First Advantage (FA) Risk Analysis

We have in the past incorporated, and may in the future continue to incorporate, certain "open-source" software into our codebase and our products and solutions. Open-source software is generally licensed by its authors or other third parties under open-source licenses, which typically do not provide any representations, warranties, or indemnity coverage by the licensor. Some of these licenses provide that combinations of open source software with a licensee's proprietary software are subject to the open source license and require that the combination be made available to third parties in source code form, at no cost, or subject to other unfavorable conditions. Some open-source licenses may also require the licensee to grant licenses under certain of its own intellectual property to third parties. From time to time, there have been claims challenging the ownership of open-source software against companies that incorporate such software into their products or applications. The terms of various open-source licenses have not been interpreted by courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our use of open-source software or our proprietary rights. In addition, if we were to combine our applications with open-source software in a certain manner, we could, under certain of the open-source licenses, be required to publicly release or license, at no cost, our products that incorporate the open-source software or the affected portions of our source code, which could allow our competitors or other third parties to create similar products and solutions with lower development effort, time, and costs, and could ultimately result in a loss of transaction volume for us. If we inappropriately use open-source software, we may be required to redesign our applications, seek licenses from third parties in order to continue offering our products, which may not be available on commercially reasonable terms, or at all, discontinue the sale of our products or solutions, or take other remedial actions, each of which could reduce or eliminate the value of our technologies and could adversely impact our business, operating results, or financial condition. We cannot ensure that we have not incorporated open-source software in our software in a manner that is inconsistent with the terms of the applicable license or our current policies, and we may inadvertently use open source in a manner that we do not intend, or that could expose us to claims for breach of contract or intellectual property infringement, misappropriation, or other violation. If we fail to comply, or are alleged to have failed to comply, with the terms and conditions of our open-source licenses, we could be required to incur significant legal expenses defending such allegations, be subject to significant damages, be enjoined from the sale of our products and solutions, and be required to comply with onerous conditions or restrictions on our products and solutions, any of which could be materially disruptive to our business. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition, or require us to devote additional development resources to change our applications.

A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social, ethical, and legal issues related to artificial intelligence and machine learning. We are increasingly building artificial intelligence and machine learning into many of our offerings and utilize data gathered from various sources in our services to train our machine-learning models. As with many cutting-edge innovations, artificial intelligence and machine learning present new risks and challenges, and existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict. The continuous development, maintenance and operation of our machine-learning models is expensive and complex, and may involve unforeseen difficulties including material performance problems, and undetected defects or errors with new machine-learning or other artificial intelligence capabilities. Some of those difficulties could arise from undetected or uncorrected inaccuracies or unrepresentative tendencies in the data. We may encounter technical obstacles, and it is possible that we may discover additional problems that prevent our machine-learning models from operating properly. If our machine-learning models do not function reliably, we may incorrectly process background checks or suffer extended processing times and other failures of our services, which could result in customer dissatisfaction. The risks and challenges presented by artificial intelligence and machine learning could undermine public confidence in artificial intelligence and machine learning which could slow its adoption and affect our business. Generally, machine-learning models use data about past decisions in a particular situation to create algorithms that make a new decision in a similar situation. If the past decisions on which our machine-learning models are based were affected by a disparate impact based on any legally prohibited classification (such as race or sex), then decisions made by our machine-learning models could have a similarly disparate impact. Consistently making decisions that result in disparate impact could subject us or our customers to legal or regulatory liability. In light of these risks and evolving concerns about the fairness of the effects of use of artificial intelligence, we expect there to be an increased focus on laws and regulations related to our business, because of the growing policy concerns with regard to the collection, use, accuracy, correction and sharing of personal information, and the use of algorithms, artificial intelligence and machine learning in business processes. Failure to adequately address these ethical, social, and legal issues that may arise with such use cases could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or legal liability, which may harm our financial condition and operating results.

Demand for our products and solutions is subject to our customers' continual evaluation of their need for our products and solutions and is impacted by several factors, including their budget availability, hiring and workforce needs, and a changing regulatory landscape. Demand for our offerings is also dependent on the size of our customers' operations. Our customers could reduce their operations for a variety of reasons, including general economic slowdown, divestitures and spin-offs, business model disruption, poor financial performance, or as a result of increasing workforce automation. Demand for drug screenings may decline as a result of evolving U.S. drug laws. For example, the legalization of cannabis in several U.S. states has led to a decrease in orders for marijuana screenings. Our revenues may be significantly reduced should our customers decide to downsize their screening programs or take such programs in-house.

