Gravity Co (GRVY) Risk Analysis

Our biggest geographic markets in terms of revenue for the year ended December 31, 2021 were Thailand, Taiwan, Korea and Japan. The following table sets forth a summary of our consolidated statement of operations showing revenues by geographic area for the periods indicated and the percentage represented by such revenues for the year ended December 31, 2021. Year Ended December 31,Country20212021(1)20202019(In millions of Won and thousands of US$, except percentages)Thailand?94,475 22.8 %US$79,485 ?59,086 ?62,043 Taiwan77,462 18.7 %65,171 100,049 52,118 Korea73,751 17.8 %62,049 109,895 45,273 Japan40,259 9.7 %33,871 22,500 28,469 Malaysia30,422 7.3 %25,595 23,121 13,511 United States/Canada (2)20,894 5.1 %17,579 20,659 55,062 The Philippines20,173 4.9 %16,972 23,690 30,951 Indonesia10,723 2.6 %9,022 12,729 22,355 Others45,779 11.1 %38,516 34,224 51,185 Total?413,938 100.0 %US$348,260 ?405,953 ?360,967 (1)For convenience only, the Won amounts are expressed in the U.S. dollar at the rate of Won  1,188.59 to US$ 1.00, the noon buying rate in effect on December 30, 2021 as certified by the Federal Reserve Bank of New York for customs purposes. (2)Revenues in the United States and Canada, as shown on this table, also include subscription and other types of game revenues generated in other countries managed by Gravity Interactive. Such revenues from other countries constitute an immaterial portion of the revenues recorded as subscription revenues from the United States and Canada.

Gravity is an online and mobile games developer and publisher based in Korea. We generate revenue from online games, mobile games and other sources (including character based merchandise and animation). Our historical principal product, Ragnarok Online, is an online game which is available in 91 markets. Revenues from Ragnarok Online decreased in 2021, representing 17.4% of our total revenues for the year ended December 31, 2021, compared to 20.8% of our total revenues in 2020. This decrease was primarily due to decreased revenue from Ragnarok Online in Thailand re-launched in May 2020. Our focus on mobile games has increased in recent years, and mobile games represented 77.3% of our total revenues for the year ended December 31, 2021. Our principal mobile games, Ragnarok X: Next Generation, Ragnarok M: Eternal Love and Ragnarok Origin accounted for 30.5%, 27.2% and 16.0%, respectively, of our total revenues for the year ended December 31, 2021. In 2020, Ragnarok M: Eternal Love accounted for 43.6% of our total revenues. We intend to continue to diversify our product offering by developing online and mobile games in house or through outsourcing as well as publishing additional games developed by third parties. Our main geographic markets in terms of revenues for the year ended December 31, 2021 were Thailand, Taiwan, Korea and Japan.

We are subject to many laws and regulations in the different countries in which we operate. See ITEM 3.D. "RISK FACTORS-RISKS RELATING TO OUR REGULATORY ENVIRONMENT." A general overview of the material laws and regulations that apply to our business is provided below for the countries from which we derive a significant portion of our revenues. The Korean game industry and online and mobile game companies operating in Korea are subject to the following laws and regulations: The Personal Information Protection Act The Personal Information Protection Act ("PIPA") was enacted on March 29, 2011 and went into effect on September 30, 2011. PIPA's scope covers anyone dealing with personal information in the private and public sectors. An amended version of PIPA, enacted on February 4, 2020 (which came into effect on August 5, 2020) now also includes Special Provisions for Personal Information Processing by Information and Communication Network Providers (the "Special Provisions"), which used to be previously covered in the Act on Promotion of Information and Telecommunications Network Utilization and Information Protection, etc. (the "Information Protection Act"). If a person's personal information is collected or used, or provided to a third person, such person's consent should be obtained. However, under the amended PIPA of February 4, 2020 (which came into effect on August 5, 2020), the consent of such persons does not have to be obtained if (i) it is deemed reasonable for the purpose of collecting information, (ii) no adverse consequences are incurred to such persons and if (iii) measures such as encryptions are taken as necessary to secure safety. Furthermore, the Special Provisions state that personal information may be collected and used without the consent of such persons (i) when the information is necessary for the performance of an information and communication network service contract, but is clearly difficult to obtain under usual procedures due to economic and/or technical reasons, or (ii) if the information is necessary in order to charge the fees incurred by the provision of information and communication network service. If personal information is no longer necessary upon achievement of the purpose of the collection and use of personal information, such information should be immediately destroyed. The Special Provisions also require, in principle, information and communication network providers to take necessary measures (e.g., the destruction of personal information) as required by Presidential Decree to protect the personal information of users who have not used the information and communication network services for a year. Any transaction requiring identifiers granted by law for identification purposes, such as the resident registration number, is generally