictions are likewise regulating such activity. These laws pose additional, material compliance risks to such data suppliers, and these suppliers may not be able to provide us with personal information in compliance with these laws. For example, some data suppliers are required to register as data brokers under certain state laws such as California law and file reports with regulators, which exposes them to increased scrutiny. Data brokers may also be required to honor certain opt-outs from consumers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. These laws and challenges may make it so difficult for our suppliers to provide the data that the costs associated with the data materially increase or may materially decrease the availability of data that our data suppliers can provide to us. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered "foreign persons" and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements. In addition, we may face compliance risks and limitations on our ability to use certain data provided by our third-party suppliers if those suppliers have not complied with applicable privacy laws, provided appropriate notice to data subjects, obtained necessary consents, or established a legal basis for the transfer and processing of the data by us. Additionally, as part of certain lead monetization efforts, we provide lead information from individuals who start but do not complete the insurance application process on our platform to a limited number of third-party agencies. While we intend for this information to be used solely for insurance-related purposes and by agencies, once shared, we do not control how these agencies handle the data. As a result, this initiative may expose us to heightened privacy, data security, and reputational risks, particularly if these third parties fail to comply with applicable laws or consumer expectations regarding the handling of personal information. We publish privacy policies, marketing materials, and other statements concerning data privacy, and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. We are also bound by contractual obligations related to data privacy and security, with which we may not fully comply and our efforts to comply with such obligations may not be successful. For example, certain privacy laws require us to undertake certain obligations with respect to data privacy and security or require us or our customers to impose specific contractual restrictions on our or their service providers. Legal requirements and obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf. In addition, these obligations may require us to change our business model in part because our business model depends on our ability to process personal information. As such, we are particularly exposed to the risks associated with the rapidly changing legal landscape, including with respect to data privacy laws and regulations. For example, we may be at heightened risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model, which could adversely impact our business, financial condition and/or results of operations. In addition, we are and may become in the future contractually subject to self-regulatory standards adopted by industry groups. For example, we are subject to the Payment Card Industry Data Security Standard, or PCI DSS, a self-regulatory standard that requires companies that accept payment cards, or that process payment card information to implement certain cybersecurity measures and/or annually validate that required security controls are in place. Companies that accept payment cards but otherwise outsource payment card processing to a third party and do not process payment card information themselves, as we do, are subject to minimal requirements under the PCI DSS. If we or our payment processors fail to comply with the PCI DSS, we may incur significant fines or liability and lose access to major payment card systems. We may at times fail (or be perceived to have failed) to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact and in certain cases has negatively impacted our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, consent orders, injunctions, settlement, or resolution orders and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight and requirements to take remedial actions; bans or restrictions on processing personal information; and orders to destroy or not use personal information. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. We have in the past received, and may in the future receive, inquiries and have been, and may again become, subject to investigations, proceedings, orders, or various government inquiries regarding our data privacy and security practices and processing and related litigation. For example, in 2022, we learned that threat actors had launched an attack against our website and obtained consumer personal information from a third-party integration. As a result, we were the subject of class action litigation that has since settled as well as inquiries and investigations from various state regulators, all of which have since settled. While we maintain policies, procedures, and technological safeguards designed to protect the security and privacy of this information, including those implemented to prevent access to consumer personal information, we cannot eliminate the risk of improper access to or disclosure of personal information nor the related costs we incur to mitigate the consequences from such events. Data privacy and cybersecurity laws, rules, and regulations are matters of growing public concern and are continuously changing in the jurisdictions in which we operate. The failure to adhere to or successfully implement adequate policies and procedures in response to evolving laws, rules, and regulations could result in legal liability or other adverse impacts on our business such as impairment to our reputation. Any of the foregoing could have a material adverse effect on our reputation, business, or financial condition, including: loss of consumers; interruptions or stoppages in our business operations; inability to process personal information; limited ability to develop or commercialize our products or services; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

