Makemytrip (MMYT) Risk Analysis

India regulates ownership of Indian companies by foreigners, although some restrictions on foreign investment have been relaxed in recent years. These regulations and restrictions may apply to acquisitions by us or our affiliates, including MMT India and affiliates that are not resident in India, of shares in Indian companies or the provision of funding by us or any other entity to Indian companies within our group. For example, under the Government of India's consolidated foreign direct investment policy ("FDI Policy") and India's Foreign Exchange Management Act, 1999, and the rules and regulations thereunder, each as amended ("FEMA"), additional requirements are applicable to foreign investments in India, including requirements with respect to downstream investments by Indian companies owned or controlled by foreign entities, and the transfer of ownership or control of Indian companies in sectors with caps on foreign investment from resident Indian persons or entities to non-residents, as well as such transactions between non-residents. These requirements, which include restrictions on pricing, valuation of shares and sources of funding for such investments and may in certain cases, include prior notice to or approval of the Government of India, may adversely affect our ability to make future acquisitions or investments in India. In addition, pursuant to amendments in April 2020 to the FDI Policy and the FEMA rules, prior government approval will be required for any non-debt investment into India by non-resident entities from countries that share a land border with India or where the beneficial owner of such an investment is situated in or is a citizen of any such country, as well as for any transfer of any such proposed or existing non-debt investment, directly or indirectly, that would result in ownership by any such non-resident entity or beneficial owner. The list of land border countries includes Afghanistan, Bangladesh, Bhutan, the People's Republic of China, Myanmar, Nepal and Pakistan. This approval requirement applies to investments in all sectors, including those that previously did not require such approval, such as travel and tourism. Pursuant to further amendments in 2026, to the FDI Policy and the FEMA, the term "beneficial owner" has been defined and the requirement for prior approval has been limited to investments or transfers pursuant to which a citizen of a land border country or an entity incorporated or registered in a land border country holds or would hold, directly or indirectly, individually or cumulatively, independently or collectively, more than 10% of the shares, capital or profits of the investor entity incorporated or registered in a country other than a land border country, or exercises control over such investor entity, or exercises ultimate effective control over the investee entity in India. If our holding company is deemed to be a non-resident entity or an entity with a beneficial owner restricted by these amendments, prior government approval will be required for investments in non-debt instruments in our direct and indirect Indian subsidiaries and group entities, including MMT India, as well as for any such proposed investments or acquisitions by us or our affiliates, including MMT India and affiliates which are not resident in India. Investments in our ordinary shares (including upon conversion of our Class B Shares, our 2028 Notes or our 2030 Notes) and our Class B Shares would be deemed to be non-debt investments into our Indian subsidiaries, including MMT India. Accordingly, under the current FDI Policy and the FEMA rules, any proposed holder or beneficial owner of our ordinary shares, Class B Shares, 2028 Notes or 2030 Notes that is a non-resident entity from a country that shares a land border with India or where the beneficial owner of such an investment is situated in or is a citizen of any such country will not be able to convert such notes into ordinary shares without such approval. The Government of India has made and may continue to make revisions to the FDI Policy and the FEMA rules, which may impose additional requirements with respect to any holder's ability to acquire our ordinary shares (including upon conversion of our Class B Shares, our 2028 Notes or our 2030 Notes) and/or requirements for acquisition of our ordinary shares or Class B Shares upon a transfer thereof. Further, under the FEMA, we are restricted from lending to or borrowing from our Indian subsidiaries and our Indian subsidiaries are restricted from lending or borrowing in foreign currencies. We are also required to complete FEMA filings with respect to past investments in order to make further investments in India. There can be no assurance that we will be able to obtain any required approvals for future acquisitions or investments in India, including in our Indian subsidiaries and group entities, or that we will be able to obtain such approvals in a timely manner, on satisfactory terms or at all. Under the FEMA, the Reserve Bank of India has the power to impose monetary penalties up to three times the value of a FEMA violation, where quantifiable, and confiscate the shares at issue. Further, the Government of India has made and may continue to make revisions to the FDI Policy on e-commerce in India, including in relation to business model, inventory, pricing and permitted services. Such changes may require us to make changes to our business in order to comply with Indian law.

