Booking Holdings (BKNG) Risk Analysis

There are several privacy-driven initiatives that are changing the collection and use of consumer data in the digital marketing ecosystem. These include: requirements by browsers such as Safari and Google Chrome to require opt-in consent for third-party cookies; restrictions on the use of the identifier for advertisers (such as the Apple "IDFA") by mobile device manufacturers; Apple's iCloud+ Private Relay (which hides a user's IP address from websites that the user accesses in favor of other IP addresses provided by Apple's partners); and the adoption of regulations that govern the use of cookies. For example, in the EU, the ePrivacy Directive regulates the use of cookies and similar technologies, including limitations on the use of data and guidelines for enabling users to accept or reject cookies. Authorities may assert, and in some cases are likely to determine, that our collection, use, or management of customer and other data is inconsistent with laws and regulations, including laws that apply to cookies or similar technology, and there may be significant penalties for non-compliance. In the EU, the ePrivacy Directive is implemented in national laws as a result of which different interpretations and requirements apply on a country by country basis. EU regulators continue to issue guidance concerning the ePrivacy Directive's requirements regarding the use of cookies and similar technologies and may impose specific measures which could impact our use of such technologies. In addition, the ePrivacy Directive and national implementation laws impose additional limitations on the use of data across messaging products and include significant penalties for non-compliance. In the U.S., disclosure requirements and limitations may apply to the use of certain cookies and other online tracking technologies deemed to be sales of personal information under the CCPA or other state laws. If these initiatives or regulations impair our ability to serve customers or if we are less effective than our competitors in addressing these issues, our ability to improve performance on our platforms, business, market share, and results of operations could be adversely affected. Further, failure or perceived failure to comply with evolving privacy regulations, guidance, and interpretations could result in significant fines, government enforcement actions, private litigation, and harm to our business, results of operations, or reputation.

The Netherlands corporate income tax law provides that income generated from qualifying innovative activities is taxed at the rate of 9% ("Innovation Box Tax") rather than the Dutch statutory rate of 25.8%. A portion of Booking.com's earnings historically has qualified for Innovation Box Tax treatment. In order to be eligible for Innovation Box Tax treatment, Booking.com must, among other things, apply for and obtain a research and development ("R&D") certificate from a Dutch governmental agency every six months confirming that the activities that Booking.com intends to be engaged in over the subsequent six-month period are "innovative." The R&D certificate is current but should Booking.com fail to secure such a certificate in any future period - for example, because the governmental agency does not view Booking.com's new or anticipated activities as innovative, the Innovation Box Tax benefit may be reduced or eliminated. Booking.com intends to apply for continued Innovation Box Tax treatment for future periods. However, Booking.com's application may not be accepted, or, if accepted, the amount of qualifying earnings may be reduced. The loss or reduction of the Innovation Box Tax benefit could substantially increase our effective tax rate and adversely impact our results of operations and cash flows.

In response to focus by our investors and other stakeholders, we made climate-related commitments and issued a Climate Action Plan. We continue to evaluate these commitments, including those related to offering more sustainable trip options as well as ESG disclosures that may be required in certain jurisdictions. Our ability to do so is subject to risks including: (1) the availability and cost of limiting or offsetting our use of carbon-based energy sources and technologies, (2) evolving regulatory requirements affecting ESG standards and disclosures, (3) our ability to work with partners and providers that can meet our sustainability and other standards, (4) the availability of vendor or other third-party data, (5) the impact of our organic growth and acquisitions or dispositions of businesses or operations on our ESG goals, and (6) customers' actual demand for ESG-oriented product offerings, which may be more expensive and less available than other options. We may need to invest significant effort and resources relating to required ESG disclosures, and inconsistent and uncertain regulations may lead us to revise or discontinue our commitments or how we measure and report ESG data. In addition, regulatory developments regarding sustainability labeling have resulted and could result in further changes to, or the discontinuation of, ESG programs or objectives. If our ESG practices and disclosures do not meet evolving investor or other stakeholder expectations or regulatory requirements, then our reputation, ability to attract or retain employees, and our attractiveness as an investment or business partner could be negatively impacted. Similarly, our failure or perceived failure to pursue or fulfill our ESG-related objectives or to satisfy increasingly broad reporting obligations could expose us to government enforcement actions, private litigation, and actions by stockholders or stakeholders, and adversely impact our business, brands, or reputation.

