Kaleyra (KLR) Risk Analysis

In the ordinary course of operating Kaleyra's network and providing its services, Kaleyra must obtain and maintain a variety of telecommunications and other licenses and authorizations. Kaleyra also must comply with a variety of regulatory obligations. There can be no assurance Kaleyra can maintain its licenses or that they will be renewed upon their expiration. Kaleyra's failure to obtain or maintain necessary licenses, authorizations or to comply with the obligations imposed upon license holders, including the payment of fees, may cause sanctions or additional costs, including the revocation of authority to provide services. Kaleyra's operations are subject to regulation at the national level and, often, at the state and local levels. Kaleyra's operations will become subject to additional regulation by other countries as Kaleyra expands to international markets. Changes to existing regulations or rules, or the failure to regulate going forward in areas historically regulated on matters such as network neutrality, licensing fees, environmental, health and safety, privacy, intercarrier compensation, emergency 911 services interconnection and other areas, in general or particular to Kaleyra's industry, may increase costs, restrict operations or decrease revenue. As Kaleyra expands internationally, Kaleyra will also become subject to telecommunications laws and regulations in the foreign countries where Kaleyra offers its products. Kaleyra's international operations are subject to country-specific governmental regulation that may increase its costs or impact its products and Platforms or prevent Kaleyra from offering or providing Kaleyra's products in certain countries. Kaleyra's inability or failure to comply with telecommunications and other laws and regulations could cause the temporary or permanent suspension of Kaleyra's operations, and if Kaleyra cannot provide emergency calling functionality through its Platforms to meet any new federal or state requirements, or any applicable requirements from other countries, the competitive advantages that Kaleyra currently has may not persist, adversely affecting Kaleyra ability to obtain and to retain enterprise customers which could have an adverse impact on Kaleyra's business.

The law relating to the liability of private network operators for information carried on or disseminated through their networks remains unsettled. While Kaleyra disclaims any liability for third-party content in Kaleyra's services agreements, Kaleyra may become subject to legal claims relating to the content disseminated on Kaleyra's network, even though such content is owned or distributed by Kaleyra customers or a customer of Kaleyra customers. For example, lawsuits may be brought against Kaleyra claiming that material distributed using Kaleyra's network was inaccurate, offensive or violated the law or the rights of others. Claims could also involve matters such as defamation, invasion of privacy and copyright infringement. In addition, the law remains unclear over whether content may be distributed from one jurisdiction, where the content is legal, into another jurisdiction, where it is not. Companies operating private networks have been sued in the past, sometimes successfully, based on the nature of material distributed, even if the content is not owned by the network operator and the network operator has no knowledge of the content or its legality. It is not practical for Kaleyra to monitor all of the content distributed using Kaleyra's network. Kaleyra may need to take costly measures to reduce Kaleyra's exposure to these risks or to defend itself against such claims, which could increase Kaleyra's costs and harm its results of operations.

Kaleyra generally conducts Kaleyra global operations through subsidiaries and report Kaleyra's taxable income in various jurisdictions worldwide based upon Kaleyra's business operations in those jurisdictions. In particular, Kaleyra's intercompany relationships are subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Also, Kaleyra's tax expense could be affected depending on the applicability of withholding and other taxes (including withholding and indirect taxes on software licenses and related intercompany transactions) under the tax laws of certain jurisdictions in which Kaleyra has business operations. The relevant revenue and taxing authorities may disagree with positions Kaleyra has taken generally, or Kaleyra's determinations as to the value of assets sold or acquired or income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and Kaleyra's position were not sustained, Kaleyra could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of Kaleyra's operations. Certain government agencies in jurisdictions where Kaleyra and its affiliates do business have had an extended focus on issues related to the taxation of multinational companies. In addition, the Organization for Economic Co-operation and Development is conducting a project focused on base erosion and profit shifting in international structures, which seeks to establish certain international standards for taxing the worldwide income of multinational companies. As a result of these developments, the tax laws of certain countries in which Kaleyra and its affiliates do business could change on a prospective or retroactive basis, and any such changes could increase Kaleyra‘s liabilities for taxes, interest and penalties, and therefore could harm Kaleyra's business, cash flows, results of operations and financial position.

