Grid Dynamics Holdings (GDYN) Risk Factors

The issue of companies outsourcing services to organizations operating in other countries is a topic of political discussion in many countries, including the U.S., which is our largest source of revenues. Many organizations and public figures in the U.S. and Europe have publicly expressed concern about a perceived association between offshore outsourcing IT services providers and the loss of jobs in their home countries. For example, measures aimed at limiting or restricting outsourcing by U.S. companies are periodically considered in Congress and in numerous state legislatures to address concerns over the perceived association between offshore outsourcing and the loss of jobs in the U.S. A number of U.S. states have passed legislation that restricts state government entities from outsourcing certain work to offshore IT services providers. Given the ongoing debate over this issue, the introduction and consideration of other restrictive legislation is possible. If enacted, such measures may broaden restrictions on outsourcing by federal and state government agencies and on government contracts with firms that outsource services directly or indirectly, impact private industry with measures such as tax disincentives or intellectual property transfer restrictions, and/or restrict the use of certain business visas. In addition, current or prospective clients may be discouraged from transferring services to providers that utilize offshore delivery centers such as us to avoid any negative perceptions that may be associated with using an offshore provider or for data privacy and security concerns. As a result, our ability to service our clients could be impaired and we may not be able to compete effectively with competitors that operate primarily from within the countries in which our clients operate. Any such slowdown or reversal of the existing industry trends toward offshore outsourcing may have a material adverse effect on our business, financial condition and results of operations. These risks may become more acute as we continue to expand to new geographies internationally. Some of our projects may involve our personnel obtaining visas to travel and work at customer sites outside of our personnel's home countries and often in the United States. Our reliance on visas to staff projects with employees who are not citizens of the country where the work is to be performed makes us vulnerable to legislative and administrative changes in the number of visas to be issued in any particular year and other work permit laws and regulations. The process to obtain the required visas and work permits can be lengthy and difficult and variations due to political forces and economic conditions in the number of permitted applications, as well as application and enforcement processes, may cause delays or rejections when trying to obtain visas. Delays in obtaining visas may result in delays in the ability of our personnel to travel to meet with and provide services to our customers or to continue to provide services on a timely basis. In addition, the availability of a sufficient number of visas without significant additional costs could limit our ability to provide services to our customers on a timely and cost-effective basis or manage our sales and delivery centers as efficiently as we otherwise could. Delays in or the unavailability of visas and work permits could have a material adverse effect on our business, results of operations, financial condition and cash flows.

A tax authority may disagree with tax positions that we have taken, which could result in increased tax liabilities. For example, a tax authority could challenge our allocation of income by tax jurisdiction and the amounts paid between our affiliated companies pursuant to our intercompany arrangements and transfer pricing policies, including methodologies for valuing developed technology and amounts paid with respect to our intellectual property development. A tax authority may take the position that material income tax liabilities, interest and penalties are payable by us, where there has been a technical violation of contradictory laws and regulations that are relatively new and have not been subject to extensive review or interpretation, in which case we expect that we might contest such assessment. High-profile companies can be particularly vulnerable to aggressive application of unclear requirements. Many companies must negotiate their tax bills with tax inspectors who may demand higher taxes than applicable law appears to provide. Contesting such an assessment may be lengthy and costly and if we were unsuccessful in disputing the assessment, the implications could increase our anticipated effective tax rate, where applicable.

