Diebold Nixdorf (DBDQQ) Risk Analysis

The Company is subject to compliance with various laws and regulations, including worldwide anti-bribery laws. Anti-bribery laws generally prohibit companies, and third parties acting on their behalf, from engaging in bribery or making or receiving other improper payments to another person or entity, including government officials for the purpose of obtaining or retaining business or gaining an unfair business advantage or inducing a person to act improperly or rewarding them for doing so. The FCPA also requires proper record keeping and characterization of such payments in the Company's reports filed with the SEC. The Company's employees and agents are required to comply with these laws. The Company operates in many parts of the world that have experienced governmental and commercial corruption to some degree, and strict compliance with anti-bribery laws may conflict with local customs and practices. Non-US companies, including some that may compete with the Company, may not be subject to the FCPA or other anti-bribery laws and may follow local customs and practices. Accordingly, such companies may be more likely to engage in activities prohibited by the anti-bribery laws which apply to the Company, which could have a significant adverse impact on the Company's ability to compete for business in such countries. Despite the Company's commitment to legal compliance and corporate ethics, it cannot ensure that its policies and procedures will always protect it from intentional, reckless or negligent acts committed by its employees or agents. Violations of these laws, or allegations of such violations, could disrupt the Company's business and result in financial penalties, debarment from government contracts and other consequences that may have a material adverse effect on its reputation, business, financial condition or results of operations. Future changes in anti-bribery or economic sanctions laws and enforcement could also result in increased compliance requirements and related expenses that may also have a material adverse effect on its business, financial condition or results of operations.

During the Chapter 11 Cases and the Dutch Scheme Proceedings, we expect our financial results to be volatile as restructuring activities and expenses, contract terminations and rejections, and claims assessments significantly impact our consolidated financial statements. As a result, the amount and composition of the Company's assets, liabilities, officers and/or directors could be significantly different following the outcome of the Chapter 11 Cases and the Dutch Scheme Proceedings, and our historical financial performance is likely not indicative of our future financial performance. In particular, the description of the Company's operations, properties and liquidity and capital resources included in this Quarterly Report on Form 10-Q may not accurately reflect our operations, properties and liquidity and capital resources following the Chapter 11 process and Dutch restructuring process. In addition, the composition of our management team may change significantly. Qualified individuals are in high demand and we may incur significant costs to attract them. In addition, the loss of any of our senior management or other key employees or changes in the composition of our management team could materially and adversely affect our ability to execute their strategy and implement operational initiatives and have a material and adverse effect on our financial condition, liquidity and results of operations.

The Company sponsors several defined benefit pension plans that cover certain eligible employees across the globe. The Company's pension expense and required contributions to its pension plans funded with assets are directly affected by the value of plan assets, the projected rate of return on plan assets, the actual rate of return on plan assets and the actuarial assumptions it uses to measure the defined benefit pension plan obligations. A significant market downturn could occur in future periods resulting in a decline in the funded status of the Company's pension plans and causing actual asset returns to be below the assumed rate of return used to determine pension expense. If return on plan assets in future periods perform below expectations, future pension expense will increase.

The Company relies on other companies, including subcontractors and suppliers, to provide and produce raw materials, integrated components and sub-assemblies and production commodities included in, or used in the production of, its products. If one or more of the Company's subcontractors or suppliers experiences delivery delays or other performance problems, it may be unable to meet commitments to its customers or incur additional costs. In some instances, the Company depends upon a single source of supply. Any service disruption from one of these suppliers, either due to circumstances beyond the supplier's control, such as geo-political developments or public health concerns (including viral outbreaks, such as COVID-19), or as a result of performance problems or financial difficulties, could have a material adverse effect on the Company's ability to meet commitments to its customers or increase its operating costs. At present, the overall impact of the COVID-19 pandemic is difficult to predict, but it may have a material adverse impact on the Company's overall business, financial condition and results of operations, in particular if COVID-19 infection rates resurge in other countries and regions, including as a result of new variants. The Company manufactures a substantial amount of its products in Paderborn, Germany, and Manaus, Brazil. In addition, certain of our products are manufactured in China. Any damage suffered by these critical locations and manufacturing plants could negatively impact our business and results of operations. While the Company maintains insurance policies that provide coverage up to certain limits for some of the potential risks and liabilities associated with its business, it does not maintain insurance policies for all risks and liabilities.

