Katapult Holdings (KPLT) Risk Factors

Continued developments in U.S. tax reform and changes to tax laws and rates in other jurisdictions where we do business could adversely affect our results of operations and cash flows. It is also possible that provisions of U.S. tax reform could be subsequently amended in a way that is adverse to us. In addition, we may undergo tax audits in various jurisdictions in which we operate. Although we believe that our income tax provisions and accruals are reasonable and in accordance with generally accepted accounting principles in the United States, and that we prepare our tax filings in accordance with all applicable tax laws, the final determination with respect to any tax audits and any related litigation, could be materially different from our historical income tax provisions and accruals. The results of a tax audit or litigation could materially affect our operating results and cash flows in the periods for which that determination is made. In addition, future period net income may be adversely impacted by litigation costs, settlements, penalties and interest assessments.

Our business involves the collection, storage, use, disclosure, processing, transfer, and other handling (collectively, "processing") of a wide variety of information, including personally identifiable information, for various purposes in our business, including to help ensure the integrity of our services and to provide features and functionality to our consumers and merchants. The processing of the information we acquire in connection with our consumers' and merchants' use of our services is subject to numerous privacy, data protection, cybersecurity, and other laws and regulations in the United States and foreign jurisdictions. The automated nature of our business and our reliance on digital technologies may make us an attractive target for, and potentially vulnerable to, cyber-attacks, computer malware, computer viruses, social engineering (including phishing and ransomware attacks), general hacking, physical or electronic break-ins, or similar disruptions. While we and our vendors have taken steps to protect the confidential, proprietary, and sensitive information to which we have access and to prevent data loss, our security measures or those of our vendors could be breached, including as a result of employee theft, exfiltration, misuse or malfeasance, our actions, omissions, or errors, third-party actions, omissions, or errors, unintentional events, or deliberate attacks by cyber criminals, any of which may result in the loss of, or unauthorized access to, our or our consumers' data, our intellectual property, or other confidential, proprietary, or sensitive business information. Any accidental or willful security breaches or other unauthorized access to our platform or servicing systems could cause confidential, proprietary, or sensitive information to be stolen and used for criminal or other unauthorized purposes. Security breaches or unauthorized access to confidential information could also expose us to liability related to the loss of the information, time-consuming and expensive litigation, and negative publicity. If security measures are breached because of employee theft, exfiltration, misuse or malfeasance, our actions, omissions, or errors, third-party actions, omissions, or errors, unintentional events, deliberate attacks by cyber criminals or otherwise, or if design flaws in our software or systems are exposed and exploited, our relationships with consumers or merchants could be damaged, and we could incur significant liability. Although we monitor our systems in order to detect security breaches or instances of unauthorized access to confidential information, there is no guarantee that our monitoring efforts will be effective. The techniques used to obtain unauthorized, improper, or illegal access to our systems, our or our consumers' data, or to disable or degrade service or sabotage systems, are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. We may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative or remedial measures. Unauthorized parties have in the past attempted and may in the future attempt to gain access to our systems or facilities through various means, including, among others, hacking into our or our partners' or consumers' systems or facilities, or attempting to fraudulently induce our employees, partners, consumers or others into disclosing usernames, passwords, or other sensitive information, which may in turn be used to access our information technology systems and gain access to our or our consumers' data or other confidential, proprietary, or sensitive information. For instance, in September 2020, we received alerts from our internal systems that there was suspicious activity involving keys used to access certain parts of our sites. After an investigation conducted by third party firms in conjunction with our internal team, we determined the compromised data was limited to non-sensitive information. Despite our monitoring efforts, there can be no assurances that future incidents would not result in a third party accessing sensitive information. Such efforts may be state-sponsored and supported by significant financial and technological resources, making them even more difficult to detect and prevent. For the years ended December 31, 2020 and 2019, we did not incur material expenses relating to cyber-attacks, employee or other internal misconduct, computer viruses, physical or electronic break-ins, or similar disruptions. In addition, in certain circumstances we utilize vendors, including cloud service providers, to facilitate the servicing of consumer accounts. Under these arrangements, these vendors require access to certain consumer data for the purpose of servicing the accounts. Because we do not control our vendors, or the processing of data by our vendors, other than through our contractual relationships, our ability to monitor our vendors' data security may be very limited such that we cannot ensure the integrity or security of measures they take to protect and prevent the loss of our or our consumers' data. As a result, we are subject to the risk that cyber-attacks on, or other security incidents affecting, our vendors may adversely affect our business even if an attack or breach does not directly impact our systems. It is also possible that security breaches sustained by, or other security incidents affecting, our competitors could result in negative publicity for our entire industry that indirectly harms our reputation and diminishes demand for our products and services. Any actual or perceived failure to comply with legal and regulatory requirements applicable to us, including those relating to information security, or any failure to protect the information that we collect from our consumers and merchants, including personally identifiable information, from cyber-attacks, or any such actual or perceived failure by our originating bank partners, may result in, among other things, revocation of required licenses or registrations, loss of approved status, private litigation, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, and constraints on our ability to continue to operate. Our originating bank partners also operate in a highly regulated environment, and many laws and regulations that apply directly to our originating bank partners are indirectly applicable to us through our arrangements with our originating bank partners. Furthermore, federal and state regulators and many federal and state laws and regulations require notice of any data security breaches that involve personal information. These mandatory disclosures regarding a security breach are costly to implement and often lead to widespread negative publicity, which may cause consumers to lose confidence in the effectiveness of our data security measures. Any security breach suffered by us or our vendors, any attack against our service availability, any unauthorized, accidental, or unlawful access or loss of data, or the perception that any such event has occurred, could result in a disruption to our service, litigation, an obligation to notify regulators and affected individuals, the triggering of indemnification and other contractual obligations, regulatory investigations, government fines and penalties, reputational damage, and loss of consumers and ecosystem partners, and our business and operations could be adversely affected. In addition, we may incur significant costs and operational consequences in connection with investigating, mitigating, remediating, eliminating, and putting in place additional tools and devices designed to prevent future actual or perceived security incidents, as well as in connection with complying with any notification or other obligations resulting from any security incidents. Our insurance policies carry retention and coverage limits, which may not be adequate to reimburse us for losses caused by security breaches, and we may not be able to collect fully, if at all, under these insurance policies. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our business. Furthermore, we cannot be certain that insurance coverage will continue to be available on acceptable terms or at all, or that the insurer will not deny coverage as to any future claim.

