Hyatt Hotels (H) Risk Factors

At December 31, 2023, our executed contract base consisted of approximately 650 hotels, or approximately 127,000 rooms. The commitments of owners and developers with whom we have agreements are subject to numerous conditions, and the eventual development and construction of our pipeline not currently under construction is subject to numerous risks, including, in certain cases, obtaining governmental and regulatory approvals and adequate financing. As a result, we cannot assure you that our entire development pipeline will be completed and developed into new hotels or that those hotels will open when anticipated, which may impact our net rooms growth. We also cannot assure you that consumer demand will meet the new supply as hotels open. The current macroeconomic environment and rising interest rates have resulted in, and could continue to result in, difficulties for certain hotel owners and franchisees to obtain commercially viable financing, which may negatively impact our future development pipeline.

Our brands and our reputation are among our most important assets. Our reputational value is based, in part, on the external perceptions of Hyatt, the quality of our hotels and services, and our corporate and management integrity. We may experience harm to our reputation, loss of consumer confidence, or a negative impact to our results of operations as a result of an incident involving the potential safety or security of our guests, customers, or colleagues; adverse publicity regarding safety or security of travel destinations around the globe or at our competitors' properties, or in respect of our third-party vendors or owners and the industry; or any media coverage resulting therefrom. Additionally, our reputation could be harmed if we fail, or are perceived to fail, to comply with various regulatory requirements or if we fail to act responsibly or are perceived as not acting responsibly in a number of areas such as health, safety and security; data security; diversity and inclusion; group events with controversial groups or speakers; sustainability; responsible tourism; environmental stewardship; supply chain management; climate change; human rights; geopolitical crises; philanthropy and support for local communities; and corporate governance. We manage a broad range of corporate responsibility matters, taking into consideration their expected impact on the sustainability of our business over time, and the potential impact of our business on society and the environment. Despite our efforts, consumer travel preferences may shift due to sustainability-related concerns or costs. In addition, stakeholder expectations regarding such matters are evolving, and we may experience engagement from stakeholders of differing views on these matters. Adverse incidents with respect to our corporate responsibility efforts could impact the value of our brands or our reputation, the cost of our operations, and relationships with investors and stakeholders, all of which could adversely affect our business and results of operations. The continued expansion in the use and influence of social media has compounded the potential scope of negative publicity that could be generated, lead to litigation or governmental investigations, or damage our reputation. Adverse incidents have occurred in the past and may occur in the future. Negative incidents could lead to tangible adverse effects on our business, including lost sales, boycotts, reduced enrollment and/or participation in the loyalty program, or paid membership program, disruption of access to our digital platforms, loss of development opportunities, or reduced colleague retention and increased recruiting difficulties. Any decline in the reputation or perceived quality of our brands or corporate image could adversely affect our market share, business, financial condition, or results of operations.

