Shutterstock (SSTK) Risk Analysis

As a global technology business, we and our third-party service providers collect and maintain confidential information and personal information about our employees, customers, contributors and other third parties, in connection with marketplace-related processes on our websites and, in particular, in connection with processing and remitting payments to and from our customers and contributors, and we are therefore exposed to security and fraud-related risks, which are likely to become more challenging as we expand our operations. We also rely heavily on our networks, and on the networks of third-party service providers for the secure storage, processing and transmission of confidential and other information and generally to conduct our business. Although we maintain security features on our websites and utilize encryption and authentication technology, our cybersecurity measures may not detect or prevent all attempts, whether intentional or unintentional, to hack our systems, denial-of-service attacks, malware (including viruses and malicious software), break-ins, phishing attacks, ransomware, other social engineering attacks, cybersecurity incidents or other attacks and disruptions that may jeopardize our networks and the security of information stored in and transmitted by our networks and websites. We use third-party service providers, including payment processors and co-location and cloud service vendors for our data centers and application hosting, to operate our business, and their security measures may not prevent cybersecurity incidents and other disruptions that may jeopardize their networks and the security of information stored in and transmitted by their networks. Some of the software and services that we use to operate our business, including our internal e-mail, payment processor and customer relationship management software, are also hosted by third parties. It is possible that our security measures or the security measures of our third-party service providers might be breached due to employee error, inadequate use of cybersecurity controls by customers, contributors or employees, malfeasance, system errors or vulnerabilities, or otherwise. Any such breach or unauthorized access could result in the loss of control of confidential or personal information, disruption to our business operations and significant legal and financial exposure, as well as damage to our reputation, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business. In addition, a significant cybersecurity breach or cyber-attack could result in payment networks prohibiting us from processing transactions on their networks. Although cybersecurity and the continued development and enhancement of the processes, practices and controls that are designed to protect our systems, computers, software, data and networks from attack, damage, disruption or unauthorized access are a high priority for us, because the techniques used to attack, damage, disrupt or obtain unauthorized access are constantly evolving in sophisticated ways to avoid detection, including through the use of emerging technologies, such as AI and machine learning, and often are not recognized until launched against a target, our efforts may not be enough to anticipate or prevent a party from circumventing our security measures, or the security measures of our third-party service providers, and accessing and misusing the confidential or personal information of our employees, customers and contributors and / or our networks. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures could be harmed and we could lose users and customers. We may also be required to expend significant capital and other resources to protect against such cybersecurity incidents to alleviate problems caused by such incidents. While we continually work to safeguard our internal network systems and validate the security of our third-party providers, to mitigate these potential risks, including through information security policies and employee awareness and training, there is no assurance that such actions will be sufficient to prevent cyber-attacks or cybersecurity breaches. Any actual or perceived breach or the perceived threat of an attack or breach, could cause our customers, contributors and other third parties to cease doing business with us, or subject us to lawsuits, regulatory fines, criminal penalties, statutory damages, and other costs, including for provision of breach notices and credit monitoring to our customers, and other action or liability, and could lead to business interruption, any of which could harm our reputation, business, financial condition, results of operations and stock price.

