WM Technology (MAPS) Risk Factors

The cannabis industry, and the complex regulatory regime applicable to it, is evolving rapidly and may develop in ways that we cannot anticipate. The pace of dramatic change in the cannabis industry makes it difficult to assess our future prospects, and you should evaluate our business in light of the risks and difficulties we may encounter as the industry continues to evolve. These risks and difficulties include: - managing complex, disparate and rapidly evolving regulatory regimes imposed by U.S. federal, state and local and other non-U.S. governments around the world applicable to cannabis and cannabis-related businesses;- adapting to rapidly evolving trends in the cannabis industry and the way consumers and cannabis industry businesses interact with technology;- maintaining and increasing our base of clients and consumers;- continuing to preserve and build our brand while upgrading our existing offerings;- successfully attracting, hiring and retaining qualified personnel to manage operations;- adapting to changes in the cannabis industry if sales of cannabis expand significantly beyond a regulated model;- commodification of the cannabis industry;- successfully implementing and executing our business and marketing strategies; and - successfully expanding our business into new and existing cannabis markets. If the demand for our platform and software solutions does not develop as we expect, or if we fail to address the needs of our clients or consumers, our business will be harmed. We may not be able to successfully address these risks and difficulties, which could harm our business and operating results.

Although cannabis is a restricted controlled substance under the federal CSA, U.S. states have legalized cannabis to varying degrees through state-specific regulatory frameworks. Laws and regulations affecting the cannabis industry in states and territories of the United States are continually changing. Any change or even the speed of changes could require us to incur substantial costs associated with compliance or alter our business plan, and could detrimentally affect our operations, revenue and profitability. Similarly, if the pace of issuance of new cannabis licenses is slower than expected, our ability to acquire new clients and grow our revenue could be harmed. The commercial cannabis industry is still a young industry, and we cannot predict the impact of the compliance regime to which it may be subject. We will incur ongoing costs and obligations related to regulatory compliance, and such costs may prove to be material. Failure to comply with regulations may result in additional costs for corrective measures, penalties or restrictions on our operations. In addition, changes in regulations, more vigorous enforcement thereof, or other unanticipated events could require extensive changes to our operations or increased compliance costs or give rise to material liabilities, which could have a material adverse effect on us. Given the concentration of our revenue from the sale of listing products, any increase in the stringency of any applicable laws, including U.S. state, or Canadian federal laws and regulations relating to cannabis, or any escalation in the enforcement of such existing laws and regulations against the current or putative cannabis industry within any jurisdiction, could negatively impact the profitability or viability of cannabis businesses in such affected jurisdictions, which in turn could materially adversely affect our business and operating results. In addition, although we have not yet been required to obtain any cannabis license as a result of existing cannabis regulations, it is possible that cannabis regulations may be enacted in the future that will require us to obtain such a cannabis license or otherwise seek to substantially regulate our business. Additionally, in some jurisdictions we may be required to seek and obtain a blanket approval of our platform in order to enable potential clients to access our services, and such approval may be subject to significant regulatory discretion. U.S. state, or Canadian federal and other non-U.S. jurisdictions' cannabis laws and regulations are broad in scope and subject to evolving interpretations, which could require us to incur substantial costs associated with compliance or alter our business plan. Our failure to adequately manage the risk associated with future regulations and adequately manage future compliance requirements may adversely affect our business, our status as a reporting company and our public listing. Further, any adverse pronouncements from political leaders or regulators about businesses related to the legal cannabis industry could adversely affect the price of our securities.

We generally do not, and cannot, ensure that our clients will conduct their business activities in a manner compliant with certain regulations and other legal requirements applicable to the cannabis industry, in whole or in part, even if our solutions provide features to support our clients' compliance with such regulations and requirements. Their legal noncompliance could result in regulatory and even criminal actions against them, which could have a material adverse impact on our business and operating results or financial condition. For additional information, see the other risk factors in this section entitled "Risk Factors-Risks Related to our Business and Industry," including "Some of our clients or their listings currently and in the future may not be in compliance with licensing and related requirements under applicable laws and regulations. Allowing unlicensed or noncompliant businesses to access our products, or allowing businesses to use our solutions in a noncompliant manner, may subject us to legal or regulatory enforcement and negative publicity, which could adversely impact our business, operating results, financial condition, brand and reputation. In addition, allowing businesses who engage in false or deceptive advertising practices to use our solutions may subject us to negative publicity, which could have similar adverse impacts on us."