We receive, store and process personal information and other data from and about customers in addition to our employees and contractors. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies and various state, local and foreign agencies. Our data handling also is subject to contractual obligations and may be deemed to be subject to industry standards, including certain industry standards that we undertake to comply with. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, the European Union has implemented the General Data Protection Regulation ("GDPR"), which came into effect on May 25, 2018. The GDPR has a significant impact on how businesses can collect and process the personal data of individuals in the European Economic Area ("EEA"). The regulation includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for non-compliance of up to the greater of €20 million or 4% of global annual revenues. With regard to transfers to the U.S. of personal data from our employees and European customers and users, we rely upon standard contractual clauses approved by the European Commission (the "SCCs"). The SCCs have been subject to legal challenge and may be modified or invalidated, and we may be unsuccessful in maintaining legitimate means for the transfer and receipt of personal data from the EEA. In the "Schrems II" decision issued by the Court of Justice of the European Union (the "CJEU") on July 16, 2020, the CJEU deemed the SCCs valid, but ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms must be analyzed on a case-by-case basis to ensure EU standards of data protection are met in the jurisdiction where the data importer is based.  Subsequent guidance from EU regulators has stated that in certain cases, the SCCs must be accompanied by the use of supplementary measures. Concerns remain about the potential for the SCCs and other mechanisms to face additional challenges. On June 4, 2021, the European Commission published new SCCs that are required to be implemented. Additionally, the United Kingdom has enacted legislation that substantially implements the GDPR, with a similar penalty structure, and on February 2, 2022, the United Kingdom's Information Commissioner's Office issued new standard contractual clauses to support personal data transfers out of the United Kingdom ("UK SCCs"). If approved by the United Kingdom Parliament, the UK SCCs will become effective March 21, 2022. We may, in addition to other impacts of the Schrems II decision and other developments relating to cross-border transfer, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA, Switzerland, or the United Kingdom to apply different standards to the transfer of personal data from those regions to the U.S., and to block, or require ad hoc verification of measures taken with respect to, certain data flows from those regions to the U.S. We also may be required to engage in new contract negotiations with third parties that aid in processing data on our behalf. We may experience reluctance or refusal by current or prospective customers in those regions to use our products, and may find it necessary or desirable to make further changes to our handling of personal data of residents of those regions. The regulatory environment applicable to the handling of personal data of residents of the EEA, Switzerland, and the United Kingdom, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and obligations and could result in our business, operating results and financial condition being harmed. Additionally, we and our customers may face a risk of enforcement actions by data protection authorities relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition. In addition, California has enacted legislation that has been described as the first "GDPR-like" law in the U.S. The California state legislature passed the California Consumer Privacy Act ("CCPA") in 2018 and California voters approved a ballot measure subsequently establishing the California Privacy Rights Act ("CPRA") in 2020, which will modify the CCPA and increase the privacy and security obligations of entities handling certain personal information of California residents, including requiring covered companies to provide new disclosures to California consumers, and afford such consumers new abilities to opt-out of certain sales of personal information. The CCPA came into effect on January 1, 2020, and the California Attorney General may bring enforcement actions, with penalties for violations of the CCPA. The CPRA will go into effect on January 1, 2023 instilling enforcement authority in a new dedicated regulatory body, the California Privacy Protection Agency, which will begin carrying out enforcement actions as soon as six months after the enactment date. Other states have also proposed, and in certain aspects enacted, legislation similar to the CCPA. Virginia and Colorado both enacted such laws in 2021, and Utah and Connecticut enacted similar laws in 2022. While aspects of the CCPA, CPRA, other state laws, and their interpretations remain to be determined in practice, we are committed to comply with their obligations. We cannot yet fully predict the impact of these laws on our business or operations, but developments regarding these and all privacy and data protection laws and regulations around the world may require us to modify our data processing practices and policies and to incur substantial additional costs and expenses in an effort to maintain compliance on an ongoing basis. Other countries and jurisdictions throughout the world are considering or enacting laws and regulations requiring the local storage of data. For example, under Russian law, all data operators collecting personal data of Russian citizens through electronic communications, including the Internet, must comply with Russian laws regulating the local storage of such data in databases located in the territory of Russia. This law applies not only to local data controllers but also to data controllers established outside Russia to the extent they gather personal data relating to Russian nationals through websites aimed at the territory of Russia. We have been undertaking measures in an effort to comply with the GDPR, CCPA, CPRA and other applicable privacy and data protection laws and regulations, and our efforts to comply with these laws and regulations may require us to incur substantial operational costs and to require its data handling practices. The costs of our measures designed to comply with, and other burdens imposed by, such laws, regulations and policies that are applicable to us may limit the use and adoption of our products and solutions, alter the way we conduct business and/or could otherwise have a material adverse impact on our results of operations. For example, we may find it necessary to establish systems to maintain data originated in certain jurisdictions within those jurisdictions, which may involve substantial expense and distraction from other aspects of our business. Further, the costs of compliance with, and other burdens imposed by, such laws, regulations and policies that are applicable to us, may limit the use and adoption of our products and solutions and could have a material adverse impact on our results of operations. Any failure or perceived failure (including as a result of deficiencies in our policies, procedures or measures relating to privacy, data protection, data security, marketing or client communications) by us to comply with laws, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to privacy, data protection or data security may result in governmental investigations and enforcement actions, litigation, fines and penalties or adverse publicity and could cause our clients to lose trust in us, which could have a material adverse effect on our reputation, business, financial condition and results of operations. We expect that there will continue to be new proposed laws, regulations and industry standards relating to privacy, data protection, data security, marketing, consumer communications and information security in the U.S., the European Union, Russia and other jurisdictions, and we cannot determine the impact such future laws, regulations and standards may have on our business. Future laws, regulations, standards and other obligations or any changed interpretation or enforcement of existing laws or regulations could impair our ability to develop and market new services and maintain and grow our client base and increase revenue.