We are subject to litigation, regulatory investigations, and claims arising in the normal course of our business operations. The risks associated with these matters often are difficult to assess or quantify and the existence and magnitude of potential claims often remain unknown for substantial periods of time. While we have insurance coverage for some of these potential claims, others may be subject to certain exclusions under our policy and/or not be otherwise covered by insurance, insurers may dispute coverage, or any ultimate liabilities may exceed our coverage limits. We may be subject to actions and claims relating to the sale of insurance. Actions and claims may result in the rescission of such sales and consequently, carriers may seek to recoup commissions paid to us, which may lead to legal action against us. The outcome of such actions cannot be predicted, and such claims or actions could have a material adverse effect on our business, financial condition, and results of operations. We are subject to numerous laws and regulations and may be subject to regulatory investigations from time to time. The insurance industry has been subject to a significant level of scrutiny by various regulatory bodies, including state attorneys general and insurance departments, concerning certain practices within the insurance industry. These practices include the marketing and sale of life insurance policies, denials of coverage, the suitability of insurance products and services, the use, handling, and disclosure of consumer information (including personal information), lead generation and data sharing and sales, and the handling of commissions and agent compensation. From time to time, we have received informational requests from governmental authorities and have been and may in the future be subject to investigations and enforcement actions, including lawsuits, injunctions, damages, and criminal and civil penalties related to disclosures of personal information, including certain types of sensitive health information. These same laws sometimes also provide individuals with private rights of action. Therefore, in addition to regulatory investigations and actions, the insurance industry has been subject to consumer lawsuits, including class actions, brought under insurance and state and federal consumer protection laws. There have been a number of revisions to existing, or proposals to modify or enact new laws and regulations regarding insurance agents, brokers, and distribution platforms. These actions have imposed or could impose additional obligations on us with respect to products sold on our platform. We cannot predict the impact that any new laws, rules, or regulations may have on our business and financial results, and we may become subject to governmental inquiries, subpoenas, or lawsuits. Regulators may raise issues during investigations, examinations, or audits that could, if determined adversely, have a material impact on us. The interpretations of regulations by regulators may change and statutes may be enacted with retroactive impact. We could also be materially adversely affected by any new industry-wide regulations or practices that may result from these proceedings. Our involvement in investigations and lawsuits have caused and may in the future cause us to incur additional legal and other costs, including fines and damages, some of which may be material in amount. Regardless of final costs, these matters could have a material adverse effect on us by exposing us to negative publicity, reputational damage, harm to consumer relationships, or diversion of personnel and management resources. Our business strategy depends in part on expanding our third-party channel, which includes independent agencies and the agents who sell insurance products through our platform. Our third-party channel also increases our exposure to regulatory and compliance risks that we do not directly control. These agencies and agents operate independently and are responsible for their own sales practices, data privacy and security, personnel and compensation policies, and marketing activities. As the volume of activity through agencies and agents increases, so does the potential for noncompliance with applicable laws by such parties, including state insurance regulations, consumer protection laws, data privacy laws, and anti-fraud statutes, and for disputes with other parties, including agents, former agents, other agencies, and carriers, that could involve us or subject us to liability. For example, agents with which we have relationships have in the past, and may in the future, terminate policies issued by carriers we have relationships with and replace them with policies issued by carriers we do not contract with in an improper manner, which is a practice that we prohibit in our contractual arrangements with agencies. Our ability to monitor and influence their conduct is limited, and if any agency or agent fails to comply with applicable laws or engages in conduct that exposes them to liability, we could face reputational harm as well as other negative consequences, including regulatory scrutiny, government investigations, legal liability, or monetary penalties, and could incur significant costs, even if we were not directly involved in the conduct at issue. Any of these outcomes could adversely affect our business, financial condition, and results of operations.

We are subject to taxes in U.S. federal, state, local, and non-U.S. jurisdictions. The amount of taxes we pay in different jurisdictions depends on the application of the relevant tax laws to our business activities, the relative amounts of income before taxes in the various jurisdictions in which we operate, the application of new or revised tax laws, the interpretation of existing tax laws and policies, the outcome of current and future tax audits, examinations, or administrative appeals, our ability to realize our deferred tax assets, and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements. The tax regimes to which we are subject or under which we operate, including income and non-income taxes, are unsettled in certain respects and may be subject to significant change. Changes in tax laws or regulations, or changes in interpretations of existing laws and regulations, could materially affect our financial condition and results of operations. For example, the Tax Cuts and Jobs Act, or the Tax Act, the Coronavirus Aid, Relief, and Economic Security Act, and the Inflation Reduction Act made many significant changes to the U.S. tax laws. Effective January 1, 2022, the Tax Act eliminated the option to deduct research and development expenses for tax purposes in the year incurred and instead requires taxpayers to capitalize and subsequently amortize such expenses over five years for research activities conducted in the United States and over 15 years for research activities conducted outside the United States. In recent years, many such changes have been made, and changes are likely to continue to occur in the future. It cannot be predicted whether, when, in what form or with what effective dates tax laws, regulations, and rulings may be enacted, promulgated or issued, which could result in an increase in our or our shareholders' tax liability or require changes in the manner in which we operate in order to minimize or mitigate any adverse effects of changes in tax law. Additionally, the enactment of the One Big Beautiful Bill Act ("OBBBA") in July 2025 has introduced significant changes to the U.S. federal tax code, including, among other changes, changes to the taxation of income derived from international operations, changes in the deduction and amortization of research and development expenditures, and limitations on the deductibility of business interest. While certain provisions, such as the restoration of immediate domestic R&D expensing, may benefit our cash flow, other provisions-including the 1% excise tax on foreign remittances and the continued capitalization of foreign R&D costs-may increase our effective tax rate. Furthermore, the complexity of transitioning to OBBBA standards may result in adjustments to our deferred tax assets or liabilities, which could materially affect our financial results in future periods. Future guidance from the Internal Revenue Service and other tax authorities with respect to any legislation may affect us, and certain aspects of such legislation could be repealed or modified or sunset in future years. Should our effective tax rate rise, our business could be harmed. The determination of our overall provision for income and other taxes is inherently uncertain because it requires significant judgment with respect to complex transactions and calculations. As a result, fluctuations in our tax liabilities may differ materially from amounts recorded in our financial statements and could adversely affect our business, financial condition, and results of operations in the periods for which such determination is made.