The industry in which we operate is intensely competitive and rapidly evolving, with low barriers to entry. We compete with a wide and diverse array of companies, from significant media companies to newly emerging generative AI technologies to individual content creators. Our current and potential domestic and international competitors range from large established companies to emerging start-ups across different industries, including online marketplace and traditional stock content suppliers of current and archival creative and editorial imagery, photography, footage, and music; specialized visual content companies in specific geographic segments; providers of commercially licensable music; websites specializing in image search, recognition, discovery and consumption; websites that host and store images, art and other related products; providers of free images, photography, music, footage and related tools (including offerings by our partners); social networking and social media services; and commissioned photographers and photography agencies. We believe that the principal competitive factors in the content industry include: quality, relevance and breadth of content; the ability to source new content; content licensing options and the degree to which users are protected from legal risk; the effective use of current and emerging technology; accessibility of content, distribution capability, and speed and ease of search and fulfillment; brand recognition and reputation; customer service; availability of additional platform features, such as workplace tools and ability to engage with additional platform features; the global nature of a company's interfaces and marketing efforts, including local content, languages, currencies, and payment methods; and newly emerging generative AI technologies. If our competitors use their experience and resources to provide an offering that is more attractive to customers across these categories, or if our competitors innovate and provide products faster than we can, we may be unable to compete effectively and our business will be harmed. In addition, new competitors may enter our market, including those that rely on generative AI technologies, and we expect to face more competition as AI continues to advance and be integrated into the markets in which we compete. Our competitors or other third parties may develop AI solutions more rapidly or successfully, including but not limited to different data training strategies or proprietary access to data and, as a result, other AI solutions may achieve greater and faster adoption and deliver content more easily or affordably. For example, we face increasing competition from companies offering generative and agentic AI solutions, including but not limited to prompt-based and multi-modal creation and editing. Many of our competitors have or may obtain significantly greater financial, marketing or other resources or greater brand awareness than we have. Some of these competitors may be able to respond more quickly to new or expanding technology and devote more resources to product development, marketing or content acquisition than we can. This could lead to more variability in operating results and could have a material adverse effect on our business, operating results, and financial condition. While we believe that there are obstacles to creating a meaningful network effect between customers and contributors, the barriers to creating a platform that allows for the licensing of content or provides workflow tools are low. If competitors offer higher royalties or more favorable royalty earning potential, easier submission workflows, or less rigorous vetting processes or incentivize contributors to distribute their content on an exclusive basis, contributors may choose to stop distributing new content with us or remove their existing content from our collection. Further, as technology advances, including AI and generative AI technologies, or other market dynamics make creating, sourcing, archiving, indexing, reviewing, searching or delivering content easier or more affordable, our existing and potential competitors may also seek to develop new products, technologies or capabilities that could render many of the products, services and content types that we offer obsolete or less competitive. For any of these reasons, we may not be able to compete successfully against our current and future competitors. In addition, demand for our products and services is sensitive to price. Many external factors, including our technology and personnel costs and our competitors' pricing and marketing strategies, could significantly impact our pricing strategies and we could fail to meet our customers' pricing expectations. Increased competition and pricing pressures may result in downward pressure on pricing and reduced sales, lower margins, losses or the failure of our product and services to maintain and grow their current market share, any of which could harm our business.

A portion of our enterprise customers typically purchase our products on payment terms, and therefore we assume a credit risk for non-payment in the ordinary course of business. Further, in certain jurisdictions, we contract with third-party resellers that may collect payment from customers and remit such payment to us. Therefore, we are subject to the third-party resellers' ability to collect and remit payment to us. We evaluate the credit-worthiness of new customers and resellers and perform ongoing financial condition evaluations of our existing customers and resellers; however, there can be no assurance that our allowances for uncollected accounts receivable balances will be sufficient. As of December 31, 2025, our allowance for doubtful accounts was $3.4 million. If the volume of sales to enterprise customers grows, we expect to increase our allowance for doubtful accounts primarily as the result of changes in the volume of sales to customers who pay on payment terms or through resellers.

We believe that the brand identity that we have developed has significantly contributed to the success of our products and services and that our ability to attract and retain new customers and contributors depends in large part on our ability to increase our brand awareness. We have and may continue to expend significant resources on advertising, marketing, and other brand-building efforts to preserve and enhance customer and contributor awareness of our brand, products and services. We also have incurred and expect to incur significant costs in developing and marketing new products to obtain user acceptance and we may not be successful in our efforts to increase awareness and market share of these products. Our competitors may be able to achieve and maintain brand awareness and market share more quickly and effectively than we can. Our brand may be adversely affected by a number of factors, including the effectiveness of our marketing campaigns, disruptions in service due to technology, data privacy and security issues, and exploitation of our trademarks and other intellectual property by others without our permission. Maintaining and enhancing our brand will depend largely on our ability to be a leading platform for high-quality content, tools and services for creative professionals and to continue to provide a user experience that anticipates our customers' needs. Additionally, our marketing campaigns or other efforts to increase our brand awareness may not succeed in bringing new visitors to our platform or converting such visitors to paying customers or contributors and may not be cost-effective. It is possible that, as our industry becomes increasingly competitive, maintaining and enhancing our brand may become increasingly difficult and expensive and our efforts may not be successful.

