Pitney Bowes (PBI) Risk Analysis

In addition to our reliance on the USPS, Presort Services relies upon third party transportation service providers to transport a significant portion of our mail volumes. The use of these providers is subject to risks, including our ability to negotiate acceptable terms due to, increased competition during peak periods, capacity issues, increased fuel costs, labor shortages, performance problems, extreme weather, natural or man-made disasters, pandemics, or other unforeseen difficulties. Given our reliance upon these providers, any unforeseen disruptions affecting the availability of these services or any dramatic increase in the cost of these services (each of which we have experienced, at times), could adversely affect client satisfaction and our financial performance.

We are subject to taxes in the U.S. and in the foreign jurisdictions where we do business. Due to continuing global fiscal challenges and political conditions, tax laws and enforcement approaches have been and may continue to be subject to significant change. Changes in tax laws may be on a prospective or retroactive basis and could have a material impact on our tax expense and cash flows. The Organization for Economic Co-operation and Development (OECD) has set forth a Two-Pillar Solution fundamentally overhauling the international tax rules. Pillar One focuses on reallocation of profits while Pillar Two applies a global minimum corporate tax. The OECD has issued Model Rules and ongoing administrative guidance to support implementation and coordination of these initiatives, and a number of jurisdictions have enacted or are implementing rules based on the OECD framework, including the Pillar Two global minimum tax. Although some jurisdictions have issued guidance or passed tax laws based on the OECD Model Rules, the final nature, timing and extent of any such tax reforms or other legislative or regulatory actions (including their scope, interpretation, implementation, enforcement and interaction with other jurisdictions' rules) are evolving and it is difficult to assess their overall effect. These developments could increase our compliance and reporting obligations and, depending on the jurisdictions in which we operate and the interaction among applicable rules, could result in incremental tax expense (including "top-up" taxes), potential double taxation and adversely impact our financial results and cash flows. We continuously monitor developments and evaluate the impact these new rules are anticipated to have on our tax rate. We are subject to tax audits in the various jurisdictions in which we operate. Given the complexity of the current and changing tax laws and regulations, tax authorities may disagree with certain positions we have taken and assess additional taxes. We regularly review the strength of our positions based on current law, court cases, rulings and proposed legislative changes to determine the appropriateness of our tax provision, however, there can be no assurance that we will accurately predict the outcomes of these audits, which could have a material impact on our effective tax rate and adversely impact our financial results and cash flows.

Our businesses use, process, and store proprietary information and personal, sensitive, or confidential data relating to our business, clients, and employees. Privacy laws and similar regulations in many jurisdictions where we do business require that we take significant steps to safeguard that information, and these laws and regulations continue to evolve. The scope of the laws that may be applicable to us is often uncertain and may be conflicting, and the growth of our cloud-based services increases the scope and complexity of laws that might apply. In addition, new laws may add an array of requirements on how we handle or use information and increase our compliance obligations. For example, India's Digital Personal Data Protection Act of 2023, and implemented rules notified in 2025, established a framework regulating the processing of digital personal data. The European Union's Artificial Intelligence Act, which entered into force in August 2024, introduces additional requirements for certain AI systems and practices and will apply on a phased timeline, and may increase compliance obligations for organizations that develop, deploy or use AI-enabled tools. In the United States, a growing number of states have enacted different laws regarding personal information, privacy and artificial intelligence that impose significant new requirements on consumer personal information. In some instances (e.g., California), these laws also expand the definition of consumer personal information to include information related to employees and business contacts. Some of these state laws have established independent agencies with rule making and enforcement authority, whose initial guidance, actions, and regulations continue to evolve and may be adopted or become effective on a phased basis. Other countries or states have enacted and will continue to enact and amend laws or regulations in the future that have similar or additional requirements. Although we endeavor to continually monitor and assess the impact of these laws and regulations, and continually update our systems to protect our data and comply with these laws, their interpretation and enforcement are uncertain, subject to change, and may require substantial costs to monitor and implement. Failure to comply with data privacy and protection laws and regulations could also result in government enforcement actions (which could result in substantial civil and/or criminal penalties) and private litigation, which could adversely affect our reputation and financial performance.

We make significant capital investments in new products and services to meet the evolving needs of our customers, improve and grow our business and remain competitive. If we are not successful in these new product or service introductions, or if our past capital investments do not yield the results anticipated when making the investments, there may be an adverse effect on our financial performance.

Our business success depends in part upon protecting our intellectual property rights, including proprietary technology developed (internally or by third party partners and subcontractors) or obtained through acquisitions. We rely on copyrights, patents, trademarks, trade secrets and other intellectual property laws to establish and protect our proprietary rights. If we are unable to protect our intellectual property rights, our competitive position may suffer, which could adversely affect our revenue and profitability. The continued evolution of patent law and the nature of our innovation work may affect the number of patents we are able to receive for our development efforts. As we continue to transition our business to more software and service-based offerings, patent protection of these innovations will be more difficult to obtain. As a result, we will rely more on copyrights and, when appropriate, trade secret protection for those software and service-based offerings. In addition, from time to time, third parties may claim that we, our clients, or our suppliers, have infringed their intellectual property rights. Although third parties also face the same difficulties in patenting software and service-based offerings, these claims, if successful, may require us to redesign affected products, enter into costly settlement or license agreements, pay damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling certain products.

We depend on the security and integrity of our information technology systems and those of certain third-party service providers and suppliers to support numerous business processes and activities, to service our clients, and to enable consumer transactions and postal services. There are numerous cybersecurity risks to these systems, including, but not limited to, individual and group criminal hackers, industrial espionage, denial of service attacks, ransomware and malware attacks, attacks on the software supply chain, and employee errors and/or malfeasance, phishing and other social engineering attacks, credential theft, insider threats and exploitation of vulnerabilities in third-party software and systems. These cyber threats are diverse and constantly evolving, especially given the advances in, and the rise of the use of, artificial intelligence, thereby increasing the difficulty of preventing, detecting, and successfully defending against them and may be more difficult to detect and mitigate, including as threat actors use artificial intelligence and other advanced tools to enhance attacks and impersonation tactics. Successful cybersecurity breaches could, among other things, disrupt our operations or degrade service delivery or result in the unauthorized disclosure, theft and misuse of company, client, consumer and employee sensitive and confidential information, all of which could adversely affect our financial performance. Cybersecurity breaches could result in legal claims or proceedings, financial liability to other parties, governmental investigations, regulatory enforcement actions and penalties, and damage to our brand and reputation. Although we maintain insurance coverage relating to cybersecurity incidents, we may incur costs or financial losses that are either not insured against or not fully covered through our insurance and such insurance may be subject to exclusions, sub-limits and retentions and may become more expensive or less available on acceptable terms. We and certain of our suppliers have experienced cybersecurity incidents in the past, and may experience additional incidents in the future. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur or that we will be able to prevent, detect or respond to all incidents in a timely and effective manner. Our goal is to prevent meaningful incursions and minimize the overall impact of those that occur. For more information on how the Company handles cybersecurity, see Item 1C. Cybersecurity.

In recent years, the United States increased tariffs for certain goods, which triggered other nations to also increase tariffs on certain of their goods. These increased tariffs resulted in additional costs on certain components used in SendTech products. In addition, there continues to be significant uncertainty about the future relationship between the United States and various other countries with respect to trade policies, treaties, tariffs, taxes, and other limitations on cross-border operations. Changes in tariffs, trade barriers, price and exchange controls and other regulatory requirements could have an adverse effect on our business, prospects, financial condition and operating results, the extent of which cannot be predicted with certainty at this time.