WM Technology (MAPS) Risk Analysis

The cannabis industry, and the complex regulatory regime applicable to it, is evolving rapidly and may develop in ways that we cannot anticipate. The pace of dramatic change in the cannabis industry makes it difficult to assess our future prospects, and you should evaluate our business in light of the risks and difficulties we may encounter as the industry continues to evolve. These risks and difficulties include: - managing complex, disparate and rapidly evolving regulatory regimes imposed by U.S. federal, state and local and other non-U.S. governments around the world applicable to cannabis and cannabis-related businesses;- adapting to rapidly evolving trends in the cannabis industry and the way consumers and cannabis industry businesses interact with technology;- maintaining and increasing our base of clients and consumers;- continuing to preserve and build our brand while upgrading our existing offerings;- successfully attracting, hiring and retaining qualified personnel to manage operations;- adapting to changes in the cannabis industry if sales of cannabis expand significantly beyond a regulated model;- commodification of the cannabis industry;- competition from the hemp industry;- successfully implementing and executing our business and marketing strategies; and - successfully expanding our business into new and existing cannabis markets. If the demand for our platform and software solutions does not develop as we expect, or if we fail to address the needs of our clients or consumers, our business will be harmed. We may not be able to successfully address these risks and difficulties, which could harm our business and operating results.

Although cannabis is a restricted controlled substance under the federal CSA, U.S. states have legalized cannabis to varying degrees through state-specific regulatory frameworks. See "Business-Government Regulation" for additional information. Laws and regulations affecting the cannabis industry in states and territories of the United States are continually changing. Any change or even the speed of changes could require us to incur substantial costs associated with compliance or alter our business plan, and could detrimentally affect our operations, revenue and profitability. Similarly, if the pace of issuance of new cannabis licenses is slower than expected, our ability to acquire new clients and grow our revenue could be harmed. The commercial cannabis industry is still a young industry, and we cannot predict the impact of the compliance regime to which it may be subject. We will incur ongoing costs and obligations related to regulatory compliance, and such costs may prove to be material. Failure to comply with regulations may result in additional costs for corrective measures, penalties or restrictions on our operations. In addition, changes in regulations, more vigorous enforcement thereof, or other unanticipated events could require extensive changes to our operations or increased compliance costs or give rise to material liabilities, which could have a material adverse effect on us. Given the concentration of our revenue from the sale of listing products, any increase in the stringency of any applicable laws, including U.S. state, or Canadian federal laws and regulations relating to cannabis, or any escalation in the enforcement of such existing laws and regulations against the current or putative cannabis industry within any jurisdiction, could negatively impact the profitability or viability of cannabis businesses in such affected jurisdictions, which in turn could materially adversely affect our business and operating results. In addition, although we have not yet been required to obtain any cannabis license as a result of existing cannabis regulations, it is possible that cannabis regulations may be enacted in the future that will require us to obtain such a cannabis license or otherwise seek to substantially regulate our business. Additionally, in some jurisdictions we may be required to seek and obtain a blanket approval of our platform in order to enable potential clients to access our services, and such approval may be subject to significant regulatory discretion. U.S. state, or Canadian federal and other non-U.S. jurisdictions' cannabis laws and regulations are broad in scope and subject to evolving interpretations, which could require us to incur substantial costs associated with compliance or alter our business plan. Our failure to adequately manage the risk associated with future regulations and adequately manage future compliance requirements may adversely affect our business, our status as a reporting company and our public listing. Further, any adverse pronouncements from political leaders or regulators about businesses related to the legal cannabis industry could adversely affect the price of our securities.

We generally do not, and cannot, ensure that our clients will conduct their business activities in a manner compliant with certain regulations and other legal requirements applicable to the cannabis industry, in whole or in part, even if our solutions provide features to support our clients' compliance with such regulations and requirements. Their legal noncompliance could result in regulatory and even criminal actions against them, which could have a material adverse impact on our business and operating results or financial condition. For additional information, see the other risk factors in this section titled "Risk Factors-Risks Related to our Business and Industry," including "Some of our clients or their listings currently and in the future may not be in compliance with licensing and related requirements under applicable laws and regulations. Allowing unlicensed or noncompliant businesses to access our products, or allowing businesses to use our solutions in a noncompliant manner, may subject us to legal or regulatory enforcement and negative publicity, which could adversely impact our business, operating results, financial condition, brand and reputation. In addition, allowing businesses who engage in false or deceptive advertising practices to use our solutions may subject us to negative publicity, which could have similar adverse impacts on us."

