Trupanion (TRUP) Risk Analysis

Existing laws and regulations impose limits on, for instance, our ability to enact price increases for our products. New laws may be adopted that could further affect our business, for example our ability to affect rate increases, to cancel or not issue existing policies, to use artificial intelligence or machine learning, or to market our products in various ways. Implementing changes in order to comply with new laws or regulations could also be time-consuming and costly.

We maintain three segregated accounts in accordance with Bermuda laws with Wyndham Insurance Company (SAC) Limited ("WICL"). One account, which we call WICL segregated account AX, has entered into a reinsurance agreement with our Canada insurance partner. The second account, WICL Segregated Account Trupanion Germany, has entered into a reinsurance agreement with our German insurance partner. The third account, WICL Segregated Account Switzerland has entered into a reinsurance agreement with our Swiss insurance partner. WICL is a class 3 insurer regulated by the Bermuda Monetary Authority ("BMA"). WICL's ability to continue operations and pay dividends could impact the ability of our segregated accounts to do the same. WICL's failure to meet regulatory requirements set forth by the BMA could result in our inability to transact business through our WICL segregated accounts. Further, WICL could be limited from allowing dividends to be paid out of any of our segregated accounts in the event of adverse regulatory actions.

Many laws governing general commerce on the Internet remain unsettled and it may take years to fully determine whether and how existing laws such as those governing insurance, intellectual property, privacy and taxation apply to the Internet. In addition, the growth and development of the market for electronic commerce and Internet-related advertisements and transactions may prompt calls for more stringent consumer protection laws that may impose additional burdens on companies conducting business and selling subscriptions over the Internet. Any new laws or regulations or new interpretations of existing laws or regulations relating to the Internet could harm our business and we could be forced to incur substantial costs in order to comply with them, which would harm our business, operating results and financial condition. Additionally, we use phone solicitation, email, and texting to market our services to potential members and/or as a means of communicating with our existing members. The laws and regulations governing the use of phone solicitation, email, and texting continue to evolve, and the growth and development of the market for commerce over the Internet may lead to the adoption of additional legislation. Failure to comply with existing or new laws regarding phone solicitation, text or electronic communications with members could lead to significant damages. We have incurred, and will continue to incur, expenses in our efforts to comply with electronic messaging laws. If new laws or regulations are adopted, or existing laws and regulations are interpreted, to impose additional restrictions on our ability to send email to our members or potential members, we may not be able to communicate with them in a cost-effective manner. In addition to legal restrictions on the use of email for commercial purposes, Internet and email service providers and others attempt to block the transmission of unsolicited email, commonly known as "spam." Many service providers have relationships with organizations whose purpose it is to detect and notify the Internet and email service providers of entities that the organization believes are sending unsolicited email. If an Internet or email service provider identifies messaging and email from us as "spam" as a result of reports from these organizations or otherwise, we could be placed on a restricted list that will block our emails to members or potential members. If we are restricted or unable to communicate by phone, text or email with our members and potential members as a result of legislation, blockage or otherwise, our business, operating results and financial condition would be harmed.

Insurance regulations generally require that each individual who sells, solicits or negotiates insurance on our behalf must maintain a valid license in the jurisdiction in which the activity occurs. Regulations also generally prohibit paying an insurance commission to an unlicensed person or entity. Regulations may also require certain individuals who process claims to be licensed. These requirements are subject to a variety of interpretations between jurisdictions. We may not interpret and apply the requirements in the same manner as all applicable regulators, and, even if we have, the requirements or regulatory interpretations of those requirements may change. Regulators have in the past and/or may in the future determine that certain of our personnel or third parties were performing licensable activities without the required license. If such persons were not in fact licensed in any such jurisdiction, we could become subject to conviction for an offense or the imposition of an administrative penalty, and liable for significant penalties. Regulators may also deem payments we make to an unlicensed entity or person to be improper. We would also likely be required to modify our business practices and/or pet acquisition programs, or license the affected individuals, which may be impractical or costly and time-consuming to implement. Any modification of our business or marketing practices in response to regulatory licensing requirements could harm our business, operating results or financial condition.

