Ritchie Bros (RBA) Risk Factors

Our global operations are subject to tax interpretations, regulations, and legislation in the numerous jurisdictions in which we operate, all of which are subject to continual change. We accrue and pay income taxes and have significant income tax assets, liabilities, and expense that are estimates based primarily on the application of those interpretations, regulations and legislation, and the amount and timing of future taxable income, as well as our use of applicable accounting principles. Accordingly, we cannot be certain that our estimates and reserves are sufficient. The timing concerning the monetization of deferred income tax amounts is uncertain, as they are dependent on our future earnings and other events. Our deferred income tax amounts are valued based upon enacted income tax rates in effect at the time, which can be changed by governments in the future. The audit and review activities of tax authorities affect the ultimate determination of the actual amounts of commodity taxes payable or receivable, income taxes payable or receivable, deferred income tax assets and liabilities, and income tax expense. There is no assurance that taxes will be payable as anticipated or that the amount or timing of receipt or use of the tax-related assets will be as currently expected. Our experience indicates that taxation authorities are increasing the frequency and depth of audits and reviews. The Canada Revenue Agency ("CRA") has been conducting audits for our 2014, 2015, 2018, 2019 and 2020 taxation years. On February 13, 2023, the CRA issued a proposal letter to Ritchie Bros. Auctioneers (International) Ltd., asserting that one of its Luxembourg subsidiaries was resident in Canada from 2010 to 2015 and that its worldwide income should be subject to Canadian income taxation. In the event that the CRA issues a notice of assessment or reassessment and a court of competent jurisdiction makes a final determination that the income of the Luxembourg subsidiary for 2010 through 2015 was subject to Canadian income tax laws, the Company may ultimately be liable for additional total Canadian federal and provincial income tax, interest and penalties for such period, which could have a material negative effect on our operations. The CRA may also challenge the manner in which the Company has filed its tax returns and reported its income with respect to 2016 to 2020 taxation years and may assert that the income of the Luxembourg subsidiary was subject to Canadian income tax because the Luxembourg subsidiary was also resident in Canada during these years. The Company could then incur additional income taxes, penalties and interest, which could have a material negative effect on our operations. In addition, future tax authority determinations, including changes to tax interpretations, regulations, legislation or jurisprudence, could have a material impact to our financial position. The fact that we operate internationally increases our exposure in this regard given the multiple forms of taxation imposed upon us. Further and more generally, there has been increased political, media and tax authority focus on taxation in recent years; the intent of which appears to be to enhance transparency and address perceived tax avoidance. As such, in addition to tax risk from a financial perspective, our activities may expose us to reputational risk.

Governments around the world continue to propose and adopt new, or modify existing, laws and regulations addressing data privacy, data protection, data sovereignty and the processing of data, generally. Although we monitor the regulatory environment and have invested in addressing these developments, such as through our cybersecurity and privacy readiness programs, these laws may require us to incur further compliance costs to make changes to our practices, products and services to enable us or our customers to meet the new legal requirements. In addition, if we are found to have breached any such laws or regulations, we may be subject to enforcement actions that require us to change our practices, products and services, which may negatively impact our revenue, as well as expose us to liability through new or higher potential penalties and fines for non-compliance, civil and criminal penalties, and litigation for alleged violations, as well as adverse publicity that could cause our customers to lose trust in us and negatively impact our reputation and business in a manner that harms our financial position. These new or proposed laws and regulations are subject to differing interpretations that may change over time resulting in further compliance costs, as well as diversion of resources to monitor and address developments. New and proposed laws and regulations may also be inconsistent among jurisdictions or conflict with other laws and regulations. As a result, these requirements and other potential self-regulatory standards and industry codes of conduct could require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and otherwise process data or, in some cases, impact our ability to offer certain services in certain locations, to deploy software or data solutions, to market to current and prospective customers, or to derive insights from customers' online activity and data globally. We believe that laws and regulations in the United States, Canada, the United Kingdom, Australia the European Union and in other jurisdictions will be increasingly restrictive in the field of data privacy and protection and will in turn result in an increase in regulatory burdens for us to address to continue meeting our customers' expectations, in particular in relation to the sharing of personal information with third parties, the use of machine learning and big data, and the tracking of online activities for advertising. As our capacity to process large volumes of data increases, customer sentiment towards increased transparency and control and further interpretive guidance from regulatory agencies may require us to change our operations and practices in a manner adverse to our business. In this uncertain and shifting regulatory and trust climate, even the perception that the privacy and security of personal information are not satisfactorily addressed or do not meet regulatory requirements could result in adverse publicity and reputation loss.