Our clients are contractually required to represent, warrant and covenant to us that they conduct their business in compliance with applicable state law, which includes any applicable licensing requirements and the regulatory framework enacted by each state or province in which they do business. Clients further contractually agree to indemnify us for any damages we may suffer as a result of their noncompliance. We rely on our clients' contractual representations, and generally do not verify them, other than with respect to the licensing information of our clients operating cannabis retail businesses, where we currently require such clients to provide evidence of a valid state or provincial cannabis license prior to their initial access and from time to time during the term of their use of such products. We require all operational cannabis retailer clients, including storefronts and delivery services, to display on their listing a valid, unexpired state-issued license number. We also currently require cannabis brand clients to provide evidence of a valid state or provincial license in order to get access to our listings and premium placement products. Additionally, many states do not require a license to sell hemp products at retail, and the illicit market could fraudulently attempt to use our hemp product listings to sell products containing more than the allowable amount of THC under federal or state laws. While we periodically audit and respond to reports related to our hemp product listings, it is difficult to monitor the individual products listed, and marketing claims contained, in the listings of our hemp clients. As a result, some of our clients or their listings currently and in the future may not be in compliance with licensing and related requirements under applicable state or provincial laws and regulations. There could be legal enforcement actions against unlicensed or insufficiently licensed entities selling cannabis or hemp, which could negatively impact us. Any legal or regulatory enforcement against us based on the business solutions that we offer, the third-party content available on our platform or noncompliance by our clients with licensing and other legal requirements, could subject us to various risks, including monetary penalties and the risk that we elect or are compelled to remove content from our platform and would likely cause us to experience negative publicity. Any of these developments could materially and adversely impact our business, operating results, financial condition, brand and reputation.

U.S. federal law, and more specifically the CSA, proscribes the cultivation, processing, distribution, sale, advertisement and possession of cannabis. As a result, U.S. federal law enforcement authorities, in their attempt to regulate the illegal or unauthorized production, distribution, promotion, sale, possession, or use of cannabis, may seek to bring criminal actions against our clients under the CSA. On August 4, 2021, the U.S. Attorney's Office for the Eastern District of California withdrew a subpoena served on us in September 2019, and informed us that it had no present plan to exercise its discretion to proceed further in the matter. The U.S. Attorney's Office for the Eastern District of California also stated that its decision was not a grant of immunity, however, and there can be no assurance that the U.S. Attorney's Office for the Eastern District of California - either the U.S. Attorney's Office for the Eastern District of California or another Department of Justice ("DOJ") entity - will not initiate another investigation in the future. If our clients are found to be violating U.S. federal law relating to cannabis, they may be subject not only to criminal charges and convictions, but also to forfeiture of property, significant fines and penalties, disgorgement of profits, administrative sanctions, cessation of business activities, or civil liabilities arising from proceedings initiated by either the U.S. government or private citizens. Any of these actions or consequences on our clients could have a material adverse effect on our business, operating results or financial condition, or could force us to cease operations, and as a result, our investors could lose their entire investment. Further, to the extent any law enforcement actions require us to respond to subpoenas, or undergo search warrants, for client records, cannabis businesses could elect to cease using our products. Until the U.S. federal government changes the laws with respect to cannabis, and particularly if the U.S. Congress does not extend the Omnibus Spending Bill's protection of state medical cannabis programs to apply to all state cannabis programs, U.S. federal authorities could more strictly enforce current federal prohibitions and restrictions. An increase in federal enforcement against companies licensed under state cannabis laws could negatively impact the state cannabis industries and, in turn, our business, operating results, financial condition, brand and reputation.

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Control, the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, and other state and national anti-bribery laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors, and other partners from authorizing, promising, offering, or providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. The FCPA also requires public companies to make and keep books and records that accurately and fairly reflect the transactions of the corporation and to devise and maintain an adequate system of internal accounting controls. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other partners, even if we do not explicitly authorize or have actual knowledge of such activities. We are also subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Controls. Export controls and trade sanctions laws and regulations may restrict or prohibit altogether the provision, sale, or supply of our products to certain governments, persons, entities, countries, and territories, including those that are the target of comprehensive sanctions or an embargo. Any violation of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other consequences.