Our clients are contractually required to represent, warrant and covenant to us that they conduct their business in compliance with applicable state law, which includes any applicable licensing requirements and the regulatory framework enacted by each state or province in which they do business. Clients further contractually agree to indemnify us for any damages we may suffer as a result of their noncompliance. We rely on our clients' contractual representations, and generally do not verify them, other than with respect to the licensing information of our clients operating cannabis retail businesses, where we currently require such clients to provide evidence of a valid state or provincial cannabis license prior to their initial access and from time to time during the term of their use of such products. We require all operational cannabis retailer clients, including storefronts and delivery services, to display on their listing a valid, unexpired state-issued license number. We also currently require cannabis brand clients to provide evidence of a valid state or provincial license in order to get access to our listings and premium placement products. Additionally, many states do not require a license to sell CBD products at retail, and the illicit market could fraudulently attempt to use our CBD listings product to sell products containing THC. While we periodically audit and respond to reports related to our CBD listings, it is difficult to monitor the individual products listed, and marketing claims contained, in the listings of our CBD clients. As a result, some of our clients or their listings currently and in the future may not be in compliance with licensing and related requirements under applicable state or provincial laws and regulations. There could be legal enforcement actions against unlicensed or insufficiently licensed entities selling cannabis or CBD, which could negatively impact us. Any legal or regulatory enforcement against us based on the business solutions that we offer, the third-party content available on our platform or noncompliance by our clients with licensing and other legal requirements, could subject us to various risks, including monetary penalties and the risk that we elect or are compelled to remove content from our platform and would likely cause us to experience negative publicity. Any of these developments could materially and adversely impact our business, operating results, financial condition, brand and reputation.

U.S. federal law, and more specifically the CSA, proscribes the cultivation, processing, distribution, sale, advertisement and possession of cannabis. As a result, U.S. federal law enforcement authorities, in their attempt to regulate the illegal or unauthorized production, distribution, promotion, sale, possession, or use of cannabis, may seek to bring criminal actions against our clients under the CSA. On August 4, 2021, the U.S. Attorney's Office for the Eastern District of California withdrew a subpoena served on us in September 2019, and informed us that it had no present plan to exercise its discretion to proceed further in the matter. The U.S. Attorney's Office for the Eastern District of California also stated that its decision was not a grant of immunity, however, and there can be no assurance that the U.S. Attorney's Office for the Eastern District of California - either the U.S. Attorney's Office for the Eastern District of California or another DOJ entity - will not initiate another investigation in the future. If our clients are found to be violating U.S. federal law relating to cannabis, they may be subject not only to criminal charges and convictions, but also to forfeiture of property, significant fines and penalties, disgorgement of profits, administrative sanctions, cessation of business activities, or civil liabilities arising from proceedings initiated by either the U.S. government or private citizens. Any of these actions or consequences on our clients could have a material adverse effect on our business, operating results or financial condition, or could force us to cease operations, and as a result, our investors could lose their entire investment. Further, to the extent any law enforcement actions require us to respond to subpoenas, or undergo search warrants, for client records, cannabis businesses could elect to cease using our products. Until the U.S. federal government changes the laws with respect to cannabis, and particularly if the U.S. Congress does not extend the Omnibus Spending Bill's protection of state medical cannabis programs, described below, to apply to all state cannabis programs, U.S. federal authorities could more strictly enforce current federal prohibitions and restrictions. An increase in federal enforcement against companies licensed under state cannabis laws could negatively impact the state cannabis industries and, in turn, our business, operating results, financial condition, brand and reputation.

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Control, the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, and other state and national anti-bribery laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors, and other partners from authorizing, promising, offering, or providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. The FCPA also requires public companies to make and keep books and records that accurately and fairly reflect the transactions of the corporation and to devise and maintain an adequate system of internal accounting controls. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other partners, even if we do not explicitly authorize or have actual knowledge of such activities. We are also subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Controls. Export controls and trade sanctions laws and regulations may restrict or prohibit altogether the provision, sale, or supply of our products to certain governments, persons, entities, countries, and territories, including those that are the target of comprehensive sanctions or an embargo. Any violation of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other consequences.