As a public company, we are required to furnish a report by management on the effectiveness of our internal control over financial reporting. This assessment is required to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting identified by our management. We are also required to have our independent registered public accounting firm issue an opinion on the effectiveness of our internal control over financial reporting on an annual basis. Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations. If we are unable to conclude in the future that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, our stock price could decline, and we could be subject to sanctions or investigations by the New York Stock Exchange, the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Our business continues to evolve into a one-stop inventory management and multichannel disposition company where customers can buy, sell, or list equipment, when, how, and where they choose- both onsite and online, and manage their existing fleets and/or inventory using our online inventory management tools. As a result of this evolution, increasingly we interact with our customers across a variety of different channels, including live auction, online, through mobile technologies, including the Ritchie Bros. mobile app, social media, and inventory management systems. Our customers are increasingly using tablets and mobile phones to make purchases online and to get detailed equipment information for assets that they own or are interested in purchasing. Our customers also engage with us online, including through social media, by providing feedback and public commentary about all aspects of our business. Consumer shopping patterns are rapidly changing and our success depends on our ability to anticipate and implement innovations in customer experience and logistics in order to appeal to customers who increasingly rely on multiple channels to meet their equipment management and disposition needs. Our ability to provide a high quality and efficient customer experience is also dependent on external factors over which we may have little or no control, including, without limitation, the reliability and performance of the equipment sold in our marketplaces and the performance of third-party carriers who transport purchased equipment on behalf of buyers. If for any reason we are unable to implement our inventory management, data solutions, bidding tools and other multichannel initiatives, provide a convenient and consistent experience for our customers across all channels, or provide our customers the services they want, when and where they want them at a compelling value proposition, then our financial performance and brand image could be adversely affected.

We believe our future success depends in part on our ability to respond to changes in buyer requirements, our ability to meet service level expectations of both buyers and sellers and our ability to meet regulatory requirements for such customers. IAA's buyer customers include automotive body shops, rebuilders, used car dealers, automotive wholesalers, exporters, dismantlers, recyclers, brokers, and the general public, among others. We work to develop strong relationships and interactive dialogue with our customers to better understand current trends and customer needs. If we are not successful in meeting our customers' expectations, our customer relationships could be negatively affected and result in a loss of future business, which would adversely affect our operating results and financial condition.

One of our founding principles is that we operate a fair and transparent business, and consistently act with integrity. Maintaining a positive reputation is key to our ability to attract and maintain customers, investors and employees. Damage to our reputation could cause significant harm to our business. Harm to our reputation could arise in a number of ways, including, but not limited to, employee conduct which is not aligned with our Code of Business Conduct and Ethics (and associated Company policies around behavioral expectations) or our Company's core values, safety incidents, failure to maintain customer service standards, loss of trust in the fairness of our sales processes, and other technology or compliance failures.

We regard our proprietary technologies and intellectual property as integral to our success. We protect our proprietary technology through a combination of trade secrets, third-party confidentiality and nondisclosure agreements, additional contractual restrictions on disclosure and use, and patent, copyright, and trademark laws. We are the registered owners of many Internet domain names internationally. As we seek to protect our domain names in an increasing number of jurisdictions, we may not be successful in doing so in certain jurisdictions. Our competitors may adopt trade names or domain names similar to ours, thereby impeding our ability to promote our marketplace and possibly leading to customer confusion. In addition, we could face trade name or trademark or service mark infringement claims brought by owners of other registered or unregistered trademarks or service marks, including trademarks or service marks that may incorporate variations of our brand names. The legal means we use to protect our proprietary technology and intellectual property do not afford complete protection and may not adequately protect our rights or permit us to gain or keep any competitive advantage. We cannot guarantee that: any of our present or future intellectual property rights will not lapse or be invalidated, circumvented, challenged or abandoned; our intellectual property rights will provide competitive advantages to us; our ability to assert our intellectual property rights against potential competitors or to settle current or future disputes will not be limited by our agreements with third parties; any of our pending or future patent applications will be issued or have the coverage originally sought; or our intellectual property rights will be enforced in jurisdictions where competition may be intense or where legal protection may be weak. We also may allow certain of our registered intellectual property rights, or our pending applications or registrations for intellectual property rights, to lapse or to become abandoned if we determine that obtaining or maintaining the applicable registered intellectual property rights is not worthwhile. Further, although it is our practice to enter into confidentiality agreements and intellectual property assignment agreements with our employees and contractors, these agreements may not be enforceable or may not provide meaningful protection for our trade secrets or other proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy, reverse engineer, or otherwise obtain and use our products or technology. We cannot be certain that we will be able to prevent unauthorized use of our technology or infringement or misappropriation of our intellectual property, particularly in foreign countries where the laws may not protect our proprietary rights. Effective patent, copyright, trademark, service mark, trade secret, and domain name protection is time-consuming and expensive to maintain. Litigation may be necessary to enforce our intellectual property rights, to protect our trade secrets, or to determine the validity and scope of the proprietary rights of others, which could result in substantial costs and diversion of our resources. In addition, our efforts may be met with defenses and counterclaims challenging the validity and enforceability of our intellectual property rights or may result in a court determining that our intellectual property rights are unenforceable. If we are unable to cost-effectively protect our intellectual property rights, then our business could be harmed. If competitors are able to use our technology or develop proprietary technology similar to ours or competing technologies, our ability to compete effectively and our growth prospects could be adversely affected.