We compete in markets characterized by rapidly changing technology, evolving industry standards, consolidation, frequent service developments, and changing consumer preferences. In addition, these market characteristics are heightened by the progress of technology adoption in various markets, including the continuing adoption of online commerce in certain geographies and the growth of mobile e-commerce transactions. We may not be able to keep up with these rapid changes. Our long-term strategy to build the Connected Trip will require increased investments that could have an adverse impact on our results of operations until we achieve the expected return on these investments. The development of the Connected Trip is subject to uncertainties, including further development of the verticals and technological capabilities (which may include developing and integrating technologies like Gen AI) necessary for the Connected Trip experience, the ability to collect, store, and use customer data in a compliant and integrated fashion, and the attraction and retention of employees dedicated to this effort. It may take longer than we expect to realize the Connected Trip vision or it may not achieve the expected return on investment. These efforts may also not be successful in improving the travel experience or retaining and attracting new customers. Further, regulatory restrictions may impact our ability to commercialize the Connected Trip or expose us to unanticipated liabilities. With any technical innovation such as the Connected Trip effort, there could be vulnerabilities and other technical failures, which could result in lost business, harm to our brand or reputation, consumer complaints, and other adverse consequences, any of which could adversely affect our business and results of operations. In the future the competitive pressure to innovate could encompass a wider range of services and technologies, and our ability to keep pace may slow. Other companies, including emerging start-ups or large technology companies utilizing proprietary Gen AI or similar capabilities, may be able to innovate and focus on developing a new product or service faster than we can or may foresee consumer need for new services or technologies before we do. In addition, the widespread adoption of new technologies, such as Gen AI and machine learning, could influence how customers search for and book travel, render our existing technology obsolete, require us to modify or adapt our services or infrastructure, which could adversely affect our results of operations or financial condition. Consumers increasingly use mobile devices and apps to make online travel bookings. The revenues earned on a mobile transaction may be less than a desktop transaction due to different purchasing patterns. To the extent mobile devices or platforms enable users to block advertising content, our advertising revenue and ability to market our brands may also be negatively affected. If we are unable to attract consumers to our mobile platforms, or app store providers like Google and Apple use their app distribution, mobile operating, or payment platforms to favor competing services to ours, we could lose market share and our business, future growth, and results of operations could be adversely affected. Our ability to offer a variety of appropriate payment solutions is an important part of our value proposition for our partners and consumers. If we are unable to offer consumers their preferred method of payment, it would limit our growth opportunities and our business and results of operations could be harmed.

- Data privacy and cyberattack risks;- IT systems-related failures or security breaches;