Kaleyra and its customers that use Kaleyra's products may be subject to data protection-related laws and regulations that impose obligations in connection with the collection, processing and use of personal data, financial data, health or other similar data. The U.S. federal and various state and foreign governments have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of personally identifiable information of individuals. The U.S. Federal Trade Commission and numerous state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of data, and to the security measures applied to such data. Similarly, many foreign countries and governmental bodies, including the EU member states, have laws and regulations concerning the collection and use of personally identifiable information obtained from individuals located in the EU or by businesses operating within their jurisdiction, which are often more restrictive than those in the U.S. laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personally identifiable information that identifies or may be used to identify an individual, such as names, telephone numbers, message addresses and, in some jurisdictions, IP addresses and other online identifiers. For example, in April 2016 the EU adopted the GDPR, which took full effect on May 25, 2018. GDPR enhances data protection obligations for businesses and requires service providers (data processors) processing personal data on behalf of customers to cooperate with European data protection authorities, implement security measures and keep records of personal data processing activities. Noncompliance with the GDPR can trigger fines equal to or greater of €20 million or 4% of global annual revenues. Given the breadth and depth of changes in data protection obligations, preparing to meet the requirements of GDPR has required significant time and resources, including a review of Kaleyra's technology and systems currently in use against the requirements of GDPR. There are also additional EU laws and regulations (and member states' implementations thereof) which govern the protection of consumers and of electronic communications. If Kaleyra's efforts to comply with GDPR or other applicable EU laws and regulations are not successful, Kaleyra may be subject to penalties and fines that would adversely impact Kaleyra's business and results of operations, and Kaleyra's ability to conduct business in the EU could be significantly impaired. Furthermore, outside of the EU, Kaleyra continues to see increased regulation of data privacy and security, including the adoption of more stringent subject matter specific state laws in the U.S. For example, on June 28, 2018, California enacted the CCPA, which took effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase Kaleyra's compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent state privacy legislation in the U.S., which could increase Kaleyra's potential liability and adversely affect its business. Kaleyra continues to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin. These regulations may inhibit Kaleyra's ability to expand into those markets or prohibit Kaleyra from continuing to offer services in those markets without significant additional costs. The uncertainty and changes in the requirements of multiple jurisdictions may increase the cost of compliance, delay or reduce demand for Kaleyra's services, restrict Kaleyra's ability to offer services in certain locations, impact Kaleyra's customers' ability to deploy its solutions in certain jurisdictions, or subject Kaleyra to sanctions, by national data protection regulators. Additionally, although Kaleyra endeavors to have its products and Platforms comply with applicable laws and regulations, these and other obligations may be modified, they may be interpreted and applied in an inconsistent manner from one jurisdiction to another, and they may conflict with one another, other regulatory requirements, contractual commitments or Kaleyra's internal practices. Kaleyra also may be bound by contractual obligations relating to its collection, use and disclosure of personal, financial and other data or may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy- or data protection-related organizations that require compliance with their rules pertaining to privacy and data protection. Kaleyra expects that there will continue to be new proposed laws, rules of self-regulatory bodies, regulations and industry standards concerning privacy, data protection and information security in the U.S, the EU and other jurisdictions, and Kaleyra cannot yet determine the impact such future laws, rules, regulations and standards may have on Kaleyra's business. Moreover, existing U.S. federal and various state and foreign privacy- and data protection-related laws and regulations are evolving and subject to potentially differing interpretations, and various legislative and regulatory bodies may expand current or enact new laws and regulations regarding privacy- and data protection-related matters. Because global laws, regulations and industry standards concerning privacy and data security have continued to develop and evolve rapidly, it is possible that Kaleyra or its products or Platforms may not be, or may not have been, compliant with each such applicable law, regulation and industry standard and compliance with such new laws or to changes to existing laws may impact Kaleyra's business and practices, requires Kaleyra to expend significant resources to adapt to these changes, or to stop offering Kaleyra's products in certain countries. These developments could harm Kaleyra's business. Any failure or perceived failure by Kaleyra, its products or its Platforms to comply with new or existing U.S., EU or other foreign privacy or data security laws, regulations, policies, industry standards or legal obligations, or any security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other customer data may result in governmental investigations, inquiries, enforcement actions and prosecutions, private litigation, fines and penalties, adverse publicity or potential loss of business.

In the years ended December 31, 2021 and 2020, Kaleyra's 10 largest customers generated an aggregate of 42% and 52% of its revenue, respectively. In the event that Kaleyra's large customers do not continue to use its products, use fewer of its products, or use its products in a more limited capacity, or not at all, Kaleyra's revenue could be limited and Kaleyra's business could be harmed.

