Sunrun (RUN) Risk Analysis

The installation of solar energy systems requires our employees and employees of our solar partners to work with complicated and potentially dangerous electrical and utility systems. The evaluation and installation of our energy-related products also require these employees to work in locations that may contain potentially dangerous levels of asbestos, lead or mold or other substances. We also maintain large fleets of vehicles that these employees use in the course of their work. There is substantial risk of serious illness, injury, or death if proper safety procedures are not followed. Our operations are subject to regulation under OSHA and equivalent state laws. Changes to OSHA requirements, or stricter interpretation or enforcement of existing laws or regulations, could result in increased costs. If we fail to comply with applicable OSHA regulations, even if no work-related serious illness, injury, or death occurs, we may be subject to civil or criminal enforcement and be required to pay substantial penalties, incur significant capital expenditures, or suspend or limit operations. Any accidents, citations, violations, illnesses, injuries or failure to comply with industry best practices may subject us to adverse publicity, damage our reputation and competitive position and adversely affect our business.

Customers who enter into Customer Agreements with us are covered by production guarantees and roof penetration warranties. As the owners of the solar energy systems, we or our investment funds receive a warranty from the inverter and solar panel manufacturers, and, for those solar energy systems that we do not install directly, we receive workmanship and material warranties as well as roof penetration warranties from our solar partners. Furthermore, one or more of our third-party manufacturers or solar partners could cease operations and no longer honor these warranties, leaving us to fulfill these potential obligations to customers, or such warranties may be limited in scope and amount, and may be inadequate to protect us. We also provide a performance guarantee with certain solar service offerings pursuant to which we compensate customers on an annual basis if their system does not meet the electricity production guarantees set forth in their agreement with us. Customers who enter into Customer Agreements with us are covered by production guarantees equal to the length of the term of these agreements, typically 20 or 25 years. We may suffer financial losses associated if significant performance guarantee payments are triggered. Because of our limited operating history and the length of the term of our Customer Agreements, we have been required to make assumptions and apply judgments regarding a number of factors, including our anticipated rate of warranty claims and the durability, performance and reliability of our solar energy systems. Our assumptions could prove to be materially different from the actual performance of our systems, causing us to incur substantial expense to repair or replace defective solar energy systems in the future or to compensate customers for systems that do not meet their production guarantees. Product failures or operational deficiencies also would reduce our revenue from power purchase or lease agreements because they are dependent on system production. Any widespread product failures or operating deficiencies may damage our market reputation and adversely impact our financial results.

We believe that the success of our business depends in part on our proprietary technology, including our software, information, processes and know-how. We rely on copyright, trade secret and patent protections to secure our intellectual property rights. Although we may incur substantial costs in protecting our technology, we cannot be certain that we have adequately protected or will be able to adequately protect it, that our competitors will not be able to utilize our existing technology or develop similar technology independently, that the claims allowed with respect to any patents held by us will be broad enough to protect our technology or that foreign intellectual property laws will adequately protect our intellectual property rights. Moreover, we cannot be certain that our patents provide us with a competitive advantage. Despite our precautions, it may be possible for third parties to obtain and use our intellectual property without our consent. Unauthorized use of our intellectual property by third parties, and the expenses incurred in protecting our intellectual property rights, may adversely affect our business. In the future, some of our products could be alleged to infringe existing patents or other intellectual property of third parties, and we cannot be certain that we will prevail in any intellectual property dispute. In addition, any future litigation required to enforce our patents, to protect our trade secrets or know-how or to defend us or indemnify others against claimed infringement of the rights of third parties could harm our business, financial condition, and results of operations.

In the ordinary course of business, we, our third-party providers upon which we rely, and our suppliers collect, receive, store, transmit, process, and use proprietary, confidential, and sensitive data, including the personal information of customers, such as names, addresses, email addresses, credit information and other housing and energy use information, as well as the personal information of our employees. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. In addition, we, our third-party service providers with whom we work are subject to a variety of evolving threats, such as computer malware (including as a result of advanced persistent threat intrusions), ransomware, malicious code (such as viruses or worms), social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), telecommunications failures, denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, natural disasters and extreme weather events, general hacking, telecommunications failures, attacks enhanced or infiltrated by AI, and other similar threats. Cybersecurity threats have become more prevalent, and could impact our systems and those of our third parties in the future. Our team members who work remotely pose increased risks to our information technology systems and data, because many of them utilize network connections outside our premises that are less secure. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. Inadvertent disclosure of confidential data, such as personal information, or if a third party were to gain unauthorized access to this type of data in our possession, has resulted in, and could result in future claims or litigation arising from damages suffered by those affected, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, indemnification obligations, reputational harm, interruptions in our operations, financial loss, and other similar harms. In addition, we could incur significant costs in complying with the multitude of federal, state and local laws, and applicable independent security control frameworks, regarding the unauthorized disclosure of personal information. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Finally, any perceived or actual unauthorized disclosure of such information, unauthorized intrusion, or other cyberthreat could harm our reputation, substantially impair our ability to attract and retain customers, interrupt our operations, and have an adverse impact on our business. We rely on third parties and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We may not, however, detect and remediate all such vulnerabilities on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our services. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we currently maintain cybersecurity insurance, such insurance may not be sufficient to cover us against claims, and we cannot be certain that cyber insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies.