From time to time in the ordinary course of business, we are subject to various legal and regulatory proceedings, claims and actions, including complaints involving our customers (for example, in relation to alleged deficiency of services and unfair trade practices, and seeking, among other things, reimbursement of travel and medical expenses, travel allowance, and compensation for tickets), our suppliers and tax proceedings relating to income tax, service tax and goods and services tax matters. See also "Item 8. Financial Information - A. Consolidated Statements and Other Financial Information - Legal Proceedings". The results of litigation and claims cannot be predicted with certainty. Regardless of the outcome, litigation can have an adverse impact on us because of the costs to defend lawsuits, diversion of management resources and other factors. There is no assurance that these legal proceedings will be decided in our favor and that no further liability will arise out of these proceedings or would not have an adverse effect on our business, financial condition and results of operations. Even if we are successful in defending such cases, we may be subject to legal and other costs incurred pursuant to defending such litigation, and such costs may be substantial and not recoverable. In addition, we may decide to settle legal disputes on terms that are unfavorable to us. Furthermore, if any litigation to which we are a party is resolved adversely, we may be subject to an unfavorable judgment that we may not choose to appeal or that may not be reversed upon appeal. The terms of any settlement or judgment in connection with any legal claims, lawsuits, or proceedings may require us to cease some or all of our operations, or pay substantial amounts to the other party and could materially and adversely affect our business, financial condition and results of operations.

We are a Mauritius Global Business Company ("GBC"), and are tax resident in Mauritius. The Income Tax Act 1995 of Mauritius imposes a tax in Mauritius on the chargeable income of our holding company at the rate of 15% and effective from the assessment year commencing on July 1, 2024, an additional 2% as Corporate Climate Responsibility ("CCR") levy. Our holding company is governed by the regulatory regime applicable to GBCs effective from July 1, 2021. Generally, income tax rate for GBCs is 15%. Subject to meeting certain prescribed conditions, a partial exemption of 80% may be allowed against certain types of income such as foreign source dividend and interest. Where the GBC derives income, which is subject to foreign tax, and where such partial exemption has not been applied, the amount of foreign tax paid may be allowed as a credit against income tax payable in Mauritius in respect of that income. In order to maintain their global business licenses, GBCs must adhere to substance requirements such as: (i)carrying out their core income generating activities in or from Mauritius by: - employing either directly or indirectly a reasonable number of qualified persons to carry out the core activities, and - having a minimum level of expenditure, which is proportionate to its level of activities (ii)be managed and controlled from Mauritius; and (iii)be administered by a Management Company. In a circular addressed to Management Companies dated October 12, 2018, the Financial Services Commission in Mauritius has advised that in assessing the substance requirements to be met by a GBC, they shall consider the nature and level of core income generating activities conducted (including the use of technology) by the GBC and taking into account the circumstances of each GBC, based on certain indicative guidelines such as minimum expenditure and employment in Mauritius. The Mauritius Financial Services Commission has clarified through a circular dated January 17, 2022, that core income generating activities requirements will only apply to those holders or applicants for a global business license wishing to benefit from the preferential tax regime. GBCs not claiming partial exemption are not required to meet the core income generating activities requirements. Accordingly, our holding company will need to meet these requirements in order to benefit from the preferential tax regime. Our holding company holds a specific Tax Residence Certificate issued under the convention between the Government of Mauritius and the Government of Republic of India for the avoidance of Double Taxation and the Prevention of Fiscal Evasion with respect to Taxes on income and Capital Gains and for the Encouragement of Mutual Trade and Investment, valid until May 4, 2027 and a general Tax Residence Certificate for all jurisdictions, valid until May 8, 2027, to certify that our holding company is resident in Mauritius, from the Mauritius Revenue Authority, as per the guidelines prescribed by the Mauritius Revenue Authority. These certificates are required for the avoidance of double taxation under the Agreements for the Avoidance of Double Taxation signed between Mauritius and other jurisdictions, including India and the UAE. These tax residence certificates are renewed annually. If these tax residence certificates are not renewed for a period for which benefit under the Agreements for the Avoidance of Double Taxation is claimed, then, the same may be denied by the tax authorities.

