High Roller Technologies, Inc. (ROLR) Risk Analysis

We have received formal and informal inquiries from time to time, from government authorities and regulators, and gaming regulators, regarding compliance with laws and other matters, and we may receive such inquiries in the future, particularly as we grow and expand our operations. Violation of existing or future regulations, regulatory orders or consent decrees could subject us to substantial monetary fines and other penalties that could adversely affect our business, financial condition, results of operations and prospects. In addition, it is possible that future orders issued by, or inquiries or enforcement actions initiated by, government or regulatory authorities could cause us to incur substantial costs, expose us to unanticipated liability or penalties, or require us to change our business practices in a manner materially adverse to our business, financial condition, results of operations and prospects.

Our tax obligations are varied and include United States federal, state and international taxes due to the nature of our business. The tax laws that are applicable to our business are subject to interpretation, and significant judgment is required in determining our worldwide provision for income taxes. In the course of our business, there will be many transactions and calculations where the ultimate tax determination is uncertain. For example, compliance with the 2017 United States Tax Cuts and Jobs Act ("TCJA") may require the collection of information not regularly produced within our Company, the use of estimates in our consolidated financial statements, and the exercise of significant judgment in accounting for its provisions. As regulations and guidance evolve with respect to the TCJA, and as we gather more information and perform more analysis, our results may differ from previous estimates and may materially affect our consolidated financial statements. The gaming industry represents a significant source of tax revenue to the jurisdictions in which we operate. Gaming companies and B2B providers in the gaming industry (directly and/or indirectly by way of their commercial relationships with operators) are currently subject to significant taxes and fees in addition to normal corporate income taxes, and such taxes and fees are subject to increase at any time. From time to time, various legislators and other government officials have proposed and adopted changes in tax laws, or in the administration or interpretation of such laws, affecting the gaming industry. In addition, any worsening of economic conditions and the large number of jurisdictions with significant current or projected budget deficits, many of which have been made worse due to COVID-19, could intensify the efforts of governments to raise revenues through increases in gaming taxes and/or other taxes. It is not possible to determine with certainty the likelihood of changes in tax laws or in the administration or interpretation or enforcement of such laws. Any material increase, or the adoption of additional taxes or fees, could have a material adverse effect on our business, financial condition, results of operations and prospects. Additionally, tax authorities may impose indirect taxes on Internet-related commercial activity based on existing statutes and regulations which, in some cases, were established prior to the advent of the Internet. Tax authorities may interpret laws originally enacted for mature industries and apply it to newer industries, such as ours. The application of such laws may be inconsistent from jurisdiction to jurisdiction. Our in-jurisdiction activities may vary from period to period which could result in differences in nexus from period to period. We are subject to periodic review and audit by domestic and foreign tax authorities. Tax authorities may disagree with certain positions we have taken or that we will take, and any adverse outcome of such a review or audit could have a negative effect on our business, financial condition, results of operations and prospects. Although we believe that our tax provisions, positions and estimates are reasonable and appropriate, tax authorities may disagree with certain positions we have taken. In addition, economic and political pressures to increase tax revenue in various jurisdictions may make resolving tax disputes favorably more difficult.