We operate in an industry that involves the risk of negative publicity, especially relating to cybersecurity, privacy, and data protection, and adverse developments with respect to our industry may also, by association, negatively impact our reputation. For example, when information services companies are involved in high-profile events involving data theft, these events could result in increased legal and regulatory scrutiny, adverse publicity, and potential litigation concerning the commercial use of such information for our industry in general. If there is a perception that the practices of our business or our industry constitute an invasion of privacy, our business and results of operations may be negatively impacted. There have been and may continue to be perception issues, social stigmas, and negative media attention regarding the collection, use, accuracy, correction, and sharing of personal data, which could materially adversely affect our business, results of operations, and financial condition.

We are subject to evolving anti-corruption laws, economic and trade sanctions, and anti-money laundering rules in several jurisdictions in which we operate, including the U.S. FCPA and the U.K. Bribery Act. The evolution of this regulatory regime has generally brought about more aggressive investigations and enforcement, which, if targeted towards us, could materially adversely impact our business. We have policies and procedures in place to assist us with monitoring the evolution of these laws and ensuring our ongoing compliance. We are continuously in the process of reviewing, upgrading, and enhancing these protocols. However, we cannot guarantee that our employees, consultants, or agents will not take actions that amount to a violation of these laws and regulations for which we may be ultimately responsible or that our policies and procedures will be adequate in protecting us from liability. Further, our services agreements with several customers contain contractual provisions mandating our ongoing compliance with applicable anti-corruption, economic, and trade sanctions or anti-money laundering laws or regulations. If we are deemed to be in violation of any such rules, our business activities could be restricted or terminated. In addition, we could face civil and criminal penalties, including fines, which could damage our reputation and customer relationships and materially impact our results of operations or financial condition.

Our products and solutions are subject to various complex laws and regulations governing cybersecurity, privacy, and data protection on the federal, state, and local levels, and in foreign jurisdictions. The regulatory framework for privacy issues is rapidly evolving and is likely to remain uncertain and inconsistently enforced for the foreseeable future. Many federal, state, and foreign governmental bodies and agencies have adopted or are considering adopting laws and regulations regarding collecting, processing, handling, maintenance, storage, use, disclosure, sale, and transmission of personal and other sensitive information, including mandatory consumer notification should the unauthorized access of consumer information occur, and further expansion of requirements is possible. It is possible that these restrictions could limit our current or future service offerings, reduce our profitability, or otherwise materially and adversely affect our ability to conduct our business or to do so economically. Further, if our practices or products are perceived to violate applicable laws or regulations, we may be subject to increased scrutiny and public criticism, litigation, investigation, fines, and reputational harm, which could disrupt our business and expose us to liability. Given the nature of our business and the volume data processed in the ordinary course of our operations, it is possible for breaches to occur, whether intentionally from hackers or other third parties, or unintentionally, for example, if we inadvertently send or otherwise make available information to an unauthorized recipient. In the United States, we are subject to numerous federal and state laws governing the collection, processing, use, transmission, disclosure, and sale of personal data (which may also be referred to as personal information, personally identifiable information, and/or non-public personal information). For example, in California, the CCPA, provides for enhanced consumer protections for California residents, a private right of action for data breaches of certain personal information and statutory fines and damages for such data breaches or other CCPA violations, as well as a requirement of "reasonable" cybersecurity. In addition, in November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020, which amends and expands the California Consumer Privacy Act with additional data privacy compliance requirements and establishes a regulatory agency dedicated to enforcing those requirements. Other states also have or are in the process of imposing similar privacy obligations. In addition, laws such as the Biometric Information Privacy Act in Illinois have also restricted the use of biometric information. These and other laws and regulations require us to continuously review our data processing practices and policies, may cause us to incur substantial costs with respect to compliance, and could require us to adapt our products and solutions, which may reduce their utility to our customers. Outside of the United States, we are subject to foreign rules and regulations. For example, we are subject to enhanced compliance and operational requirements under the GDPR, which expanded the scope of data protection in the European Union ("EU") to foreign companies who process the personal data of EU residents, imposed a strict data protection compliance regime with stringent penalties for noncompliance and included new rights for data subjects such as the "portability" of personal data. In particular, under the GDPR, fines of up to 20 million euros, or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR's requirements. If we were found to be in breach of the GDPR, the potential penalties we might face could have a material adverse impact on our business, financial condition, results of operations, and cash flows. Compliance with the GDPR requires time and expense and may require us to make changes to our business operations. While the GDPR applies uniformly across the EU, each EU member state is permitted to issue nation-specific data protection legislation, which has created inconsistencies on a country-by-country basis. The decision by the U.K. to leave the EU ("Brexit") has resulted in a new U.K. data privacy and protection law that essentially tracks the GDPR but is applicable in the U.K. which is no longer a part of the EU. The European Commission has adopted an adequacy decision for the U.K., allowing for transfer of most personal data from the European Economic Area ("EEA") to the U.K, subject to a "sunset clause," which limits the duration of adequacy to four years. However, there will likely be increasing scope for divergence in application, interpretation and enforcement of the data protection law as between the U.K. and EEA. The effects of U.S. state, U.S. federal, local, and international laws and regulations that are currently in effect or that may go into effect in the future are significant and may require us to modify our data processing practices and policies, cease offering certain products and solutions, and incur substantial costs and potential liability in an effort to comply with such laws and regulations. Any actual or perceived failure to comply with these and other cybersecurity, privacy, and data protection laws and regulations could result in regulatory scrutiny or investigation and increased exposure to the risk of litigation or the imposition of consent orders, resolution agreements, requirements to take particular actions with respect to training, policies or other activities, and civil and criminal penalties, including fines, which could have an adverse effect on our business, results of operations, and financial condition. Moreover, allegations of non-compliance, whether or not true, could be costly, time-consuming, and distracting to management and cause reputational harm.

