AgileThought (AGILQ) Risk Analysis

The market for IT services is intensely competitive, highly fragmented and subject to rapid change and evolving industry standards and we expect competition to intensify. We believe that the principal competitive factors that we face are the ability to innovate; technical expertise and industry knowledge; end-to-end solution offerings; delivery location; price; reputation and track record for high-quality and on-time delivery of work; effective employee recruiting; training and retention; and responsiveness to clients' business needs. Our primary competitors include next-generation IT service providers, such as EPAM Systems, Inc., Endava Plc, Infosys Limited and Globant S.A., global consulting and traditional global IT service companies such as Accenture plc, Capgemini SE, Cognizant Technology Solutions Corporation and International Business Machines Corporation, or IBM; and in-house IT and development departments of our existing and potential clients. Many of our competitors have substantially greater financial, technical and marketing resources and greater name recognition than we do. As a result, they may be able to compete more aggressively on pricing or devote greater resources to the development and promotion of IT services. Companies based in some emerging markets also present significant price competition due to their competitive cost structures and tax advantages. In addition, there are relatively few barriers to entry into our markets and we have faced, and expect to continue to face, competition from new market entrants. Further, there is a risk that our clients may elect to increase their internal resources to satisfy their IT service needs as opposed to relying on third-party service providers. The IT services industry may also undergo consolidation, which may result in increased competition in our target markets from larger firms that may have substantially greater financial, marketing or technical resources, may be able to respond more quickly to new technologies or processes and changes in client demands, and may be able to devote greater resources to the development, promotion and sale of their services than we can. Increased competition could also result in price reductions, reduced operating margins and loss of our market share. We cannot assure you that we will be able to compete successfully with existing or new competitors or that competitive pressures will not materially adversely affect our business, financial condition, results of operations and prospects.

We, along with a significant number of our clients, are subject to a variety of federal, state, local and international laws, rules, regulations and industry standards related to data privacy and cybersecurity, and restrictions or technological requirements regarding the processing, collection, use, storage, protection, retention or transfer of data. The regulatory framework for privacy and security issues worldwide is rapidly evolving and, as a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. For example, the European Union General Data Protection Regulation, or the GDPR, came into force in May 2018 and contains numerous requirements and changes from prior EU law, including more robust obligations on data processors and data controllers, heavier documentation requirements for data protection compliance programs, greater control over personal data by data subjects (e.g., the "right to be forgotten"), increased data portability for data subjects, data breach notification requirements and increased fines. In particular, under the GDPR, fines of up to €20 million or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR's requirements. The GDPR requirements apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. If our efforts to comply with GDPR or other applicable EU laws and regulations are not successful, or are perceived to be unsuccessful, it could adversely affect our business in the EU. Further, in July 2020, the European Court of Justice, or the ECJ, invalidated the EU-U.S. Privacy Shield, which had enabled the transfer of personal data from the EU to the U.S. for companies that had self-certified to the Privacy Shield. The ECJ decision also raised questions about the continued validity of one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission's Standard Contractual Clauses, and EU regulators have issued additional guidance regarding considerations and requirements that we and other companies must consider and undertake when using the Standard Contractual Clauses. Although the EU has presented a new draft set of contractual clauses, at present, there are few, if any, viable alternatives to the EU-U.S. Privacy Shield and the Standard Contractual Clauses. To the extent that we were to rely on the EU-U.S. or Swiss-U.S. Privacy Shield programs, we will not be able to do so in the future, and the ECJ's decision and other regulatory guidance or developments may impose additional obligations with respect to the transfer of personal data from the EU and Switzerland to the U.S., each of which could restrict our activities in those jurisdictions, limit our ability to provide our products and services in those jurisdictions, or increase our costs and obligations and impose limitations upon our ability to efficiently transfer personal data from the EU and Switzerland to the U.S. Further, the exit of the United Kingdom, or the UK, from the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the UK. Specifically, the UK exited the EU on January 31, 