Kaleyra's business depends on its ability to successfully obtain payment from its customers of the amounts they owe Kaleyra for technology offerings sold or services performed. Kaleyra typically evaluates the financial condition of its customers and usually bills and collects on relatively short cycles. Kaleyra maintains allowances against receivables and unbilled services. Actual losses on client balances could differ from those that Kaleyra currently anticipate and, as a result, Kaleyra might need to adjust its allowances. There is no guarantee that Kaleyra will accurately assess the creditworthiness of its customers. Macroeconomic conditions could also result in financial difficulties for Kaleyra's customers, including limited access to the credit markets, insolvency, or bankruptcy, and, as a result, could cause customers to delay payments to Kaleyra, request modifications to their payment arrangements that could increase Kaleyra's receivables balance, or default on their payment obligations to Kaleyra. Timely collection of client balances also depends on Kaleyra's ability to complete its contractual commitments and bill and collect its contracted revenue. If Kaleyra is unable to meet its contractual requirements, it might experience delays in collection of and/or be unable to collect its client balances. In addition, if Kaleyra experiences an increase in the time to bill and to collect for its services, Kaleyra's cash flows could be negatively impacted.

Kaleyra believes that maintaining and enhancing Kaleyra's brand identity and increasing market awareness of Kaleyra and its services are critical to achieving widespread acceptance of Kaleyra and its Platforms, as well as to strengthen Kaleyra's relationships with its existing customers and to Kaleyra's ability to attract new customers. The successful promotion of Kaleyra's brand will depend largely on Kaleyra's continued marketing efforts, Kaleyra's ability to continue to offer high quality services and Kaleyra's ability to successfully differentiate Kaleyra's services from competing products and services. Kaleyra's brand promotion activities may not be successful or yield increased revenue. In addition, independent industry analysts often provide reviews of Kaleyra's services and competing products and services, which may significantly influence the perception of Kaleyra's services in the marketplace. If these reviews are negative or not as strong as reviews of Kaleyra's competitors' services, then Kaleyra's brand may be harmed. From time to time, Kaleyra's customers have complained about Kaleyra's services. If Kaleyra does not handle customer complaints effectively, then Kaleyra's brand and reputation may suffer, Kaleyra's customers may lose confidence in Kaleyra and they may reduce or cease their use of Kaleyra's services. Kaleyra's success depends, in part, on Kaleyra's ability to generate positive customer feedback. Complaints or negative publicity about Kaleyra, its services or Platforms could harm Kaleyra's ability to attract and retain customers. The promotion of Kaleyra's brand also requires Kaleyra to make substantial expenditures, and Kaleyra anticipates that these expenditures will increase as Kaleyra's market becomes more competitive and as Kaleyra expands into new markets. To the extent that these activities increase revenue, this revenue still may not be enough to offset the increased expenses Kaleyra incurs. If Kaleyra does not successfully maintain and enhance its brand, then Kaleyra's business may not grow, Kaleyra may see its pricing power reduced relative to competitors and Kaleyra may lose customers, all of which could lower Kaleyra's revenue and harm its business.

Kaleyra operates in a highly competitive, quickly changing environment, and Kaleyra's future success depends on its ability to develop or acquire, and introduce new products and services that achieve broad market acceptance. Kaleyra's ability to successfully introduce and market new products is unproven. Because Kaleyra has a limited operating history and the market for its products, including newly acquired or developed products, is rapidly evolving, it is difficult to predict Kaleyra's operating results, particularly with respect to any new products that it may introduce. Kaleyra's future success will depend in large part upon its ability to identify demand trends in the market in which it will operate and quickly develop or acquire, and design, manufacture and sell, products and services that satisfy these demands in a cost-effective manner. In order to differentiate Kaleyra's products and services from competitors' products, Kaleyra will need to increase focus and capital investment in research and development, including software development. If any products currently sold by, and services offered by, Kaleyra do not continue, or if Kaleyra's new products or services fail to achieve widespread market acceptance, or if Kaleyra is unsuccessful in capitalizing on opportunities in the market in which Kaleyra operates, our future growth may be slowed and its business, results of operations and financial condition could be materially adversely affected. Successfully predicting demand trends is difficult, and it is very difficult to predict the effect that introducing a new product or service will have on existing product or service sales. It is possible that Kaleyra may not be successful with its new products and services, and as a result Kaleyra's future growth may be slowed and our business, results of operations and financial condition could be materially adversely affected. Also, Kaleyra may not be able to respond effectively to new product or service announcements by competitors by quickly introducing competitive products and services. In addition, Kaleyra may acquire companies and technologies in the future. In these circumstances, Kaleyra may not be able to successfully manage integration of the new product and service lines with our existing suite of products and services. If Kaleyra is unable to effectively and successfully further develop these new product and service lines, Kaleyra may not be able to increase or maintain sales (as compared to sales of Kaleyra on a standalone basis), and our gross margin (as compared to sales of Kaleyra on a standalone basis) may be adversely affected. Furthermore, the success of Kaleyra's new products will depend on several factors, including, but not limited to, market demand costs, timely completion and introduction of these products, prompt resolution of any defects or bugs in these products, Kaleyra's ability to support these products, differentiation of new products from those of the Kaleyra's competitors, market acceptance of these products, delays and quality issues in releasing new products and services. The occurrence of one or more of the foregoing factors may result in lower quarterly revenue than expected, and Kaleyra may in the future experience product or service introductions that fall short of its projected rates of market adoption.

