Verra Mobility (VRRM) Risk Analysis

Our ability to retain, expand, and engage our customer base and to increase revenue depends, in large part, on our ability to continue evolving our existing solutions and developing successful new solutions. We may introduce significant changes to our existing solutions or acquire, develop, or introduce new and unproven products and services, including through the use of emerging technologies, such as AI, or by entering markets or industries in which we have limited experience. For example, as Government Solutions customers increase requirements related to data security, privacy, and IT architecture, we have invested significant effort and expense to develop new solutions to meet these evolving requirements, and such efforts may not be successful. Modifications to existing solutions or the development of new solutions can be costly, may be subject to regulatory requirements, and require significant research and development, time, expense, and human capital, and may not result in successful commercialization or customer adoption. The failure of any new or enhanced solution to achieve customer adoption, or our failure to otherwise successfully monetize our development efforts, could have a material adverse effect on our business, financial condition, and results of operations. Further, changes to the hardware solutions we offer to our government customers may require certification by a government agency, and failure to achieve such certification may result in an inability to sell or operate photo enforcement systems in a particular jurisdiction. Any failure to evolve existing solutions or create new successful solutions could have a material adverse effect on our business, financial condition, and results of operations.

We act as a trusted business partner in both front office and back-office platforms, interacting with our customers and other third parties. Our customers include large, multinational corporations and government agencies that rely on our operational efficiency and the uninterrupted, accurate, and secure delivery of our services and information. We receive, process, transmit, and store substantial volumes of information relating to identifiable individuals, in our capacity as a back-end and direct-to-consumer service provider and as an employer, and we also receive, process, and facilitate financial transactions, including the disbursement of funds, which requires the handling of debit and credit card information. We also rely upon third-party providers such as subcontractors, software vendors, utility providers, and network providers to offer our products, services, and solutions. As a result of these and other aspects of our business, the integrity, security, and accuracy of our information systems and those of third parties with which we interact, including customers and government agencies, are critically important. Our cybersecurity and processing systems, and those of third parties with which we interact, may be damaged, disrupted, or otherwise compromised for a number of reasons, including power outages, computer or telecommunications failures, computer viruses, malware, or other destructive software, internal design, manual, or usage errors, cyberattacks, terrorism, workplace violence or other misconduct, catastrophic events, natural disasters, and severe weather conditions. Our visibility and role as a processor of transactions containing personally identifiable information may increase our risk of being targeted by threat actors, and we have experienced malicious cyberattack attempts in the normal course of our business and we expect we will continue to be subject to future attacks. We maintain insurance intended to provide coverage for certain losses arising from cybersecurity incidents; however, such coverage may be insufficient to cover all losses or all types of claims that may arise. In addition, numerous and evolving cybersecurity threats, including advanced and persistent cyber-attacks, including the use of AI tools to aid such threats, phishing, and social engineering schemes could compromise our systems and the confidentiality, availability, and integrity of data in our systems, as well as the systems and data of the third parties with which we interact. The security measures and procedures we and the third parties with which we interact have in place to protect sensitive consumer data and other information may not be successful or sufficient to counter cybersecurity incidents or system failures. See the section entitled, "Risks Related to Our Customers, Industry, Competition, and Vendors," for additional information. Further, employee error or malfeasance, faulty password management, or other irregularities may result in a defeat of security measures or a cybersecurity incident. Although we devote significant resources to our cybersecurity programs and have implemented security measures that we believe are reasonable and appropriate to protect our systems and data and to prevent, detect, and respond to data security incidents, these efforts, as well as the efforts of third parties with which we interact, may not be sufficient to prevent these or other threats. Moreover, because the techniques used to obtain unauthorized access to, or to disable or degrade, systems are continually evolving and have become increasingly complex and sophisticated, and may remain undetected for periods of time, we and the third parties with which we interact may be unable to anticipate, detect, or respond to such acts adequately or on a timely basis. As these threats continue to evolve and increase, we may be required to devote significant additional resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities or conduct due diligence of those of third parties. If we are sued in connection with any cybersecurity incident or system failure, we may be subject to protracted litigation or significant settlement. In addition, a cybersecurity incident could lead to unfavorable publicity and significant damage to our brand, the loss of existing and potential customers, allegations by customers that we have not performed or have breached our contractual obligations, or decreased use and acceptance of our solutions. A cybersecurity incident or system failure may also subject us to additional regulations or governmental or regulatory scrutiny, which could result in significant compliance costs, fines, or enforcement actions, or potential restrictions imposed by regulators on our ability to operate our business. A cybersecurity incident would also likely require us to devote significant management time and other resources to the response and follow-up to the incident. Any of the foregoing could have a material adverse effect on our business, financial condition, and results of operations.