Our ability to attract and retain consumers, agents, and carriers is dependent in part on our ability to provide high-quality support for our platform. Consumers, agents, agencies, and carriers depend on our support organization to resolve any issues relating to our platform. If we are unable to resolve issues in a timely and effective manner, whether raised by prospective or existing policyholders, or by agents and agencies, those users may lose trust in our platform, disengage from our offerings, or shift their business elsewhere. This could result in lower policy volume, reputational harm, and reduced commission revenue. As we continue to grow our business and expand our offerings, we will face challenges related to providing high-quality platform support services at scale. Any failure to maintain high-quality support for our platform, or a market perception that we do not maintain high-quality support, could harm our reputation and adversely affect our ability to scale our platform and business, our financial condition, and results of operations.

Promoting awareness of our platform and maintaining and enhancing our reputation is important to our ability to grow our business, and attracting consumers, agents, agencies, and carriers can be costly. We believe that much of the growth in the number of consumers, agents, agencies, and carriers that utilize our platform is attributable to our paid marketing initiatives. Our marketing efforts have included referrals, affiliate programs, partnerships, display advertising, television, billboards, radio, video, social media, email, podcasts, search engine optimization, and keyword search campaigns. Our marketing initiatives may become increasingly expensive, and we may not generate a meaningful return on these initiatives. Even if we increase revenue as a result of our paid marketing efforts, it may not offset the additional marketing expenses we incur. If our marketing efforts to help grow our business are not successful or cost-effective, our business, financial condition, and results of operations could be adversely affected. The successful promotion of our brand and the market's awareness of our platform and product offerings will depend on a number of factors, including our marketing efforts, ability to continue to expand our product offerings, and ability to successfully differentiate our platform from competing channels. We expect to invest substantial resources to promote and maintain our brand, but there is no guarantee that our brand development strategies will enhance the recognition of our brand or lead to increased sales. Brand promotion activities may not yield increased revenue, and even if they do, the increased revenue may not offset the expenses we incur in promoting and maintaining our brand and reputation. If our efforts to cost-effectively promote and maintain our brand are not successful, our results of operations and our ability to attract and engage consumers, agencies, and agents may be adversely affected. Further, even if our brand recognition and consumer loyalty increase, this may not yield increased revenue for us. Unfavorable publicity regarding our customer service, privacy, data security, data protection practices, and certain agencies with which we have a relationship could also harm our reputation and diminish confidence in, and the use of, our services. Fear of loss of consumers or lack of consumer adoption due to poor service quality or negative customer or shopper reviews or press may make agencies or agents reluctant to remain with us. The same negative network effects could occur as a result of trust and safety or fraud incidents as well as data breaches and other data security incidents. In addition, negative publicity related to agencies or carriers with whom we work may damage our reputation, even if the publicity is not directly related to us. If we fail to maintain, protect, and enhance our brand successfully or to maintain loyalty among consumers, agencies, and carriers, or if we incur substantial expenses in unsuccessful attempts to maintain, protect, and enhance our brand, we may fail to attract or increase the engagement of consumers, agencies, and carriers, and our business, financial condition, and results of operations may suffer.

Concerns regarding the effects of climate change on the global environment have led governmental bodies to adopt laws and regulations aimed at reducing greenhouse gas emissions and other measures to mitigate the impact of climate change. As a result, the global business community has increased its political and social awareness surrounding the issue. At various times, the U.S. Congress, state legislatures, and federal and state regulatory agencies have adopted or proposed legal requirements and other initiatives to combat climate change. Climate change legislation or regulation could cause us to incur increased costs and capital expenditures to comply, which may impact our financial condition and operating performance. In addition, the U.S. Federal Reserve has in the past identified climate change as a potential risk to the stability of the financial system. It also reported that a gradual change in investor sentiment regarding climate risk introduces the possibility of abrupt tipping points or significant swings in sentiment, which could create unpredictable follow-on effects in financial markets. If this occurred, not only would we be negatively impacted by the general economic decline, but a drop in the stock market affecting our stock price could negatively impact our ability to grow through mergers and acquisitions financed using our common stock. Moreover, if our carriers fail or withdraw from offering certain lines of insurance because of large payouts related to climate change, overall risk-taking capital capacity could be negatively affected, which could reduce our ability to place certain lines of insurance and, as a result, reduce our revenue and profitability.