CBRE Group (CBRE) Risk Factors

Recently, there has been heightened interest from advocacy groups, government agencies and the general public in ESG matters and increasingly regulators, customers, investors, employees and other stakeholders are focusing on ESG matters and related disclosures. Such governmental, investor and societal attention to ESG matters, including expanding mandatory and voluntary reporting, diligence, and disclosure on topics such as climate change, human capital, labor and risk oversight, could expand the nature, scope, and complexity of matters that we are required to control, assess and report. We are subject to changing rules and regulations promulgated by a number of governmental and self-regulatory organizations, including the SEC, the New York Stock Exchange and the Financial Accounting Standards Board. Further, new and emerging regulatory initiatives in the U.S., EU and U.K. related to climate change and ESG could adversely affect our business, including, for example, initiatives such as the European Commission's May 2018 "action plan on financing sustainable growth" and Taskforce on Climate-related Financial Disclosures (TCFD)-aligned disclosure requirements in the U.K. These and other rules and regulations continue to evolve in scope and complexity and many new requirements have been created in response to laws enacted by the U.S. congress, making compliance more difficult and uncertain. These changing rules, regulations and stakeholder expectations have resulted in, and are likely to continue to result in, increased general and administrative expenses and increased management time and attention spent complying with or meeting such regulations and expectations. For example, developing and acting on new or ongoing initiatives within the scope of ESG, and collecting, measuring and reporting ESG related information and metrics may be costly, difficult and time consuming and subject to evolving reporting standards, including the SEC's proposed climate-related reporting requirements, California's Climate Corporate Data Accountability Act and Greenhouse Gases: Climate-related Financial Risk Act, and similar proposals by other international regulatory bodies. Further, we may choose to communicate certain initiatives and goals, regarding environmental matters, diversity, responsible sourcing and social investments and other ESG related matters, in our SEC filings or in other public disclosures. These initiatives and goals within the scope of ESG could be difficult and expensive to implement and we could be criticized for the accuracy, adequacy or completeness of the disclosure. Statements about our ESG related initiatives and goals, and progress against those goals, may be based on standards for measuring progress that are still developing, internal controls and processes that continue to evolve, and assumptions that are subject to change in the future. We could also be criticized for the scope or nature of such initiatives or goals, or for any revisions thereto. If we are unable to adequately address such ESG matters or if we fail to achieve progress with respect to our goals within the scope of ESG on a timely basis, or at all, or if we or our borrowers fail or are perceived to fail to comply with all laws, regulations, policies and related interpretations, it could negatively impact our reputation and our business results.

We are subject to numerous United States federal, state, local, and international laws and regulations regarding privacy, data protection and cybersecurity that govern the processing of certain data (including personal information, sensitive information, health information, and other regulated data). These laws and regulations are increasing in severity, complexity and number, change frequently, and increasingly conflict among the various jurisdictions in which we operate, which has resulted in greater compliance risk and cost for us. In addition, we are also subject to the possibility of security breaches and other incidents, which themselves may result in a violation of these laws. For example, the European Union General Data Protection Regulation (GDPR) became effective on May 25, 2018, and has resulted and will continue to result in significantly greater compliance burdens and costs for businesses established in the European Union (EU) or European Economic Area (EEA) or who are established outside the EU or EEA and offer goods or services, or monitor the behavior of individuals located in the EU or EEA, including with respect to cross-border transfers of personal information. Under GDPR, fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater, may be imposed for violations. Further, the U.K.'s withdrawal from the EU and ongoing developments in the U.K. have created additional compliance obligations and some uncertainty regarding whether data protection regulation in the U.K. will further diverge from the GDPR. As of December 31, 2023, we are required to comply with the GDPR as well as the U.K. equivalent and other global data protection laws (including in Switzerland, Japan, Singapore, China, United Arab Emirates, Australia, and Brazil), the implementation of which exposes us to parallel data protection regimes, each of which potentially authorizes similar fines and other enforcement actions for certain violations. In the U.S., the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) broadly defines personal information, gives California residents expanded privacy rights and protections, and provides for civil penalties for certain violations, and established a regulatory agency dedicated to enforcing those requirements. At least a dozen states including Colorado, Connecticut, Texas and Virginia, have also passed comprehensive privacy laws protecting residents acting in their individual or household capacities, and several states, most notably Illinois, have passed laws regulating the processing of biometric information. These state laws impose additional obligations and requirements on impacted businesses. We are also subject to an increasing number of reporting obligations in respect of material cybersecurity incidents. These reporting requirements have been proposed or implemented by a number of regulators in different jurisdictions, may vary in their scope and application, and could contain conflicting requirements. Certain of these rules and regulations may require us to report a cybersecurity incident before we have been able to fully assess its impact or remediate the underlying issue. Efforts to comply with such reporting requirements could divert management's attention from our cybersecurity incident response and could potentially reveal system vulnerabilities to threat actors. Failure to timely report cybersecurity incidents under these rules could also result in regulatory investigations, litigation, monetary fines, sanctions, or subject us to other forms of liability. A significant actual or potential theft, loss, corruption, exposure, fraudulent use or misuse of client, employee or other personal information or proprietary business data, whether by third parties or as a result of employee malfeasance or otherwise, perceived or actual non-compliance with our contractual or other legal obligations regarding such data or intellectual property or a violation of our privacy and security policies with respect to such data could result in significant remediation and other costs, fines, litigation or regulatory actions against us. Such an event could additionally disrupt our operations and the services we provide to clients, harm our relationships with contractors and vendors, damage our reputation, result in the loss of a competitive advantage, impact our ability to provide timely and accurate financial data and cause a loss of confidence in our services and financial reporting, which could adversely affect our business, revenues, competitive position and investor confidence. Additionally, we rely on third parties to support our information and technology networks, including cloud storage solution providers, and as a result have less direct control over our data and information technology systems. Such third parties are also vulnerable to security breaches and compromised security systems, for which we may not be indemnified and which could materially adversely affect us and our reputation.

We conduct a significant portion of our business and employ a substantial number of people outside of the U.S. and, as a result, we are subject to risks associated with doing business globally. During the year ended December 31, 2023, approximately 45% of our revenue was transacted in foreign currencies. We also report our results in U.S. dollars. As a result, the strengthening or weakening of the U.S. dollar will positively or negatively impact our reported results, including revenue and earnings as well as the assets under management for our investment management business, which could have a material adverse effect on our business, financial condition and operating results. Due to the constantly changing currency exposures to which we are subject and the volatility of currency exchange rates, we cannot predict the effect of exchange rate fluctuations upon future operating results.

We have approximately 130,000 employees (including Turner & Townsend employees) as well as independent contractors working in over 100 countries. We have undertaken to implement what we believe to be best practices to safeguard the health, safety and security of our employees, independent contractors, clients and others at our worksites. However, if these policies, procedures and programs are not adequate, or employees do not receive related adequate training or follow them for any reason, the consequences may be severe to us, including serious injury or loss of life, which could impair our operations and cause us to incur significant legal liability or fines as well as reputational damage. Our insurance may not cover, or may be insufficient to cover, any legal liability or fines that we incur for health, safety or security incidents.