Rocky Mountain Chocolate Factory (RMCF) Risk Analysis

In order to sell our products, we need to maintain a good reputation with our customers and consumers. Issues related to the quality and safety of our products, ingredients or packaging could jeopardize our Company's image and reputation. Negative publicity related to these types of concerns, or related to product contamination or product tampering, whether valid or not, could decrease demand for our products or cause production and delivery disruptions. We may need to recall products if any of our products become unfit for consumption. In addition, we could potentially be subject to litigation or government actions, which could result in payments of fines or damages. Costs associated with these potential actions could negatively affect our results of operations.

The retailing of confectionery products is highly competitive. We and our franchisees compete with numerous businesses that offer similar products. Many of these competitors may have greater name recognition and financial, marketing and other resources than we do. In addition, there is intense competition among retailers for real estate sites, store personnel and qualified franchisees. Competitive market conditions could have a material adverse effect on us and our results of operations and our ability to expand successfully.

From time to time, we are called upon to defend ourselves against lawsuits relating to our business. Due to the inherent uncertainties of litigation, we cannot accurately predict the ultimate outcome of any such proceedings. An unfavorable outcome in any current or future legal proceedings could have an adverse impact on our business, and financial results. In addition, any significant litigation in the future, regardless of its merits, could divert management's attention from our operations and result in substantial legal fees. Any litigation could result in substantial costs and a diversion of management's attention and resources that are needed to successfully run our business.

Consumer purchases of discretionary items, including our products, often decline during weak economic periods where disposable income is adversely affected. Our performance is subject to factors that affect worldwide economic conditions, including employment, consumer debt, reductions in net worth based on severe market declines, residential real estate and mortgage markets, taxation, fuel and energy prices, interest rates, tariffs, consumer confidence, public health, the value of the U.S. dollar versus foreign currencies and other macroeconomic factors. These factors may cause consumers to purchase products from lower priced competitors or to defer purchases of discretionary products altogether. Economic weakness could have a material effect on our results of operations, liquidity and capital resources. It could also impact our ability to fund growth and/or result in us becoming more reliant on external financing, the availability and terms of which may be uncertain. In addition, a weak economic environment may exacerbate the other risks noted below. We rely in large part on our franchisees and the manner in which they operate their stores to develop and promote our business. It is possible that additional franchisees could file for bankruptcy, become delinquent in their payments to us, or simply shut down which could have a significant adverse impact on our business due to loss of factory sales and loss or delay in payments of royalties, contributions to our marketing fund and other fees. Additionally, the availability of credit to our small business franchisees may be curtailed due to tighter credit conditions in the marketplace, and as a result, could delay or preclude franchisees from making required store upgrades. Although we have developed, and continue to develop, evolving criteria to evaluate and screen prospective developers and franchisees, we cannot be certain that the developers and franchisees we select will have the business acumen or financial resources necessary to open and operate successful franchises in their franchise areas, and state franchise laws may limit our ability to terminate or modify these franchise arrangements. Moreover, franchisees may not successfully operate stores in a manner consistent with our standards and requirements, or may not hire and train qualified managers and other store personnel. The failure of developers and franchisees to open and operate franchises successfully could have a material adverse effect on us, our reputation, our brand, our ability to attract prospective franchisees, our business, financial condition, results of operations and cash flows.

Our business and financial results could be negatively impacted by public health outbreaks. The severity, magnitude and duration of global or regional public health outbreaks are uncertain and hard to predict. For example, COVID-19 significantly impacted economic activity and markets around the world, and resulted in broader supply, transportation and labor disruptions resulting in inflation and generally higher operating costs in our business. Relatedly, commodity and transportation costs have become more volatile and generally increased since the COVID-19 pandemic, as have supply chain disruptions, and transportation and labor shortages. Additionally, government or regulatory responses to public health outbreaks could negatively impact our business. Mandatory lockdowns or other restrictions on operations in some countries temporarily disrupted our ability to distribute our products in some markets. Resumption, continuation or expansion of these disruptions could materially adversely impact our operations and results. These and other impacts of global or regional public health outbreaks could have the effect of heightening many of the other risks described in the risk factors presented in this filing, including but not limited to those relating to our reputation, brands, consumer preferences, supply chain, product sales, pricing actions, results of operations or financial condition. We might not be able to predict or respond to all impacts on a timely basis to prevent near- or long-term adverse impacts to our results. The ultimate impact of these disruptions also depends on events beyond our knowledge or control, including the duration and severity of other public health outbreaks and actions taken by parties other than us to respond to them. Any of these disruptions could have a negative impact on our business operations, financial performance, results of operations and stock price, and this impact could be material.

Changes in trade policy, including trade restrictions, new or increased tariffs or quotas, embargoes, sanctions and countersanctions, safeguards or customs restrictions by the U.S. and/or other foreign governments could have a material adverse impact on our business. The imposition of new tariffs or increases in existing tariffs on products imported from countries could result in increased costs for our goods. These cost increases may reduce our margins, require us to raise prices, or make our products less competitive in the marketplace. In addition, other countries may change their business and trade policies in anticipation of or in response to increased import tariffs and other changes in trade policy and regulations already enacted or that may be enacted in the future. If we are unable to mitigate these risks through supply chain adjustments, pricing strategies, or other measures, our financial performance and growth prospects could be negatively affected.