We are subject to general business regulations and laws as well as federal, state, provincial and foreign laws specifically governing the internet. Existing and future laws and regulations, narrowing of any existing legal safe harbors, or previous or future court decisions may impede the growth of the internet or online products and solutions, and increase the cost of providing online products and solutions. These laws may govern, among other issues, taxation, tariffs, pricing, content, copyrights, distribution, electronic contracts and other communications, consumer protection, broadband residential internet access and the characteristics and quality of offerings. It is not clear how existing laws governing issues such as property ownership, sales, use and other taxes, and libel apply to the internet or online services. There is also a risk that these laws may be interpreted and applied in conflicting ways across jurisdictions, and in a manner that is not consistent with our current practices. Unfavorable resolution of these issues may limit our business activities, expose us to potential legal claims or cause us to spend significant resources on ensuring compliance, any of which could harm our business and operating results.

In the ordinary course of business, we process personal data and other sensitive information, including proprietary and confidential business data, intellectual property, and sensitive third-party data. Our data processing subjects us to various federal, state, provincial and foreign laws and regulations, as well as other obligations including contractual obligations, industry standards and internal and external policies related to privacy, data protection, and information security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN-SPAM") and the Telephone Consumer Protection Act of 1991 ("TCPA") impose specific requirements on communications with customers. For example, the TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities. In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CPRA") (collectively, "CCPA"), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages for certain data breaches. A number of other proposals are being considered or have passed at the federal, state, and local levels, and we expect more states to pass similar laws in the future. Many foreign countries and governmental bodies, including Canada, the United Kingdom ("UK"), and the European Union ("E.U.") and other relevant jurisdictions where we conduct business, have laws and regulations concerning the processing of personal information. For example, in Canada, the federal Personal Information Protection and Electronic Documents Act, or PIPEDA and various related provincial laws may apply to our operations. Further, Canada has robust anti-spam legislation, the Anti-Spam Legislation, or CASL. The penalties for non-compliance under CASL are significant. In addition, the E.U.'s General Data Protection Regulation, or the EU GDPR, and the United Kingdom's GDPR, or UK GDPR (collectively, "GDPR"), may also apply to our operations. The GDPR provides for substantial penalties for noncompliance. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. We may be subject to new laws governing the privacy of consumer health data. For example, Washington's My Health My Data Act ("MHMD") broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the CCPA, require our customers to impose specific contractual restrictions on their service providers. In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data related to our EU users. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. We publish privacy policies, marketing materials and other statements regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are evolving, becoming increasingly stringent, and creating uncertainty. These obligations may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations. Future laws, regulations, standards and other obligations, or amendments or changes in the interpretation of existing laws, regulations, standards and other obligations, could impair our or (or the third parties upon whom we rely) ability to collect, use, disclose or otherwise process information relating to employees or consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our client and consumer bases and increase revenue. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. Any failure or perceived failure by us or the third parties upon whom we rely to comply with federal, state, provincial or foreign laws or regulations, industry standards, contractual obligations or other legal obligations may result in governmental enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar) and prosecutions, private litigation (including class actions) and mass arbitration demands, adverse publicity that could cause employees, clients and consumers to lose trust in us, additional reporting requirements and/or oversight, bans on processing personal data, and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