We believe member satisfaction and retention depends in part on our ability to accurately evaluate and pay veterinary invoices in a timely manner. Many factors can affect our ability to do this, including the training, experience and skill of our personnel, our ability to reduce the number of payment requests made for services not included in our subscription, effectiveness of management, our ability to develop or select and implement appropriate procedures, supporting technologies and systems, changes in our policy and veterinarian compliance with our protocols and procedures. Our failure to pay veterinary invoices, accurately and in a timely manner, or to deploy resources appropriately, could result in unanticipated costs to us, lead to material litigation, undermine member goodwill and our reputation, and impair our brand image and, as a result, materially and adversely affect our competitiveness, financial results, prospects and liquidity. In addition, we automate the payment of veterinary invoices using machine learning. Although we intend to increase the percentage of veterinary invoices paid without human intervention and process veterinary invoices in seconds, our efforts may be unsuccessful for a number of reasons. The data we gather is extensive, and the development, maintenance and operation of our data analytics engine is novel, expensive and complex. We may face unforeseen difficulties, including material performance problems, undetected defects or technical obstacles, for example, with new capabilities incorporating machine learning. If such problems, defects, or obstacles prevent our proprietary algorithms from operating properly, we may incorrectly pay or deny claims made by our customers. Such errors could result in existing members canceling their policies, prospective members declining to purchase our subscription, or improper payments that reduce our resources. Additionally, our artificial intelligence and machine learning algorithms may lead to unintentional bias or discrimination, which could subject us to legal or regulatory liability that has a material and adverse effect on our business, results of operations and financial condition. State legislatures and insurance regulators have shown interest in insurance companies' use of external data and artificial intelligence in insurance practices, including underwriting, marketing, communicating with customers and prospects, and claims practices. The NAIC has adopted Artificial Intelligence Principles. In addition, a number of states have had legislative or regulatory initiatives relating to the use of external data and artificial intelligence in the insurance industry, such as bulletins issued by the California and Connecticut Departments of Insurance advising insurers of their obligations related to unfair discrimination when using data and artificial intelligence. There is also increasing focus on regulating the use of artificial intelligence and machine learning in Europe such as the proposal by the European Commission for regulation on artificial intelligence using a comprehensive risk-based governance framework. Increased focus on regulation in the United States and foreign jurisdictions could subject us to legal or regulatory liability that has a material and adverse effect on our business, results of operations and financial condition.

Although we have transitioned most of our Canadian policies to GPIC, our wholly-owned subsidiary, a portion of our business is still written through Accelerant. Under our arrangement with Accelerant, we have assumed all premiums written by Accelerant and the related veterinary invoice expense through an agency agreement and a fronting and administration agreement. GPIC has limited operating history, and as it continues underwriting policies, we will face risks and uncertainties similar to those faced by our United States insurance company APIC. As a relatively new underwriting entity, GPIC may face undue scrutiny from regulators, which may affect its financial position and may require a disproportionate amount of internal administrative resources. With respect to the continued transition itself, we may encounter regulatory delay and challenges, face operational and information technology issues that are new to us, and create confusion for our members. In addition, we may be required to contribute more risk-based capital into GPIC, potentially over a short time frame as our underwritten premiums grow at a rapid pace.

We own our headquarters office building in Seattle, Washington, and lease a portion of the building to third parties. Our financial condition and cash flow could be materially affected by changes in costs associated with maintaining the building and ensuring it is suitable for our use and that of other tenants and maintain compliance with all environmental and other regulations applicable to ownership of real estate. Failure to attract and retain tenants for our unused space will result in our not receiving rental income and could also cause a reduction in the value of the building. Managing tenants, maintaining the building, and otherwise facing the costs and responsibilities of being the owner of a building may be a distraction from our core business and cause our performance to suffer. We are also exposed to potential third-party liability as the owner of our office building, such as if an accident occurs on the premises.

We currently have insurance subsidiaries in the U.S. and Canada. Our two primary insurance subsidiaries in the U.S. are APIC, domiciled in New York, and ZPIC, domiciled in Missouri. In Canada, our wholly-owned insurance subsidiary, GPIC, underwrites most of our Canadian business. Over time, we may also seek to acquire or establish other insurance subsidiaries, including to support our operations in certain countries in Continental Europe. Acquisitions and operations of these insurers present a number of risks, including the following: - Acquiring or forming a new insurance subsidiary may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable opportunities, whether or not the acquisition or formation is completed. - Even if we are successful in forming or acquiring a new insurance subsidiary we may not achieve the anticipated benefits. We may incur additional costs if we decide to sell or dissolve any such subsidiary. - Each insurance entity will likely require a significant initial minimum capital contribution. It may take a longer period of time to achieve efficiency on these contributions, if ever. - Each insurance entity will be subject to additional regulatory scrutiny in the jurisdiction of incorporation and any additional jurisdictions in which the insurance subsidiary operates. Failure to comply with laws, regulations and guidelines applicable to a new insurance subsidiary could result in significant liability, result in the loss of revenue and otherwise harm our business, operating results and financial condition. - A supervisory regulator may increase the amount of capital we must hold in an insurance subsidiary, especially if it shows material growth. We may not have easy access to such capital, and using it for this purpose may prevent us from investing in our growth and operations, which may require us to modify our operating plan, delay new initiatives, interfere with personnel growth, incur indebtedness or pursue financings, or otherwise modify our operations, any of which could have a material adverse effect on our operating results and financial condition. - If the required minimum capital in one of our insurers falls below the required threshold, the responsible regulator may take action, or such a reduction may result in a breach of various contractual relationships, including, for example, with the unaffiliated general agents for which we write medical insurance for pets policies, which may give such parties the ability to cancel their contracts with us and/or sue us for damages related to our risk-based capital levels, which could have a material adverse effect on our financial condition. - We may not obtain required regulatory approvals in connection with potentially investing a portion of an insurer's assets, for example in real property.

