Dun & Bradstreet Holdings (DNB) Risk Factors

There has been substantial litigation in the United States regarding intellectual property rights in the information technology industry, including infringement litigation in connection with use of artificial intelligence. We may face claims that we infringe on the intellectual property rights of third parties, including the intellectual property rights of third parties in other countries, which could result in a liability to us. In the event that claims are asserted against us, we may be required to obtain licenses from third parties (if available on acceptable terms or at all). Any such claims, regardless of merit, could be time consuming and expensive to litigate or settle, divert the attention of management and materially disrupt the conduct of our business, and we may not prevail. Intellectual property infringement claims against us could subject us to liability for damages and restrict us from providing solutions or require changes to certain solutions. Although our policy is to obtain licenses or other rights where necessary, we may not have obtained all required licenses or rights. With respect to patents, applications in the United States and some foreign countries are not always publicly disclosed until 18 months following submission of the patent application, and we may therefore not be aware of currently filed patent applications that relate to our solutions or processes. If patents are later issued on these applications, we may be liable for infringement. If a successful claim of infringement is brought against us and we fail to develop non-infringing solutions, or to obtain licenses on a timely and cost-effective basis, it could have a material adverse effect on our business, financial condition and results of operations.

The reliability of our solutions is dependent upon the integrity of the data in our global datastores as well as our models, including scores and other analytics. We utilize single source providers in certain countries to support the needs of our clients globally and rely on members of our WWN to provide local data in certain countries. A failure in the integrity of our datastores and models, or an inability to ensure that our usage and processing of data is consistent with legal and regulatory obligations, including any terms or restrictions on such use, whether inadvertently or through the actions of a third party, could harm us by exposing us to client or third-party claims or by causing a loss of client confidence in our solutions. For example, we license data from third parties for inclusion in the data solutions that we sell to our clients, and while we have guidelines and quality control requirements in place, we do not have absolute control over such third parties' data collection and compliance practices. We may experience an increase in risks to the integrity of our datastores as we acquire content through the acquisition of companies with existing databases that may not be of the same quality or integrity as our existing datastores. In addition, there are continuous improvements in computer hardware, network operating systems, programming tools, programming languages, operating systems, data matching, data filtering and other database technologies and the use of the internet as well as emergence of new technologies. These improvements, as well as changes in client preferences or regulatory requirements or transitions to non-traditional or free data sources or new technologies, may require changes in the technology used to gather and process our data and deliver our solutions. Further, we rely on third-party technology contractors that have extensive knowledge of our systems and database technologies. The loss of these third-party contractors could negatively affect our ability to maintain and improve our systems. Our success will depend, in part, upon our ability to: - internally develop and implement new and competitive technologies;- use leading third-party technologies and contractors effectively;- respond to changing client needs and regulatory requirements, including being able to bring our new solutions to the market quickly; and - transition clients and data sources successfully to new interfaces or other technologies. We may not successfully implement new technologies, cause clients or data suppliers to implement compatible technologies or adapt our technology to evolving client, regulatory and competitive requirements. If we fail to respond, or fail to cause our clients or data suppliers to respond, to changes in technology, regulatory requirements or client preferences, the demand for our solutions, the delivery of our solutions or our market reputation could be adversely affected. Additionally, our failure to implement important updates or the loss of key third-party technology consultants could affect our ability to successfully meet the timeline for us to generate cost savings resulting from our investments in improved technology. Failure to achieve any of these objectives would impede our ability to deliver strong financial results. Although we are continually evolving the systems upon which we rely to sustain delivery of our solutions, meet client demands and support the development of new solutions and technologies, certain of our existing infrastructure is comprised of complex legacy technology that requires time and investment to upgrade without disruption to the business. We have in the past been subject to client and third-party complaints and lawsuits regarding our data, which have occasionally been resolved by the payment of monetary damages. We have also licensed, and we may license in the future, proprietary rights to third parties. While we attempt to ensure that the quality of our brand is maintained by the third parties to whom we grant such licenses and by clients, they may take actions that could materially adversely affect the value of our proprietary rights or our reputation, which could have a material adverse effect on our business, financial condition and results of operations.

Our ability to provide solutions to our clients requires that we work with certain third party providers, including software and service providers and network and cloud providers, and depends on such third parties meeting our expectations in both timeliness, quality, quantity and economics. Our third party providers may be unable to meet such expectations due to a number of factors. We might incur significant additional liabilities if the services provided by these third parties do not meet our expectations, if they terminate or refuse to renew their relationships with us or if they were to offer their services to us on less advantageous terms. Although alternative providers may be available to us, we may incur significant expense and research and development efforts to deploy any alternative providers. In addition, while there are backup systems in many of our operating facilities, if these third party providers experience an outage, disruption or cybersecurity incident, we may experience reputational damage, incur liability or experience an extended outage of network services supplied by these vendors or providers that could impair our ability to deliver our solutions, which could have a material adverse effect on our business, financial condition and results of operations.