Kaleyra cannot be sure that its brand, technology offerings, and services, including, for example, the software solutions of others that Kaleyra offers to its customers, do not infringe on the intellectual property rights of third parties, and these third parties could claim that Kaleyra or its customers are infringing upon their intellectual property rights. These claims could harm Kaleyra's reputation, cause Kaleyra to incur substantial costs or prevent Kaleyra from offering some services or solutions in the future or require Kaleyra to rebrand. Any related proceedings could require Kaleyra to expend significant resources over an extended period of time. In most of Kaleyra's contracts, Kaleyra agrees to indemnify its customers for expenses and liabilities resulting from claimed infringements of the intellectual property rights of third parties. Any claims or litigation in this area, regardless of merit, could be time-consuming and costly, damage Kaleyra's reputation, and/or require Kaleyra to incur additional costs to obtain the right to continue to offer a service or solution to its customers. If Kaleyra cannot secure this right at all or on reasonable terms, or, alternatively, substitute a non-infringing technology, Kaleyra's business, results of operations, or financial condition could be harmed. Similarly, if Kaleyra is unsuccessful in defending a trademark claim, Kaleyra could be forced to re-brand, which could harm its business, results of operations, or financial condition. Additionally, in recent years, individuals and firms have purchased intellectual property assets where their sole or primary purpose is to assert claims of infringement against technology providers and customers that use such technology. Any such action naming Kaleyra or its customers could be costly to defend or lead to an expensive settlement or judgment against Kaleyra. Moreover, such an action could result in an injunction being ordered against Kaleyra's client or Kaleyra's own services or operations, causing further damages.

Kaleyra's products and Platforms incorporate open source software, and Kaleyra expects to continue to incorporate open source software in its products and Platforms in the future. Few of the licenses applicable to open source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on Kaleyra's ability to commercialize its products and Platforms. Moreover, although Kaleyra has implemented policies to regulate the use and incorporation of open source software into Kaleyra's products and Platforms, Kaleyra cannot be certain that it has not incorporated open source software in Kaleyra products or Platforms in a manner that is inconsistent with such policies. If Kaleyra fails to comply with open source licenses, Kaleyra may be subject to certain requirements, including requirements that it offer Kaleyra's products that incorporate the open source software for no cost, that Kaleyra make available source code for modifications or derivative works Kaleyra creates based upon, incorporating or using the open source software and that it license such modifications or derivative works under the terms of applicable open source licenses. If an author or other third party that distributes such open source software were to allege that Kaleyra has not complied with the conditions of one or more of these licenses, Kaleyra could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products. In any of these events, Kaleyra and its customers could be required to seek licenses from third parties in order to continue offering Kaleyra's products and Platforms and to re-engineer Kaleyra's products or Platforms or discontinue offering its products to customers in the event re-engineering cannot be accomplished on a timely basis. Any of the foregoing could require Kaleyra to devote additional research and development resources to re-engineer Kaleyra's products or Platforms, which could result in customer dissatisfaction and could harm Kaleyra's business.