prohibited, and exceptions are recognized on a restrictive basis only if consent is obtained or required by law. In addition, any person dealing with personal information as determined pursuant to the Presidential Decree, for instance, such as signing up for a website, should provide alternative methods to using the resident registration number. In the event of a personal information leak, the processor of personal information should promptly notify the affected person after discovering such incident. If the volume of the leak of personal information exceeds a certain number, the processor of personal information should report the incident to the authorities and take necessary measures to minimize damages. The Special Provisions also state that upon becoming aware of any loss, theft or leakage of personal information, information and communication network providers must without delay notify the affected users of such fact, and within 24 hours, file a report to the Personal Information Protection Committee or a specialized agency. Information and communication network providers must also take necessary measures such as deleting or blocking the publicly exposed personal information, as requested by the Personal Information Protection Committee or by the specialized agency designated by Presidential Decree. In addition, the same legislation grants to each individual the right to request perusal, the right to request correction or deletion, and the right to request suspension of process with respect to one's personal information, and also provides the methods to exercise such rights. We are required to indemnify users for damages occurring as a result of our violation of the foregoing restrictions, unless we can prove the absence of willful misconduct or negligence on our part. Penalty surcharges are imposed on any information and communication networking provider violating the regulation on the protection of personal information to recover any unfair profits gained by such enterprises, and some conducts, such as collection of personal information of users without their consent, are the subject of criminal punishment. Any information and communication network provider violating its obligation to protect personal information by collecting, using, disclosing such information without consent, and not complying with protective measures, may be imposed with surcharges not exceeding 3% of the sales relevant to the conduct of violation in consideration of the details, degree, period, the number of times and the scale of gained profits. Following the continued occurrence of personal information leakage incidents, PIPA was amended on July 24, 2015 (which came into effect on July 25, 2016) to strengthen personal information protection measures and supplement remedial methods for users by strengthening punishment on personal information processors and introducing a statutory damage compensation system. According to the amended PIPA, a user may claim for statutory damage compensation up to Won 3 million in case of loss, theft or leakage of his/her personal information under management by personal information processors. To promote prompt and fair settlement of disputes concerning personal information, the same legislation also provides that a Personal Information Dispute Mediation Committee, or "PIDMC," should be established and the PIDMC's decision, if accepted by the disputing parties, should have the same legal effect as settlement by trial. In consideration of the fact that most identity theft cases are large in scale and small in the amount of monetary damages, the legislation adopts a collective dispute settlement system. A class action system for personal information has been adopted, but in order to prevent frivolous class action suits, litigants are required to go through the collective dispute settlement system prior to bringing a class action and cases are limited to those seeking suspension or injunctive relief. The Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., or Information Protection Act Previously, the Information Protection Act was silent on mobile application developers' access to personal information of application users, and such application users typically consented to such access as they would otherwise not be permitted to use the mobile application services. However, the Information Protection Act was amended on March 22, 2016 (which came into effect on September 23, 2016) to require mobile application developers to distinguish between information that is critical to provision of material components of the application services and information that is not critical, and clearly explain to each user why access to such critical information is necessary when the developers' request such user to provide consent for such developer's access to the data stored on such user's smart phone. Moreover, a mobile application developer may not refuse to provide services based on a user's refusal to provide access to his or her information which is not critical to provision of the application services. While the current Information Protection Act also includes provisions on matters regarding personal information protection, all such provisions are deleted from the amended version of the Information Protection Act as of February 4, 2020 (which came into effect on August 5, 2020) and integrated into the amended PIPA as of February 4, 2020 (which came into effect on August 5, 2020). The Act on Consumer Protection for Transactions through Electronic Commerce Under this Act, we are required to take necessary measures to maintain the security of consumer information related to our electronic settlement services. We