The confidentiality, integrity and availability of our information technology infrastructure, networks, hardware and software (collectively, "IT Systems"), are crucial for engaging in electronic commerce and maintaining the trust of consumers and travel service providers. Some of our critical IT Systems and confidential information are managed or controlled by third-parties, such as our business partners, vendors and service providers. Any cyberattack or security breach, whether internal or external, targeting our systems or the systems of these third-parties, could have a significant negative impact on our business, financial condition, results of operations, brands and market share. It is possible that breaches or disruptions could occur due to circumvention capabilities, developments or our own actions, which could compromise confidential information or third-party data that we handle. For example, third-parties may attempt to fraudulently obtain sensitive information, such as usernames, passwords or credit card details, from our employees, travel service provider partners or customers, which could be used to access our IT Systems or defraud our partners and customers. Furthermore, defects or vulnerabilities in the hardware, software and applications we use, whether developed internally or procured from third-parties, could unexpectedly impact the security and operation of our IT Systems or those of third-parties with whom we interact. As part of our operations, we are required to comply with the Information Technology Act, 2000 (the "IT Act") and the rules thereof, which provides for civil and criminal liability. Further, the Digital Personal Data Protection Act, 2023 (the "Data Protection Act"), read with Digital Personal Data Protection Rules, 2025 (the "Data Protection Rules"), which came into effect in November 2025, require organizations to protect the privacy of their customers, prohibit unauthorized disclosure of personal information, and stipulate a monetary penalty in case of breach of the provisions of the Data Protection Act. For more information on privacy and data security regulations, see "– We are subject to evolving global privacy and data security regulations, which could impose significant compliance burdens and expose us to liability". We frequently encounter attempts to breach our security infrastructure through website attacks, phishing scams and denial of service incidents and anticipate facing other cyberattacks and security breaches. These risks are expected to increase as we expand our offerings, integrate products and services and handle more confidential information. Despite our efforts to safeguard the security, integrity and availability of our IT Systems and confidential information, we may not always be successful in doing so. Legitimate attempts to book reservations through our services may inadvertently be rejected. Such incidents could have a significant negative impact on our business, financial condition and results of operations. Our existing security measures may not be successful in preventing breaches, as evidenced by high-profile security breaches experienced by other major companies in recent years, which exposed their systems, information and personal data of their customers and employees. We allocate significant resources to mitigate the risks of cyberattacks and security breaches, and may need to increase our investments in security to enhance the protection of our systems, meet evolving compliance requirements and address problems and liabilities arising from breaches. Advances in technology or other developments could potentially compromise or breach our security technology. Managing these challenges is expected to become more complex as we expand our geographical presence and diversify our range of products and services. Threat actors are becoming increasingly sophisticated, utilizing tools and techniques such as AI to bypass security controls, avoid detection and obscure forensic evidence. This makes it more difficult for us to promptly and effectively detect, identify, investigate, contain and recover from future cyberattacks and incidents. Furthermore, the continued prevalence of remote working globally for our customers, employees and critical third-parties has amplified the risk of threat actors engaging in social engineering and exploiting vulnerabilities commonly found in non-corporate networks. A party, whether internal, external or unrelated, with the ability to bypass our security systems could cause severe harm to our IT Systems. This damage could impair our ability to provide services and prevent consumers from making reservations or conducting searches on our platform. Such breaches could result in the loss of crucial customer, financial or other data, which could significantly and adversely impact our business operations, compliance with commercial obligations and timely fulfillment of public reporting requirements. Security breaches may also lead to negative publicity, reputational damage, financial losses, legal actions, regulatory investigations, penalties and sanctions. Additionally, such incidents may erode consumer trust in our security measures, prompting them to choose our competitors' services instead. These outcomes would have a detrimental effect on our business, financial condition, results of operations, brands and market share. Our insurance coverage may not be sufficient to fully compensate us for all costs and losses resulting from security breaches. We are exposed to risks related to security breaches affecting third-parties engaged in online business activities. As consumers are generally concerned about security and privacy online, any publicized security issues could potentially diminish their willingness to provide personal information or engage in commercial electronic commerce transactions as a whole, including through our services. Some of our business operations involve collaborating with third-party marketing affiliates that may generate travel reservations using our infrastructure or other systems. Moreover, security breaches at third-parties such as travel service providers, payment processors, Switch and GDS service providers, that we rely on could impact consumers utilizing our services. If a security breach were to occur at any of these third-party marketing affiliates, travel service providers, payment processors, Switch, GDS service providers or other third-parties, it could be perceived as a breach of our own systems by consumers. Any such incidents could result in negative publicity, trigger notification requirements, harm our reputation, expose us to the risk of losses or litigation and potentially subject us to regulatory penalties and sanctions. Furthermore, these third-parties may not adhere to applicable disclosure and other requirements, which could expose us to liability.