Our revenues have historically been highly dependent on a limited number of clients. In the three months ended September 30, 2022 and 2021, we generated a significant portion of our revenues from our largest clients. For example, we generated approximately 59.8% and 61.7% of our revenue from our 10 largest clients during the nine months ended September 30, 2022 and 2021, respectively. Our top two clients each accounted for greater than 10% of our revenue for the nine months ended September 30, 2022 and 2021, respectively. Since a substantial portion of our revenue is derived through time and materials contracts, which are mostly short-term in nature, a major client in one year may not provide the same level of revenues for us in any subsequent year. In addition, a significant portion of our revenues is concentrated in our top two industry verticals: technology and retail. Our growth largely depends on our ability to diversify the industries in which we serve, continued demand for our services from clients in these industry verticals and other industries that we may target in the future, as well as on trends in these industries to outsource the type of services we provide. Our business is also subject to seasonal trends that impact our revenues and profitability between quarters, driven by the timing of holidays in the countries in which we operate and the U.S. retail cycle, which drives the behavior of several of our retail clients. Excluding the impact of growth in our book of business, we have historically recorded higher revenue and gross profit in the second and third quarters of each year compared to the first and fourth quarters of each year. In addition, many of our retail sector clients tend to slow their discretionary spending during the holiday sale season, which typically lasts from late November (before Thanksgiving) through late December (after Christmas). Such seasonal trends may cause reductions in our profitability and profit margins during periods affected. A reduction in demand for our services and solutions caused by seasonal trends, downturns in any of our targeted industries, a slowdown or reversal of the trend to outsource IT services in any of these industries or the introduction of regulations that restrict or discourage companies from outsourcing may result in a decrease in the demand for our services and could have a material adverse effect on our business, financial condition and results of operations.

Our business depends on our ability to successfully obtain payment from our clients of the amounts they owe for work performed. We usually bill and collect such amounts on relatively short cycles and maintain allowances for doubtful accounts. However, actual losses on client balances could differ from those that we anticipate and, as a result, we might need to adjust our allowances. There is no guarantee that we will accurately assess the creditworthiness of our clients. If clients suffer financial difficulties, it could cause them to delay payments, request modifications to their payment arrangements that could increase our receivables balance, or default on their payment obligations. In addition, some of our clients may delay payments due to changes in internal payment procedures driven by rules and regulations to which they are subject. Timely collection of client balances also depends on our ability to complete our contractual commitments and bill and collect contracted revenues. If we are unable to meet our contractual requirements, we may experience delays in collection of or inability to collect accounts receivable. If this occurs, our financial condition, results of operations and cash flows could be materially adversely affected.