We are subject to general business regulations and laws as well as federal, state, provincial and foreign laws specifically governing the internet. Existing and future laws and regulations, narrowing of any existing legal safe harbors, or previous or future court decisions may impede the growth of the internet or online products and solutions, and increase the cost of providing online products and solutions. These laws may govern, among other issues, taxation, tariffs, pricing, content, copyrights, distribution, electronic contracts and other communications, consumer protection, broadband residential internet access and the characteristics and quality of offerings. It is often unclear how existing laws governing issues such as property ownership, sales, use and other taxes, and libel apply to the internet or online services. There is also a risk that these laws may be interpreted and applied in conflicting ways across jurisdictions, and in a manner that is not consistent with our current practices. Unfavorable resolution of these issues may limit our business activities, expose us to potential legal claims or cause us to spend significant resources on ensuring compliance, any of which could harm our business and operating results.

In the ordinary course of business, we process personal data and other sensitive information, including proprietary and confidential business data, intellectual property, and sensitive third-party data. Our data processing subjects us to various federal, state, provincial and foreign laws and regulations, as well as other obligations including contractual obligations, industry standards and internal and external policies related to privacy, data protection, and information security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 and the Telephone Consumer Protection Act of 1991 ("TCPA") impose specific requirements on communications with customers. For example, the TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as sale of personal data, targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as obtaining consumer consent and conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act ("CCPA"), applies to personal data of consumers, business representatives, and employees who are California residents, provides for fines, and allows private litigants affected by certain data breaches to recover significant statutory damages for certain data breaches. A number of other proposals are being considered or have passed at the federal, state, and local levels, and we expect more states to pass similar laws in the future. Many foreign countries and governmental bodies, including Canada, the United Kingdom ("UK"), and the European Union ("E.U.") have laws, regulations, and industry standards concerning the processing of personal information, including for example, in Canada, the federal Personal Information Protection and Electronic Documents Act, or PIPEDA and various related laws. Further, Canada has robust anti-spam legislation, the Anti-Spam Legislation, or CASL. The penalties for non-compliance under CASL are significant. In addition, the E.U.'s General Data Protection Regulation, or the EU GDPR, and the United Kingdom's GDPR, or UK GDPR (collectively, "GDPR") regulate the processing of personal data and provide for substantial penalties for noncompliance. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, up to 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. There are also laws governing the privacy of consumer health data. For example, Washington's My Health My Data Act broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states have adopted and may in the future adopt similar laws. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions have and may continue to adopt similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that a company can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for a company to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, a company could face significant adverse consequences, including, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against their processing or transferring of personal data related to EU users. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. We are bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the CCPA, require our customers to impose specific contractual restrictions on their service providers. We are also subject to the PCI-DSS, which requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with the PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. Our employees and personnel use generative artificial intelligence ("AI) and/or automated decision-making technologies to perform their work, and the disclosure and use of personal data in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating AI and/or automated decision-making technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI and/or automated decision-making technologies, it could make our business less efficient and result in competitive disadvantages. We use machine learning and AI, including generative AI, in certain aspects of our products and services. The development and use of AI technologies present various privacy and security risks that may impact our business. AI technologies are subject to privacy and data security laws, as well as increasing regulation and scrutiny. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we share consumer information to third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. We publish privacy policies, marketing materials and other statements regarding data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are evolving, becoming increasingly stringent, and creating uncertainty. These obligations have and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations. Future laws, regulations, standards and other obligations, or amendments or changes in the interpretation of existing laws, regulations, standards and other obligations, could impair our or (or the third parties upon whom we rely) ability to collect, use, disclose or otherwise process information relating to employees or consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our client and consumer bases and increase revenue. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. Any failure or perceived failure by us or the third parties upon whom we rely to comply with federal, state, provincial or foreign laws or regulations, industry standards, contractual obligations or other legal obligations may result in governmental enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar) and prosecutions, private litigation (including class actions) and mass arbitration demands, adverse publicity that could cause employees, clients and consumers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal data, and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Should the federal government legalize cannabis for adult-use and/or medical-use, it is possible that the U.S. Food and Drug Administration (the "FDA") would seek to regulate it under the Food, Drug and Cosmetics Act of 1938, and Continuing Appropriations and Extensions Act of 2026 (H.R. 5371) (the "2026 Appropriations Act") ,directed FDA to create regulations relating to hemp products. The FDA may issue rules and regulations including certified good manufacturing practices related to the growth, cultivation, harvesting and processing of hemp, cannabinoids broadly, or following a rescheduling, even adult-use and medical-use cannabis specifically. Clinical trials may be needed to verify efficacy and safety. It is also possible that the FDA would require that facilities where adult-use and medical-use cannabis is grown register with the FDA and comply with certain federally prescribed regulations. In the event that some or all of these regulations are imposed, we do not know what the impact would be on the adult-use and medical-use cannabis industry, including what costs, requirements and possible prohibitions may be enforced. If our clients are unable to comply with any new rules, regulations or registration as prescribed by the FDA, or are unable to do so in a cost-effective manner, our clients may be unable to continue to operate their respective business in its current form, or at all, which may also result in our clients being unable to continue engaging our technology services.