We are subject to competition and consumer protection laws and regulations around the world. These laws and regulations evolve, and their interpretation, application, and enforcement can also change, be unpredictable, or be affected by changing political or social pressures. As we expand our business into new areas, including building the Connected Trip vision, we may become subject to additional laws and regulations. We have been the subject of investigations or inquiries by national competition authorities ("NCAs") and other governmental authorities. For example, we are involved in investigations related to whether certain of Booking.com's contractual parity arrangements with accommodation providers are anti-competitive because they require partners to provide Booking.com with rates, conditions, and availability at least as favorable as those offered to other OTCs or by the partner itself. In July 2024, the Comisión Nacional de los Mercados y la Competencia (the "CNMC") in Spain notified Booking.com of its decision to impose a fine and to restrict certain business practices based on the allegation that certain practices by Booking.com may produce adverse effects for hotels and other OTCs. Booking.com does not agree with the rationale stated in the decision and certain of the restrictions imposed, and has filed an appeal. In September 2017 the Swiss Price Surveillance Office opened an investigation that may require Booking.com to reduce its commissions in Switzerland. To resolve and close certain of these investigations, we have made commitments regarding future business practices or activities, such as agreeing to narrow the scope of our parity arrangements. While we believe that we are complying with the commitments we have made, investigating authorities or third parties may determine otherwise and decide to pursue legal action to compel compliance or seek other remedies. We cooperate with regulators but we are unable to predict what, if any, effect any investigations or their resolution, including the effect of any commitments we might make, will have on our business, industry practices, or online commerce more generally. An unfavorable outcome in an investigation could encourage additional regulatory inquiries that could become widespread over time, significantly increasing the potential financial and reputational impact on the Company. Additionally, these types of investigations can result and have resulted in the assessment of fines, private litigation, and negative publicity. We have also been involved in investigations or inquiries involving consumer protection matters and we have previously made voluntary commitments to consumer authorities to resolve investigations or inquiries that have included showing prices inclusive of all mandatory taxes and charges, providing information about the effect of money earned on search result rankings, displaying certain sustainability-related information about accommodations, making adjustments to how discounts and statements concerning popularity or availability are shown to consumers, and displaying additional customer service details. To the extent that these or any other investigations or inquiries result in additional commitments, changes to our business practices, negative publicity, fines, damages from private litigation, or other remedies, it could have a material adverse effect on our business, financial condition, and results of operations. There is significant legislative and public focus on the technology industry, especially as technology companies become larger. In some instances countries have passed legislation that goes further to restrict business activities than actions taken by NCAs or other regulatory authorities. The EU's Platform to Business Regulation regulates the relationship between online platforms such as Booking.com and European business users of online platforms. The DMA and DSA give regulators in the EU more instruments to investigate and regulate digital businesses and impose additional rules and requirements on platforms designated as "gatekeepers" under the DMA and online platforms more generally, with separate rules for "Very Large Online Platforms" ("VLOPs") under the DSA. As a result of our designation as a gatekeeper under the DMA and Booking.com's designation as a VLOP under the DSA, we are subject to additional rules and regulations that may not be applicable to our competitors. For example, Booking.com has implemented changes to address the DMA prohibition on parity arrangements in the European Economic Area and the requirements regarding the usage of data across services, which could adversely impact our business. As a gatekeeper, we also established an independent compliance function to monitor compliance with the DMA. Under the DSA, as a VLOP, Booking.com is required to collect more information from partners, which could disincentivize certain partners from using our services. Booking.com is also subject to additional scrutiny, obligations, and costs, such as payment of an annual supervisory fee, annual risk assessments and independent audits, and establishing an independent compliance function. The DMA and DSA each have significant penalties for non-compliance, and could lead to private litigation. Our compliance costs have increased in connection with becoming subject to the DMA and DSA, each of which remains subject to further interpretation and regulatory engagement, and could require additional changes to our products, business practices, and compliance activities in the future. The EC designates VLOPs based on a platform's number of EU "monthly active recipients" ("MARs"). The EC requires counting users who display and to whom information was displayed (e.g., partners and consumers), even if a user does not make a transaction on the platform. The assessment of MARs and any other similarly published information by our brands represents an estimate based on the data available to us and limited guidance, and is subject to limitations. Any such estimate is published solely as required by applicable rules or regulations, may be inaccurate, and should not be used for any other purpose. New state and federal laws and regulations could impact our services, require us to change our business practices, and impose additional complexity and costs. As market conditions change as a result of investigations, litigation, legislation, changing public perception of the industry, or political or social pressure, we may decide to modify our business practices beyond what is required, the full effects of which may not be known when making the decision, but which could harm our competitive position and adversely affect our business and results of operations. With additional attention on the size of travel or technology companies generally, our size and market share may negatively affect our ability to obtain regulatory approval of proposed acquisitions or other opportunities, our ability to expand into complementary businesses, or our latitude in dealing with travel service providers (such as by limiting our ability to provide discounts, rebates, or incentives or to exercise contractual rights), any of which could adversely affect our business, results of operations, or ability to grow and compete. Another area of potential regulatory inquiry involves contractual online search term bidding restrictions where one contracting party agrees not to bid on certain key search terms related to the other party (e.g., such other party's name). In some of our contracts, we or the other party have agreed to bidding restrictions. If bidding restrictions are held to be illegal or otherwise unenforceable or if we remove them from all of our contracts, it could negatively impact our performance marketing efficiency, business, and results of operations.