Our business depends on our ability to maintain and scale the infrastructure necessary to operate our technology platform, which includes our analytics and pricing engine, systems for managing veterinary invoice payments, customer relationship management system, billing system, contact center phone system and website. We use these technology frameworks to price our subscriptions, provide quotes to prospective members, enroll members, engage with current members and pay veterinary invoices. Prospective members research and purchase subscriptions through our website and contact center. Our reputation and ability to acquire, retain and serve our members and support our partners depends on the reliable performance of our technology platform and the underlying network systems and infrastructure, and on providing best-in-class member service, including through our contact center and website. As our member base continues to grow, the amount of information collected and stored on the systems and infrastructure supporting our technology platform will continue to grow, and we expect to require an increasing amount of network capacity, computing power and information technology personnel to develop and maintain our technology platform and service our departments involved in member interaction and comply with regulations governing the collection, use, retention, sharing and security of personal information. We have made, and expect to continue to make, substantial investments in equipment and related network infrastructure to handle the operational demands on our technology platform, including increasing data collection, software development, traffic on our website and the volume of calls at our contact center. The operation of the systems and infrastructure supporting our technology platform is expensive and complex and could experience operational failures. In the event that our data collection, member base or amount of traffic on these systems grows more quickly than anticipated, we may be required to incur significant additional costs to increase the capacity in our systems. Further, our development and implementation activities may not be successful, may not be well-received by veterinarians or by prospective or existing members, particularly if they are costly, cumbersome or unreliable, and we may incur delays or cost overruns or elect to curtail our currently planned expenditures related to them. Even if our system improvements are well-received, they may be or become obsolete due to regulatory or technological reasons or the availability of alternative solutions in the marketplace. If new solutions and enhancements are not successful on a long-term basis or we are required to maintain legacy systems longer than anticipated, we may not realize benefits from these investments, and our business and financial condition could be adversely affected. In addition, any system failure that causes an interruption in or decreases the responsiveness of our services could impair our revenue-generating capabilities, harm our business and operating results and damage our reputation. Any loss or mishandling of data could result in breach of confidence, competitive disadvantage or loss of members, and subject us to potential liability or regulatory action. Any failure of the systems and infrastructure that we rely on could negatively impact our enrollments as well as our relationship with members. If we do not maintain or expand the systems and infrastructure underlying our technology platform successfully, or if we experience operational failures, including those that may impact our proprietary direct pay software, our reputation could be harmed and we could lose current and potential members, which could harm our operating results and financial condition. Computer viruses, hackers, employee misconduct, and other external hazards could expose our technology platforms to security breaches, cyber-attacks or other disruptions. While we have implemented security measures designed to protect against breaches of security and other interference with our systems and networks, our systems and networks may be subject to breaches or interference and we, and our third-party service providers, will likely continue to experience cybersecurity incidents of varying degrees. Any such event may result in operational disruptions as well as unauthorized access to, the disclosure of, or loss of our proprietary information or our customers' data and information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the incurrence of costs to eliminate or mitigate further exposure, the loss of customers or affiliated advisors, or other damage to our business. In addition, the trend toward general public notification of such incidents could exacerbate the harm to our business, financial condition and results of operations. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive data, we could suffer harm to our business and reputation if attempted security breaches are publicized. We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology or other security measures protecting the networks and systems used in connection with our business. Third parties to whom we outsource certain of our functions are also subject to these risks. While we can review and assess our third-party providers' cybersecurity controls, as appropriate, and make changes to our business processes to manage these risks, we cannot ensure that our attempts to keep such information confidential will always be successful. Moreover, our use of third-party services (e.g. cloud technology and software as a service) can make it more difficult to identify and respond to cyberattacks in any of the above situations due to the dynamic nature of these technologies and because we do not directly control these services.