We collect, use, and retain large volumes of customer data, including payment card numbers and other personal information for business, marketing, and other purposes, and our various information technology systems capture, process, summarize, and report such data. We also maintain personal information and other data about our colleagues, as well as other forms of proprietary business information such as trade secrets. We store and process such customer, colleague, and Company data both at onsite facilities and at third-party owned facilities including, for example, in third-party hosted cloud environments. We also rely on the availability of information technology systems to operate our business, including communications; reservations; digital platforms, including the loyalty program and paid membership program; guest services; payments; and other general operations. The availability and protection of customer, member, colleague, and Company data, as well as the continuous operation of our systems, are critical to our business. Our customers and colleagues expect that we, as well as our third-party owners, franchisees, licensees, hospitality venture partners, and service providers, will adequately protect their personal information and that our services will be continuously available. The regulations and contractual obligations applicable to security and privacy are increasingly demanding, both in the United States and in other jurisdictions where we operate, and cyber threat actors regularly target the hospitality industry, including our business. In addition, the scope and complexity of the cyber-threat landscape could affect our ability to adapt to and comply with changing regulatory obligations and expectations. Because of the scope and complexity of our information technology structure, our reliance on third party hardware, software, and services to support and protect our structure and data, and the constantly evolving cyber-threat landscape, our systems are vulnerable to disruptions, failures, unauthorized access, cyber-terrorism, adverse action by state actors, malfeasance by insiders, human error, negligence, fraud, or other misuse. Moreover, our systems, colleagues, and customers have been, and we expect will continue to be, targeted by social engineering attacks or account takeover tactics that may, among other things, aim to obtain funds or information fraudulently. These or similar occurrences, whether accidental or intentional, have in the past, and could in the future, result in an interruption in the operation of our systems or theft, unauthorized access, disclosure, destruction, encryption by ransomware, loss, and fraudulent or unlawful use of customer, colleague, or Company data, all of which has in the past, and could in the future, impact our business, result in operational interruptions, inefficiencies or loss of business, create negative publicity, cause harm to our reputation, or subject us to remedial and other costs, fines, penalties, investigations, enforcement actions, or lawsuits. Additionally, we increasingly rely on third-party owners, franchisees, licensees, and hospitality venture partners who operate their own networks and systems and engage with their own service providers, and a security incident involving such networks or systems could lead to an interruption in, or other adverse effects on, our business, resulting in operational inefficiencies, potential exposure to fines or litigation, or loss of business, and negative publicity and reputational harm. In addition, we may be subject to data risks and cybersecurity vulnerabilities as part of acquisition activities. Our due diligence and post-acquisition assessments of an acquiree's cybersecurity controls and procedures and information technology systems may not be sufficient to detect current or prior security incidents that have not yet been detected or to identify security measures that are not sufficient to appropriately address security risks to data and business continuity. Any such security incidents may pose material cybersecurity risks, including risks of theft, unauthorized access, disclosure, loss, and fraudulent use of customer colleague, or Company data. We have previously detected and disclosed prior incidents involving cyber threat actors who have attacked our systems, as well as those operated by third-parties. We expect ongoing attempts to gain access to our systems and those operated by our third-party owners, franchisees, licensees, hospitality venture partners, and vendors. We also may be victims of current or future software supply-chain incidents, even if those incidents are not directly targeted at Hyatt. We continue to use an evolving privacy and security risk management framework utilizing risk assessments to identify priorities for enhancements and security updates. While we implement security measures designed to safeguard our systems and data and have business continuity measures, and intend to continue implementing additional measures in the future, our implementation efforts may be incomplete or our measures may not be sufficient or timely enough to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business. We work to continuously evaluate our security posture throughout our business and make changes to our operating processes and improve our defenses. Nonetheless, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information. Attackers are also increasingly sophisticated and using techniques and tools, including artificial intelligence ("AI"), that can circumvent security controls, evade detection and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our systems, information, or business. Furthermore, although we carry cyber insurance that is designed to protect us against certain losses related to cyber risks, that insurance coverage may not be sufficient or available to cover all expenses or other losses that may occur, such as brand and reputational damage, loss of customers, loss of business partners, regulatory investigations, penalties and fines, legal claims brought by customers or employees, significant system or data restoration, remediation or compliance costs, and/or other liabilities that may arise in connection with cyberattacks, security compromises, and other related incidents. Any future occurrences could result in costs and business impacts that may not be covered or may be in excess of any available insurance that we, or our third-party owners, franchisees, licensees, or hospitality venture partners, may have arranged. Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all. As a result, future incidents could have a material impact on our business and adversely affect our financial condition and results of operations.