Our financial results depend upon sales of travel services, which can fluctuate based on consumer discretionary spending levels. Demand for and sales of travel services often decline during periods of perceived or actual adverse economic conditions and times of political or economic uncertainty. Economic and political uncertainty can negatively impact transaction growth rates, cancellation rates, and accommodation average daily rates ("ADRs"). While lower occupancy rates can increase distribution of accommodation reservations through third-party intermediaries such as us, if there are lower ADRs, it generally has a negative effect on our revenues and results of operations. Macroeconomic uncertainties have led to significant volatility in currency exchange rates, stock markets, and oil prices, which can impact consumer travel behavior. The uncertainty of macroeconomic factors and their impact on consumer behavior makes it difficult to forecast industry and consumer trends and their potential impact on our business, which could adversely affect our ability to effectively manage our business and adversely affect our results of operations. Other events beyond our control such as pandemics, terrorist attacks, natural disasters, wars and regional hostilities, travel-related accidents, or increased focus on the environmental impact of travel may disrupt or limit the ability or willingness of travelers to visit certain locations, or result in declines in demand for our travel offerings. Responses to such events by governments or global organizations could restrict travel in ways that could impact our ability to conduct our business. Because these events and their impacts are largely unpredictable, they can dramatically and suddenly affect travel behavior by consumers, demand for and provision of our services, and relationships with travel service providers and other partners, any of which can adversely affect our business and results of operations.

Our results have been and will likely continue to be negatively impacted by consumer purchases made using fraudulent payment cards, claims the consumer did not authorize the purchase, or consumers who have closed bank accounts or have insufficient funds in their bank accounts to satisfy payments. We may be held liable for fraudulent transactions on our platforms, as well as other payment disputes. Accordingly, we calculate and record an allowance for resulting chargebacks. If we are unable to successfully implement and evolve measures to detect and reduce the risk of fraud on our platforms, our business, profit margins, results of operations, and financial condition could be materially adversely affected. We process many of our transactions on a merchant basis where we facilitate payments from travelers through payment cards and other payment methods. While processing transactions on a merchant basis allows us to offer a variety of payment methods and flexible transaction terms, we incur additional payment processing costs (which are typically higher for foreign currency transactions) and other costs related to these transactions, such as costs related to fraudulent payments and transactions and fraud detection. These costs may increase as we expand our payments services to consumers and partners, and our results of operations and profit margins could be materially adversely affected. As a greater percentage of our transactions involve us processing payments, our global systems and processes must be managed on a larger scale, which adds complexity, administrative burdens and costs, and increases the demands on our systems and controls, which could adversely affect our results of operations. In addition, as our payment processing activities develop or expand into different geographies, we expect to be subject to additional regulations, including financial services and export controls regulations, which we expect to result in increased compliance costs and complexities, including those associated with the implementation of new or advanced internal controls. Compliance with and implementation of the EU's Payment Services Directive 2 and similar or successor legislation such as the EU's Payment Services Directive 3 and Payment Services Regulations may be difficult to adhere to in a timely manner, result in increased compliance costs, and be administratively burdensome, any of which could negatively impact our business and results of operations. Regulators (or we) may determine, and in some cases are likely to determine, that certain aspects of our business are subject to laws that govern payments activities, such as money transmission and online payments processing, which could require us to obtain licenses to continue to operate in certain jurisdictions or result in modification or interruption of our business plans, which would negatively impact our business and results of operations. Certain of our subsidiaries that may provide payment services in support of our brands are subject to licensing and regulations that impose notice and approval obligations on investors that seek indirect or direct ownership, in the aggregate, of 10% or more of our outstanding shares. Regulations relating to operational resilience, including the EU's Digital Operations Resilience Act, banking (including consumer protection), privacy, and security of our processes also apply to us. Further, our payments systems are susceptible to illegal and improper uses, including money laundering, terrorist financing, fraudulent sales of goods or services, and transactions by or with sanctioned parties. We have invested and will need to continue to invest substantial resources to comply with applicable laws and regulations, and failure to maintain compliance with applicable licensing, payment services, customer fund safeguarding, or related regulations could lead to fines, which could be significant, or require us to modify or interrupt our business practices, plans, or operations, any of which could negatively impact our business, results of operations, and profit margins. We are also subject to payment card association rules and obligations under our contracts with the card schemes and our payment card processors, and indirectly to the rules of payment systems in respect of credit (i.e., account to account) transfers. The rules of the card schemes and payment systems are often updated or interpreted in different ways, and we may need to adjust our systems and/or processes to comply with any updated obligations. If we fail to comply with such obligations, we may be fined, required to pay additional processing fees, lose our ability to accept certain credit and debit card payments from our customers, or facilitate other types of online payments, any of which would negatively impact our business, operating results, and profit margins. Under card association rules, including the Payment Card Industry Data Security Standard (the "Standard"), if information is compromised, we could be liable to payment card issuers for associated expenses and penalties, and in some cases, we could be restricted in our ability to accept payment cards. Under certain circumstances in our agreements with the card schemes and in relation to the Standard, we are also subject to periodic audits, self-assessments, and other assessments of our compliance with the rules and obligations of the payment card associations and the Standard, which could result in additional expenses and administrative burdens. In addition, if we fail to follow payment card industry security standards, even if no consumer information is compromised, we could incur significant fines or experience a significant increase in payment card transaction costs. Compliance with the Standard may not prevent all security incidents. We rely on banks, card schemes, and other payment processors to execute certain components of the payments process. For inbound payments, we pay these third parties interchange and other processing and gateway fees to facilitate payments from consumers to travel service providers. If we are unable to maintain our relationships with these third parties on favorable terms, fees are increased, or if we provide security, our profit margin, business, and results of operations could be harmed. Additionally, if these third parties experience service disruptions or if they cease operations, consumers and travel service providers could have difficulty making or receiving payments, which could adversely impact our reputation, business, and results of operations. In addition, in the event that one of our major travel service providers declares bankruptcy or otherwise ceases or limits operations, we could experience an increase in chargebacks from customers with travel reservations with such travel service provider and we could experience financial loss from certain prepayments made to such travel service provider if we are not able to recover the prepayments.