We rely on IT resources to manage and operate our business, including maintaining proprietary databases containing sensitive and confidential information about our customers, suppliers, counterparties and employees (which may include personal information and credit information) and utilizing approved third-party technology providers to support the management and operation of IT systems and infrastructure. The malicious tools and techniques used to obtain unauthorized access to or impair IT systems and devices and the data processed thereby evolve frequently in terms of attack vectors and sophistication and we may not be able to anticipate these vectors or to timely implement adequate preventative and protective measures. Unauthorized parties have and may in the future attempt to gain access to our and our providers' primary and backup systems or facilities through various means, including hacking into IT systems or facilities, fraud, trickery or other means of deceiving our and their employees or contractors. Ransomware attacks are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, and diversion of funds. Further, breaches experienced by other companies may also be leveraged against us and sophisticated actors can mask their attacks, making them increasingly difficult to identify and prevent. There can be no assurance that impacts from these incidents will not be material or significant in the future. In addition, our limited control over our customers may affect the security and integrity of our IT systems and create financial or legal exposure. For example, our customers may accidentally disclose their passwords, use insecure passwords, or store them on a device that is lost or stolen, providing bad actors with access to a customer's account with us and the possible means to redirect customer payments. Further, users of our services could have vulnerabilities on their own devices that are entirely unrelated to our systems and platforms but could mistakenly attribute their own vulnerabilities to us. Under credit card payment rules and our contracts with credit card processors, if there is a breach of payment card information used to process transactions, we could be liable to the payment card issuing banks for certain fraudulent credit card transactions and other payment disputes with customers, including the cost of issuing new cards and related expenses. If we were liable for a significant number of fraudulent transactions or unable to accept payment cards, our results of operations would be materially and adversely affected. The information security measures we implement, maintain and follow that are designed to mitigate our risks with respect to IT-related cybersecurity incidents do not guarantee that our operations will not be disrupted, that we will prevent an attack from occurring in the future, or that our internal controls, for instance relating to user access management, will perform as intended to prevent unauthorized access to our systems and data. Any breach of our IT systems may have a material adverse impact on our business, the assessment of the performance of our internal control environment, results of operations, reputation, stock price and our ability to access capital markets, and may also be deemed to contribute to a material weakness in internal controls over financial reporting. Security events, hacking or other malicious or surreptitious activity (or the perception that such activities have occurred), could damage our reputation, cause a loss of confidence in the security of our services and thereby a loss of customers, and expose us to a risk of loss, governmental investigations and enforcement actions or litigation and possible liability for damages. We may be required to make significant expenditures and divert management attention to monitor, detect and prevent security events, to remediate known or potential security vulnerabilities, or to alleviate problems caused by any security events. In addition, circumvention of our security measures may result in the loss or misappropriation of valuable business data, intellectual property or trade secret information, misappropriation of our customers' or employees' personal information, damage to our computing infrastructure, networks and stored data, service delays, key personnel being unable to perform duties or communicate throughout the organization, loss of sales, significant costs for data restoration and other adverse impacts on our business. Further, such a breach may require us to incur significant expenses to notify governmental agencies, individuals or other third parties pursuant to various privacy and security laws. The costs of mitigating cybersecurity risks are significant and are likely to increase in the future. Our third-party service providers may be vulnerable to interruption or loss of valuable business data and information of our customers and employees (among others). Data stored by our third party providers might be improperly accessed or unavailable due to a variety of events beyond our control, including, but not limited to, employee error or negligence, natural disasters, terrorist attacks, telecommunications failures, computer viruses, hackers and other security issues. Additionally, if any of our third-party technology providers violate applicable laws or our contracts or policies, such violations may also put our customers' information at risk and could in turn have a material and adverse effect on our business. These issues are likely to become costlier as we grow. Our insurance policies may not be adequate to reimburse us for losses caused by security breaches, and we may not be able to fully collect, if at all, under these insurance policies.

