Ooma (OOMA) Risk Analysis

We are subject to the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other anti-bribery and anti-money laundering laws in countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees and third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector. We use third-party representatives for product testing, customs, export, and import matters outside of the United States. As we increase our international sales and business, we may engage with business partners and third-party intermediaries to sell our products and services. We or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities. While we devote resources to our U.S. and international compliance programs and have implemented policies, training, and internal controls designed to reduce the risk of corrupt payments, such as controls over expenditures for foreign contractors, and collusive activity, our employees, partners, vendors, or agents may violate our policies. Noncompliance with anti-corruption and anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage, and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations and financial condition could be materially harmed. In addition, responding to any action will likely result in a materially significant diversion of management's attention and resources, significant defense costs and other professional fees. Enforcement actions and sanctions could further harm our business, results of operations, and financial condition.

Our products and services are subject to export and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Controls. U.S. export control laws and economic sanctions programs generally prohibit the export of certain products and services to countries, governments and persons subject to U.S. economic embargoes and trade sanctions unless a license, approval, or other authorization is obtained from the U.S. Government. Obtaining the necessary authorizations and licenses for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil or criminal penalties, including the possible loss of export or import privileges, government investigations, reputational harm, fines which may be imposed on us and responsible employees or managers, and, in extreme cases, the incarceration of responsible employees or managers. In addition, any changes in our products or services, or changes in applicable export, import, embargo and trade sanctions regulations, may create delays in the introduction and sale of our products and services in international markets or, in some cases, prevent the export or import of our products and services to certain countries, governments, or persons altogether. Any change in export, import, embargo, or trade sanctions regulations, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could also result in decreased use of our products and services, or in our decreased ability to export or sell our products and services to existing or potential customers with international operations. Any decreased use of our products and services or limitation on our ability to export or sell our products and services would likely adversely affect our business.

Federal Regulation. Our business is regulated by the FCC. As a communication services provider, we are subject to FCC regulations relating to privacy, disability access, law enforcement access, porting of numbers, revenue reporting, Federal USF contributions and other regulatory assessments, E-911, robocall mitigation, and other matters. If we do not comply with FCC rules and regulations, we could be subject to FCC enforcement actions, substantial fines, loss of licenses, repayment of funds, potential private right of actions and possibly restrictions on our ability to operate or offer certain of our services. Any enforcement action by the FCC, which may include a public process, would hurt our reputation in the industry, possibly impair our ability to sell our services to customers and could have a materially adverse impact on our revenue. State Regulation. We are also subject to state consumer protection laws, as well as U.S. state, municipal and local sales, use, excise, utility user and ad valorem taxes, fees or surcharges. The imposition of such regulatory obligations or the imposition of additional taxes on our services could increase our cost of doing business and limit our growth. International Regulation. As we expand internationally, we are subject to telecommunications, consumer protection, data privacy and other laws and regulations in the foreign countries where we offer our services. Our international operations are potentially subject to country-specific governmental regulation and related actions that may increase our costs and prevent us from offering or providing our products and services in certain countries. Certain of our services may be used by customers located in countries where VoIP and other forms of IP communications may be illegal or require special licensing. In countries where local laws and regulations prohibit (or come to prohibit) the use of our products, users may continue to use our products and services, which could subject us to costly penalties or governmental action adverse to our business and damaging to our brand and reputation, our international expansion efforts, or our business and operating results.

We may not be able to comply with additional 911 requirements adopted by the FCC for interconnected VoIP providers, providers of enterprise telephone services, non-interconnected VoIP providers and texting providers. We may or may not be able to comply with these obligations. For example, beginning January 6, 2022, providers of non-fixed interconnected VoIP services were required to supply automated dispatchable location, if technically feasible, or either registered location information obtained by the customer or alternative location information. At present, we have no means to automatically identify the physical location of our customers. Our obligation to comply with the FCC's VoIP E-911 order and related costs puts us at a competitive disadvantage to VoIP service providers who are either not subject to the requirements or have chosen not to comply with the FCC's mandates. We cannot guarantee emergency calling service consistent with the VoIP E-911 order will be available to all of our customers, especially those accessing our services on a mobile device or from outside of the United States. The FCC's current E-911 requirements and changes to those requirements, including their impact on our customers due to service price increases or other factors could have a material adverse effect on our business, financial condition or operating results. In addition, customers may attempt to hold us responsible for any loss, damage, personal injury, or death suffered as a result of delayed, misrouted, or uncompleted emergency service calls or text messages, subject to any limitations on a provider's liability provided by applicable laws, regulations, and our customer agreements.

The FCC's rules regarding the system of compensation for various types of traffic require, among other things, interconnected VoIP providers who originate interstate or intrastate traffic destined for the PSTN, to transmit the telephone number associated with the calling party to the next provider in the call path. Intermediate providers must pass unaltered calling party number or charge number signaling information they receive from other providers to subsequent providers in the call path. In addition, effective June 30, 2021, voice service providers in the United States were required to either fully implement "STIR/SHAKEN" technology on their entire networks or implement a robocall mitigation program on those portions of their networks that are not STIR/SHAKEN-enabled. Canada is also currently in the process of implementing STIR/SHAKEN requirements. Although we have implemented STIR/SHAKEN in the United States and are in the process of implementing STIR/SHAKEN in Canada, to the extent that we inadvertently pass traffic that does not have appropriate calling party number or charge number information, we could be subject to fines, cease and desist orders, or other penalties. Similarly, to the extent that we cannot authenticate our customers, their traffic may be more likely to be blocked or adversely labeled. Additionally, as a VoIP provider, we rely on the FCC to design rules that do not disadvantage our service relative to those of incumbent local exchange carriers and competitive local exchange carriers. Should the FCC decide to do so, it could result in an inferior user experience for Ooma's service, which may negatively impact our business.

