Churchill Downs (CHDN) Risk Analysis

We believe that the prospect of raising significant additional revenue through taxes and fees is one of the primary reasons that certain jurisdictions permit legalized gaming. As a result, gaming companies are typically subject to significant taxes and fees in addition to the normal federal, state, provincial, and local income taxes and such taxes and fees may be increased at any time. From time to time, legislators and officials have proposed changes in tax laws or in the administration of laws affecting the horse racing, online wagering, and casino industries. Many states and municipalities, including ones in which we operate, are currently experiencing budgetary pressures that may make it more likely they would seek to impose additional taxes and fees on our operations. We are subject to tax in multiple U.S. tax jurisdictions and judgment is required in determining our provision for income taxes, deferred tax assets or liabilities, and in evaluating our tax positions. It is not possible to determine the likelihood, extent or impact of any future changes in tax laws or fees, or changes in the administration of such laws; however, if enacted, such changes could have a material adverse impact on our business.

We may decide to develop, construct, and open hotels, casinos, other gaming venues, or racetracks in response to opportunities that may arise. For example, we've announced multiple major multi-year capital investments to transform key areas of Churchill Downs Racetrack, as well as other capital investments such The Rose Dumfries, Owensboro Racing & Gaming, a charitable gaming facility in New Hampshire, and the Terre Haute Casino Resort. Future development projects may require significant capital commitments and the incurrence of additional debt, which could have a material adverse impact on our business. In addition, we may not receive the intended benefits of such capital investments.

Our Churchill Downs Racetrack is dependent upon the number of people attending and wagering on live horse races. If interest in horse racing is lower in the future, it may have a negative impact on revenue and profitability in our Live and Historical Racing segment. In addition, accidents and adverse events that may occur at our racetrack and any reputational damage as a result may negatively impact attendance at our live horse races. If attendance at and wagering on live horse racing declines, it could have a material adverse impact on our business. The number and level of sponsorships are important to the success of the Kentucky Derby. Our ability to retain sponsors, acquire new sponsors, and compete for sponsorships and advertising dollars could have a material adverse impact on our business.

We allow funding and payments to accounts using a variety of methods, including electronic funds transfer ("EFT") and credit and debit cards. As we continue to introduce new funding or payment options to our players, we may be subject to additional regulatory and compliance requirements. We also may be subject to the risk of fraudulent use of credit or debit cards, or other funding and/or payment options. For certain funding or payment options, including credit and debit cards, we may pay interchange and other fees which may increase over time and, therefore, raise operating costs and reduce profitability. We rely on third parties to provide payment-processing services and it could disrupt our business if these companies become unwilling or unable to provide these services to us. We are also subject to rules and requirements governing EFT which could change or be reinterpreted to make it difficult or impossible for us to comply. If we fail to comply with these rules or requirements, we may be subject to fines and higher transaction fees or possibly lose our ability to accept credit or debit cards, or other forms of payment from customers which could have a material adverse impact on our business. Chargebacks occur when customers seek to void credit card or other payment transactions. Cardholders are intended to be able to reverse card transactions only if there has been unauthorized use of the card or the services contracted for have not been provided. In our business, customers occasionally seek to reverse online gaming and other wagering losses through chargebacks. Our control procedures to protect from chargebacks may not be sufficient to protect us from adverse effects on our business or results of operations.

Horse racing, pari-mutuel wagering, and casino gaming businesses depend on the public perception of integrity and fairness in their operations. To prevent cheating or erroneous payouts, necessary oversight processes must be in place to ensure that such activities cannot be manipulated. A lack or loss of confidence in the fairness of our industries could have a material adverse impact on our business. Acts of fraud or cheating in our gaming businesses using counterfeit chips, covert schemes, and other tactics, possibly in collusion with our employees, may be attempted or committed by our gaming customers with the aim of increasing their winnings. Our gaming customers, visitors, and employees may also commit crimes such as theft to obtain chips not belonging to them. We have taken measures to safeguard our interests including the implementation of systems, processes, and technologies to mitigate against these risks, extensive employee training, surveillance, security, and investigation operations and adoption of appropriate security features on our chips such as embedded radio frequency identification tags. Despite our efforts, we may not be successful in preventing or detecting such culpable behavior and schemes in a timely manner and the relevant insurance we have obtained may not be sufficient to cover our losses depending on the incident, which could result in losses to our gaming operations and generate negative publicity, both of which could have an adverse effect on our reputation, business, results of operations, and cash flows. Other factors that could influence our reputation include the quality of the services we offer and our actions with regard to social issues such as diversity, human rights, and support for local communities. Broad access to social media makes it easy for anyone to provide public feedback that can influence perceptions of us or our properties. It may be difficult to control or effectively manage negative publicity, regardless of whether it is accurate. Negative events and publicity could quickly and materially damage perceptions of us, our properties, or our industries, which, in turn, could adversely impact our business, financial condition or results of operations through loss of customers, loss of business opportunities, lack of acceptance of our company to operate in host communities, employee retention, or recruiting difficulties or other difficulties.