2020, subject to a transition period that ended December 31, 2020. As of January 1, 2021, following the expiry of such transition period, data processing in the UK is governed by a UK version of the GDPR (combining the GDPR and the UK's Data Protection Act 2018), exposing us to two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations. With respect to transfers of personal data from the EEA to the UK, the European Commission has published a decision finding that the UK ensures an adequate level of data protection, although such decision is subject to renewal and may be revised or revoked in the interim, resulting in uncertainty and the potential for increasing scope for divergence in application, interpretation and enforcement of the data protection law as between the UK and EEA. Another example is the recently adopted the California Consumer Privacy Act of 2018, or the CCPA, in the United States, which became effective on January 1, 2020. The CCPA establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for California residents, imposing special rules on the collection of data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. The CCPA provides for severe civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. In addition, it is anticipated the CCPA will be expanded on January 1, 2023, when the California Privacy Rights Act of 2020, or the CPRA, becomes operative. The CPRA will, among other things, give California residents the ability to limit use of certain sensitive personal information, further restrict the use of cross-contextual advertising, establish restrictions on the retention of personal information, expand the types of data breaches subject to the CCPA's private right of action, provide for increased penalties for CPRA violations concerning California residents under the age of 16, and establish a new California Privacy Protection Agency to implement and enforce the CCPA and the CPRA. While aspects of the CPRA and its interpretation remain to be determined in practice, they create further uncertainty and may result in additional costs and expenses in an effort to comply. Additionally, on March 2, 2021, the Virginia Consumer Data Protection Act, or the CDPA, was signed into law. The CDPA becomes effective beginning January 1, 2023, and contains provisions that require businesses to conduct data protection assessments in certain circumstances, and that require opt-in consent from consumers to process certain sensitive personal information. These laws could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business. Additionally, all 50 states now have data breach laws that require timely notification to individuals, and at times regulators, the media or credit reporting agencies, if a company has experienced the unauthorized access or acquisition of personal information. More than a dozen states require that reasonable information security protections be used to protect personal information. If we fail to comply with any applicable privacy laws, rules, regulations, industry standards and other legal obligations, we may be subject to the aforementioned penalties, our business, financial condition, results of operations and prospects could be adversely affected. Also, in the United States, further laws, rules and regulations to which we may be subject include those promulgated under the authority of the Federal Trade Commission, the Gramm Leach Bliley Act and state cybersecurity and breach notification laws, as well as regulator enforcement positions and expectations. Globally, governments and agencies have adopted and could in the future adopt, modify, apply or enforce laws, rules, policies, regulations and standards covering user privacy, data security, technologies such as cookies that are used to collect, store or process data, marketing online, the use of data to inform marketing, the taxation of products and services, unfair and deceptive practices, and the collection, including the collection, use, processing, transfer, storage or disclosure of data associated with unique individual internet users. New regulation or legislative actions regarding data privacy and security, together with applicable industry standards, may increase the costs of doing business and could have a material adverse effect on our business, financial condition, results of operations and prospects. While we have taken steps to mitigate the impact of the GDPR and other laws, rules, regulations and standards on us, including by implementing certain security measures and mechanisms, the efficacy and longevity of these mechanisms remains uncertain. Despite our ongoing efforts to bring practices into compliance, we may not be successful either due to various factors within our control, such as limited financial or human resources, or other factors outside our control. Our efforts could fail and result in unauthorized access to or disclosure, modification, misuse, loss or destruction of data. It is also possible that local data protection authorities may have different interpretations of the GDPR and other laws, rules, regulations and standards to which we are subject, leading to potential inconsistencies amongst various EU member states. Because the interpretation and application of many privacy and data protection laws, rules and regulations along with contractually imposed industry standards are uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our services and platform capabilities. If so, in addition to the possibility of fines, lawsuits, regulatory investigations, imprisonment