We and our clients are subject to a variety of laws and regulations in the United States regarding financial transactions. Violations of the U.S. anti-money laundering ("AML") laws require proceeds from enumerated criminal activity, which includes trafficking in cannabis in violation of the CSA. Financial institutions that both we and our clients rely on are subject to the Bank Secrecy Act, as amended by Title III of the USA Patriot Act. In Canada, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada), as amended and the rules and regulations thereunder and the Criminal Code (Canada) apply. The penalties for violation of these laws include imprisonment, substantial fines and forfeiture. In 2014, the DOJ under the Obama administration directed federal prosecutors to exercise restraint in prosecuting AML violations arising in the state legal cannabis programs and to consider the federal enforcement priorities enumerated in the Cole Memo when determining whether to charge institutions or individuals based upon cannabis-related activity. Around the same time, the Treasury Department issued guidance that clarified how financial institutions can provide services to cannabis-related businesses, consistent with financial institutions' obligations under the Bank Secrecy Act. Then-Attorney General Sessions' rescission of the DOJ's guidance on the state cannabis programs in early 2018 increased uncertainty and heightened the risk that federal law enforcement authorities could seek to pursue money laundering charges against entities, or individuals, engaged in supporting the cannabis industry. On January 31, 2018, the Treasury Department issued additional guidance that the 2014 Guidance would remain in place until further notice, despite the rescission of the DOJ's earlier guidance memoranda. A detailed description of current U.S. policy and the legal status of cannabis, including President Biden's stance on cannabis enforcement and current and foreseeable decriminalization and legalization initiatives, can be found in the "U.S. and Territories" section. We are subject to a variety of laws and regulations in the United States, Canada and elsewhere that prohibit money laundering, including the Proceeds of Crime and Terrorist Financing Act (Canada) and the Money Laundering Control Act (U.S.), as amended, and the rules and regulations thereunder and any related or similar rules, regulations or guidelines issued, administered or enforced by governmental authorities in the United States, Canada or any other jurisdiction in which we have business operations or to which we export our offerings. If any of our clients' business activities, any dividends or distributions therefrom, or any profits or revenue accruing thereby are found to be in violation of money laundering statutes, our clients could be subject to criminal liability and significant penalties and fines. Any violations of these laws, or allegations of such violations, by our clients could disrupt our operations and involve significant management distraction and expenses. As a result, a significant number of our clients facing money laundering charges could materially affect our business, operations and financial condition. Additionally, proceeds from our clients' business activities, including payments we have received from those clients, could be subject to seizure or forfeiture if they are found to be illegal proceeds of a crime transmitted in violation of anti-money laundering laws, which could have a material adverse effect on our business. Finally, if any of our clients are found to be violating the above statutes, this could have a material adverse effect on their ability to access or maintain financial services, as discussed in detail below, which could, in turn, have a material adverse effect on our business.