The FCC's rules governing the completion of calls to rural areas and related reporting requirements require us, among other things, to monitor the performance of our intermediate providers – telecom companies we use to help complete telephone calls to rural areas and take steps to prevent rural call completion problems that may be caused by our intermediate providers, such as persistent low answer or completion rates, unexplained anomalies in performance, or repeated complaints to the FCC. Under certain circumstances, if our routing choices, meaning the intermediate providers we chose to help us complete calls to rural areas, result in lower quality service, we may be held liable for the actions taken by our intermediate providers. If we cannot comply with these rules, we could be subject to investigation and enforcement action and could be exposed to substantial liability. The FCC also has increased enforcement activity related to completion of calls to rural customers, and we could be subject to substantial fines and to conduct requirements that could increase our costs if we are the subject of an enforcement proceeding and cannot demonstrate calls from our customers to rural customers are completed at a satisfactory rate.

We rely on a variety of marketing techniques in connection with our sales efforts, including telemarketing and email marketing campaigns. We also record certain telephone calls between our customers or potential customers and our sales and service representatives for training and quality assurance purposes. These activities are subject to a variety of state and federal laws such as the Telephone Consumer Protection Act of 1991 (also known as the Federal Do-Not-Call law, or the TCPA), the Telemarketing Sales Rule, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (also known as the CAN-SPAM Act) and various U.S. state laws regarding telemarketing and telephone call recording. The FCC continues to adopt and consider additional rules related to robocalling, robotexting, and autodialing. For example, in December 2023, the FCC adopted a one-to-one consent rule requiring companies to obtain consent from consumers to receive automated or robotic calls or texts only from one specific good or service provider at a time. These laws are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making our compliance efforts more challenging. We cannot be certain our efforts to comply with these laws, rules and regulations will be successful, or, if they are successful, that the cost of such compliance will not be material to our business. Changes to these or similar laws, or to their application or interpretation, or new laws, rules and regulations governing our communication and marketing activities could adversely affect our business. In the event that any of these laws, rules or regulations significantly restrict our business, we may not be able to develop adequate alternative communication and marketing strategies. Further, non-compliance with these laws, rules and regulations carries significant financial penalties and the risk of class action litigation, which would adversely affect our financial performance and significantly harm our reputation and our business.

The FCC is considering, in various proceedings, issues arising from the transition from traditional copper networks to IP networks. The FCC is also considering whether interconnected VoIP services should be treated as telecommunications services, which could subject interconnected VoIP services to additional common carrier regulation. The FCC's efforts may result in additional regulation of IP network and service providers, which may negatively affect our business.

The FCC and a number of states are considering modifications to USF programs, including the manner in which companies, like us, contribute to the federal USF program, and whether certain non-interconnected VoIP providers and broadband providers, among others, should contribute to the USF. If the FCC or certain states modify contribution obligations that continue to increase our contribution burden, we will either need to absorb the increased costs or raise the amount we currently collect from some of our customers to cover these obligations, which would either reduce our profit margins or diminish our price advantage. A number of states require us to contribute funds to state USF programs, while others are actively considering extending their programs to include the services we provide. We currently charge our customers certain fees and other surcharges, which may result in our services becoming less competitive as compared to those provided by others. If our pricing advantage is diminished or eliminated, or if we are required to absorb these increased costs and not pass-through to our customers, our results of operations would be negatively impacted.

In addition to reliability and quality standards, the market acceptance of telephony over broadband IP networks is dependent upon the adoption of industry standards so that products from multiple manufacturers are able to communicate with each other. Our unique hybrid SaaS connectivity platforms rely on communication standards such as SIP, SRTP and network standards such as TCP/IP and UDP to interoperate with other vendors' equipment. There is currently a lack of agreement among industry leaders about which standard should be used for a particular application and about the definition of the standards themselves. We also must comply with certain rules and regulations of the FCC regarding electromagnetic radiation and safety standards established by Underwriters Laboratories ("UL"), as well as similar regulations and standards applicable in other countries. In addition, the market acceptance of POTS replacement products such as Ooma AirDial will depend on compliance with industry standards such as National Fire Protection Association NFPA 72, UL 864 and American Society of Mechanical Engineers ASME A17.1B. As standards evolve, we may be required to modify our existing products or develop and support new versions of our products. We must comply with certain federal, state and local requirements regarding how we interact with our customers, including marketing practices, consumer protection, privacy, and billing issues, the provision of 9-1-1 emergency service and the quality of service we provide to our customers. The failure of our products and services to comply, or delays in compliance, with various existing and evolving standards could delay or interrupt volume production of our VoIP telephony products, subject us to fines or other imposed penalties, or harm the perception and adoption rates of our service, any of which would have a material adverse effect on our business, financial condition or operating results.