of company officials and public censure, other claims and penalties, significant costs for remediation and damage to our reputation, we could be required to fundamentally change our business activities and practices or modify our services and platform capabilities, any of which could have an adverse effect on our business, financial condition, results of operations and prospects. Certain of our clients require solutions that ensure security given the nature of the content being distributed and associated applicable regulatory requirements. In particular, our U.S. healthcare industry clients may rely on our solutions to protect information in compliance with the requirements of the Health Insurance Portability and Accountability Act of 1996, the 2009 Health Information Technology for Economic and Clinical Health Act, the Final Omnibus Rule of January 25, 2013, and related regulations, which are collectively referred to as HIPAA, and which impose privacy and data security standards that protect individually identifiable health information by limiting the uses and disclosures of individually identifiable health information and requiring that certain data security standards be implemented to protect this information. As a "business associate" to "covered entities" that are subject to HIPAA, such as certain healthcare providers, health plans and healthcare clearinghouses, we also have our own compliance obligations directly under HIPAA and pursuant to the business associate agreements that we are required to enter into with our clients that are HIPAA-covered entities and any vendors we engage that access, use, transmit or store individually identifiable health information in connection with our business operations. Compliance efforts can be expensive and burdensome, and if we fail to comply with our obligations under HIPAA, our required business associate agreements or applicable state data privacy laws and regulations, we could be subject to regulatory investigations and orders, significant fines and penalties, mitigation and breach notification expenses, private litigation and contractual damages, corrective action plans and related regulatory oversight and reputational harm. We make public statements about our use and disclosure of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any concerns about our data privacy and security practices, even if unfounded, could damage the reputation of our business and harm our business, financial condition and results of operations. Any failure or perceived failure, including as a result of deficiencies in our policies, procedures, or measures relating to privacy, data protection, marketing, client communications or information security, by us to comply with laws, rules, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to data privacy or security, may result in governmental investigations and enforcement actions, litigation, significant fines and penalties or adverse publicity, and could cause our clients and partners to lose trust in us, which could have an adverse effect on our reputation and business. We expect that there will continue to be new proposed laws, rules, regulations and industry standards relating to privacy, data protection, marketing, client communications and information security in the United States, the EU and other jurisdictions, and we cannot determine the impact such future laws, rules, regulations and standards may have on our business. Current and future laws, rules, regulations, standards and other obligations or any changed interpretation of existing laws, rules, regulations or standards could impair our ability to develop and market new services and maintain and grow our client base and increase revenue.

We have offices located in Mexico, Costa Rica, Brazil, Argentina and the United States. As a result of the international scope of our operations, fluctuations in exchange rates, particularly between the Mexican peso and the U.S. dollar, may adversely affect us. The value of our common stock may be affected by the foreign exchange rate between the U.S. dollar and the Mexican peso, and between those currencies and other currencies in which our revenues and assets may be denominated. For example, a depreciation of the Mexican peso relative to the U.S. dollar will temporarily impact our operations in the following ways: (i) the operations in the United States that have a nearshore cost component will benefit at the gross margin level from a lower U.S. dollar denominated cost until the point where salary inflation in Mexico offsets that benefit; and (ii) on the Mexico operations side, a depreciation of the Mexican peso will result in an overall reduction of the value of our business in Mexico when translated to U.S. dollars for consolidation purposes, as the same number of Mexican pesos will now represent fewer U.S. dollars. While our current exposure is relatively balanced at the operating profit (loss) level - meaning the benefit on the U.S. operations from a Mexican peso depreciation on operating profit (loss) would largely offset the impact of our operating income (loss) of a reduction in the value of our business in Mexico, this may change in the future as our nearshore operations grow. If our operations in the United States and Mexico grow at different rates, fluctuations in the exchange rate between the Mexican peso and U.S. dollar could have negative impacts on our financial condition and results of operations and could materially adversely affect the market price of our common stock.