Cannabis, other than hemp (defined by the U.S. government as Cannabis sativa L. with a THC concentration of not more than 0.3% on a dry weight basis), is a prohibited controlled substance under the CSA. Even in states or territories that have legalized cannabis to some extent, the cultivation, possession and sale of cannabis all violate the CSA and are punishable by imprisonment, substantial fines and forfeiture. Moreover, individuals and entities may violate federal law if they aid and abet another in violating the CSA, or conspire with another to violate the law, and violating the CSA is a predicate for certain other crimes, including money laundering laws and the Racketeer Influenced and Corrupt Organizations Act. The U.S. Supreme Court has ruled that the federal government has the authority to regulate and criminalize the sale, possession and use of cannabis, even for individual medical purposes, regardless of whether it is legal under state law. Since 2014, however, the U.S. government has not prioritized the enforcement of those laws against cannabis companies complying with state law and their vendors. No reversal of that policy of prosecutorial discretion is expected under a Biden administration given his actions on cannabis to date, and statements of Attorney General Merrick Garland discussed further below, although prosecutions against state-legal entities cannot be ruled out entirely at this time. On January 4, 2018, then U.S. Attorney General Jeff Sessions issued a memorandum for all U.S. Attorneys (the "Sessions Memo") rescinding certain past DOJ memoranda on cannabis law enforcement, including the Memorandum by former Deputy Attorney General James Michael Cole (the "Cole Memo") issued on August 29, 2013, under the Obama administration. Describing the criminal enforcement of federal cannabis prohibitions against those complying with state cannabis regulatory systems as an inefficient use of federal investigative and prosecutorial resources, the Cole Memo gave federal prosecutors discretion not to prosecute state law compliant cannabis companies in states that were regulating cannabis, unless one or more of eight federal priorities were implicated, including use of cannabis by minors, violence, or the use of federal lands for cultivation. The Sessions Memo, which remains in effect, states that each U.S. Attorney's Office should follow established principles that govern all federal prosecutions when deciding which cannabis activities to prosecute. As a result, federal prosecutors could and still can use their prosecutorial discretion to decide to prosecute even state legal cannabis activities. Since the Sessions Memo was issued over five years ago, however, U.S. Attorneys have generally not prioritized the targeting of state law compliant entities. In March 2023, Attorney General Merrick Garland testified in a Congressional hearing that the Department of Justice was continuing its work on a new memorandum regarding cannabis enforcement. Garland stated that the policy will be "very close to what was done in the Cole memorandum" but was yet to be finalized. Though no official timeline has been announced, industry participants expect such a memorandum to be issued in 2024. We cannot assure that each U.S. Attorney's Office in each judicial district where we operate will not choose to enforce federal laws governing cannabis sales against state-legal companies like our business clients. The basis for the federal government's lack of recent enforcement with respect to the cannabis industry extends beyond the strong public sentiment and ongoing prosecutorial discretion. Since 2014, versions of the U.S. omnibus spending bill have included a provision prohibiting the DOJ, which includes the DEA, from using appropriated funds to prevent states from implementing their medical-use cannabis laws (formerly known as the Rohrabacher-Bluemnauer Amendment, and now known as the Joyce Amendment). In 2021, President Joe Biden became the first president to propose a budget with the Joyce amendment included. The amendment most recently was renewed through the signing of the stopgap spending bill. While the Joyce Amendment has continuously been renewed since its inception with little fanfare, there is no assurance that Congress will approve inclusion of a similar prohibition on DOJ spending in future appropriations bills. In USA vs. McIntosh, the U.S. Court of Appeals for the Ninth Circuit held that the provision prohibits the DOJ from spending funds to prosecute individuals who engage in conduct permitted by state medical-use cannabis laws and who strictly comply with such laws. The court noted that, if the spending bill provision were not continued, prosecutors could enforce against conduct occurring during the statute of limitations even while the provision was previously in force. Other courts that have considered the issue have ruled similarly, although courts disagree about which party bears the burden of proof of showing compliance or noncompliance with state law. Our policies do not prohibit our state-licensed cannabis retailers from engaging in the cannabis business for adult use that is permissible under state and local laws. Consequently, certain of our retailers currently (and may in the future) sell adult-use cannabis, if permitted by such state and local laws now or in the future, and therefore may be outside any protections extended to medical-use cannabis under the spending bill provision. This could subject our clients to greater and/or different federal legal and other risks as compared to businesses where cannabis is sold exclusively for medical use, which could in turn materially adversely affect our business. Furthermore, any change in the federal government's enforcement posture with respect to state licensed cannabis sales, including the enforcement postures of individual federal prosecutors in judicial districts where we operate, would result in our inability to execute our business plan, and we would likely suffer significant losses with respect to client base, which would adversely affect our operations, cash flow and financial condition. Additionally, financial transactions involving proceeds generated by cannabis-related conduct can form the basis for prosecution under the federal money laundering statutes, unlicensed money transmitter statutes and the Bank Secrecy Act of 1970, as amended (the "Bank Secrecy Act"). The penalties for violation of these laws include imprisonment, substantial fines and forfeiture. Prior to the DOJ's rescission of the Cole Memo, supplemental guidance from the DOJ issued under the Obama Administration directed federal prosecutors to consider the federal enforcement priorities enumerated in the Cole Memo when determining whether to charge institutions or individuals with any of the financial crimes described above based upon cannabis-related activity. With the rescission of the Cole Memo, there is increased uncertainty and added risk that federal law enforcement authorities could seek to pursue money laundering charges against entities or individuals engaged in supporting the cannabis industry. Federal prosecutors have significant discretion and no assurance can be given that the federal prosecutor in each judicial district where we operate will not choose to strictly enforce the federal laws governing cannabis production or distribution. Any change in the federal government's enforcement posture with respect to state-licensed cultivation of cannabis, including the enforcement postures of individual federal prosecutors in judicial districts where we operate, would result in our inability to execute our business plan, and we would likely suffer significant losses with respect to our investment in cannabis facilities in the United States. Furthermore, following any such change in the federal government's enforcement position, we could be subject to prosecution, which could lead to imprisonment and/or the imposition of penalties, fines, or forfeiture. During his campaign, President Biden promised federal reform on cannabis, including decriminalization generally. In 2022, President Biden signed into law the "Medical Marijuana and Cannabidiol Research Expansion Act," a bill aimed at easing restrictions on cannabis research -- bipartisan legislation which is the first standalone cannabis reform bill to pass both the House and Senate. Additionally, on October 6, 2022, President Biden issued a presidential proclamation pardoning federal convictions for simple marijuana possession offenses, encouraging state governors to do the same on the state level where permissible, and requesting that the Secretary of Health and Human Services ("HHS") and the Attorney General initiate an administrative process to review cannabis's Schedule I classification under the CSA. On August 29, 2023, HHS issued a letter to the DEA recommending that cannabis be reclassified as a Schedule III controlled substance under the CSA. On May 16, 2024, President Biden announced that the U.S. Attorney General initiated proceedings to transfer cannabis from Schedule I to Schedule III, through an NPRM published on May 21, 2024. This is a momentous change whose full implications are currently unknown. The DEA's decision to reclassify cannabis would neither legalize nor likely eliminate current state cannabis programs. If placed under Schedule III, cannabis will remain a controlled substance and state-legal programs will continue to operate outside of federally legal channels in their distribution of the substance particularly because no state operator holds a DEA registration to possess or distribute cannabis. However, some fear that the DEA or FDA may impose additional requirements or begin to target enforcement of state cannabis programs. If our clients are ultimately negatively impacted by rescheduling, we would likely be unable to execute our business plan, and our business and financial results would be adversely affected. Additionally, although the current U.S. Attorney General is expected to issue policy guidance to federal prosecutors that they should not interfere with cannabis businesses operating in compliance with states' laws, any such guidance would not have the force of law, and could not be enforced by the courts. The President alone cannot legalize medical cannabis, and as states have demonstrated, legalizing medical cannabis can take many different forms. On January 20, 2021, President Biden formally nominated Merrick Garland to his cabinet as the U.S. Attorney General. Confirmation hearings for Attorney General Garland began on February 22, 2021. On the first date of his confirmation hearing, Attorney General Garland stated that he did not see enforcement of federal cannabis law as a high priority use of resources for the DOJ: "This is a question of the prioritization of our resources and prosecutorial discretion. It does not seem to me a useful use of limited resources that we have, to be pursuing prosecutions in states that have legalized and that are regulating the use of marijuana, either medically or otherwise. I don't think that's a useful use. I do think we need to be sure there are no end-runs around the state laws that criminal enterprises are doing. So that kind of enforcement should be continued. But I don't think it's a good use of our resources, where states have already authorized. That only confuses people, obviously, within the state." In April 2022, Attorney General Garland reiterated that prosecuting the possession of cannabis is "not an efficient use" of federal resources, especially "given the ongoing opioid and methamphetamine epidemic[s]" facing the nation. And, in March 2023, Attorney General Garland testified that the Department of Justice was continuing its progress on a new cannabis enforcement guidance, which he described as "very close to what was done in the Cole memorandum. While the statement is not a promise to avoid federal interference with state cannabis laws, it does continue to signal that the enforcement priorities of DOJ lie elsewhere. Furthermore, while industry observers are hopeful that there will continue to be incremental federal cannabis policy reform, we cannot provide assurances about the content, timing or chances of passage of a bill legalizing cannabis. In recent years, members of the U.S. Congress from both parties have introduced bills to end the federal cannabis prohibition, by de-scheduling cannabis completely and regulating it, as well as incremental reform bills, including the "Medical Marijuana and Cannabidiol Research Expansion Act" described above. While the timing of federal reform remains unknown, it is expected that federal policy on cannabis will continue becoming more, rather than less, permissive, and legislative efforts to legalize cannabis or cannabis banking at the national level are likely to continue in 2024. However, the outcome of the 2024 presidential election could impact reform in ways that are unpredictable. Accordingly, we cannot predict the timing of any change in federal law or possible changes in federal enforcement. In the unlikely event that the federal government were to reverse its long-standing hands-off approach to the state legal cannabis markets and start more broadly enforcing federal law regarding cannabis, we would likely be unable to execute our business plan, and our business and financial results would be adversely affected.