We are, and will increasingly become as we seek to expand our business, subject to numerous domestic and foreign laws, regulations, rules and standards, as well as associated industry standards, policies and contractual or other obligations, relating to the collection, use, storage, safeguarding, retention, security, destruction, disclosure, transfer, and/or other processing of personal data (collectively, "Processing") in the jurisdictions in which we operate (collectively, "Data Protection Requirements"). These Data Protection Requirements often vary significantly by jurisdiction. While we have taken steps to comply with Data Protection Requirements, we cannot assure you that our efforts to achieve and remain in compliance have been and/or will continue to be, fully successful. If we fail, or are perceived to have failed, to address or comply with any such Data Protection Requirements, this could result in enforcement actions against us that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some Processing of personal data or orders to destroy or not use personal data. Further, individuals or other relevant stakeholders could bring a variety of claims against us for our actual or perceived failure to comply with the Data Protection Requirements. Any of these events could have a material adverse effect on our reputation, business, or financial condition, and could lead to a loss of actual or prospective customers, collaborators or partners; result in an inability to Process personal data or to operate in certain jurisdictions; limit our ability to develop or commercialize current or prospective offerings or services; or require us to revise or restructure our operations. For example, the European Union's General Data Protection Regulation ("GDPR") applies to any Processing operations carried out in the context of the activities of an establishment in the EEA, as well as to any other Processing operations relating to the offering of goods or services to individuals in the EEA and/or the monitoring of individuals' behavior in the EEA. Also, notwithstanding the United Kingdom's withdrawal from the EU, by operation of the so called ‘UK GDPR' (i.e., the GDPR as it continues to form part of the law of the United Kingdom by virtue of section 3 of the EU (Withdrawal) Act 2018 and as subsequently amended) ("UK GDPR") the GDPR continues to apply in substantially equivalent form to Processing operations carried out in the context of the activities of an establishment in the United Kingdom and any other Processing relating to the offering of goods or services to individuals in the United Kingdom and/or monitoring of individuals' behavior in the United Kingdom. Consequently, any reference we make to the GDPR also refers to the UK GDPR in the context of the United Kingdom, unless the context indicates otherwise. The GDPR further provides that EEA Member States may introduce specific, supplementary requirements related to the Processing of "special categories of personal data"; as well as personal data related to criminal offences or convictions. In the United Kingdom, the UK Data Protection Act 2018 complements the UK GDPR in this regard. This fact may lead to greater divergence on the law that applies to the Processing of such personal data across the EEA and/or United Kingdom, which may increase our costs and overall compliance risk. The GDPR and such supplementary requirements impose stringent data privacy and security requirements. In particular, the GDPR imposes several requirements relating to ensuring there is a lawful basis for Processing personal data, extends the rights of individuals to whom the personal data relates, materially expands the definition of what is expressly noted to constitute personal data, requires additional disclosures about how personal data is to be used, imposes limitations on retention of personal data, imposes strict rules on the transfer of personal data out of the EEA/UK to most third countries, creates mandatory data breach notification requirements in certain circumstances and establishes onerous new obligations on service providers, or processors, who Process personal data simply on behalf of others. It also significantly increased penalties for noncompliance. Additionally, following the United Kingdom's withdrawal from the European Union on January 31, 2020 and end of the post-Brexit transition period on December 31, 2020, as noted above, the United Kingdom has introduced the UK GDPR which currently makes the privacy regimes of the EEA and United Kingdom similar, though it is possible that either the European Union, and consequently those further states that make up the remainder of the EEA, or United Kingdom could elect to change their approach and create differences in legal requirements and regulation in this area. On June 28, 2021, the European Commission issued an adequacy decision under the GDPR which allows transfers (other than those carried out for the purposes of United Kingdom immigration control) of personal data from the EEA to the United Kingdom to continue without restriction for a period of four years ending June 27, 2025. These decisions were renewed in late 2025 following a review, extending the adequacy status until December 27, 2031. After that period, the adequacy decision may be renewed, however, only if the United Kingdom continues to ensure an adequate level of data protection. During these four years, the European Commission will continue to monitor the legal situation in the United Kingdom and could intervene at any point if the United Kingdom deviates from the level of data protection in place at the time of issuance of the adequacy decision. If the adequacy decision is withdrawn or not renewed, transfers of personal data from the EEA to the United Kingdom will require a valid ‘transfer mechanism' and we may be required to implement new processes and put new agreements in place (such as the then-current form of the