are also required to notify consumers when electronic payments are made and to indemnify consumers for damages resulting from misappropriation of consumer information by third parties. Copyright Act The Copyright Act grants certain protections to general works and computer program works. In connection with computer program works, the Copyright Act provides for restrictions on software copyrights, reverse analysis of computer programs and the establishment of the exclusive right to issue computer programs as a special case apart from other kinds of works. The Copyright Act has the relevant provisions necessary for implementing the Korea-US Free Trade Agreement, such as recognition of temporary storage as copying, introduction of a system of fair use of copyrighted materials, prohibition of acts of infringement on the rights of copyright holders including the distribution of forged labels, and the introduction of statutory damages in accordance with the agreements in the Korea-US Free Trade Agreement. In order to protect the rights of copyright holders in a digital environment, the Copyright Act specifies that temporary storage falls under the scope of "copying" but allows temporary storage to the extent it is deemed necessary for smooth and efficient information processing. Under the Copyright Act, an online service provider will be deemed not liable for copyright infringement: (i) if the online service provider has adopted and reasonably implemented a policy of terminating the account of a person who infringed copyrights or (ii) if the online service provider has accepted and not interfered with a right holder's use of standard technical measures for identifying and protecting copyrighted materials. The Act on Promotion of the Game Industry, or Game Act Under the Game Act, which became effective on April 20, 2007, online games are classified into four categories: "suitable for users of all ages," "suitable for users 12 years of age or older," "suitable for users 15 years of age or older" and "suitable for users 18 years of age or older." The 15 years of age or older category was added between the 12 years of age and 18 years of age categories to increase ratings flexibility. Ragnarok Online has been classified as "suitable for users 12 years of age or older." The Game Act includes the definition of the term "speculative game." A speculative game refers to a game that permits betting and offers monetary loss or profit that is determined by chance. Elements that may cause a game to be considered a speculative game include the existence of game money used as a means for betting or purchasing game items (items used within the game for progression in the game) that become the subject of exchange with real money. The Supreme Court Decision No. 2009Do12117 rendered on February 25, 2010 provided that a ‘speculative game' under the Game Act, should be carried out in accordance with the contents and method prescribed under Article 2, (1-2) of the Game Act, and further, that the term refers to a gaming device or tool which directly provides money, prize or other financial profit or incurs loss on the game user via a payment tool installed on the gaming device or tool depending on the results of the game. Although the Game Act's definition of speculative games and the Supreme Court decision are intended to provide clarity for the determination of whether a game is deemed speculative or not, because our games involve transactions with game items, we have had to take measures to ensure that we are in compliance with the new rules. Such measures include distributing a game after a rating review is conducted by the Game Rating and Administration Committee, or a self-rating review is conducted in respect of such game in accordance with the Article 21-2 of the Game Act. As described above, the Game Act requires a prior rating to be allocated to any game before its distribution in Korea in order to protect young users from violent and otherwise harmful content and to control the distribution of speculative games. Previously, such rating was allocated solely by government agencies in Korea. However, concerns were raised over potential violation of freedom of speech resulting from the requirement that all games must be rated by government agencies. As a result, the Game Act was amended in July 2011 and again in May 2013 to allow a private agency to conduct a rating review on games and permit a self-rating in cases where a game distributor cannot receive a prior rating from the Game Rating and Administration Committee due to special circumstances in its production and distribution channels. In January 2017, the Game Act was amended to allow governmental authorities to designate a "Self Rating Review Company" which would be entitled to conduct a self rating review on all of its games with the exception of adult-only games and arcade games. The governmental authorities have designated Google LLC, Apple Korea Limited, Sony Interactive Entertainment Korea Inc., Samsung Electronics Co., Ltd, Nintendo of Korea Co., Ltd., Kakao Games Corp. etc., as Self Rating Review Companies. In addition, the amendment to the Game Act in January 2017 allowed allocation of game rating only based on game contents. Prior to such amendment, a game rating was required to be conducted in respect of each gaming device or platform regardless of whether different devices and/or platforms are used for the same game contents. Such requirement, however, came under criticism with emergence of a number of new platforms for games such as Internet protocol television and virtual reality devices and development of new games which may be played using multiple