Foot Locker (FL) Risk Factors

The U.S. Foreign Corrupt Practices Act ("FCPA") and similar worldwide anti-corruption laws, including the U.K. Bribery Act of 2010, which is broader in scope than the FCPA, generally prohibit companies and their intermediaries from making improper payments to government officials for the purpose of obtaining or retaining business. Our internal policies mandate compliance with these anti-corruption laws. Despite our training and compliance programs, we cannot be assured that our internal control policies and procedures will always protect us from reckless or criminal acts committed by our employees or agents. Our continued expansion outside the United States, including in developing countries, could increase the risk of FCPA violations in the future. Violations of these laws, or allegations of such violations, could have a material adverse effect on our results of operations or financial condition.

We are exposed to the risk that federal or state legislation may negatively affect our operations. Changes in federal or state wage requirements, employee rights, health care, social welfare, or entitlement programs, including health insurance, paid leave programs, or other changes in workplace regulation could increase our cost of doing business or otherwise adversely affect our operations. Additionally, we are regularly involved in litigation and demands, including commercial, tort, intellectual property, customer, employment, wage and hour, data privacy, anti-corruption, and other claims, including purported class action lawsuits. The cost of defending against these types of claims against us or the ultimate resolution of such claims, whether by settlement, mediation, arbitration, or adverse court or agency decision, may harm our business.

There is increasing scrutiny and evolving expectations from investors, customers, regulators, and other stakeholders on ESG practices and disclosures, including those related to environmental stewardship, climate change, and diversity, inclusion, and belonging. Legislators and regulators have imposed, and likely will continue to impose, ESG-related legislation, rules, and guidance, which may conflict with one another and impose additional costs on us, impede our business opportunities, or expose us to new or additional risks. For example, developing and acting on ESG-related initiatives, including sourcing and operational decisions, collecting, measuring, and reporting ESG-related information and metrics can be costly, difficult and time consuming and is subject to evolving reporting standards, including the SEC's recently approved climate-related reporting requirements and sustainability reporting requirements in the European Union. In addition, state attorneys general and other state officials have spoken out against ESG-motivated investing by some investment managers and terminated contracts with managers based on their following certain ESG-motivated strategies. Moreover, proxy advisory firms that provide voting recommendations to investors have developed ratings for evaluating companies on their approach to different ESG matters, and unfavorable ratings of our company or our industry may lead to negative investor sentiment and the diversion of investment to other companies or industries. If we are unable to meet these standards or expectations, whether established by us or third parties, it could result in adverse publicity, reputational harm, or loss of customer and/or investor confidence, which could adversely affect our business, results of operations, financial condition, and liquidity.

Our performance is subject to global economic conditions and the related effects on consumer spending levels. Continued uncertainty about global economic conditions poses a risk as consumers and businesses may postpone spending in response to tighter credit, unemployment, negative financial news, and/or declines in income or asset values, which could have a material negative effect on demand for our products. The ongoing conflicts in Ukraine and the Middle East may lead to disruption in the global supply chain, rising fuel costs, or cybersecurity risks, and economic instability generally, any of which could materially and adversely affect our business and results of operations. Additionally, with the U.K.'s exit from the European Union in January 2020, known as Brexit, the ongoing uncertainties of the trading relationship between the U.K. and the European Union have yet to be completely realized and the ultimate outcome and long-term impacts for the U.K. and Europe remain uncertain. Ongoing changes and uncertainties related to Brexit, including trade frictions and Britain's high inflation rate, continue to subject us to heightened trade risks in that region. In addition, disruptions to trade and free movement of goods, services, and people to and from the U.K., disruptions to the workforce of our business partners, increased foreign exchange volatility with respect to the British pound, and additional legal, political, and economic changes also subject us to further uncertainty in the region. As a retailer that is dependent upon consumer discretionary spending, our results of operations are sensitive to changes in macroeconomic conditions. Our customers may have less money for discretionary purchases as a result of job losses, foreclosures, bankruptcies, increased fuel and energy costs, higher interest rates, higher taxes, reduced access to credit, and lower home values. These and other economic factors could adversely affect demand for our products, which could adversely affect our financial condition and operating results.