Our Global Operating Center in Bangalore, India provides critical support for our operations by processing screening requests, undertaking a manual review of records and verifications work, handling certain customer calls and interactions, and completing certain internal shared service support functions. We also have other important operational sites, including Fishers, Indiana; Atlanta, Georgia; Manila, Philippines; and Mumbai, India. If our operations at our Global Operating Center or such other sites are disrupted, even for a brief period of time, whether due to malevolent acts, defects, computer viruses, climate change, natural disasters such as earthquakes, fires, hurricanes or floods, power or telecommunications failures, or other external events beyond our control, it could result in interruptions in service to our customers, damage to our reputation, harm to our customer relationships, and reduced revenues and profitability. In addition, strikes, wars, terrorism, and other geopolitical unrest could cause disruptions in our business and lead to interruptions, delays, or loss of critical data. We may not have sufficient protection or recovery plans in certain circumstances, such as a significant natural disaster, and our business interruption insurance may be insufficient to compensate us for losses that occur. In the case of such an event, customers could elect to terminate our relationship, delay or withhold payment to us, or even make claims against us.

Our ability to deliver products to our customers effectively requires us to work with certain third-party vendors and service providers. For example, we engage third-party vendors to maintain and upgrade portions of our software and technology. In addition, from time to time and in certain geographic locations, we engage third-party support service providers depending on demand requirements on our operations and customer service call centers. Our business, therefore, depends on such third parties meeting our expectations and the expectations of our customers in timeliness, quality, and volume. We cannot guarantee our third-party providers will be able to do so on a cost-effective basis or at all due to a number of factors. Some of the third-party vendors that we rely on conduct operations outside of the United States, which subjects us to the risk that economic, political, and military events in foreign jurisdictions might cause an interruption to our operations. We may not be able to ensure that our third-party vendors perform in accordance with agreed-upon, regulated, and expected standards. We could be held accountable for their failure to do so, which may subject us to fines or other sanctions. If our third-party vendors do not meet our expectations and those of our customers, it could negatively affect our reputation, harm our relationships with existing customers, and hamper our ability to win new customers. While we have entered into agreements with some of these third-party service providers, they have no obligation to renew their agreements with us on commercially reasonable terms or at all. If any one of our third-party service provider's ability to perform their obligations was impaired, we may not be able to find an alternative supplier in a timely manner or on acceptable financial terms, which could result in operational interruptions. In addition, any shift in business strategy, corporate reorganization, or financial difficulties, such as bankruptcy faced by our third-party providers, may have negative effects on our ability to implement our business strategy. Any termination of our agreements with, or disruption in the performance of, one or more of these third-party providers could result in operational disruptions and delayed turnaround times. This could adversely impact our relationships with our existing customers, reduce our ability to attract new customers, impact our ability to innovate and introduce new products and solutions, and result in an inability to meet our obligations or require us to seek alternative service providers on less favorable terms, any of which can adversely affect our business, results of operations, and financial condition.