European Commission-issued Standard Contractual Clauses), to enable transfers of personal data from the EEA to the United Kingdom to continue. We are also subject to the Data Protection (Bailiwick of Guernsey) Law, 2017 (as amended) (the "Guernsey DP Law"), which largely follows GDPR and requires us to control and process personal data only for proper purposes and in accordance with statutory data protection principles, and the Data Protection Law of Colombia, which requires the consent of the customer to their data being transmitted outside of Colombia. Because our products and services rely on the movement of data across national boundaries, global privacy and data security concerns could result in additional costs and liabilities to us or inhibit sales of our products and/ or services globally. In particular, European data protection laws, such as the GDPR, generally prohibit the transfer of personal data from the EEA, United Kingdom and Switzerland to the United States, and most other countries, known as ‘third countries', in respect of which the European Commission or other relevant regulatory body has not issued a so-called ‘adequacy decision', unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the primary safeguards used for transfers of personal data to the United States was the E.U.-U.S. Privacy Shield framework administered by the U.S. Department of Commerce. On July 16, 2020, the Court of Justice of the European Union, or CJEU, in a decision known as 'Schrems II', invalidated the EU-U.S. Privacy Shield, under which personal data could be transferred from the EEA and the United Kingdom to U.S. entities that had self-certified under the Privacy Shield. To align with the CJEU's decision in respect of the E.U.-U.S. Privacy Shield, on September 8, 2020, the UK government similarly invalidated the use of the EU-U.S. Privacy Shield as a mechanism for lawful personal data transfers from the United Kingdom to the United States under the UK GDPR and the Swiss Federal Data Protection and Information Commissioner announced that the Swiss-U.S. Privacy Shield regime was also inadequate for the purposes of personal data transfers from Switzerland to the U.S. entities who had self-certified under the Swiss Privacy Shield. The CJEU Schrems II decision mentioned above also cast doubt on the ability to use one of the primary alternatives to the E.U.-U.S. Privacy Shield and Swiss-U.S. Privacy Shield, namely, the European Commission's Standard Contractual Clauses, lawfully to transfer personal data to the United States and most other third countries. On June 4, 2021, the European Commission published new versions of the Standard Contractual Clauses. These must be used for all new transfers of personal data from the EEA to third countries starting September 27, 2021, and all existing transfers of personal data from the EEA to third countries relying on the existing versions of the Standard Contractual Clauses must be replaced by December 27, 2022. A transition period set for the adoption of the updated standard clauses ended on December 27, 2022. The implementation of the new Standard Contractual Clauses will necessitate significant contractual overhaul of our data transfer arrangements with partners, sub-processors and vendors. Use of both the existing and the new Standard Contractual Clauses must, following the Schrems II decision, now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional supplementary technical, organizational and/or contractual measures and/or contractual provisions may need to be put in place; however, the nature of these additional measures is currently uncertain. At present, there are few if any viable alternatives to the Privacy Shield and the Standard Contractual Clauses and there remains some uncertainty with respect to the nature and efficacy of such supplementary measures in ensuring an adequate level of protection of personal data. As such, our transfers of personal data to third countries may not comply with European data protection laws and may increase our exposure to the GDPR's heightened sanctions for breaching of its cross-border data protection rule, including fines of up to 4% of annual global revenue or €20 million ($21.2 million), or 4% of annual global revenue of the preceding year, whichever is higher, and injunctions against transfers. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the Standard Contractual Clauses can and cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate and/or engage providers and/or otherwise transfer personal data, it could affect the manner in which we receive and/or provide services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results and generally increase compliance risk. Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of operating our business. In recent years, U.S. and European lawmakers and regulators have expressed concern over electronic marketing and the use of third-party cookies, web beacons and similar technology for online behavioral advertising. On June 20, 2019, the U.K.'s Information Commissioner (the "ICO") published a report setting out its views on advertising technology, specifically the use of personal data in "real time bidding", and the key privacy compliance challenges arising from it. In its report, which is a status update rather than formal guidance, several key deficiencies were noted and marked for formal regulatory action. However, in May 2020, the ICO paused its investigation into real time bidding and the advertising technology industry, as it sought to prioritize activities responding to the COVID-19 pandemic. The ICO's investigation resumed in January 2021. We are likely to be required to expend further capital and other resources to ensure compliance with the findings of the ICO's report on advertising technology, and any relevant changing laws and regulations. While we have numerous mitigation controls in place, advertisements produced by us may be erroneously