Our success largely depends on our ability to use and develop our technology, tools, code, methodologies and services without infringing the intellectual property rights of third parties, including patents, copyrights, trade secrets and trademarks. We may be subject to litigation involving claims of patent infringement or violation of other intellectual property rights of third parties. We typically indemnify clients who purchase our services and solutions against potential infringement of intellectual property rights, which subjects us to the risk of indemnification claims. These claims may require us to initiate or defend protracted and costly litigation on behalf of our clients, regardless of the merits of these claims and are often not subject to liability limits or exclusion of consequential, indirect or punitive damages. If any of these claims succeed, we may be forced to pay damages on behalf of our clients, redesign or cease offering our allegedly infringing services or solutions or obtain licenses for the intellectual property such services or solutions allegedly infringe. If we cannot obtain all necessary licenses on commercially reasonable terms, our clients may be forced to stop using our services or solutions. The holders of patents and other intellectual property rights potentially relevant to our service offerings may make it difficult for us to acquire a license on commercially acceptable terms. Also, we may be unaware of intellectual property registrations or applications relating to our services that may give rise to potential infringement claims against us. There may also be technologies licensed to and relied on by us that are subject to infringement or other corresponding allegations or claims by third parties which may damage our ability to rely on such technologies. Parties making infringement claims may be able to obtain an injunction to prevent us from delivering our services or using technology involving the allegedly infringing intellectual property. Intellectual property litigation is expensive and time-consuming and could divert management's attention from our business. A successful infringement claim against us, whether with or without merit, could, among other things, require us to pay substantial damages, develop non-infringing technology, or rebrand our name or enter into royalty or license agreements that may not be available on acceptable terms, if at all, and would require us to cease making, licensing or using products that have infringed a third party's intellectual property rights. Protracted litigation could also result in existing or prospective clients deferring or limiting their purchase or use of our software product development services or solutions until resolution of such litigation or could require us to indemnify our clients against infringement claims in certain instances. Any intellectual property claims or litigation in this area, whether or not we ultimately win or lose, could damage our reputation and materially adversely affect our business, financial condition and results of operations.

We often incorporate software licensed by third parties under so-called "open source" licenses, which may expose us to liability and have a material impact on our software development services. Use of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide support, warranties, indemnification, or other contractual protections regarding infringement claims or the quality of the code. In addition, the public availability of such software may make it easier for others to compromise our services. Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our client deliverables to conditions we do not intend, the terms of many open source licenses have not been interpreted by courts in relevant jurisdictions, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our clients' ability to use the software that we develop for them and operate their businesses as they intend. Moreover, we cannot assure you that our processes for controlling our use of open source software in our products will be effective. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products. Therefore, there is a possibility that our clients could be subject to actions by third parties claiming that what we believe to be licensed open source software infringes such third parties' intellectual property rights, and we would generally be required to indemnify our clients against such claims. In addition, in the event that portions of client deliverables are determined to be subject to an open source license, we or our clients could be required to publicly release the affected portions of source code or re-engineer all, or a portion of, the applicable software. Disclosing our proprietary source code could allow our clients' competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for our clients. Furthermore, if the license terms for the open source code change, we may be forced to re-engineer our software or incur additional costs. Any of these events could create liability for us to our clients and damage our reputation, which could have a material adverse effect on our business, financial condition and results of operations.

As most of our client projects are performed and invoiced on a time and materials basis, our management tracks and projects billable hours as an indicator of business volume and corresponding resource needs for IT professionals. To maintain our gross profit margins, we must effectively utilize our IT professionals, which depends on our ability to: - integrate and train new personnel;- efficiently transition personnel from completed projects to new assignments;- forecast customer demand for services; and - deploy personnel with appropriate skills and seniority to projects. If we experience a slowdown or stoppage of work for any client, or on any project for which we have dedicated personnel or facilities, we may be unable to reallocate these personnel or assets to other clients and projects to keep their utilization and productivity levels high. If we are unable to maintain appropriate resource utilization levels, including as we relocate personnel from Ukraine and Russia and expand to new geographies, our profitability may suffer.

Our success depends substantially upon the continued services of our senior executives and other key employees. If we lose the services of one or more of such senior executives or key employees, our business operations can be disrupted, and we may not be able to replace them easily or at all. In addition, competition for senior executives and key personnel in our industry is intense, and we may be unable to retain our senior executives and key personnel or attract and retain new senior executives and key personnel in the future, in which case our business may be severely disrupted.