Should the federal government legalize cannabis for adult-use and/or medical-use, it is possible that the U.S. Food and Drug Administration (the "FDA") would seek to regulate it under the Food, Drug and Cosmetics Act of 1938, as it has with federally legal hemp. Additionally, the FDA may issue rules and regulations including certified good manufacturing practices related to the growth, cultivation, harvesting and processing of adult-use and medical-use cannabis. Clinical trials may be needed to verify efficacy and safety. It is also possible that the FDA would require that facilities where adult-use and medical-use cannabis is grown register with the FDA and comply with certain federally prescribed regulations. In addition, as a result of the recent lung injuries and deaths associated with e-cigarettes and other vaping products, the FDA and the U.S. Centers for Disease Control and Prevention (the "CDC") have warned consumers not to use vaping products containing tetrahydrocannabinol ("THC"). While the FDA and the CDC continue to conduct ongoing investigations, it is currently unknown when and whether the FDA will impose additional rules and regulations on e-cigarettes and other vaping products. In the event that some or all of these regulations are imposed, we do not know what the impact would be on the adult-use and medical-use cannabis industry, including what costs, requirements and possible prohibitions may be enforced. If our clients are unable to comply with any new rules, regulations or registration as prescribed by the FDA, or are unable to do so in a cost-effective manner, our clients may be unable to continue to operate their respective business in its current form, or at all, which may also result in our clients being unable to continue engaging our technology services.