In connection with the Merger Agreement, two complaints were filed against us and each member of our board of directors and we and Getty Images received a number of demand letters alleging that the disclosures contained in the definitive proxy statement we filed with the SEC on April 30, 2025 in connection with the Merger (the "Proxy Statement") were deficient and sought additional disclosures to address those alleged deficiencies. We believe that we have substantial defenses in connection with such matters and that no supplemental disclosure is required under applicable law. However, in order to avoid the risk that the such matters may delay or otherwise adversely affect the implementation of the Merger, to minimize the costs, risks and uncertainties inherent in litigation, and without admitting any liability or wrongdoing, we voluntarily supplemented the Proxy Statement in a Current Report on Form 8-K, filed with the SEC on May 30, 2025, to provide additional information to Shutterstock stockholders We and/or our respective directors and officers may also become subject to lawsuits and additional demand letters or complaints relating to the Merger. Such litigation is very common in connection with acquisitions of public companies, regardless of the merits of the underlying acquisition. While we will evaluate and defend against any actions vigorously, the costs of the defense of such lawsuits and other effects of such litigation could have an adverse effect on our business, financial condition and operating results.

We currently provide content licensing to customers in more than 150 countries and license content from contributors located in over 150 countries. In connection with providing content licensing, we collect, store, process and use our customers' and contributors' personal information and other data, and we rely on third parties that are not directly under our control to do so as well. We also collect, store, process, transmit and use our employees' personal information and other data in connection with their employment. While we take measures intended to protect the security, integrity and confidentiality of the personal information and other sensitive information we collect, store or transmit, we cannot guarantee that inadvertent or unauthorized use or disclosure will not occur, or that third parties will not gain unauthorized access to or misuse this information. There have been a number of reported incidents where third-party service providers or partners have used software to access the personal information of their customers' or partners' customers for marketing and other purposes. Our privacy policies and practices prohibit such activities, but our third-party service providers or partners may nevertheless engage in such activity without our knowledge or consent. If we or our third-party service providers or partners were to experience a cybersecurity incident, data breach or disruption, unauthorized access or failure of systems compromising our customers', contributors' or employees' data, or if one of our third-party service providers or partners were to access our customers' personal information without authorization, our brand and reputation could be adversely affected, use of our products could decrease, we could experience business interruption and we could be exposed to a risk of loss, litigation and regulatory proceedings. Depending on the nature of the information compromised in a cybersecurity incident, data breach or disruption or unauthorized access or failure of systems compromising our customers', contributors' or employees' data, we may also have obligations to notify customers, contributors, employees or governmental bodies about the incident and we may need to provide some form of mitigation and relief for the individuals affected. In addition, ongoing rulemaking and the potential for changes to cybersecurity disclosure rules may subject us to enhanced or uncertain requirements. Complying with these obligations could cause us to incur substantial costs, including compliance, crisis management and remediation costs, and receive negative publicity. While we maintain insurance coverage that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event we experience a cybersecurity incident, data breach, disruption, unauthorized access or failure of systems. Regulatory scrutiny of privacy, data collection, use of data and data protection continues to intensify both within the United States and globally. The personal information and other data we collect, store, process and use is increasingly subject to legislation and regulations in numerous jurisdictions around the world, especially in Europe. These laws often develop in ways we cannot predict and some laws may be in conflict with one another. This may significantly increase our cost of doing business, particularly as we expand our localization efforts. For example, the GDPR imposes stringent operational requirements for controllers and processors of personal data of individuals in the European Economic Area (the "EEA"), and noncompliance can trigger fines of up to the greater of €20 million or 4% of global annual revenues. Further, following the U.K.'s formal exit from the E.U. in January 2020, we became subject to the GDPR as incorporated into U.K. law. Additionally, although we are making use of the E.U. Standard Contractual Clauses with regard to the transfer of certain personal data to countries outside the EEA recent legal developments in Europe have created complexity and regulatory compliance uncertainty regarding certain transfers of personal information from the EEA to the United States. For example, on July 16, 2020, the Court of Justice of the European Union ("CJEU") invalidated the E.U.