We are subject to various government regulations affecting our collection, processing, and sale of our data-driven solutions, including but not limited to the FTC Act and the CCPA, as amended by the CPRA, existing and expected rules and regulations in various U.S. states governing the collection, processing and protection of data, privacy rights, data security breach notification and related matters, the GDPR and certain credit information laws and permits as well as constitutional requirements in the European Union, the Cyber Security Law, DSL, and PIPL, and new AI regulations in China and various other international, federal, state and local laws and regulations. See "Business-Regulatory Matters" for a description of select regulatory regimes to which we are subject. These laws and regulations, which generally are designed to protect information relating to individuals and small businesses, the data rights of individuals, and to prevent the unauthorized collection, access to and use of personal or confidential information available in the marketplace and prohibit certain deceptive and unfair acts, are complex and have tended to become more stringent over time. Further, new laws and regulations are likely to be enacted and existing laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. New and amended data protection, privacy, credit, data security, artificial intelligence and environmental, social and governance ("ESG") legislation that may impact Dun & Bradstreet has also been proposed in the U.S., European Union, China, India, and other international markets. We incur significant expenses in our effort to ensure compliance with these laws, and those expenses may increase as new laws or regulations are enacted or the interpretation and application of existing laws and regulations change. We responded to a second civil investigative demand from the U.S. Federal Trade Commission ("FTC") that we received in September 2019 in relation to an investigation by the FTC into potential violations of Section 5 of the FTC Act, primarily concerning our credit managing and monitoring products, such as CreditBuilder. Following consent negotiations, on September 21, 2021, we agreed to enter into an Agreement Containing Consent Order (the "FTC Consent Order") subject to acceptance by the FTC, the approval of which was finalized on April 6, 2023. The FTC Consent Order requires that we undertake specific compliance practices, recordkeeping, monitoring and reporting during its term, which ends on April 6, 2042. Our compliance with the FTC Consent Order may cause us to incur significant expenses or to reduce the availability or effectiveness of our solutions. Failure to comply with the FTC Consent Order could subject us to civil or criminal penalties or other liabilities. On March 17, 2023, along with four other industry peers, we were served by the FTC with an Order under Section 6(b) of the FTC Act (the "6(b) Order"), which authorizes the FTC to conduct wide-ranging studies that do not have a specific law enforcement purpose, in connection with the FTC's inquiry into the small business credit reporting industry. Certain requirements of the 6(b) Order relate to subject matter similar to the scope of the FTC Consent Order. The FTC's 6(b) inquiry is expected to examine various aspects of the collection, processing, and quality of information concerning small businesses for purposes of business credit reports and other business risk solutions, as well as the marketing and commercial practices related to such solutions, and various related matters. It is too early to determine what action, if any, the FTC may take with respect to its findings from its inquiry. It is possible that the FTC's findings could result in FTC rule making or other action that may impact our business. Some new U.S. state laws are intended to provide consumers (including sole proprietors) with greater transparency and control over their personal data as well as to provide additional obligations and duties for businesses. These laws place requirements on a broad scope of data sales and processing, which are likely to affect our business. Additionally, the duties and obligations for data handling, time sensitive privacy rights management, assessments, contracts, and similar requirements are expected to create more operational burdens on our business. We anticipate that additional state and/or federal legislation in the U.S. relating to these matters will be enacted in the future and that our operations will need to continue to evolve to accommodate unique considerations across jurisdictions. The following legal and regulatory developments also could have a material adverse effect on our business, financial condition or results of operations: - changes in cultural and consumer attitudes in favor of further restrictions on information collection use and transfer, which may lead to regulations that prevent full utilization of our solutions and impair our ability to transfer data across borders;- failure of data suppliers, third party processors, or clients to comply with laws or regulations, where mutual compliance is required or where our ability to comply is dependent on the compliance of those parties;- failure of our solutions to comply with current laws and regulations or the requirements of the FTC Consent Order; and - failure to adapt our solutions to changes in the regulatory environment in an efficient, cost-effective manner. This would include the failure to modify existing solutions, or new solutions created internally or acquired through mergers, to comply with existing or evolving legal requirements. Changes in applicable legislation or regulations that restrict or dictate how we collect, maintain, combine and disseminate information could have a material adverse effect on our business, financial condition or results of operations. In the future, we may be subject to significant additional expense to ensure continued compliance with applicable laws and regulations and the FTC Consent Order and to investigate, defend or remedy actual or alleged violations. Moreover, our compliance with privacy and other data laws and regulations and our reputation depend in part on our clients' and business partners' adherence to such laws and regulations and their use of our solutions in ways consistent with client expectations and regulatory requirements. Businesses today are under intense scrutiny to comply with an ever-expanding and evolving set of data regulatory requirements, which can vary by geography and industry served. As such, performing adequate diligence on clients and suppliers can be cumbersome and dampen the pace of their business expansion or leave a business exposed to fines and penalties. Further, certain of the laws and regulations governing our business are subject to interpretation by judges, juries and administrative entities, creating substantial uncertainty for our business. We cannot predict what effect the interpretation of existing or new laws or regulations may have on our business.

We are from time to time subject to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our clients in connection with commercial disputes, defamation claims by subjects of our reporting and employment claims made by our current or former employees. We also may be subject to regulatory inquiries, investigations or other proceedings by U.S. and foreign government regulators, such as those related to the 6(b) Order or the civil investigative demand that gave rise to the FTC Consent Order. We may incur material costs and expenses in connection with any inquiries, investigations, claims or other proceedings, including but not limited to fines or penalties and legal costs, or we may be subject to other remedies including those that may require changes to the way we operate our businesses or may otherwise cause management distraction or reputational harm, any of which could have a material adverse effect on our business, financial condition and results of operations. Insurance may not be available or sufficient to cover any loss or expense relating to any such investigations and claims or may not continue to be available on terms acceptable to us.

Our future success substantially depends on the continued service and performance of the members of our senior leadership team. These individuals possess business and technical capabilities that are difficult to replace. If we lose key members of our senior management operating team or are unable to effect smooth transitions from one executive to another as part of our succession plan, we may not be able to effectively manage our current operations or meet ongoing and future business challenges, and this could have a material adverse effect on our business, financial condition and results of operations.