In connection with credit and debit card sales, we and our franchisees transmit confidential credit and debit card information by way of secure private retail networks. A number of retailers have experienced actual or potential security breaches in which credit and debit card information may have been stolen. Although we and our franchisees use private networks, third parties may have the technology or know-how to breach the security of the customer information transmitted in connection with credit and debit card sales, and our and our franchisees' security measures and those of our and our franchisees' technology vendors may not effectively prohibit others from obtaining improper access to this information. If a person were able to circumvent these security measures, he or she could destroy or steal valuable information or disrupt our and our franchisees' operations. Any security breach could expose us and our franchisees to risks of data loss and liability and could seriously disrupt our and our franchisees' operations and any resulting negative publicity could significantly harm our reputation. We may also be subject to lawsuits or other proceedings in the future relating to these types of incidents. Proceedings related to the theft of credit and debit card information may be brought by payment card providers, banks, and credit unions that issue cards, cardholders (either individually or as part of a class action lawsuit), and federal and state regulators. Any such proceedings could harm our reputation, distract our management team members from running our business and cause us to incur significant unplanned liabilities, losses and expenses. We also sell and accept for payment gift cards, and our customer loyalty program provides rewards that can be redeemed for purchases. Like credit and debit cards, gift cards and rewards earned by our customers are vulnerable to theft, whether physical or electronic. We believe that, due to their electronic nature, rewards earned through our customer loyalty program are primarily vulnerable to hacking. Customers affected by any loss of data or funds could litigate against us, and security breaches or even unsuccessful attempts at hacking could harm our reputation, and guarding against or responding to hacks could require significant time and resources. We also receive and maintain certain personal information about our customers, including information received through our marketing programs, franchisees and business partners. Our collection, storage, handling, use, disclosure and security of this information is regulated by U.S. federal, state and local and foreign laws and regulations. If our security and information systems are compromised or our employees fail to comply with these laws and regulations and this information is obtained by unauthorized persons or used inappropriately, it could adversely affect our reputation, as well as the results of operations, and could result in litigation against us or the imposition of penalties. In addition, our ability to accept credit and debit cards as payment in our stores and online depends on us maintaining our compliance status with standards set by the PCI Security Standards Council. These standards, set by a consortium of the major credit card companies, require certain levels of system security and procedures to protect our customers' credit and debit card information as well as other personal information. Privacy and information security laws and regulations change over time, and compliance with those changes may result in cost increases due to necessary system and process changes.

We and our franchisees rely on our computer systems and network infrastructure across our operations, including point-of-sale (POS) processing at our stores. Our and our franchisees' operations depend upon our and our franchisees' ability to protect our computer equipment and systems against damage from physical theft, fire, power loss, telecommunications failure or other catastrophic events, as well as from internal and external cybersecurity breaches, viruses and other disruptive problems. Any damage or failure of our computer systems or network infrastructure that causes an interruption in our operations could have a material adverse effect on our business and subject us or our franchisees to litigation or to actions by regulatory authorities. Furthermore, the importance of such information technology systems and networks increased in FY 2021 and continued into FY 2022, FY 2023, FY 2024 and FY 2025 due to many of our employees working remotely. A party who is able to compromise the security measures on our networks or the security of our infrastructure could, among other things, misappropriate our proprietary information and the personal information of our customers and employees, cause interruptions or malfunctions in our or our franchisee's operations, cause delays or interruptions to our ability to operate, cause us to breach our legal, regulatory or contractual obligations, create an inability to access or rely upon critical business records or cause other disruptions in our operations. These breaches may result from human errors, equipment failure, fraud, or malice on the part of employees or third parties. We expend financial resources to protect against such threats and may be required to further expend financial resources to alleviate problems caused by physical, electronic, and cyber security breaches. As techniques used to breach security are growing in frequency and sophistication and are generally not recognized until launched against a target, regardless of our expenditures and protection efforts, we may not be able to implement security measures in a timely manner or, if and when implemented, these measures could be circumvented. Any breaches that may occur could expose us to an increased risk of lawsuits, loss of existing or potential future customers, harm to our reputation and increases in our security costs, which could have a material adverse effect on our financial performance and operating results. In the event of a breach resulting in loss of data, such as personally identifiable information or other such data protected by data privacy or other laws, we may be liable for damages, fines and penalties for such losses under applicable regulatory frameworks despite not handling the data. Further, the regulatory framework around data custody, data privacy and breaches varies by jurisdiction and is an evolving area of law. We may not be able to limit our liability or damages in the event of such a loss. We are continuing to invest in and expand, upgrade and develop our information technology capabilities, including enterprise resource planning (ERP) software and point-of-sale (POS) systems, as well as the adoption of cloud services for e-mail, intranet, and file storage. If we are unable to successfully upgrade or expand our technological capabilities, we may not be able to take advantage of market opportunities, manage our costs and transactional data effectively, satisfy customer requirements, execute our business plan or respond to competitive pressures. Additionally, unforeseen problems with our ERP or POS system may affect our operational abilities and internal controls and we may incur additional costs in connection with such upgrades and expansion.