Certain elements of our cost structure are largely fixed in nature. Consumer spending remains uncertain, which makes it more challenging for us to maintain or increase our operating margins. The competitive environment in our industry and increasing price transparency means that the focus on achieving efficient operations is greater than ever. As a result, we must continuously focus on managing our cost structure. Failure to manage our overall cost of operations, labor and benefit rates, advertising and marketing expenses, operating leases, data costs, payment processing costs, cost of capital, or indirect spending could materially adversely affect our profitability.

Negative publicity about us or our industry, including the transparency, fairness, user experience, quality, and reliability of our platform or lease-to-own platforms in general, effectiveness of our risk model, our ability to effectively manage and resolve complaints, our privacy and security practices, litigation, regulatory activity, misconduct by our employees, funding sources, service providers, or others in our industry, the experience of consumers and investors with our platform or services or lease-to-own platforms in general, even if inaccurate, could adversely affect our reputation and the confidence in, and the use of, our platform, which could harm our reputation and cause disruptions to our platform. For instance, in October 2020, a data breach broker purported to offer customer records from a number of companies, including us, for sale on a hacker forum. Although we determined with third party firms and our internal team that the compromised data was limited to non-sensitive information, we cannot guarantee that this publicity or any similar publicity in the future will not have a negative effect on our business or reputation. Any such reputational harm could further affect the behavior of consumers, including their willingness to utilize lease-to-own programs through our platform or to make payments on their leases. As a result, our business, results of operations, financial condition, and future prospects would be materially and adversely affected.

Our solution is a technology-driven platform that relies on innovation to remain competitive. The process of developing new technologies and products is complex, and we build our own technology, using the latest in artificial intelligence and machine learning ("AI/ML"), cloud-based technologies, and other tools to differentiate our products and technologies. In addition, our dedication to incorporating technological advancements into our platform requires significant financial and personnel resources and talent. Our development efforts with respect to these initiatives could distract management from current operations and could divert capital and other resources from other growth initiatives important to our business. We operate in an industry experiencing rapid technological change and frequent product introductions. We may not be able to make technological improvements as quickly as demanded by our consumers and merchants, which could harm our ability to attract consumers and merchants. In addition, we may not be able to effectively implement new technology-driven products and services as quickly as competitors or be successful in marketing these products and services to consumers and merchants. If we are unable to successfully and timely innovate and continue to deliver a superior merchant and consumer experience, the demand for our products and technologies may decrease and our growth, business, results of operations, financial condition, and future prospects could be materially and adversely affected. Further, we use AI/ML in many aspects of our business, including fraud, credit risk analysis, and product personalization. The AI/ML models that we use are trained using various data sets. If the AI/ML models are incorrectly designed, the data we use to train them is incomplete, inadequate, or biased in some way, or we do not have sufficient rights to use the data on which our AI/ML models rely, the performance of our products, services, and business, as well as our reputation, could suffer or we could incur liability through the violation of laws, third-party privacy, or other rights, or contracts to which we are a party. Our failure to accurately predict the demand or growth of our new products and technologies also could have a material and adverse effect on our business, results of operations, financial condition, and future prospects. New products and technologies are inherently risky, due to, among other things, risks associated with: the product or technology not working, or not working as expected; consumer and merchant acceptance; technological outages or failures; and the failure to meet consumer and merchant expectations. As a result of these risks, we could experience increased claims, reputational damage, or other adverse effects, which could be material. The profile of potential consumers using our new products and technologies also may not be as attractive as the profile of the consumers that we currently serve, which may lead to higher levels of delinquencies or defaults than we have historically experienced. Additionally, we can provide no assurance that we will be able to develop, commercially market, and achieve acceptance of our new products and technologies. In addition, our investment of resources to develop new products and technologies and make changes or updates to our platform may either be insufficient or result in expenses that exceed the revenue actually generated from these new products. Failure to accurately predict demand or growth with respect to our new products and technologies could have a material and adverse effect on our business, results of operations, financial condition, and future prospects.

We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We may not have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.