While we are a technology company, not a cannabis licensee, and as such, are not subject to commercial cannabis regulations that apply to cannabis operators, we cannot guarantee that our systems, protocols and practices will prevent any and all unauthorized or illegal activities by our clients. Our success depends in part on our clients' ability to operate consistently with the regulatory and licensing requirements of each state, local and regional jurisdiction in which they operate. Despite the procedures and protocols in place for license verification by our Policy & Compliance Operations team, any non-compliance by our clients could put our business at risk, as discussed herein, and could also subject us to potential actions by state regulators, to the extent they could be applied to technology service providers, which could materially adversely affect our business, operations, financial condition, brand and reputation.

We and our clients are subject to a variety of laws and regulations in the United States regarding financial transactions. Violations of the U.S. anti-money laundering ("AML") laws require proceeds from enumerated criminal activity, which includes trafficking in cannabis in violation of the CSA. Financial institutions that both we and our clients rely on are subject to the Bank Secrecy Act, as amended by Title III of the USA Patriot Act. In Canada, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada), as amended and the rules and regulations thereunder and the Criminal Code (Canada) apply. The penalties for violation of these laws include imprisonment, substantial fines and forfeiture. In 2014, the DOJ under the Obama administration directed federal prosecutors to exercise restraint in prosecuting AML violations arising in the state legal cannabis programs and to consider the federal enforcement priorities enumerated in the Cole Memo when determining whether to charge institutions or individuals based upon cannabis-related activity. Around the same time, the Treasury Department issued guidance that clarified how financial institutions can provide services to cannabis-related businesses, consistent with financial institutions' obligations under the Bank Secrecy Act. Then-Attorney General Sessions' rescission of the DOJ's guidance on the state cannabis programs in early 2018 increased uncertainty and heightened the risk that federal law enforcement authorities could seek to pursue money laundering charges against entities, or individuals, engaged in supporting the cannabis industry. On January 31, 2018, the Treasury Department issued additional guidance that the 2014 Guidance would remain in place until further notice, despite the rescission of the DOJ's earlier guidance memoranda. A detailed description of current U.S. policy and the legal status of cannabis, including President Trump's prior lack of action against cannabis and his current stance on cannabis, can be found in the "U.S. and Territories" section. We are subject to a variety of laws and regulations in the United States, Canada and elsewhere that prohibit money laundering, including the Proceeds of Crime and Terrorist Financing Act (Canada) and the Money Laundering Control Act (U.S.), as amended, and the rules and regulations thereunder and any related or similar rules, regulations or guidelines issued, administered or enforced by governmental authorities in the United States, Canada or any other jurisdiction in which we have business operations or to which we export our offerings. If any of our clients' business activities, any dividends or distributions therefrom, or any profits or revenue accruing thereby are found to be in violation of money laundering statutes, our clients could be subject to criminal liability and significant penalties and fines. Any violations of these laws, or allegations of such violations, by our clients could disrupt our operations and involve significant management distraction and expenses. As a result, a significant number of our clients facing money laundering charges could materially affect our business, operations and financial condition. Additionally, proceeds from our clients' business activities, including payments we have received from those clients, could be subject to seizure or forfeiture if they are found to be illegal proceeds of a crime transmitted in violation of anti-money laundering laws, which could have a material adverse effect on our business. Finally, if any of our clients are found to be violating the above statutes, this could have a material adverse effect on their ability to access or maintain financial services, as discussed in detail below, which could, in turn, have a material adverse effect on our business.