served on websites that are not suitable for the advertising content of a casino (e.g., websites predominantly aimed at children). There is also a risk that such advertisements are viewed by people who do not want to view them, or who have taken measures not to receive them (for example, individuals on "self-exclusion" lists). In each case this may have adverse legal and reputational effects on our business. In the EU, rules relating to electronic direct marketing are currently set out in the ePrivacy Directive, which is likely to be replaced by a new ePrivacy Regulation. While no official time frame has been given for the ePrivacy Regulation, there will be a transition period after the ePrivacy Regulation is agreed for compliance. As of the date of this Annual Report it is still undergoing legislative processes and has not been officially adopted by the EU. The ePrivacy Regulation will be directly implemented into the laws of each of the EU Member States, without the need for further enactment. When implemented, the ePrivacy Regulation is expected to alter rules on thirdparty cookies, web beacons and similar technology for online behavioral advertising and to impose stricter requirements on companies using these tools. Regulation of cookies and web beacons may lead to broader restrictions on our online activities, including efforts to understand followers' Internet usage and promote ourselves to them. The current draft of the ePrivacy Regulation significantly increases fining powers to the same levels as the GDPR. Given the delay in finalizing the ePrivacy Regulation, certain regulators have issued guidance (including ICO and French data protection regulators) on the requirement to seek strict opt-in, unbundled consent to use all nonessential cookies and similar technologies and the requirement to increase the standard of transparency relating to use of cookies and similar technologies. Our cookie consent management functionality and cookies notices may not meet the standards outlined in such guidance. In the United States, the federal government, including Congress, the Federal Trade Commission and the Department of Commerce, has announced that it is reviewing the need for greater regulation for the collection of information concerning consumer behavior on the internet, including regulation aimed at restricting certain targeted advertising practices. Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination, and security practices that appear to be unfair or deceptive. Numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and processing of state residents' personal data. For example, the California Consumer Privacy Act ("CCPA") took effect on January 1, 2020. The CCPA establishes a new privacy framework for covered businesses such as ours and may require us to modify our data processing practices and policies and incur compliance related costs and expenses. The CCPA provides new and enhanced data privacy rights to California residents, such as affording consumers the right to access and delete their information and to opt out of certain sharing and sales of personal information. The law also prohibits covered businesses from discriminating against consumers (for example, charging more for services) for exercising any of their CCPA rights. The CCPA imposes severe statutory penalties for certain violations of the law as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. It remains unclear how various provisions of the CCPA will be interpreted and enforced. In November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020 ("CPRA"). The CPRA further expands the CCPA with additional data privacy compliance requirements that may impact our business, and establishes a regulatory agency dedicated to enforcing those requirements. The Stop Hacks and Improve Electronic Data Security Act, otherwise known as the SHIELD Act, is a New York State bill, the data protection portions of which became effective on March 23, 2020. The SHIELD Act requires companies to adopt reasonable safeguards to protect the security, confidentiality, and integrity of private information. A company should implement a data security program containing specific measures, including risk assessments, employee training, vendor contracts, and timely data disposal. Laws like the SHIELD Act, the CPRA and the CCPA may lead other states to pass comparable legislation, with potentially greater penalties, and more rigorous compliance requirements relevant to our business. For example, Virginia has enacted the Consumer Data Protection Act and Colorado has enacted the Colorado Privacy Act, each of which may impose obligations similar to or more stringent than those we may face under other data protection laws. Compliance with any newly enacted privacy and data security laws or regulations may be challenging and cost and time-intensive, and we may be required to put in place additional mechanisms to comply with applicable legal requirements. Although we have implemented certain policies and procedures, and continue to review and improve such policies and procedures, that are designed to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail, or are perceived to have failed, to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations and penalties (including potential suspension or loss of licensure), enforcement notices requiring us to change the way we use personal data or our marketing practices or other liabilities such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Fines are significant in some countries (e.g., the GDPR introduced fines of up to €20 million or up to 4% of the total worldwide annual revenue of the preceding financial year, whichever is higher) as well as litigation, compensation claims by affected individuals (including class action type litigation where individuals suffer harm), regulatory investigations and enforcement notices that could require us to change the way we use personal data.