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets. Furthermore, the most recent global financial crisis caused extreme volatility and disruptions in the capital and credit markets. A severe or prolonged economic downturn, including due to the impact of the COVID-19 pandemic or one that could result from the recent military conflict between Russia and Ukraine, could result in a variety of risks to our business, including a reduced ability to raise additional capital when needed on acceptable terms, or at all. Furthermore, supply chain issues that developed in 2021, and the nature, magnitude, and duration of hostilities stemming from Russia's military conflict with Ukraine, including the effects of sanctions and retaliatory cyber-attacks on the world economy and markets, could negatively impact our business. Any of the foregoing could harm our business and we cannot anticipate all of the ways in which the current economic climate and financial market conditions could adversely impact our business.

Kaleyra is headquartered in Milan, Italy, has a sizable presence in India and the United States, and operates in other countries throughout the world. In addition, Kaleyra's customers have operations throughout the world, and Kaleyra derives a substantial part of its revenue internationally. As a result, Kaleyra may be subject to risks inherently associated with international operations, including risks associated with foreign currency exchange rate fluctuations, difficulties in enforcing intellectual property and/or contractual rights, the burdens of complying with a wide variety of foreign laws and regulations, including economic sanctions and export control regulations, potentially adverse tax consequences, tariffs, quotas, and other barriers, potential difficulties in collecting trade receivables, international hostilities, such as the military conflict between Russia and Ukraine, terrorism, and natural disasters. Expansion of international operations also increases the likelihood of potential or actual violations of domestic and international anticorruption laws, such as the U.S. Foreign Corrupt Practices Act, or of U.S. and international export control and sanctions regulations. Kaleyra may also face difficulties integrating any new facilities in different countries into its existing operations, as well as integrating employees that it hires in different countries into its existing corporate culture. If Kaleyra is unable to manage the risks of its global operations, its business could be harmed.

A significant natural disaster, such as an earthquake, fire or flood, occurring at Kaleyra's headquarters, at one of Kaleyra's other facilities or where a business partner is located could adversely affect Kaleyra's business, results of operations and financial condition. Further, if a natural disaster or man-made problem were to affect Kaleyra's service providers, this could adversely affect the ability of Kaleyra's customers to use its products and Platforms. In addition, natural disasters and acts of terrorism could cause disruptions in Kaleyra's or its customers' businesses, national economies or the world economy as a whole. Kaleyra also rely on its network and third-party infrastructure and enterprise applications and internal technology systems for Kaleyra's engineering, sales and marketing, and operations activities. Although Kaleyra maintains incident management and disaster response plans, in the event of a major disruption caused by a natural disaster or man-made problem, Kaleyra may be unable to continue its operations and may endure system interruptions, reputational harm, delays in Kaleyra's development activities, lengthy interruptions in service, breaches of data security and the loss of critical data. In addition, computer malware, viruses and computer hacking, fraudulent use attempts and phishing attacks have become more prevalent in Kaleyra's industry, have occurred on Kaleyra's Platforms in the past and may occur on Kaleyra's Platforms in the future. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance, reliability, security, integrity and availability of Kaleyra's products and technical infrastructure to the satisfaction of Kaleyra's users may harm Kaleyra's reputation and Kaleyra's ability to retain existing users and attract new users.

We currently depend on various third-party vendors throughout the world for the provision of our services to our customers. This subjects us to a number of risks ranging from the quality of the services provided to us by such vendors, to the ability of these vendors to be able to provide services to us to the extent that such vendors are themselves impacted by events, such as the COVID-19 pandemic or the military conflict between Russia and Ukraine, or economic or geopolitical fallout from such events. A Singapore vendor which we use to provide a messaging gateway that we use for some international connections has a majority of its employees in Russia. The imposition of economic sanctions on Russia and Russian entities by many countries, although not targeted towards this entity, could have an impact on the services provided to us by this entity to the extent that such sanctions have an adverse economic effect on the general Russian economy. In addition, sanctions imposed by the U.S., the United Kingdom, the European Union, and other countries against Russia as a result of the military conflict in Ukraine, any related counter-sanctions, and any further escalation of the political tensions or economic instability in the area could have an adverse impact on other third party vendors. If the operations of any third parties providing services to us are disrupted or discontinued due to local instability, political, economic, or military conditions, our ability to provide services to some of our current customers and the development of new products or enhancement of existing products could be delayed, and our results of operations could be adversely affected. We anticipate that we will continue to depend on these and other third-party relationships in order to grow our business for the foreseeable future. If we are unsuccessful in maintaining existing and, if needed, establishing new relationships with third parties, our ability to efficiently operate existing services or develop new services and provide adequate customer support could be impaired, and, as a result, our competitive position or our results of operations could suffer