The U.K.'s exit from the EU (Brexit) and the resulting significant change to the U.K.'s relationship with the EU and with countries outside the EU (and the laws, regulations and trade deals impacting business conducted between them) could disrupt the overall economic growth or stability of the U.K. and the EU and negatively impact the Company's European operations. The U.K. and the EU have entered into a free trade agreement that now governs the U.K.'s relationship with the EU. While the U.K. and the EU can generally continue to trade with each other without the imposition of tariffs for imports and exports, there are new customs requirements that require additional documentation and data, and there are also new controls on the movement and reporting of goods. Although we have not experienced any material disruption in our business as a result of Brexit, we do not know the extent to which Brexit and the free trade agreement will ultimately impact the business and regulatory environment in the U.K., the rest of the EU or other countries, although it is possible there will be tighter controls and administrative requirements for imports and exports between the U.K. and the EU or other countries, as well as increased regulatory complexities. Any of these factors could adversely impact customer demand, our relationships with customers and suppliers and our results of operations.

To reduce these risks, the Company has programs and measures in place designed to detect and help safeguard against cybersecurity attacks. Although we have implemented cybersecurity measures designed to detect and limit the risk of unauthorized access to our systems and acquisition of, loss, modification of, use, access to, or disclosure of our data, threat actors are using evolving, sophisticated, and ever-changing techniques to obtain unauthorized access to systems and data. The types and motivations of threat actors that may attempt to access our systems also are evolving and expanding, and include sophisticated nation-state sponsored and organized cyber-criminals, who are targeting the financial services industry. As a result, the risk of cyberattack is increasing. An attack, disruption, intrusion, denial of service, theft or other data or cybersecurity incident (such as phishing attack, virus, ransomware, or other malware installation), or an inadvertent act by an employee or contractor, could result in unauthorized access to, acquisition of, loss, disclosure, or modification of, our systems, products, and data (or our third-party service provider's systems, products, and data), which may result in operational disruption, loss of business, claims (including by customers, financial institutions, cardholders, and consumers), costs and reputational harm that could negatively affect our operating results. The Company could incur significant expenses in investigating and addressing cybersecurity incidents, including the expenses of deploying additional personnel, enhancing or implementing additional protection measures, training employees or hiring consultants, and such incidents could divert the attention of our management and key personnel from our business operations. Further, remedial measures may later prove inadequate to prevent or reduce the impact of new or emerging threats. The Company may face regulatory investigations or litigation relating to cybersecurity incidents, which may be costly to defend and which, if successful, may require the Company to pay damages and fines, incur expenses to comply with consent orders or injunctions, and/or change its business practices. The Company also is subject to risks associated with cyberattacks involving our supply chain. We may also detect, or may receive notice from third parties (including governmental agencies and those in our supply chain) of potential vulnerabilities in our information technology systems, our products, or third-party products used in conjunction with our products. Even if these potential vulnerabilities do not affect our products, services, data, or systems, their existence or claimed existence could adversely affect customer confidence and our reputation in the marketplace, causing us to lose existing or potential customers. To the extent such vulnerabilities require remediation, such remedial measures could require significant resources, may not be implemented before such vulnerabilities are exploited, and may not prevent or reduce the risk. As the cybersecurity landscape evolves, we may also find it necessary to make significant further investments to protect data and infrastructure. We maintain cybersecurity insurance intended to cover some of these risks, but this insurance may not be sufficient to cover all of our losses from future cybersecurity incidents the Company may experience. We have experienced cybersecurity incidents in the past, but none of these incidents, individually or in the aggregate, has had a material adverse effect on our business, reputation, operations or products. The Company has in place various information technology protections designed to detect and reduce cybersecurity incidents, although there can be no assurance that our protections will be successful. The Company also regularly evaluates its protections against cybersecurity incidents, including through self-assessments and third-party assessments, and takes steps to enhance those protections in response to specific threats and as part of the Company's information security program. There can be no assurance, however, that the Company will be able to prevent, reduce the risk of, or remediate all future cybersecurity incidents or that the cost associated with responding to any such incident or impact of such incident will not be significant or material. Portions of the Company's IT infrastructure