Our global operations subject us to income taxes (e.g., corporate income, withholding, and other taxes in lieu of corporate income tax) and non-income taxes (e.g., sales, use, value added, goods and services, payroll, property, and franchise taxes in numerous jurisdictions). Our future tax expenses and liabilities could be affected by changes in tax laws or the interpretation of the tax laws, as well as changes in our business operations. Our future tax expenses could be affected by changes in the composition of earnings in jurisdictions with differing tax rates, changes to our transfer pricing methodologies, changes in the valuation of our deferred tax assets and liabilities, including net operating losses, or changes in determinations regarding the jurisdictions in which we are subject to tax. From time to time, the U.S. federal, state, local, and foreign governments make substantive changes to tax rules and the application thereof. The Organization for Economic Cooperation and Development ("OECD") introduced Base Erosion and Profit Shifting Pillar Two rules that impose a global minimum tax rate of 15%. Numerous countries, including European Union member states, have enacted or are expected to enact legislation to be effective as early as January 1, 2024, with general implementation of a global minimum tax by January 1, 2025. We do not expect a material impact to our effective tax rate or cash flows based on currently enacted legislation and will continue to closely monitor evolving legislation and guidance that could change our current assessment. Furthermore, the Inflation Reduction Act of 2022 was enacted in August 2022 and imposed a 15% minimum corporate income tax on certain corporations and a 1% U.S. federal excise tax on certain stock buybacks and similar corporate actions. Legislative and tax treaty changes and the interpretation thereof could result in materially higher corporate taxes than would be incurred under existing or prior tax law or interpretation and could adversely impact profitability. As tax authorities increase their efforts to increase revenue, changes in tax laws and the frequency of tax audits could increase our future tax liabilities. We are subject to ongoing and periodic audits by the Internal Revenue Service ("IRS") and various state, local, and foreign tax authorities and currently are engaged in disputes with certain of such tax authorities. We are a party to certain agreements with tax authorities that reduce or defer the amount of tax we pay. The ultimate results of these agreements, or the expiration of such agreements, or changes in circumstances or in the interpretation of such agreements, could increase our tax costs. We believe we have established adequate reserves for potential tax liabilities, but the final amount of taxes, interest and penalties, in connection with any tax audit, could exceed the amount of such reserves, which could reduce our profits and cash position.

Our operations and properties are subject to extensive environmental laws and regulations of various federal, state, local, and foreign governments, including requirements addressing: - health and safety;- the use, management, storage, and disposal of hazardous substances and wastes;- discharges of waste materials into the environment, such as refuse or sewage;- water discharge and supply;- air emissions;- pollution; and - climate change. We could be subject to liability under some of these laws for the costs of investigating or remediating hazardous substances or wastes on, under, or in real property we currently or formerly manage, own, or develop, or third-party sites where we sent hazardous substances or wastes for disposal. We could be held liable under these laws regardless of whether we knew of, or were at fault in connection with, the presence or release of any such hazardous or toxic substances or wastes. Some of these laws make each covered person responsible for all of the costs involved, even if more than one person may have been responsible for the contamination. Furthermore, a person who arranges for hazardous substances or wastes to be transported, disposed of, or treated offsite, such as at disposal or treatment facilities, may be liable for the costs of removal or remediation if those substances are released into the environment by third parties at such disposal or treatment facilities. The presence or release of hazardous or toxic substances or wastes, or the failure to properly clean up such materials, could cause us to incur significant costs, or jeopardize our ability to develop, use, sell, or rent real property we own, lease, or operate or to borrow using such property as collateral. Other laws and regulations require us to manage, abate, or remove materials containing hazardous substances such as mold, lead, or asbestos during demolitions, renovations, or remodeling at properties that we manage, own, lease, or develop or to obtain permits for certain of our equipment or operations. The costs of such management, abatement, removal, or permitting could be substantial. Further, we may be subject to common law claims by third parties based on damages and costs resulting from violations of environmental regulations or from contamination associated with one or more of our properties. Complying with these laws and regulations, or addressing violations arising under them, could increase our environmental costs and liabilities, reduce our profits, or limit our ability to run our business. The identification of new areas of contamination, a change in the extent or known scope of contamination, a change in cleanup requirements, or the adoption of new requirements governing our operations could have a material adverse effect on our results of operations, financial condition, and business. In addition, existing environmental laws and regulations may be revised or reinterpreted or new more stringent laws and regulations related to global climate change, air quality, or other environmental, health, and safety concerns may be adopted or become applicable to us. For example, compliance with future corporate responsibility and other climate-related legislation and regulation, and our efforts to achieve science-based emissions reduction targets, could be difficult and costly. As a result, we may experience significant increased operating and compliance costs, and operating disruptions or limitations, which could adversely affect our results of operations, financial condition, and business.