We generate revenue from, among others, commissions and fees from our travel suppliers, as well as incentives from airline suppliers and GDS suppliers. The commissions and incentives under such agreements are primarily linked to the contribution of these suppliers to our revenue. Our incentive programs with travel suppliers are re-negotiated periodically, and in some cases fees or commissions have been reduced. Further, certain agreements provide our suppliers with the right to modify incentives upon short notice to us or to suspend incentives if our revenue contribution falls below a pre-determined threshold. If any of these suppliers reduce or eliminate the commissions and incentives they pay to us, our business, financial condition and results of operations may be adversely affected. Some airlines have recently started to offer air tickets at discounted or lower rates on their own booking platforms. If airlines continue to move away from distribution through GDS service providers and use other distribution channels, it may result in a decrease in our fees or incentives earned from our GDS service providers. Hotel suppliers may seek to renegotiate commission rates or shift inventory allocation to their own direct booking channels or competing platforms. In addition, consolidation among hotel chains and aggregators may increase their bargaining power and reduce the commissions and fees we are able to negotiate. State Road Transport Corporations may unilaterally revise the commission they pay to us. Similar risks apply to our others business, including rail, car hire, and tours and attractions, where suppliers may reduce or eliminate commissions or fees, or seek to increase direct customer engagement through their own platforms. To the extent any of our travel suppliers further reduce or eliminate the commissions or incentive payments they pay to us in the future, our revenue and Adjusted Margin may be significantly impacted. Any increase in convenience fees, to mitigate reductions in or elimination of commissions or otherwise, may also result in a loss of potential customers. Our business would also be negatively impacted if competition or regulation in the travel industry causes us to reduce or eliminate our convenience fees.

We maintain and annually renew insurance for losses arising from fire, burglary and terrorist activities for our corporate office at Gurugram and other offices in India. We have a liability policy to insure our directors and officers from various liabilities arising out of the general performance of their duties. We have purchased insurance for fire, earthquake and burglary for office equipment, and have also obtained cyber and crime insurance for our operations. We have also obtained medical insurance, term life insurance and accidental insurance for our employees. See "Item 4. Information on the Company - B. Business Overview - Insurance". While we renew our insurance policies in the ordinary course of business, there can be no guarantee that the insurance costs on renewal will not substantially increase or that the renewed terms will be fully acceptable to us. We may need to bear losses to the extent we incur uninsured losses or losses in excess of policy limits, or where there are claims that are rejected or delayed by the insurer. Moreover, if we incur a serious uninsured loss of significant value or a successful assertion of one or more large claims against us that exceeds our available insurance coverage or there are changes in terms of our insurance policies on renewal, including premium increases or the imposition of a larger deductible or co-insurance requirement, our business, financial condition, cash flows and results of operations could be adversely affected.

India has experienced high inflation relative to developed countries in the recent past. Changes in inflation rates can affect our pricing as well as our expenses, including employee salaries. High fluctuations in inflation rates may make it more difficult for us to accurately estimate or control our costs. Any increase in inflation in India can increase our expenses, which we may not be able to adequately pass on to our customers, whether entirely or in part, and may adversely affect our business, financial condition and results of operations. In particular, we might not be able to reduce our costs or entirely offset any increases in costs with increases in prices for our products. In such case, our business, financial condition and results of operations may be adversely affected. In addition, higher inflation may result in our customers cutting back on travel due to reductions in their disposable income and increases in the price of travel and related offerings, which could have an adverse effect on our business, prospects, financial condition, results of operations and cash flows. Although the Government of India has previously initiated economic measures to combat high inflation rates, it is unclear whether these measures will remain in effect. There can be no assurance that Indian inflation levels will not worsen in the future.