Macroeconomic factors that affect oil prices and the vehicle and commodity markets can have adverse effects on our revenue and operating results. Significant increases in the cost of fuel, whether due to inflationary pressures, the current war between Ukraine and Russia or Israel and Hamas or otherwise, could lead to a reduction in miles driven per car and a reduction in accident rates. A material reduction in accident rates, whether due to a reduction in miles driven or other factors, could reduce our vehicle assignment volumes, which in turn, could have a material adverse impact on our revenues. In addition, significant increases in the cost of fuel have resulted and could continue to result in an increase in the prices charged to us by our independent subhaulers and trucking fleet operators. Further, we have recently experienced labor shortages, which have resulted in an increase in associated costs, such as increased overtime to meet demand and increased wages to attract and retain employees. If these conditions or other inflationary pressures continue, our costs for towing and branch labor may continue to rise. To the extent we are unable to pass these costs on to our customers, the increase in prices charged by our independent subhaulers and trucking fleet operators and the increase in labor costs could negatively impact our profitability. Volatility in salvage car prices could have a material adverse effect on our revenues in future periods. Adverse economic conditions, including increases in interest rates and lease rates, real estate values and real estate development and construction costs, may increase the costs required to invest in capacity expansion or delay our ability to open new facilities, both of which could have a material impact on our consolidated results of operations and financial position.

We conduct business in many countries around the world and intend to continue to expand our presence in international markets, including emerging markets. Although we report our financial results in U.S. dollars, a significant portion of our revenues and expenses are generated outside the U.S., primarily in currencies other than the U.S. dollar. In particular, a significant portion of our revenues are earned, and expenses incurred, in the Canadian dollar and the Euro. The results of operations of our foreign subsidiaries are translated from local currency into U.S. dollars for financial reporting purposes. If the U.S. dollar weakens against foreign currencies, the translation of these foreign currency denominated revenues or expenses will result in increased U.S. dollar denominated revenues and expenses. Similarly, if the U.S. dollar strengthens against foreign currencies, particularly the Canadian dollar and the Euro, our translation of foreign currency denominated revenues or expenses will result in lower U.S. dollar denominated revenues and expenses. We do not currently engage in foreign currency hedging arrangements on any of our revenues or expenses. Fluctuating currency exchange rates may negatively affect our business in international markets and our related results of operations. In addition, currency exchange rate fluctuations between the different countries in which we conduct our operations impact the purchasing power of buyers, the motivation of consignors, asset values and asset flows between various countries, including those in which we do not have operations. These factors and other global economic conditions may harm our business and our results of operations. Other risks inherent in doing business internationally include, but are not limited to the following: (a) trade barriers, trade regulations, currency controls, import or export regulations, and other restrictions on doing business freely; (b) local labor, environmental, tax, and other laws and regulations, and the potential for adverse changes in such laws and regulations or the interpretations thereof; (c) difficulties in staffing and managing foreign operations; (d) economic, political, social or labor instability or unrest; (e) terrorism, war, hostage-taking, or military repression; (f) corruption; (g) expropriation and nationalization, or difficulties in enforcing or protecting our property rights, including with respect to intellectual property; (h) increased exposure to high rates of inflation; and (i) unpredictability as to litigation in foreign jurisdictions and enforcement of local laws. If we violate the complex foreign and U.S. laws and regulations that apply to our international operations, we may face fines, criminal actions or sanctions, prohibitions on the conduct of our business and damage to our reputation. These risks inherent in our international operations increase our costs of doing business internationally and may result in a material adverse effect on our operations or profitability.