Nova (NVMI) Risk Factors

Pursuant to the lease agreements for our Manufacturing Facilities, the landlord and anyone on its behalf, and additional tenants are exempt from any liability for direct or consequential damages to our Manufacturing Facilities, except in the event of willful misconduct. While we have obtained insurance policies against certain damages, the aforementioned exemption of liability could compromise our ability to recover the full amount of such damages, and consequently we may incur substantial costs upon the occurrence of such damages.

Our principal customers are located in Taiwan, South Korea, China, Singapore, the United States and Europe, and we produce our products in Israel and the United States. International operations expose us to a variety of risks that could seriously impact our financial condition and impede our growth including: instability in political or economic conditions, including but not limited to inflation, recession, foreign currency exchange restrictions and devaluations, restrictive governmental controls on the movement and repatriation of earnings and capital, and actual or anticipated military or political conflicts, particularly in emerging markets;intergovernmental conflicts or actions, including but not limited to armed conflict, trade wars and acts of terrorism or war; and interruptions to the Company's business with its largest customers, distributors and suppliers resulting from but not limited to, strikes, and financial instabilities. For instance, trade restrictions, changes in tariffs and import and export license requirements could adversely affect our ability to sell our products in the countries adopting or changing those restrictions, tariffs or requirements. This could reduce our sales by a material amount. In addition, effective October 30, 2018, the U.S. Department of Commerce has taken action to restrict exports to Fujian Jinhua Integrated Circuit Company, Ltd. (Jinhua) by adding them to the Entity List (Supplement No. 4 to Part 744 of the Export Administration Regulations (EAR), claiming that Jinhua poses a significant risk of becoming involved in activities that are contrary to the national security interests of the United States. On November 1, 2018, a federal grand jury indicted JHICC, along with four other criminal defendants, charging them with crimes related to a conspiracy to steal, convey, and possess stolen trade secrets of an American semiconductor company for the benefit of a company controlled by the PRC government. JHICC has acquired several of our metrology solutions in the past, and due to the abovementioned export ban our U.S. subsidiary and MMD division is currently not able to ship any tools or parts or provide any form of service to JHICC, until it is cleared to resume by the appropriate authorities. In some cases, these export restrictions might also be applicable to the products which we export from Israel. Additionally, the uncertainty of the economic, financial, regulatory, trade, tax and legal implications of the withdrawal of the U.K. from the E.U. ("Brexit") and other significant political developments could also have a materially adverse effect on our business. All of these risks could also result in increased costs or decreased revenues, either of which could have a materially adverse effect on our profitability.

The occurrence of unforeseen or catastrophic events such as terrorist attacks, extreme terrestrial or solar weather events or other natural disasters, emergence of a pandemic, or other widespread health emergencies (or concerns over the possibility of such an emergency), could create economic and financial disruptions, and could lead to operational difficulties that could impair our ability to manage our business. In particular, the current outbreak of novel coronavirus (COVID-19) that was first reported from Wuhan, China, on December 31, 2019, including the resulting travel restrictions and quarantines already imposed by several countries, present concerns that may dramatically affect our ability to conduct our business effectively, including, but not limited to, effects on revenues from customers, potential inability to visit customer sites for sales and services purposes, and/or a potential disruption to our supply chain. The trajectory of the coronavirus remains uncertain and it is becoming increasingly plausible that our business, and the livelihood of our employees (including employees stationed in our main sites in Israel and the US) and customers upon both of which our business relies, may be directly afflicted.

We must continue to make significant investments in research and development in order to introduce new products and technologies, or to enhance the performance, features and functionality of our existing products, to keep pace with the competitive landscape and to satisfy customer demands. Substantial research and development costs are typically incurred before we confirm the technical feasibility and commercial viability of a new product, and not all development activities result in commercially viable products. There can be no assurance that revenues from future products or product enhancements will be sufficient to recover the development costs associated with such products or enhancements. In addition, we cannot be sure that these products or enhancements will receive market acceptance or that we will be able to sell these products at prices that are favorable to us. Our business will be seriously harmed if we are unable to sell our products at favorable prices or if the market in which we operate does not accept our products. In addition, in some cases, we accumulate inventories based on sales forecasts. If such sales forecasts are not materialized, we might need to write-off the related inventory, which will increase our losses.