We hold significant amounts of goodwill, intangible assets, property and equipment, and investments. On a regular basis, we evaluate our assets for impairment based on various factors, including actual operating results, trends of projected revenues and profitability, and potential or actual terminations of underlying management and hotel services agreements and franchise agreements. During times of economic distress, declining demand and declining earnings often result in declining asset values. As a result, we have incurred impairment charges, and may incur charges in the future, which could be material and may adversely affect our earnings.

Our operations outside the United States represented approximately 24% of our revenues for the year ended December 31, 2023. Our properties outside of the United States represent approximately 51% of the rooms in our system-wide inventory at December 31, 2023. Over the long term, we expect our international operations may account for an increasing portion of our total revenues and rooms. As a result, we are subject to the risks of doing business outside the United States, including: - the costs of complying with laws, regulations, and policies, including taxation policies, of foreign governments relating to investments and operations; the costs or desirability of complying with local practices and customs; and the impact of various anti-corruption and other laws affecting the activities of U.S. companies abroad;- currency exchange rate fluctuations or currency restructurings;- evolving local data residency requirements that require data to be stored only in and, in some cases, also to be accessed only from within a certain jurisdiction;- U.S. taxation of income earned abroad;- limitations on the redeployment of non-U.S. earnings;- import and export licensing requirements and regulations, as well as unforeseen changes in regulatory requirements, including the imposition of tariffs or embargoes, export regulations, controls, and other trade restrictions;- political and economic instability;- health and safety protocols, including global care and cleanliness certifications, at our portfolio of properties;- the complexity of managing an organization doing business in many jurisdictions;- uncertainties as to local laws and enforcement of contract and intellectual property rights and occasional requirements for onerous contract clauses; and - rapid changes in government, economic, and political policies; political or civil unrest; acts of war or terrorism; or the threat of international boycotts or U.S. anti-boycott legislation. While these factors and the impact of these factors are difficult to predict, any one or more of them could lower our revenues, affect our operations, increase our costs, reduce our profits, or disrupt our business. In addition, conducting business in currencies other than U.S. dollars subjects us to fluctuations in currency exchange rates, currency devaluations, or restructurings that could have a negative impact on our financial results. Our exposure to foreign currency exchange rate fluctuations or currency restructurings is expected to continue to grow if the relative contribution of our operations outside the United States increases. We occasionally enter into foreign exchange hedging agreements with financial institutions to reduce certain of our exposures to fluctuations in currency exchange rates. However, these hedging agreements may not eliminate foreign currency risk entirely and involve costs and risks of their own, such as ongoing management time and expertise and external costs related to executing hedging agreements.

Cash balances not required to fund our daily operating activities are invested in interest-bearing investments with a greater focus placed on capital preservation than on investment return. The majority of our cash and cash equivalent balances are held on deposit with high quality financial institutions that hold long-term ratings of at least BBB or Baa from S&P Global ("S&P") or Moody's Investors Service, Inc. ("Moody's"), respectively, and in AAA-rated money market funds. As such, we are exposed to counterparty risk on our cash and cash equivalent balances. We also have established investment accounts for purposes of investing portions of cash resources for the World of Hyatt loyalty program, certain benefit programs, and our captive insurance company. Although we have not recognized any significant losses to date on these investments, any significant declines in their market values could materially adversely affect our financial condition and results. Credit ratings and pricing of these investments can be negatively affected by liquidity, credit deterioration, financial results, economic risk, political risk, sovereign risk, or other factors. As a result, the value and liquidity of our investments could decline and result in impairments, which could materially adversely affect our financial condition and results of operations.