platforms at the same time, (such as mobile and online games). The amendment to the Game Act in January 2017 addressed such criticism. A game provider has to report any modification in the content of a game to the Game Rating and Administration Committee or a Self Rating Review Company, which may require the game to be reclassified depending on the scope of the modification. If the Game Rating and Administration Committee determines that the game is speculative, it can refuse to classify such game, in which case the game will be prohibited. According to Article 1-2 of the Enforcement Decree of the Game Act, any games in which money or items of value are collected from a multiple number of persons and profits or losses are allocated based on winnings or losses determined by chance fall under speculative games. According to Article 16-2 of the Enforcement Decree of the Game Act, so long as certain guidelines are followed, a provision of a gift equivalent to a customer price of Won 10,000 or less, with respect to games that are classified as "suitable for users of all ages," is not deemed to be an act that encourages gambling. Under the Game Act, the Minister of Culture, Sports and Tourism may order information and communication service providers to refuse, stop, or restrict the offering of games if such games are unrated, contents are different from those submitted for rating, were denied rating as speculative games, or were manufactured or distributed by a person not registered for operation of manufacturing or distributing games for profit-making. The Game Rating and Administration Committee undertakes examination of the information and communications service providers and provides recommendation of correction to the providers as necessary. In addition, under the Game Act, online game companies are required to comply with the following to prevent players' excessive preoccupation with and addiction to games: (i) verification of registered game users, including through verification of their real names, ages and identities, (ii) obtaining a parent/guardian's consent for minors, (iii) restriction on the playing of games and limits on access hours, among others, when requested by minors or their parent/guardian, (iv)publishing of basic information such as the nature of the game being offered, its rating and in-game purchase policy, and notification to minors and their parents/guardians with respect to game use information such as access hours and payment information, (v) publishing of a warning statement to prevent excessive use of the game, (vi) providing of measures to prevent excessive use of the game including placing the access hour indicator on the game play screen (collectively, the "Prevention Measures"). In accordance with item (iii), upon request from minors or their parents/guardians, an online game company is required to implement the Selective Shut-down System. The Minister of the Ministry of Culture, Sports and Tourism may issue corrective orders if the Prevention Measures adopted are deemed inadequate, and if such corrective orders have not been implemented, imprisonment not exceeding two years or a fine not exceeding Won 20 million may be imposed. The Juvenile Protection Act The Juvenile Protection Act prescribes the establishment of the Juvenile Protection Commission under the authority of the Minister of the Ministry of Health and Welfare in Korea, formerly known as the Ministry for Health, Welfare and Family Affairs, or the "MIHWAF," which has the authority to designate the types of media harmful to juveniles. Under the Juvenile Protection Act, any person who intends to sell, lend or distribute media materials harmful to minors or provides them for viewing or utilization is required to confirm the age of the intended user, and shall not sell, rent or distribute such materials, or provide them for viewing or utilization, to minors. A person in violation may be punished by imprisonment for a maximum of three years or by a fine not exceeding Won 30 million. The MIHWAF issued a public notice announcing that "Web sites for trading items" are considered "harmful mass media" to minors based on the findings of Juvenile Protection Commission that such Web sites for trading online game items are likely to encourage gambling and speculation and negatively influence juveniles. In the public notice, the MIHWAF prohibited any person under the age of 19 from visiting Web sites for trading online game items. A Web site for trading items is a Web site which offers the services of a brokerage or agency for the trading of tangible or intangible things gained from online games as prescribed in the Game Act. The Supreme Court held in a case regarding Item Bay, one of the leading Web sites in Korea for trading online game items, that "Trading items on Item Bay falls under speculative activity as it is hard for game users to resist the temptation of cash trades through which they may easily gain items, which will cause users to be attracted to the cash convertibility of items rather than the game itself." While we offer virtual in-game items for sale to our users on the game Web sites that we operate in Korea, we do not broker the trade of such game items or any other tangible or intangible acquisitions obtained by using online games among our users, and currently do not fall under the category of "Web site for trading items." The Korean Civil Code and the Act on the Establishment and Management of the Korea Communications Commission Pursuant to the Korean Civil Code, contracts entered into with minors, who were persons under 20 years of age, without parental consent under the Korean Civil Code prior to its