Our global operations are linked by information systems, including telecommunications, the internet, our corporate intranet, network communications, email and various computer hardware and software applications. In light of information technology security threats, we have implemented network security measures and engaged the services of a cybersecurity consulting firm to conduct an information security risk assessment review which was reviewed and discussed by our audit committee and board of directors. In the current environment, there are numerous and evolving risks to cybersecurity and privacy, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, employee malfeasance and human or technological error. High-profile security breaches at other companies and in government agencies have increased in recent years, and security industry experts and government officials have warned about the risks of hackers and cyberattacks targeting businesses such as ours. Computer hackers and others routinely attempt to breach the security of technology products, services and systems, and to fraudulently induce employees, customers, or others to disclose information or unwittingly provide access to systems or data. Although we have invested in measures to reduce these risks, we can provide no assurance that our current IT systems are fully protected against third-party intrusions, viruses, hacker attacks, information or data theft or other similar threats. The cost and operational consequences of implementing, maintaining and enhancing further data or system protection measures could increase significantly to overcome increasingly intense, complex, and sophisticated global cyber threats. Despite our best efforts, we are not fully insulated from data breaches and system disruptions and, accordingly, we have experienced and expect to continue to experience actual or attempted cyberattacks of our IT networks. Although none of these actual or attempted cyberattacks has had a material adverse effect on our operations or financial condition thus far, we cannot guarantee that any such incidents will not have a material adverse effect on our operations or financial condition in the future. Any material breaches of cybersecurity or media reports of perceived security vulnerabilities to our systems or those of the Company's third parties, even if no breach has been attempted or occurred, could cause us to experience reputational harm, loss of customers and revenue, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard our customers' information, or financial losses that are either not insured against or not fully covered through any insurance maintained by us. Any of the foregoing may have a material adverse effect on our business, operating results and financial condition. As such, our tools and servers are vulnerable to computer viruses, break-ins and similar disruptions from unauthorized tampering with our computer systems and tools located at our facility or at customer sites, or could be subject to system failures or malfunctions for other reasons. Increased information technology security threats and more sophisticated computer crime pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data or customer data. Cybersecurity attacks could also include attacks targeting the security, integrity and/or reliability of the hardware and software installed in our products. System failures or malfunctioning could disrupt our operations and our ability to timely and accurately process and report key components of our financial results. Further, the regulatory framework for privacy and security issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. In the European Union, the General Data Protection Regulation (GDPR) imposes more stringent data protection requirements and provides for greater penalties for noncompliance. The California Consumer Privacy Act (CCPA), enacted in 2018 and entered into effect in January 2020, creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by businesses. Any inability to adequately address privacy and security concerns or comply with applicable privacy and data security laws, rules and regulations could have an adverse effect on our business prospects, results of operations and/or financial position.