We rely heavily on the satisfactory performance and availability of our information technology infrastructure and systems, including our websites and network infrastructure, to conduct our business. We rely on third-party communications services and system providers to provide technology services and link our systems with our customers' networks and systems, including a reliable network backbone with the necessary speed, data capacity, and security. We also rely on third-party vendors, including data center, bandwidth, and telecommunications equipment providers. A failure or interruption that results in the unavailability of any of our information systems or a major disruption of communications between a system and the customers we serve could disrupt the effective operation of our solutions and otherwise adversely impact our ability to manage our business effectively. We may experience system and service interruptions or disruptions for a variety of reasons, including as a result of network failures, power outages, cyber-attacks, employee errors, software errors, an unusually high volume of transactions, or localized conditions such as fire, explosions, or power outages, or broader geographic events such as earthquakes, storms, floods, epidemics, strikes, acts of war, civil unrest, or terrorist acts. We have taken steps to mitigate our exposure to certain service disruptions by investing in redundant or blended circuits, although the redundant or blended circuits may also suffer disruption. Because we are dependent in part on independent third parties for the implementation and maintenance of certain aspects of our systems and because some causes of system interruptions may be outside of our control, we may not be able to remedy such interruptions in a timely manner, or at all. Any interruption, delay, or failure of these services and systems could disrupt our operations, adversely affect our customers, harm our reputation, and cause us to miss or delay contractual obligations. These impacts could also result in litigation, reduced use and acceptance of our solutions, data loss, and significant costs and remediation efforts, any of which could materially adversely affect our business, financial condition, and results of operations.

From time to time, and as further discussed in the section entitled "Legal Proceedings," we may be involved in litigation and other disputes or regulatory investigations that arise in and outside the ordinary course of business. We expect that the number, frequency, and significance of these matters may increase as our business expands and we grow as a company. Litigation, disputes, or regulatory investigations may relate to, among other things, intellectual property, antitrust claims, commercial arrangements, negligence and fiduciary duty claims, vicarious liability based upon conduct of individuals or entities outside of our control, including our third-party service providers or our customers, deceptive trade practices, claims related to compliance with laws or our contractual requirements, invoicing, personal injury claims, claims related to licensing, general fraud claims and employment law claims, including compliance with wage and hour regulations and contractual requirements. An adverse determination may result in liability to us for the claim and may also result in the imposition of penalties and/or fines. Like other companies that handle sensitive personal and payment information, we also face the possibility of allegations regarding employee fraud or misconduct. In addition to more general litigation, at times we are also a named party in claims made against our customers, including putative class actions challenging the legality and constitutionality of automated photo enforcement and other similar programs of our Government Solutions customers and consumer fraud claims brought against our RAC customers alleging faulty disclosures regarding our services. As a public company, we may also be subject to securities class action and stockholder derivative lawsuits. From time to time, we may also be reviewed or investigated by U.S. federal, state, or local regulators or regulators in the foreign jurisdictions in which we operate regarding similar and other matters, including tax assessments. These investigations may be commenced at the initiative of a governmental authority or as a result of complaints by private citizens, regardless of whether the complaint has any merit. At times, we are also required to obtain licensing and permitting, including with respect to matters such as general contracting, performance of engineering services, performance of electrical work, and performance of private investigative work, all of which subject us to governmental and regulatory oversight. Although we carry general liability insurance coverage, our insurance may not cover all potential claims to which we are exposed, whether as a result of a dispute, litigation, or governmental investigation, and it may not adequately indemnify us for all liability that may be imposed. Any potential claims against us or investigation into our business and activities, whether meritorious or not, could be time consuming, result in significant legal and other expenses, require significant amounts of management time, and result in the diversion of significant operational resources. Class action lawsuits can often be particularly burdensome given the breadth of claims, large potential damages, and significant costs of defense. In the case of intellectual property litigation and proceedings, adverse outcomes could include the cancellation, invalidation, or other loss of material intellectual property rights used in our business and injunctions prohibiting our use of business processes or technology that is subject to third-party patents or other third-party intellectual property rights. Legal or regulatory matters involving our directors, officers, or employees in their individual capacities can also create exposure for us because we may be obligated or may choose to indemnify the affected individuals against liabilities and expenses they incur in connection with such matters. Regulatory investigations, including with respect to proper licensing, payment of wages, procurement practices or permitting, can also lead to enforcement actions, fines, and penalties, the loss of a license or permit, or the assertion of private litigation claims. Risks associated with these liabilities are often difficult to assess or quantify and their existence and magnitude can remain unknown for significant periods of time, making the amount of any legal reserves related to these legal liabilities difficult to determine and, if a reserve is established, subject to future revision. Future results of operations could be adversely affected if any reserve that we establish for a legal liability is increased or the underlying legal proceeding, investigation, or other contingency is resolved for an amount in excess of established reserves. Because litigation and other disputes and regulatory investigations are inherently unpredictable, the results of any of these matters may have a material adverse effect on our business, financial condition, and results of operations.