-U.S. Privacy Shield Framework ("Privacy Shield") under which personal information could be transferred from the E.U. to U.S. entities who had self-certified under the Privacy Shield program. While the CJEU upheld the adequacy of E.U.-specified standard contractual clauses as an adequate mechanism for cross-border transfers of personal data, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances and that their use must be assessed on a case-by-case basis taking into account the surveillance laws in and the right of individuals afforded by, the destination country. The CJEU went on to state that, if the competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer unless the data exporter has already done so itself. To fill the gap left by the invalidation of the Privacy Shield, the U.S. and EU agreed on a legal framework in October 2022 for transferring personal information from the EU to the U.S. ("EU-U.S. Data Privacy Framework"). In July 2023, the European Commission issued an adequacy decision on the EU-U.S. Data Privacy Framework which replaced the Privacy Shield. An entity seeking to transfer personal information under the EU-U.S. Data Privacy Framework must first self-certify to the U.S. Department of Commerce that it complies with the EU-U.S. Data Privacy Framework Principles. The protections afford transfers of personal information under the EU-U.S. Data Privacy Framework was also extended to transfers between the U.S. and U.K. in October 2023. We rely on a mixture of mechanisms to transfer personal information from our E.U. business to the U.S. (having previously relied on the Privacy Shield) and are evaluating what additional mechanisms may be required to establish adequate safeguards for personal information. As supervisory authorities issue further guidance on personal information export mechanisms, including circumstances where the standard contractual clauses cannot be used and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines. Moreover, if we are otherwise unable to transfer personal information between and among countries and regions in which we operate, it could affect the manner in which we provide our services and could adversely affect our financial results. Several other foreign jurisdictions have adopted or are considering adopting new or updated comprehensive privacy legislation to offer additional data privacy protections for individuals. For example, in Brazil, the General Data Privacy Law, which was signed into law in August 2018 and was subject to enforcement beginning in August 2021, imposes detailed rules for the collection, use, processing and storage of personal information. Similarly, on August 9, 2023, India passed an information protection law that will establish how entities can handle personal information and the rights individuals have over their personal information. Further, data privacy laws have been enacted in a number of jurisdictions, including, but not limited to, the European Union, Illinois, Texas and California, which regulate the collection of certain biometric data regarding individuals, including their facial images, and the use of such data, including in facial recognition systems. State governments as well as private and class plaintiffs have successfully asserted claims in settled litigation relating to the processing and storage of photographs under biometric privacy laws. Similar laws have also been introduced in several additional states. We have entered into certain contractual agreements that may implicate or make use of such technology. Such laws may have the effect of adversely impacting our ability to grow our business in that area. Although we are closely monitoring regulatory developments in this area, any actual or perceived failure by us to comply with any regulatory requirements or orders or other domestic or international privacy or consumer protection-related laws and regulations could result in proceedings or actions against us by governmental entities or others (e.g., class action litigation), subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs and adversely affect our business. Data protection legislation is also becoming increasingly common in the United States at both the federal and state level. For example, in June 2018, the State of California enacted the California Consumer Privacy Act ("CCPA"), which came into effect on January 1, 2020. The CCPA requires, among other things, companies that collect personal information about California residents to make new disclosures to those residents about their data collection, use and sharing practices, allows residents to exercise certain rights regarding their personal information (including the right to opt out of certain data sharing with third parties), and provides a private right of action for data breaches. In addition, the California Privacy Rights Act ("CPRA"), which came into effect on January 1, 2023 (with a look back to January 2022), amends and expands the CCPA to add additional disclosure obligations (including an obligation to disclose retention periods or criteria for categories of personal information), grant consumers additional rights (including rights to correct their data, limit the use and disclosure of sensitive personal information, and opt out of the sharing of personal information for certain targeted behavioral advertising purposes), and establishes a privacy enforcement agency known as the California Privacy Protection Agency ("CPPA"). The CPPA will serve as California's chief privacy regulator, which will likely result in greater regulatory activity and enforcement in the privacy area. Additional comprehensive data privacy laws have become effective in Colorado, Utah, Virginia, Connecticut, Florida, Oregon, Montana, and Texas. In 2025 and 2026, data privacy laws in Delaware, Iowa, New Jersey, Tennessee, Indiana, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, and Rhode Island will take effect, creating an evolving climate for data privacy compliance obligations and risks. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data. The scope and interpretation of data privacy and cybersecurity regulations continues to evolve, and we believe that the adoption of increasingly restrictive regulations in this area is likely in the near future within the U.S. at both state and federal levels. The burdens imposed by the CCPA, the CPRA and other similar laws that may be enacted at the federal and state level may require us to modify our data processing practices and policies and to incur substantial costs in order to investigate, comply and defend against potential private class-action litigation. Further, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed and stored only within that country. Russia adopted such a law in 2014, and, in 2018, India introduced a bill, which was updated in December 2019, requiring local storage of certain personal information of Indian data principals. Such data localization requirements may have cost implications for us, impact our ability to utilize the efficiencies and value of our global network, and could affect our strategy. Further, if other countries in which we have customers were to adopt data localization laws, we could be required to expand our data storage facilities there or build new ones in order to comply. The expenditure this would require, as well as costs of ongoing compliance, could harm our financial condition.

We rely on independent third parties to provide certain services for our Company. The state of the law regarding independent contractor status varies from jurisdiction to jurisdiction and is subject to change based on court decisions and regulation. For example, on April 30, 2018, the California Supreme Court adopted a new standard for determining whether a company "employs" or is the "employer" for purposes of the California Wage Orders in its decision in the Dynamex Operations West, Inc. v. Superior Court case. This standard was expanded and codified in California via Assembly Bill 5, effective as of January 1, 2020. The Dynamex decision and Assembly Bill 5 altered the analysis of whether an individual, who is classified by a hiring entity as an independent contractor in California, has been properly classified as an independent contractor. In addition, independent workers have been the subject of widespread national discussion and it is possible that other jurisdictions may enact laws similar to Assembly Bill 5 or that otherwise impact our business and our relationships with independent third parties. As a result, there is significant uncertainty regarding the future of the worker classification regulatory landscape. From time to time, we may be involved in lawsuits and claims that assert that certain independent contractors should be classified as our employees. Adverse determinations regarding the status of any of our independent contractors could, among other things, entitle such individuals to the reimbursement of certain expenses and to the benefit of wage-and-hour laws, and could result in the Company being liable for income taxes, employment, social security, and withholding taxes and benefits for such individuals. Any such adverse determination could result in a material reduction of the number of subcontractors we can use for our business or significantly increase our costs to serve our customers, which could adversely affect our business, financial condition and results of operations.

Global economic, political and social conditions can affect the business of our customers and the markets they serve, as well as disrupt the business of our vendors, third-party resellers and strategic partners. Numerous external forces beyond our control, including generally weak or uncertain economic conditions, negative or uncertain political climates, changes in government and election results in the United States and other jurisdictions in which we operate and global health epidemics, could adversely affect our financial condition. Particularly, our financial condition is affected by worldwide economic conditions and their impact on advertising spending. Expenditures by advertisers generally tend to reflect overall economic conditions, and to the extent that the economy stagnates as a result of macro conditions, companies may reduce their spending on advertising and marketing, and thus the use of our platform. This could have a serious adverse impact on our business. To the extent that overall economic conditions reduce spending on advertising and marketing activities, our ability to retain current and obtain new customers could be hindered, which could reduce our revenue and negatively impact our business. In addition, if we are unable to successfully anticipate changing economic, political and social conditions, we may be unable to effectively plan for and respond to those changes and our business could be negatively affected. Further, economic, political and social macro developments in the United States, Europe, and Asia could negatively affect our ability to conduct business in those territories. Financial difficulties experienced by our customers, third-party resellers, vendors and strategic partners due to economic volatility or unfavorable changes could result in these companies scaling back operations, exiting businesses, merging with other businesses or filing for bankruptcy protection and potentially ceasing operations, all of which could adversely affect our business, financial condition and results of operations.