Until the end of 2016, we received royalty-bearing grants from the Israel Innovation Authority, or IIA (formerly known as the Office of the Chief Scientist of the Ministry of Economy and Industry, or the OCS), for the financing of certain of our research and development programs that meet specified criteria. Starting 2018, we also participate in IIA royalty free grant programs. In addition, through the years, we participated in consortiums which are either solely managed by the IIA, or are joint consortiums of the IIA and the European Research Area. To maintain our eligibility for these programs, we must continue to meet certain conditions. All these programs also restrict our ability to manufacture particular products and transfer particular technology, which were developed as part of the IIA's programs, outside of Israel. The restrictions associated with these IIA's programs may require us to obtain approval of the research and development committee nominated by the IIA for certain actions and transactions and pay additional payments to the IIA. Approval to manufacture products outside of Israel or consent to the transfer of technology, if requested, might not be granted and if granted, may increase our financial liabilities to IIA. In addition, if we fail to comply with certain restrictions associated with formerly received IIA's funding, we may be subject to criminal charges. We are further exposed to risks related to the receipt of funding from other governments or governmental agencies in connection with strategic development programs, under which we receive funding. Under such strategic development programs, governments and governmental agencies typically have the right to terminate the program's funding at any time. In addition, a project may be terminated by a mutual agreement, if the parties determine that the project's goals or milestones are not being achieved. As a result, there is no assurance that these sources of external funding will continue to be available to us in the future. Moreover, under the terms of certain governmental funding programs in which we receive funding, the applicable granting agency has the right to audit the costs that we incur, directly and indirectly, in connection with such programs. Any such audit could result in modifications to, or even termination of, the applicable governmental funding program. Any adverse finding resulting from any such audit could lead to penalties (financial or otherwise), termination of funding programs, suspension of payments or other adverse consequences to our ability to receive governmental funding. In addition, obligations related to grants received from the IIA grants bear an annual interest rate based on the 12-month LIBOR. Currently, there is considerable uncertainty regarding the publication of LIBOR beyond 2021, and it is not possible to determine precisely whether, or to what extent, the replacement of LIBOR would affect companies' existing or future liabilities to the IIA.

We produce highly complex optical and electronic components and, accordingly, there is a risk that defects may occur in any of our products. Such defects can give rise to significant costs, including expenses relating to recalling products, replacing defective items, writing down defective inventory and loss of potential sales. In addition, the occurrence of such defects may give rise to product liability and warranty claims, including liability for damages caused by such defects. In our commercial relationship with customers, we attempt to negotiate waivers of consequential and indirect damages arising from damages for loss of use, loss of product, loss of revenue and loss of profit caused by our products. Similarly, with respect to our commercial relationship with subcontractors and suppliers, we attempt to negotiate arrangements which do not include a limitation of liabilities and limitation of consequential and in direct damages. However, some contracts and arrangements we are bound by expose us to product liability claims resulting in personal injury or death, up to an unlimited amount, and the incurrence of the risk of material penalties for consequential or liquidated damages. Additionally, under such contracts and arrangements, we may be named in product liability claims even if there is no evidence that our products caused the damage in question, and such claims could result in significant costs and expenses relating to attorneys' fees and damages. In addition, such contracts and arrangements may include non-limited liability provisions for infringement of a third party's intellectual property rights in connection with our products. Although we have not incurred in the past any material penalties for consequential or liquidated damages, we may incur such penalties in the future. Such penalties for consequential or liquidated damages may be significant (and so is the legal process conducted in connection with such penalties) and could negatively affect our financial condition or results of operations.

The Securities and Exchange Commission requires certain disclosure by companies that use conflict minerals in their products, with substantial supply chain verification requirements in the event that the materials come from, or could have come from, the Democratic Republic of the Congo or adjoining countries. These rules and verification requirements may impose additional costs on us and on our suppliers, and limit the sources or increase the prices of materials used in our products. Among other things, this rule could affect sourcing at competitive prices and availability in sufficient quantities of certain minerals used in the manufacture of components that are incorporated into our products. In addition, the number of suppliers who provide conflict-free minerals may be limited, and there may be material costs associated with complying with the disclosure requirements, such as costs related to the process of determining the source of certain minerals used in our products, as well as costs of possible changes to products, processes, or sources of supply as a consequence of such verification activities. We may not be able to sufficiently verify the origins of the relevant minerals used in components manufactured by third parties through the procedures that we implement, and we may encounter challenges to satisfy those customers who require that all of the components of our products be certified as conflict-free, which could place us at a competitive disadvantage if we are unable to do so. While we have created processes and procedures designed to enable compliance to these rules, if in the future we are unable to certify that our products are conflict free, we may face challenges with our customers, which could place us at a competitive disadvantage and harm our reputation.