We use personal information in our operations and as an employer, and we process additional data-such as photographs and video recordings-that may be considered personal information or sensitive personal information in certain jurisdictions, including in connection with our Government Solutions, Commercial Services, and Parking Solutions businesses. As a result, we are subject to various laws and regulations regarding personal information, privacy, and data security, including those promulgated by the United States federal government and its agencies, and state, local, and foreign governments, agencies, and public authorities. In addition, our handling of personal information is subject to our published privacy policies and notices, contractual obligations, and informed by industry standards. Laws, regulations, and industry standards relating to privacy are rapidly evolving and subject to significant change, and may result in increasing regulatory and public scrutiny, as well as heightened levels of enforcement and sanctions. These laws and regulations may also be subject to new or different interpretations. For example, the California Consumer Privacy Act ("CCPA"), as amended, created several new obligations for companies which process personal information. It also gives California residents expanded rights to access, delete, and obtain a copy of their personal information, opt out of certain personal information disclosures, and receive detailed information about how their personal data is processed. The law provides for civil penalties against companies that fail to comply. Many other states have also enacted privacy laws and several others have introduced privacy bills. The U.S. Congress also enacted several federal privacy bills in 2025 which protect personal information by limiting how it can be collected, used, shared, and exposed, and by strengthening safeguards and accountability for privacy harms. In addition, the FTC uses its consumer protection authority to initiate enforcement actions against companies relating to their use and disclosure of personal information, particularly in response to actual or perceived unfair or deceptive acts or practices. Various U.S. state laws and regulations may also require us to notify affected individuals and state agencies in the event of a data breach involving personal information. Penalties for failing to adequately protect personal information or to provide required or timely notice vary by jurisdiction. In the United States, most state data breach notification laws consider violations to be unfair or deceptive trade practices and give the relevant state attorneys general the authority to levy fines or bring enforcement actions. Some laws, such as the CCPA, also grant affected individuals a private right of action for certain data breaches, with the CCPA also providing for statutory damages. Class action lawsuits against companies that experience data breaches involving personal information have become increasingly common and may result in significant damages or settlements. Foreign laws concerning personal information, privacy, and data security may be more restrictive and burdensome than those in the United States. Given that data is highly mobile and transferable, many foreign data protection and privacy laws assert broad extraterritorial application to conduct occurring outside the geographic boundaries of the relevant jurisdiction. For example, the GDPR extends the scope of E.U. data protection law to non-E.U. companies processing data of E.U. residents when certain conditions are satisfied. The GDPR imposes extensive privacy and data protection requirements, including robust compliance obligations for companies and their service providers, enhanced rights for individuals, significant documentation requirements for data protection compliance programs, restrictions on transfers of personal data to non-E.U. countries, and, in certain circumstances, prompt notification of data breaches to data subjects and supervisory authorities. The GDPR provides for administrative fines of up to €20 million or up to 4% of a company's total global annual turnover for the preceding fiscal year, whichever is greater. In addition, our customers may, through contractual requirements, require us to comply with certain GDPR obligations regardless of whether the GDPR otherwise applies to our business. Compliance with privacy- and data security-related laws, regulations, contractual requirements, and industry standards may involve significant costs and short implementation timelines, and may limit our ability to compete for new business, conduct business with certain government agencies (including existing customers), or continue to access certain data. These requirements may also limit the use or adoption of our smart mobility technology solutions and services, reduce overall demand for our offerings, slow revenue growth, subject us to fines or penalties, or result in breaches of contractual commitments to our customers. As these laws, regulations, and standards continue to develop in the United States and internationally, we may be required to expend significant time and resources in order to update existing processes or implement additional mechanisms to ensure compliance. Moreover, if our policies, procedures, or measures relating to these matters fail to comply with, or if regulators assert that we have failed to comply with, applicable laws, regulations, or industry standards, we may be subject to governmental enforcement actions, regulatory investigations, litigation, fines, algorithmic disgorgement, limitations on the use of previously collected personal information or the collection of new personal information, other penalties, and adverse publicity. In addition, our application providers, customers, and partners may lose trust in us or discontinue doing business with us. We expect that there will continue to be new proposed laws, regulations, and industry standards concerning personal information, privacy, and data retention in the United States, the E.U., and other jurisdictions, and we cannot yet determine the impact that such future laws, regulations, and industry standards may have on our business. Any of the foregoing could have a material adverse effect on our business, financial condition, and results of operations.