Revenues derived from customers outside of the United States comprise a significant portion of our revenues and we seek to expand our international operations to attract customers and contributors in countries other than the United States as a critical element of our business strategy. For each of the years ended December 31, 2025, 2024 and 2023, approximately 59%, 55% and 54%, respectively, of our revenue was derived from customers located outside of the United States. Our ability to expand our business and attract talented employees, as well as customers and contributors, in an increasing number of international markets requires considerable management attention and resources and is subject to the challenges of supporting a growing business in an environment of multiple languages, cultures, customs, legal systems, alternative dispute systems, regulatory systems and commercial infrastructures. If we fail to deploy, manage or oversee our international operations successfully, our business may suffer. Our international presence exposes us to additional risks, including risks associated with: - modifying our technology and marketing and localizing our offerings for customers' and contributors' preferences, customs and language;- legal, political or systemic restrictions on the ability of U.S. companies to do business in foreign countries, including, among others, restrictions imposed by the U.S. Office of Foreign Assets Control ("OFAC") on the ability of U.S. companies to do business in certain specified foreign countries or with certain specified organizations and individuals;- compliance with the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act and similar laws in other jurisdictions;- compliance with foreign laws and regulations, including with respect to disclosure requirements, privacy, consumer and data protection, marketing restrictions, human rights, rights of publicity, intellectual property, technology and content;- government regulation of e-commerce and other services and restrictive governmental actions on the distribution of content, such as filtering or removal of content;- disturbances in a specific country's or region's political, economic or military conditions, including potential sanctions (e.g., civil, political and economic conditions in markets including but not limited to Russia, Ukraine and the Crimean peninsula);- lower levels of consumer spending in foreign countries or lack of adoption of the internet as a medium of commerce;- longer payment cycles in some countries, increased credit risk, and higher levels of payment fraud;- reduced protection for our or our contributors' intellectual property rights in certain countries;- laws that grant rights that may conflict with our business operations;- enhanced difficulties of integrating any foreign acquisitions;- difficulty in staffing, developing, managing and overseeing foreign operations as a result of travel distance, language and cultural differences as well as infrastructure, human resources and legal compliance costs;- difficulty enforcing contractual rights in our license agreements;- potential adverse global tax consequences, especially those that may result from the expected proactive global development of greater efforts to identify, capture and subject to income and transactional tax, e-commerce revenue earned solely via the internet;- currency exchange fluctuations, hyperinflation, or devaluation;- strains on our financial and other systems to properly comply with, and administer, VAT, withholdings, sales and other taxes; and - higher costs associated with doing business internationally. These risks may make it impossible or prohibitively expensive to expand to new international markets, delay entry into such markets, or require us to enter into commercial arrangements with local partners, all of which may affect our ability to grow our business. As international e-commerce and other online and web services grow, competition is expected to intensify and local companies may have a substantial competitive advantage because of their greater understanding of, and focus on, the local customer. If we do not effectively enter new international markets, our competitive advantage may be harmed.

As of December 31, 2025, we had operations based in a number of territories outside of the United States and a significant portion of our business may be transacted in currencies other than the U.S. dollar, including the euro, the British pound, the Australian dollar and the Japanese yen. Because our financial results are reported in U.S. dollars, fluctuations in the value of the euro, British pound, Australian dollar, Japanese yen and other currencies against the U.S. dollar have had and will continue to have a significant effect on our reported financial results. Exchange rates have been volatile in recent years and such volatility may persist due to economic and political circumstances. A decline in the value of any of the foreign currencies in which we receive revenues, including the euro, British pound, Australian dollar and Japanese yen, against the U.S. dollar will tend to reduce our reported revenues and expenses, while an increase in the value of any such foreign currencies against the U.S. dollar will tend to increase our reported revenues and expenses. Variations in exchange rates can significantly affect the comparability of our financial results between financial periods. As we further expand our international operations, our exposure to foreign exchange risk will increase. At this time, we do not, but we may in the future, enter into derivatives or other financial instruments in order to hedge our foreign currency exchange risk. It is difficult to predict the impact hedging activities would have on our results of operations and any future actions we may take with respect to hedging our foreign currency exchange risk may be unsuccessful.