amendment, may be invalidated. The definition of minors was changed to persons under 19 years of age in the amendment to the Korean Civil Code on March 7, 2011, which became effective on July 1, 2013. Under the Act on the Establishment and Management of the Korea Communications Commission, the Korea Communications Commission ("KCC") was established to oversee services relating to broadcasting and communications and also to deliberate and resolve matters concerning the protection of users' information and communications. As a result, telecommunications service contracts and online game user agreements are required to specifically set forth procedures for rescinding service contracts, which may be entered into by persons under 19 years of age without parental consent. In November 2003, the KCC issued an order addressed to 15 major online game companies in Korea, including us, to regulate certain business practices relating to the settlement of service charges involving minors. The KCC raised concerns about the ability of minors to subscribe to online game services without parental consent by settling charges payable to online game companies through settlement systems operated by fixed-line or broadband service providers. The order required online game companies to implement more specific and effective procedures to ensure, where relevant, that parental consent has been specifically obtained. Although only a small number of our current subscribers were using the settlement options mentioned in the KCC order, we have enhanced our age verification and parental consent procedures for players using the relevant settlement options. In April 2014, to help prevent damages from payments made by minors or unauthorized persons, the KCC required mobile application market providers to strengthen the security apparatus in a charged mobile application as follows: (i) to require setting up a password and entering it before the purchase of a charged mobile application, (ii) to standardize the phrases that indicate the application is a charged one and requires purchase and (iii) to provide certain major notices including the refund policies on the first page of the purchasing process. Moreover, in July 2017, the KCC implemented an alert system regarding minors' usage of paid content within mobile applications, under which the mobile phone account holder and the minor's parents or guardian will be notified upon the purchased amount exceeding a certain threshold. The Telecommunications Business Act Under the Telecommunications Business Act, a person who intends to run a value-added telecommunications business must report to the Ministry of Science, ICT and Future Planning, or the "MSIP", which has the authority to accept and monitor such reports. We are classified as a value-added telecommunications service provider such that we are required to prepare and submit statistical reports regarding, among others, the current status of facilities, subscription records and current status of users to the MSIP upon its request. The MSIP is responsible for compiling information and formulating telecommunications policies under this Telecommunications Business Act. In addition, we are required to report any transfer, takeover, suspension or closing of our business activities to the MSIP, which may issue a correction order if we fail to comply with its rules and regulations. Also, the MSIP may cancel our registration or order us to suspend our business for a period of up to one year if we fail to comply with correction order without a justifiable cause. Meanwhile, Article 2-2 of the Telecommunications Business Act, which was amended on December 24, 2018, established a new application clause for overseas activities which may have an impact on the Korean market or users, and such amendment took effect on January 1, 2021.

As of December 31, 2021, our property and equipment mainly consisted of (i) network servers, (ii) PCs and (iii) right–of-use assets. As of December 31, 2021, the net book value of our property and equipment was Won 11,338 million (US$ 9,539 thousand). Our principal executive and administrative offices are located at 15F, 396 World Cup buk-ro, Mapo-gu, Seoul 03925, Korea. We currently occupy 99,537 square feet of office space, which we lease from National IT Industry Promotion Agency, pursuant to an amendment agreement we entered into on January 1, 2021, amending our lease agreement dated December 31, 2019. The lease expires on December 31, 2022. The annual lease payment amounts to Won 844 million (US$ 710 thousand). The offices of Gravity NeoCyon, our 99.53% owned subsidiary, are located at 12F, 396 World Cup buk-ro, Mapo-gu, Seoul 03925, Korea. Gravity NeoCyon currently occupies 26,244 square feet of office space, subleased from us. The annual lease payment amounts to Won 322 million (US$ 271 thousand). We believe that the existing facilities of Gravity and Gravity NeoCyon are adequate for our current requirements and that additional space can be obtained on commercially reasonable terms to meet our future requirements.

We maintain medical and accident insurance for our employees to the extent required under Korean law, and we also maintain fire and general commercial insurance with respect to our facilities. We do not have any business liability or disruption insurance coverage for our operations in Korea. We maintain a directors' and officers' liability insurance policy covering certain potential liabilities of our directors and officers. See ITEM 3.D. "RISK FACTORS-RISKS RELATING TO OUR BUSINESS-We have limited business insurance coverage and business interruption could have a material adverse effect on our business."