Our business and financial performance is significantly affected by the health of the travel industry in India and worldwide. Factors beyond our control that have in the past and could in the future materially and adversely affect the travel industry and demand in general and negatively affect our business include adverse macroeconomic and geopolitical conditions, changes in supply and pricing, changes in the commercial aviation landscape, fare increases, travel bans or restrictions, travel-related strikes, accidents or labor unrest, terrorism, general civil unrest and political instability, fuel price volatility and bankruptcies or liquidations of our suppliers. As the domestic Indian air travel industry is concentrated among a small base of domestic airlines, adverse market developments, particularly among the larger domestic airlines, are more likely to impact our business. Go Airlines (India) Limited ("Go First") being one of our top domestic airline suppliers in certain periods prior to fiscal year 2024, suspended all of its flight operations on May 3, 2023, and was ordered to be liquidated by the National Company Law Tribunal on January 20, 2025. As a result, we recorded an impairment provision for non-financial assets of $10.0 million in fiscal year 2024 in respect of advances for the supply of air tickets provided by us to Go First. Further, in December 2025, there were a significant number of flight delays in India as a result of updated flight duty time limitations enforced by the DGCA. This resulted in exceptional supply side constraints from Indian airline carriers in the domestic market, which impacted revenue from our air ticketing business during the third quarter of fiscal year 2026 and contributed to a decline in domestic air ticketing flight segments from 46.8 million in fiscal year 2025 to 45.9 million in fiscal year 2026. Additionally, our business is sensitive to safety concerns, and our business, financial condition and results of operations have been, and may in the future be, affected by incidents of actual or threatened terrorism, political instability or conflicts or other factors due to which travelers become concerned about safety, including in the regions we operate. India has also experienced instances of hostilities with neighboring countries from time to time. For example, on April 22, 2025, a terrorist attack in the Baisaran Valley near Pahalgam, Jammu and Kashmir, India resulted in the deaths of a number of civilians and injured numerous others, primarily tourists, resulting in escalating tensions and conflict between India and Pakistan. This led to significant disruptions in the region, including closure of tourist sites and cancellations of travel bookings, as well as significant infrastructure disruptions, including the temporary closure of airports in several Indian cities in northern and western India. Additionally, Pakistan's closure of its airspace for Indian aircraft and airlines flying to and from India forced rerouting of international flights, increasing travel time, fuel costs and operational complexities for airlines. As a result, our Gross Bookings were muted during the period following the incident on April 22, 2025, until the ceasefire that was agreed between India and Pakistan on May 10, 2025. In addition, the West Asia conflict, which commenced in late February 2026, has resulted in significant regional and global travel disruptions and impacted the performance of our air ticketing business, particularly for international flight segments. Natural disasters such as earthquakes, tsunamis, floods, landslides, cyclones and droughts, which have occurred in India and elsewhere in the past, can have an adverse impact on economic activity and travel demand in affected areas. Major public health issues, including outbreaks of disease or other epidemics or pandemics, could have a significant negative impact on our travel business. In the past, the COVID-19 pandemic, and efforts to stop the spread of COVID-19, severely restricted the level of economic activity around the world and had an unprecedented significant negative impact on the global travel industry. The COVID-19 pandemic materially impacted our business, financial performance and liquidity position, as well as those of many of the partners on which our business relies. Such events are outside our control and any future outbreak of contagious diseases or similar adverse public health developments could result in a significant decrease in demand for our travel services. The occurrence of such events has resulted in a reduction in the supply of products and services available on our platform, cancellations and disruptions to our customers' travel plans in the past, which led to a decline in bookings and an increase in cancellations and thus contributed to lower Gross Bookings and revenue. In addition, if we fail to provide timely refunds to customers in connection with booking cancellations, perception of our platform may be adversely impacted, and we may be subject to increased customer complaints and potential litigation. There is no assurance that such events will not occur in the future. If there is a prolonged substantial decrease in travel volumes, for these or any other reasons, our business, financial condition and results of operations could be significantly and adversely affected.