The markets for our solutions are increasingly competitive, rapidly evolving, and fragmented, and are subject to changing technology, shifting customer needs, contract renewals, and new laws and policies. A number of vendors develop and market products and services that compete to varying extents with our offerings, and we expect this competition to intensify. The rapid rate of technological change in our industry could increase the chances that we will face competition from new products or services designed by companies with whom we do not currently compete. This includes advancements in the area of self-driving vehicles, which may significantly reduce the frequency of vehicles illegally running red lights, exceeding posted speed limits, or requiring parking, as well as AI-enabled tools, which may allow for new or more efficient competing solutions. Moreover, we face competition from our own customers as they may choose to invest in developing their own internal solutions. Some of our existing competitors and potential new competitors have longer operating histories, greater name recognition, less debt, more established customer bases, or significantly greater financial, technical, research, and development, marketing, and other resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies (including AI), standards, or customer requirements. In some cases, our competitors may be better positioned to initiate or withstand substantial price competition, and we may have to reduce our pricing to retain existing business or obtain new business. If we are not able to maintain favorable pricing for our solutions, our profit margin and profitability could suffer. In addition, if a prospective customer is currently using a competing solution, the customer may be unwilling to switch to our solution without set-up support services or other incentives. Certain existing and new competitors may be better positioned to acquire competitive solutions, develop new solutions, modify existing solutions, effectively negotiate third-party licenses and other strategic relationships, and take advantage of acquisitions or other similar expansion opportunities. Any failure to achieve our target pricing levels, maintain existing customer relationships, generate additional customer wins, or otherwise successfully compete would have a material adverse effect on our business, financial condition, and results of operations.

Our business model depends, in large part, on our ability to retain existing work and attract new work from existing customers. If a customer is dissatisfied with our products, services, or solutions, or with the timeliness or quality of our work, we may incur additional costs to address the issue, experience payment delays, suffer reduced contract profitability, or incur reputational harm that could impair our ability to win new business. Failure to properly transition new customers to our systems or existing customers to different systems, accurately budget transition costs, or estimate contract costs could result in delays and customer dissatisfaction. In addition, many of our contracts may be terminated by the customer upon specified advance notice without cause. Any failure to properly perform under our contracts or meet our customers' expectations could have a material adverse effect on our business, financial condition, and results of operations.