Our business is subject to numerous risks and uncertainties that you should consider before investing in our company, as fully described below. The principal factors and uncertainties that make investing in our company risky include, among others: - We have a relatively short operating history and operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not continue to be successful and may adversely impact our stock price. - We may be unable to effectively manage our growth or achieve anticipated growth, particularly as we expand into new geographies, which could place significant strain on our management personnel, systems and resources. - Our revenues have historically been highly dependent on a limited number of clients and industries that are affected by seasonal trends, and any decrease in demand for outsourced services in these industries may reduce our revenues and adversely affect our business, financial condition and results of operations. - We have incurred significant net losses in recent years, we expect to incur losses in the future and we may not be able to generate sufficient revenue to achieve and maintain profitability. - The impact of the military action in Ukraine has affected and may continue to affect our business. - The impact of the COVID-19 pandemic (and its variants) has and may continue to affect our overall financial performance, business operations, and stock price. - Macroeconomic conditions, inflationary pressures, and the geopolitical climate could adversely affect our operating results and growth prospects. - Our revenues are highly dependent on clients primarily located in the U.S. Any economic downturn in the U.S. or in other parts of the world, including Europe, or disruptions in the credit markets may have a material adverse effect on our business, financial condition and results of operations. - We face intense competition. - Damage to our reputation may adversely impact our ability to generate and retain business. - Our failure to successfully attract, hire, develop, motivate and retain highly skilled personnel could have a significant adverse effect on our business, financial condition, and results of operations. - Our business operations may be severely disrupted if we lose the services of our senior executives and key employees. - Failure to adapt to changing technologies, methodologies, and evolving industry standards may have a material adverse effect on our business, financial condition, and results of operations. - Security breaches and incidents, system failures or errors, and other disruptions to our networks and systems, could result in unauthorized access to, or disclosure or other processing of, confidential information and expose us to liability, which would cause our business and reputation to suffer. - Undetected software design defects, errors or failures may result in loss of business or in liabilities that could have a material adverse effect on our reputation, business and results of operations. - War, terrorism, other acts of violence, or natural or manmade disasters may affect the markets in which we operate, our clients and our service delivery. - Acquisitions, strategic investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management, disrupt our business, dilute stockholder value and adversely affect our financial condition and results of operations, we may not achieve the financial and strategic goals that were contemplated at the time of a transaction, and we may be exposed to claims, liabilities and disputes as a result of the transaction that may adversely impact our business, operating results and financial condition.

Recent events, including new policy introductions following the 2020 U.S presidential election, may result in substantial regulatory uncertainty regarding international trade and trade policy. U.S. policies have called for substantial changes to trade agreements, have increased tariffs on certain goods imported into the U.S. and have raised the possibility of imposing significant, additional tariff increases. In the past, unilateral tariffs on imported products by the U.S. have triggered retaliatory actions from certain foreign governments, including China and Russia, and may trigger retaliatory actions by other foreign governments, potentially resulting in a "trade war." While we cannot predict the extent to which the U.S. or other countries will impose quotas, duties, tariffs, taxes or other similar restrictions upon the import or export of our products in the future, a "trade war" of this nature or other governmental action related to tariffs or international trade agreements could have an adverse impact on demand for our services, sales and clients and affect the economies of the U.S. and various countries, having an adverse effect on our business, financial condition and results of operations. In addition, regulatory, judicial or other developments regarding SPACs or companies, such as us, that have merged with a SPAC, could have an adverse effect on us. For example, the SEC has recently issued several statements regarding regulatory matters involving SPACS, and there can be no assurances that future statements would not have an adverse effect on our business, financial condition and results of operations.

Our business may be adversely affected by instability, disruption or destruction in a geographic region in which we operate, regardless of cause, including war, terrorism, riot, civil insurrection or social unrest, and natural or manmade disasters, including famine, flood, fire, earthquake, storm or pandemic events and spread of disease, such as the COVID-19 pandemic. For example, the significant military action against Ukraine launched by Russia has affected and will further affect our business, and other geopolitical events in the region, including in Serbia, could also adversely affect our business. Such events may cause clients to delay their decisions on spending for the services provided by us and give rise to sudden significant changes in regional and global economic conditions and cycles. These events also pose significant risks to our personnel and to physical facilities and operations, which could materially adversely affect our financial results.