Marriott Vacations Worldwide Corporation (VAC) Risk Analysis

We rely on various third parties, including suppliers, service providers, and business partners, to fulfill contractual obligations that are critical to our operations. For example, we have outsourced certain corporate functions, including a significant portion of our global technology, finance and accounting, and human resources functions to third-party service providers and shared service centers. While these actions are intended to streamline operations and improve scalability, at times they have resulted in disruptions, increased transition costs, delays in service delivery and disputes with vendors and we may experience similar or more severe issues in the future. Additionally, such initiatives may lead to the loss of institutional knowledge, reduced employee morale, or increased attrition, including among key personnel. We may increase our reliance on third-party providers to deliver critical services and any failure by these providers to perform their contractual obligations, or any disruption in our ability to manage or transition these services effectively, could adversely affect our internal controls, compliance functions, or overall business operations. Furthermore, these initiatives may expose us to additional risks, including data security vulnerabilities, regulatory compliance challenges across jurisdictions and reputational harm. If we are unable to successfully execute and manage these third-party relationships, our financial condition, results of operations, internal controls over financial reporting and stock price could be materially and adversely affected.

Our international operations expose us to a number of additional risks, any of which could negatively impact our results of operations or disrupt our business, such as: compliance with laws of non-U.S. jurisdictions, including foreign ownership restrictions, import and export controls, data privacy and usage, and trade restrictions, and U.S. laws affecting our activities outside of the U.S.; anti-American sentiment; war, political or civil unrest and terrorism; difficulties of managing operations in many different countries; local economic risks; foreign currency exchange risks; and uncertainty as to the enforceability of contract and intellectual property rights under local laws, which can change or be interpreted in ways that could negatively impact our business.

Our exchange network's transaction levels depend on the supply of inventory in the system and demand for the available inventory. Exchange inventory is deposited in the system by members, or by developers on behalf of members, to support current or anticipated exchanges. Inventory supply and demand for specific regions and on a broader scope are influenced by a variety of factors, such as: economic conditions; health and safety concerns, including concerns and travel restrictions relating to Health Crises such as the COVID-19 pandemic; the occurrence or threat of natural disasters and severe weather; and owner decisions to travel to their home resort/vacation club system or otherwise not deposit exchange inventory. The factors that affect demand for specific destinations could significantly reduce the number of accommodations available in such areas for exchanges. The level of inventory in our system also depends on the number of developers whose resorts are in our exchange network, and the numbers of members of such resorts. The number of developers affiliated with our exchange network may decrease for a variety of reasons, such as consolidation and contraction in the industry and competition. If inventory supply and demand do not keep pace, transactions may decrease or we may purchase additional inventory to fulfill the demand, both of which could negatively affect our results of operations.

Sales of VOIs by existing owners, which are typically at lower prices than the prices at which we would sell interests, can create pricing pressure on our sale of vacation ownership products and cause our sales revenues, margins and results of operations to decline. In addition, unlawful or deceptive third-party VOI resale schemes involving interests in our resorts could damage our reputation and brand value and adversely impact our sales revenues and results of operations. Development of a more robust secondary market may also cause the volume of lower-cost VOI inventory that we are able to repurchase to supplement our inventory needs to decline, which could adversely impact our development margin.

Our project development activities entail risks that may cause project delays or increased project costs and therefore may adversely impact our results of operations, cash flows and financial condition. These risks include construction delays or cost overruns; shortages of skilled labor; claims for construction defects, including claims by purchasers and owners' associations; the discovery of hazardous or toxic substances, or other environmental, culturally-sensitive, or related issues; an inability to timely obtain required governmental permits and authorizations; compliance with zoning, building codes and other local regulations; performance by third parties involved in the financing and development of our projects; the cost or availability of raw materials; and interference of weather-related, geological or other events, such as hurricanes, earthquakes, floods, tsunamis, fires, and volcanic eruptions.

Our success depends, in part, on our relationships with Marriott International and Hyatt. These relationships are governed by various agreements, including long-term license agreements that expire between 2090 and 2095, subject to renewal. However, if we breach our obligations under a license agreement and fail to cure such breach, or if our properties do not meet brand standards, the applicable licensor may be entitled to terminate the license agreement and our rights to use its brands and trademarks at the subject properties. The termination of our license agreements with Marriott International, Hyatt or their affiliates could materially harm our business and results of operations and materially impair our ability to market and sell our products and maintain our competitive position, and could have a material adverse effect on our financial position, results of operations or cash flows. Our inability to rely on the strength of the Marriott, Sheraton, Westin, or Hyatt brands to attract qualified prospects in the marketplace would likely cause our results of operations to decline and our marketing and sales expenses to increase. Our inability to market to guests in hotels affiliated with our licensors that are located near one of our sales locations or maintain our marketing relationships with Marriott International or Hyatt reservation centers would likely cause our sales to decline, which could adversely affect our financial condition and results of operations. In addition, we would not be able to use the brand websites as channels through which to rent available inventory, which could cause our rental revenue to decline materially. Our license agreements also allow us to market directly to members of the customer loyalty programs associated with the Marriott, Sheraton, Westin and Hyatt brands, and offer points in such loyalty programs as premiums for related promotional offers. The termination of the license agreements with Marriott International or Hyatt would eliminate this valuable marketing channel. We must obtain the applicable licensor's consent to use its trademarks in connection with properties we acquire or develop in the future. If our licensors do not consent to such use, our ability to expand our business and remain competitive may be materially adversely affected.