We receive, process, store, and use personal information and other customer and employee data by maintaining and transmitting customers' personal and financial information, credit card settlements, credit card funds transmissions, mailing lists, and reservations information. Our collection of such data is subject to extensive regulation by private groups, such as the payment card industry, as well as governmental authorities, including gaming authorities. There are numerous federal, state, and local laws regarding privacy and the storing, sharing, use, processing, disclosure and protection of personal information and other data, and such privacy laws and regulations continue to evolve. Many states have passed laws requiring notification to customers when there is a security breach for personal data, such as the 2002 amendment to California's Information Practices Act or requiring the adoption of minimum information security standards that are often vaguely defined and difficult to implement. California has adopted the California Consumer Privacy Act of 2018 (the "CCPA"), which went into effect on January 1, 2020, providing California consumers greater control of the information collected, stored, and sold, and other states are considering similar legislation. The CCPA provides a private right of action (in addition to statutory damages) for California residents whose sensitive personal information was breached as a result of a business's violation of its duty to reasonably secure such information. The costs of compliance with these laws may increase as a result of changes in interpretation or changes in law. Any failure on our part to comply with these laws or our privacy policies may subject us to significant liabilities, including governmental enforcement actions or litigation. We have experienced cyber attacks in the past. While these attacks did not have a significant impact to the Company, we may continue to experience such attacks. Our systems and processes that are designed to protect customer information and prevent data loss and other security breaches, including systems and processes designed to reduce the impact of a security breach at a third-party vendor or joint venture partner, may not be successful. Interruptions in our services or a breach of a customer's secure data could cause current or potential users to believe that our systems are unreliable, which could permanently harm our reputation and brand. These interruptions could also increase the burden on our engineering staff, which, in turn, could delay our introduction of new features and services on our websites and in our casinos. Such incidents could give rise to remediation costs, monetary fines, and other penalties, which could be significant. We attempt to protect against this risk with our property and business interruption insurance, which covers damage or interruption of our systems, although there is no assurance that such insurance will be adequate to cover all potential losses. Third parties we work with, such as vendors, may violate applicable laws or our privacy policies, and such violations may also put our customers' information at risk and could in turn have an adverse impact on our business. We are also subject to payment card association rules and obligations under each association's contracts with payment card processors. Under these rules and obligations, if information is compromised, we could be liable to payment card issuers for the associated expense and penalties. If we fail to follow payment card industry security standards, even if no customer information is compromised, we could incur significant fines or experience a significant increase in payment card transaction costs. Security breaches, computer malware, and computer hacking attacks have become more prevalent in our industry, and hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks. Many companies, including ours, have been the targets of such attacks. Moreover, the rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Any security breach caused by hacking which involves efforts to gain unauthorized access to information or systems, or to cause intentional malfunctions or loss or corruption of data, software, hardware or other computer equipment, and the inadvertent transmission of computer viruses could harm our business. Though it is difficult to determine what harm may directly result from any specific interruption or breach, any failure to maintain performance, reliability, security, and availability of our network infrastructure to the satisfaction of our players may harm our reputation and our ability to retain existing players and attract new players. The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service, and loss of existing or potential suppliers or customers. As threats related to cyber attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact our results of operations. We have insurance coverage for protection against cyber attacks, which is designed to cover expenses around notification, credit monitoring, investigation, crisis management, public relations, and legal advice. This insurance coverage may not be sufficient to cover all possible claims, and we could suffer losses that could have a material adverse effect on our business. Because the techniques used to obtain unauthorized access, disable, or degrade service, or sabotage systems, change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Economic trends can impact consumer confidence and consumers' discretionary spending, including: - Negative economic conditions and the persistence of elevated levels of unemployment can impact consumers' disposable incomes and, therefore, impact the demand for entertainment and leisure activities. - Inflationary periods negatively impact consumers' discretionary income and could reduce the amount of income previously used for gaming and entertainment. - Declines in the residential real estate market, increases in individual tax rates and other factors that we cannot accurately predict may reduce the disposable income of our customers. - Decreases in consumer discretionary spending could affect us even if such decreases occur in other markets. For example, reduced wagering levels, and profitability at racetracks from which we carry racing content could cause certain racetracks to cancel races or cease operations and therefore reduce the content we could provide to our customers. Lower consumer confidence or reductions in consumers' discretionary spending could result in fewer patrons spending money at our racetracks, our online wagering sites and gaming and wagering facilities, and reduced consumer spending overall. Our access to and the cost of credit may be impacted to the extent global and U.S. credit markets are affected by downward economic trends. Economic trends can also impact the financial viability of other industry constituents, making collection of amounts owed to us uncertain. Our ability to respond to periods of economic contraction may be limited, as certain of our costs remain fixed or even increase when revenue declines.

Our operating results depend, in large part, on revenues derived from customers visiting our casinos and racetracks, which is subject to the occurrence and threat of extraordinary events that may discourage attendance or expose us to substantial liability. Terrorist activity, including acts of domestic terrorism, civil unrest, or other actions that discourage attendance at other locations, or even the threat of such activity, including public concerns regarding air travel, military actions, safety, and additional national or local catastrophic incidents, could result in reduced attendance at Churchill Downs Racetrack and at our other locations. A major epidemic or pandemic, outbreak of a contagious equine disease, or the threat of such an event, could also adversely affect attendance and could impact the supply chain for our major construction projects resulting in higher costs and delays of the projects. For example, the COVID-19 global pandemic resulted in the temporary suspension of operations of all of our wholly owned gaming properties, certain wholly owned racing operations, and the two casino properties related to our equity investments. While we are constantly evaluating our security precautions in an effort to ensure the safety of the public, no security measures can guarantee safety and there can be no assurances of avoiding potential liabilities. Since horse racing is conducted outdoors, unfavorable weather conditions, including extremely high and low temperatures, heavy rains, high winds, storms, tornadoes, and hurricanes, could cause events to be canceled and/or attendance to be lower, resulting in reduced wagering. Climate change could have an impact on longer-term natural weather trends. Extreme weather events that are linked to rising temperatures, changing global weather patterns, sea, land, and air temperatures, as well as sea levels, rain, and snow could result in increased occurrence and severity of adverse weather events. Our operations are subject to reduced patronage, disruptions, or complete cessation of operations due to weather conditions, natural disasters, and other casualties. The occurrence or threat of any such extraordinary event at our locations, particularly at Churchill Downs Racetrack during Kentucky Derby and Oaks week, could have a material negative effect on our business and results of operations.