Information technology is a critical part of our business operations. We depend on information systems to process transactions, analyze customer behaviors through our loyalty program, make operational decisions, manage inventory, operate our websites, purchase, sell and ship goods on a timely basis, and maintain cost-efficient operations. There is a risk that we could experience a business interruption, theft of information, or reputational damage as a result of a cyber-attack, such as an infiltration of a data center or data leakage of confidential information, either internally or through our third-party providers. We may experience operational problems with our information systems as a result of system failures, system implementation issues, viruses, malicious hackers, sabotage, or other causes. We invest in security technology to protect the data stored by us, including our data and business processes, against the risk of data security breaches and cyber-attacks. Our data security management program includes enforcement of standard data protection policies such as Payment Card Industry compliance and other regulatory requirements. Additionally, we evaluate our major technology suppliers and any outsourced services through accepted security assessment measures. We maintain and routinely test backup systems and disaster recovery, along with external network security penetration testing by an independent third party as part of our business continuity preparedness. While we believe that our security technology and processes follow appropriate practices in the prevention of security breaches and the mitigation of cybersecurity risks, given the ever-increasing abilities of those intent on breaching cybersecurity measures and given the necessity of our reliance on the security procedures of third-party vendors, the total security effort at any point in time may not be completely effective. Failure of our systems, either internally or at our third-party providers, including failures due to cyber-attacks that would prevent the ability of systems to function as intended, could cause transaction errors, loss of customers and sales, and negative consequences to us, our employees, and those with whom we do business. A cyberattack on a communications network or power grid could cause operational disruption resulting in loss of revenues. Any security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential information by us could also severely damage our reputation, expose us to the risks of litigation and liability, increase operating costs associated with remediation, and harm our business. While we carry insurance that would mitigate losses in connection with security breaches and cyber incidents, insurance may be insufficient to compensate us fully for potentially significant losses. On July 26, 2023, the SEC adopted a final rule on cybersecurity risk management, strategy, governance, and incident disclosure (the "SEC Cyber Rule"). The SEC Cyber Rule requires public companies to make current disclosures about material cybersecurity incidents, as well as annual disclosures of material information about their cybersecurity risk management, strategy, and governance. The SEC Cyber Rule became effective on September 5, 2023. New data security laws add additional complexity, requirements, restrictions and potential legal risk, and compliance programs may require additional investment in resources, and could affect strategies and availability of previously useful data.

We continue to invest in initiatives designed to deliver a high-quality, coordinated shopping experience online, in stores, and on mobile devices, which requires substantial investment in technology, information systems, and employee training, as well as significant management time and resources. Our omni-channel retailing efforts include the integration and implementation of new technology, including technology and software associated with our ERP implementation, and processes to be able to fulfill orders from any point within our system of stores and distribution centers, which is extremely complex and may not meet customer expectations for timely and accurate deliveries. These efforts involve substantial risk, including risk of implementation delays, cost overruns, technology interruptions, supply and distribution delays, and other issues that can affect the successful implementation and operation of our omni-channel initiatives. If our omni-channel initiatives are not successful we may not be able to provide a relevant shopping experience, or we may not realize the return on our omni-channel investments that we anticipate, our financial performance and future growth could be materially adversely affected.

Our comparable-store sales have fluctuated significantly in the past, on both an annual and a quarterly basis, and we expect them to continue to fluctuate in the future. A variety of factors affect our comparable-store sales results, including, among others, fashion trends, product innovation, promotional events, the highly competitive retail sales environment, economic conditions, timing of income tax refunds, changes in our merchandise mix, calendar shifts of holiday periods, declines in foot traffic, supply chain disruptions, and weather conditions. Many of our products represent discretionary purchases. Accordingly, customer demand for these products could decline in an economic downturn or if our customers develop other priorities for their discretionary spending. These risks could have a material adverse effect on our business, financial condition, and results of operations.