We collect large volumes of data, including social security numbers and other personally identifiable information of our customers and employees, and retain it in our information systems and those of our service providers. It is critical that we maintain the integrity of and protect this data, which we rely on to make business decisions and which our customers and employees expect that we will protect. We may have to expend significant capital and other resources to enhance the security of our data. Our information systems and records, including those we maintain with our service providers or licensors, may be subject to security breaches, cyber-attack or cyber-intrusion, system failures, viruses, malicious software, operator error or inadvertent releases of data, or other cybersecurity incidents. Data breaches have increased in recent years as the number, intensity and sophistication of attacks increased. Techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, may be difficult to detect and could be enhanced by artificial intelligence ("AI"). Neither we nor our service providers may be able to prevent, detect and contain unauthorized activity and misuse or human errors compromising the efficacy of security measures. A breach in the security of our information systems or those of our service providers or licensors could lead to interruptions in the operation of our systems, resulting in operational inefficiencies and a negative impact to our results of operations. A significant cybersecurity incident or theft, loss, disclosure, or fraudulent use of our customer, employee or company data could adversely impact our reputation and result in remedial and other expenses, fines, penalties or litigation, any of which may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. The regulatory environment in the jurisdictions where we operate, and the requirements imposed on us by the payment card industry regarding information, security and privacy, are increasingly demanding. Many of the laws applicable to us in different jurisdictions vary from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Our efforts to comply with these requirements may require significant additional resources and time and may not be successful. We and the companies we work with have experienced cybersecurity threats to our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. We have experienced cybersecurity incidents in the past, and have previously disclosed those with material operational or financial implications to the Company or our stakeholders. Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. The failure of any such service providers or products to comply with our privacy policies or privacy laws and regulations, or any unauthorized release of personally identifiable information or other user data, could damage our reputation, discourage potential users from trying our products and services, breach certain agreements under which we have obligations with respect to network security, and result in fines and proceedings against us. Our insurance might not be sufficient in type or amount to cover us against such claims or losses. Any of the foregoing could materially adversely affect our business, financial condition and results of operations.

We are subject to a wide variety of highly complex international, national, federal, state, and local laws, regulations and policies. The vacation ownership industry is subject to extensive regulation around the world. Each jurisdiction where we operate generally requires resort developers to follow a set of specific procedures to develop, market and sell VOIs. Our real estate development activities, marketing and sales activities, lending activities and resort management activities are also heavily regulated. In addition, a myriad of laws, regulations and policies impact multiple areas of our business, such as those regulating the sale and offer of securities, anti-discrimination, anti-fraud, environmental and social matters, data protection, anti-corruption and bribery or implementing government economic sanctions. Complying with the intricate and multifaceted regulatory structures applicable to our businesses across the globe is complicated, constantly evolving, time-consuming and costly. We may not be able to successfully comply with all laws, regulations and policies. Laws, regulations, policies, and case law precedent may change or be subject to different interpretation in the future, including in ways that could decrease demand for our products and services, increase costs, and subject us to additional liabilities. Failure to comply could have a material adverse effect on our business. For example, we could lose licenses or registrations required to operate our business, sales contracts for our products could be void or voidable, we may incur fines or other sanctions, and our exposure to litigation may increase. Allegations of our failure to comply with applicable laws could adversely affect our business, financial condition, and reputation.

Changes in tax and other revenue raising laws, regulations and policies in the jurisdictions where we do business could impose new restrictions, costs or prohibitions on our practices and negatively impact our results of operations. In addition, interpretation of tax regulations requires us to exercise our judgment and taxing authorities or our independent registered public accounting firm may reach conclusions about the application of such regulations that differ from our conclusions. Our effective tax rate reflects the fact that income earned and reinvested outside the U.S. is generally taxed at local rates that can be higher or lower than U.S. tax rates or based on a different tax base than U.S. jurisdictions, as well as our ability to carry forward losses in certain jurisdictions from prior years to offset future profits. Changes to U.S. or international tax laws, regulations or interpretations could impact the tax treatment of our earnings and adversely affect our cash flows and financial results. For example, if such changes significantly increase the tax rates on non-U.S. income, our effective tax rate could increase, our financial results and cash flows could be negatively impacted, and if such increases were a result of our status as a U.S. corporation, we could be placed at a disadvantage to our non-U.S. competitors that are subject to lower local tax rates. We are subject to audit in various jurisdictions, and these jurisdictions may assess additional taxes against us. Developments in an audit, litigation, or laws, regulations, administrative practices, principles, and interpretations could have a material effect on our operating results or cash flows. An unfavorable outcome from any tax audit could result in higher tax expense, penalties and interest, and could materially and adversely affect our financial condition or results of operations.