We rely significantly on third-party providers, including subcontractors, manufacturers, software vendors, software application developers, and utility and network providers, to meet their obligations to us in a timely and reliable manner. For example, we rely on third parties to provide data sourced from state departments of motor vehicles (and their European equivalents) and other governmental agencies with which we do not have direct relationships for driver and other information we use in our business. Our access to such governmental data may be suspended, restricted, or terminated at any time, including as a result of changes in law or policy, contractual or licensing disputes, data-sharing moratoria, privacy or security concerns, system outages, or discretionary decisions by those agencies or their data service intermediaries. Any reduction, interruption, or loss of access to this data, or increase in prices for access to this data could materially and adversely affect our ability to offer our solutions and meet customer expectations and contractual commitments. Our Government Solutions business also relies on a number of third-party manufacturers, including camera manufacturers and automated license plate recognition providers, and outsources some engineering, construction, maintenance, printing and mailing, call center, image review, and event processing work. Further, if one or more tolling authorities cancels our accounts, or stops providing transponders, and we are unable to obtain transponders through other sources, our Commercial Services business would be affected. Our Parking Solutions business also relies on a number of domestic and foreign third-party manufacturers in the production of our pay station, Parking Access and Revenue Control (PARCS) and parking enforcement hardware solutions, and our inability to access third-party providers could have a material adverse effect on our business. We also outsource a meaningful percentage of our software development work to third parties. Some of our agreements with these third parties include termination rights, allowing the third party to terminate the arrangement in certain circumstances. For example, the agreements with our third-party payment processors give them the right to terminate the relationship if we fail to keep credit card chargeback and retrieval rates below certain thresholds. If any of our third-party providers are unable or unwilling to meet their obligations to us, fail to satisfy our expectations or those of our customers, including those imposed through flow-down provisions in prime contracts, or if they terminate or refuse to renew their relationships with us on substantially similar terms, we may be unable to find adequate replacements within a reasonable time frame, on favorable commercial terms or at all, and our business, financial condition, and results of operations could be materially and adversely affected. While we perform some due diligence on these third parties and take measures to ensure that they comply with applicable laws and regulations, we do not have an extensive screening or review process and ultimately cannot guarantee our third-party providers will comply with applicable laws, the terms of their agreements, or flow-down requirements from our customers. Misconduct or performance deficiencies by any of our third-party providers may be perceived as misconduct or poor performance by us, cause us to fall short of our contractual obligations, or harm our reputation, any of which could have a material adverse effect on our business, financial condition, and results of operations.

We provide smart mobility technology solutions to customers in our Commercial Services, Government Solutions, and Parking Solutions business segments. Accordingly, the demand for our products in the past has been, and in the future may be, impacted by industry and macroeconomic trends and conditions impacting our customers, including seasonality, demand for business and leisure travel, changes to or disruptions in governmental budgeting, reductions in the level of air travel, higher airfare costs, energy shortages, and cost increases, international, national, and local economic conditions and cycles, as well as other factors affecting travel levels, such as military conflicts, terrorist incidents, natural disasters, epidemic diseases, or government shutdowns. For example, our Commercial Services segment may be impacted by travel demand and extreme weather events which may affect overall travel demand in the United States. Our Government Solutions segment may be impacted to the extent our customers experience a reduction in political acceptance of, or additional government restrictions on, automated safety programs. Our Parking Solutions segment may be impacted to the extent our customers see an increase in usage of public transportation, rideshare, or autonomous taxi services, all of which may cause a decrease in parking usage. Furthermore, uncertain economic conditions may make it more difficult for us to raise funds through borrowings or private or public sales of debt or equity securities. We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry. Government actions and regulations, such as tariffs and trade protection measures, may negatively impact our business. To minimize tariff impact, we have, at times, shifted manufacturing and final assembly locations and our sourcing teams prioritize domestic alternatives when feasible. Future changes to United States tariff policy, including the expansion of existing tariffs, elimination of exclusion programs, retaliatory measures by foreign governments, or changes to preferential trade programs, could further increase our costs, and could have an adverse impact on our results of operations. Because many tariff actions may be implemented with limited advance notice, our ability to mitigate the impact of such actions may be constrained. In addition, consumer spending and activities may be materially adversely affected in response to financial market volatility, negative financial news, changes to or disruptions in governmental budgeting processes or amounts, conditions in the real estate and mortgage markets, declines in income or asset values, energy prices, labor and healthcare costs, and other economic factors, all of which may have a negative effect on our business and results of operations. Additionally, uncertainty about, or a decline in, global or regional economic conditions, may have a significant impact on our suppliers, manufacturers, logistics providers, distributors, and other partners. Potential effects on our suppliers and partners include financial instability, inability to obtain credit to finance operations, and insolvency. Negative conditions in the general economy, both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, inflation, financial and credit market fluctuations, international trade relations, government shutdowns, pandemics, political turmoil, natural catastrophes, warfare, and terrorist attacks on the United States or elsewhere, could negatively affect customer demand and the growth of our business.