We rely on providers of accommodations, rental cars, and airline tickets, and on restaurants, to make their services available to consumers for reservation through us. Our arrangements with travel service providers generally do not require them to make available any specific quantity of reservations, or to make reservations available in any geographic area, for any particular route, or at any particular price. Similarly, our arrangements with restaurants generally do not require them to provide all of their available tables and reservations to customers through us. Our arrangements with OTCs and travel service providers to provide pricing, schedules, availability, and other information in connection with Kayak's meta-search services are non-exclusive and can be terminated with little notice. A significant reduction on the part of any of our major travel service providers, or restaurants, for a sustained period of time or their complete withdrawal from our services, including due to a provider's bankruptcy or closure, could have an adverse effect on our business, advertising revenue, market share, and results of operations. Further, as consolidation among travel service providers increases, or if Gen AI better enables, or offers alternatives for travel service providers to reach consumers, the potential adverse effect of a decision by a significant travel service provider to withdraw from or reduce its participation in our services also increases. We rely upon Google and other search and meta-search services to generate a significant portion of traffic to our platforms, principally through pay-per-click marketing campaigns. The pricing and operating dynamics on these platforms can change rapidly. If the logic determining placement and display of results of a consumer's search changes, the placement of links to our platforms can be negatively affected and our costs to improve or maintain our placement can increase. A decline or slowing growth in travel search traffic also negatively impacts our ability to efficiently generate traffic to our platforms through performance marketing on general search platforms, which could have an adverse effect on our business and results of operations. We rely on various third-party distribution channels (i.e., marketing affiliates) to distribute accommodation, rental car, and airline ticket reservations. If distribution through such third parties declines, our business, market share, and results of operations could be adversely affected. We offer a range of insurance products related to our travel offerings, primarily through third-party insurance providers. Our business and reputation may be adversely affected if such providers no longer make such offerings available to us on economically reasonable terms or at all.