We have incorporated AI tools and technologies into our business operations, including data analytics, machine learning and AI capabilities to provide curated, personalized recommendations, as well as Myra, our multilingual, agentic trip-planning assistant that provides curated booking selections for flights, accommodation and holiday packages through conversational interactions via voice and text. The use of AI in our business presents risks and challenges, including that algorithms may be flawed, datasets may be insufficient, erroneous, stale or contain biased information or content chosen for display to customers by AI systems may be discriminatory, offensive, culturally insensitive, illegal or otherwise harmful. In addition, we may face operational risks with integrating AI tools and technologies into our platform. These deficiencies and other failures of AI systems could subject us to competitive harm, regulatory action, legal liability, brand or reputational harm. We have developed a substantial portion of our AI and machine learning systems internally, including search, recommendation and personalization engines, while also utilizing certain open-source frameworks and various licensed third-party large language models. These dependencies create additional risks. Our use of third-party AI may be disrupted, limited or become subject to unfavorable licensing terms, while open-source frameworks may expose us to intellectual property or licensing claims. Our AI models are trained on a combination of proprietary datasets and external datasets. Reliance on these diverse datasets presents risks of inaccuracies, incompleteness or bias that could reduce the reliability of our recommendations, adversely impact supplier or customer trust or subject us to heightened regulatory scrutiny. In addition, the regulatory landscape governing AI is complex and rapidly evolving, and new laws or regulations in jurisdictions where we operate may impose restrictions on the usage of AI, require changes to our operations or increase compliance costs. There is no guarantee that our AI-focused initiatives will be competitive or attract more customers to our platform.

The end-to-end payments process, from accepting customer payments through to paying suppliers, for a variety of payment methods, is subject to various laws, rules, regulations, legal interpretations and regulatory guidance, including those governing cross-border and domestic money transmission and funds transfers, foreign exchange, payment services and consumer protection. If we are found to be in violation of applicable payments laws or regulations, we could be subject to civil and criminal penalties, additional restrictive and burdensome requirements, or forced to cease or amend certain services we currently provide. We have entered into agreements with third-party service providers, including banks and certain companies that handle the processing of digital payments, to facilitate customer bookings for travel products and services on our platform. These agreements are non-exclusive and can be terminated by the third-party service providers upon 30 to 60 days' prior notice and, in some cases, immediately without notice if the third-party service provider considers it necessary. Further, as per the terms of these agreements, we are required to indemnify the third-party service providers against all claims, demands, actions, suits, losses and costs, including legal fees, arising from our actions or omissions or use of the facility. The third-party service providers also have the right to modify or impose transaction limits under these agreements. In addition, we may be liable for accepting fraudulent digital payments on our platform. In the fiscal year 2026, we experienced losses amounting to $0.6 million due to payment-related disputes. These losses were associated with disputed settlements and refunds resulting from credit card or digital commerce fraud committed by third parties, which primarily involved the purchase of air tickets and hotels and packages on our platform using counterfeit credit cards or other fraudulent digital payment methods. We operate a co-branded credit card program with ICICI Bank under which ICICI Bank issues and operates the cards while we support marketing, data-sharing and loyalty/benefits fulfillment. However, we remain exposed to unauthorized usage and chargebacks under the card network and processor rules, increased compliance and security costs, including tokenization and requirements under the Payment Card Industry Data Security Standard and the Data Protection Act. If we fail to effectively combat fraudulent digital payments, we may encounter payment disputes with customers and be subject to demands from relevant banks, credit card processing companies and digital payment providers. Consequently, our business, financial condition and results of operations may be adversely affected. Payment card networks may increase the interchange fees and assessments that they charge for each transaction that accesses their networks and may impose special fees or assessments on such transactions. Certain of our payment processors also have the right to pass any increases in interchange fees and assessments on to us, which could significantly increase our costs and thereby adversely affect our financial performance. In addition, we are also subject to payment card association rules and obligations under our contracts with payment card processors. Under these rules and obligations, if information is compromised, we could be liable to payment card issuers for associated expenses and penalties. The Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, Government of India (the "CERT-In"), has issued directions under the IT Act, as amended, requiring reporting of cybersecurity incidents and maintenance of transaction records. Pursuant to Reserve Bank of India circulars in relation to the security of credit and debit card transactions, card data is required to be tokenized by card issuers and any data previously stored by entities other than card issuers and card networks were required to be purged on or prior to September 30, 2022. In addition, if we fail to follow payment card industry security standards, even if no customer information is compromised, we could incur significant fines or experience a significant increase in payment gateway charges, which could adversely affect our business, financial condition and results of operations.