also may experience interruptions, delays or cessations of service or produce errors in connection with systems integration or migration work that takes place from time to time. The Company may not be successful in implementing new systems, and transitioning data and other aspects of the process could be expensive, time consuming, disruptive and resource-intensive. Such disruptions could adversely impact the ability to fulfill orders, service customers and interrupt other processes and, in addition, could adversely impact the Company's ability to maintain effective internal control over financial reporting. Delayed sales, lower margins, lost customers or diminished investor confidence resulting from these disruptions could adversely affect the Company's financial results, stock price and reputation. The Company's actual or perceived failure to comply with increasing and increasingly stringent laws, regulations and contractual obligations relating to privacy, data protection and information security could harm its reputation, subject the Company to significant fines and liability or loss of business, and decrease demand for the Company's services. The Company and its customers are subject to privacy, data protection, and information security laws and regulations ("Data Protection Laws") in the United States and in jurisdictions around the globe that restrict the collection, use, disclosure, transfer and processing of personal data, including financial data. For example, the Company and its customers are subject, without limitation, to the European Union General Data Protection Regulation ("GDPR"), the U.K. General Data Protection Regulation, the California Consumer Privacy Act ("CCPA"), and the Brazilian Lei Geral de Proteção de Dados. Costs to comply with these Data Protection Laws are significant. Failure to comply with these laws could result in material legal exposure and business impact, including the loss of customers and decreased demand for our products and services. The GDPR, for example, imposes onerous accountability obligations on companies, with penalties for non-compliance of up to the greater of €20 and four percent of annual global revenue. The GDPR, and other Data Protection Laws, also grant corrective powers to supervisory authorities, including the ability to impose a limit on processing personal data or ability to order companies to cease operations. The Data Protection Laws are part of an evolving global data protection landscape in which the number, complexity, requirements, and consequences of non-compliance with these laws are increasing. This landscape includes legislative proposals recently adopted or currently pending in the United States, at both the federal and state levels (including by banking agencies), as well as in other jurisdictions, implementing new or additional requirements for data protection that could increase compliance costs, the cost and complexity of delivering our services, and significantly affect our business. Additionally, the interpretation and application of new data protection laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. Complying with these evolving and varying standards, and implementing the required operational changes as a result of such standards, could require significant expense and effort and may require us to change our business practices or the functionality of our products and services in a manner adverse to our customers and our business. In addition, violations of these laws can result in governmental investigations, significant fines, penalties, claims by regulators or other third parties, imposition of limits on the processing of data, and damage to our brand and business. Like other global companies, to conduct its operations, the Company transfers data across international borders. Transferring personal data across international borders is complex and subject to legal and regulatory requirements. In many cases, the laws and regulations governing such transfers apply not only to transfers between unrelated third parties but also to transfers between the Company and its subsidiaries. There is also active litigation and enforcement with respect to data transfers in a number of jurisdictions around the world, each of which could have an adverse impact on our ability to process and transfer personal data as part of our business operations. Some countries have also enacted or are enacting data localization laws that prohibit or significantly restrict the transfer of data out of the country. Developments related to cross-border transfers, including the Court of Justice July 2020 ruling in the "Schrems II" case as well as related guidance from the European Data Protection Board, have resulted in some changes to the way we provide our services in the European Union and conduct our business, and could expose us to potential sanctions and fines for non-compliance. If we cannot transfer data from some jurisdictions or implement valid mechanisms for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal data from Europe or elsewhere, and require us to increase our personal data or other data processing capabilities in the Europe Union and/or elsewhere at significant expense. In addition to our legal obligations, our contractual obligations relating to privacy, data protection and information security have become increasingly prevalent and stringent due to changes in laws and regulations, including the development related to cross-border transfers, as well as the heightened regulatory requirements in the financial services industry. Certain Data Protection Laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. If we are unable to comply with our contractual obligations, this could impact our reputation and result in liabilities and loss of business.