The solar energy industry is highly competitive and continually evolving as participants strive to distinguish themselves within their markets and compete with large utilities. We believe that our primary competitors are the established utilities that supply energy to homeowners by traditional means. We compete with these utilities primarily based on price, predictability of price, and the ease by which homeowners can switch to electricity generated by our solar service offerings. If we cannot offer compelling value to customers based on these factors, then our business and revenue will not grow. Utilities generally have substantially greater financial, technical, operational and other resources than we do. As a result of their greater size, utilities may be able to devote more resources to the research, development, promotion and sale of their products or respond more quickly to evolving industry standards and changes in market conditions than we can. Furthermore, these competitors are able to devote substantially more resources and funding to regulatory and lobbying efforts. Utilities could also offer other value-added products or services that could help them compete with us even if the cost of electricity they offer is higher than ours. In addition, a majority of utilities' sources of electricity are non-solar, which may allow utilities to sell electricity more cheaply than we can. Moreover, regulated utilities are increasingly seeking approval to "rate-base" their own residential solar and battery businesses. Rate-basing means that utilities would receive guaranteed rates of return for their solar and battery businesses. This is already commonplace for utility-scale solar projects and commercial solar projects. While few utilities to date have received regulatory permission to rate-base residential solar or storage, our competitiveness would be significantly harmed should more utilities receive such permission because we do not receive guaranteed profits for our solar service offerings. We face competition from other residential solar service providers, and we also may face competition from new entrants into the market as a result of the passage of the IRA and its impacts and benefits to the solar industry. Some of these competitors may have a higher degree of brand name recognition, differing business and pricing strategies, lower barriers to entry into the solar market, and greater capital resources than we have, as well as extensive knowledge of our target markets. For example, more recently, we have seen some of these competitors offer significantly higher turnkey prices and sales commissions than prevailing industry norms. If we are unable to establish or maintain a consumer brand that resonates with customers, maintain high customer satisfaction, or compete with the pricing offered by our competitors, our sales and market share position may be adversely affected, as our growth is primarily dependent on originating new customers. We also face competitive pressure from companies that may offer lower-priced consumer offerings than we do. In addition, we compete with companies that are not regulated like traditional utilities but that have access to the traditional utility electricity transmission and distribution infrastructure. These energy service companies are able to offer customers electricity supply-only solutions that are competitive with our solar service offerings on both price and usage of solar energy technology while avoiding the long-term agreements and physical installations that our current fund-financed business model requires. This may limit our ability to attract customers, particularly those who wish to avoid long-term contracts or have an aesthetic or other objection to putting solar panels on their roofs. Furthermore, we face competition from purely finance-driven nonintegrated competitors that subcontract out the installation of solar energy systems, from installation businesses (including solar partners) that seek financing from external parties, from large construction companies and from electrical and roofing companies. In addition, local installers that might otherwise be viewed as potential solar partners may gain market share by being able to be the first providers in new local markets. Some of these competitors may provide energy at lower costs than we do. Finally, as declining prices for solar panels and related equipment has resulted in an increase in consumers purchasing instead of leasing solar energy systems, we face competition from companies that offer consumer loans for these solar panel purchases. As the solar industry grows and evolves, we will continue to face existing competitors as well as new competitors who are not currently in the market (including those resulting from the consolidation of existing competitors) that achieve significant developments in alternative technologies or new products such as storage solutions, EV chargers, loan products, or other programs related to third-party ownership. Our failure to adapt to changing market conditions, to compete successfully with existing or new competitors and to adopt new or enhanced technologies could limit our growth and have a material adverse effect on our business and prospects.

The solar energy industry is an emerging and constantly evolving market opportunity. We believe the solar energy industry is still developing and maturing, and we cannot be certain that the market will grow to the size or at the rate we expect. For example, we have experienced increases in cancellations of our Customer Agreements in certain geographic markets during various periods in our operating history. Any future growth of the solar energy market and the success of our solar service offerings depend on many factors beyond our control, including recognition and acceptance of the solar service market by consumers, the pricing of alternative sources of energy, a favorable regulatory environment, the continuation of expected tax benefits and other incentives, and our ability to provide our solar service offerings cost effectively. If the markets for solar energy do not develop to the size or at the rate we expect, our business may be adversely affected. Solar energy has yet to achieve broad market acceptance and depends in part on continued support in the form of rebates, tax credits, and other incentives from federal, state and local governments. Additionally, there have been significant changes in the residential solar policy and pricing framework in California, which is one of our key markets and represents over 45% of our customer base. Changes to California's net metering policy adopted in December 2022, with the new billing regime implemented in April 2023, present a significant change to the financial benefits California customers receive from our solar systems and may limit the financial attractiveness of our offerings in this market, particularly for solar-only systems. Originations in California are below levels prior to the Net Billing Tariff ("NBT") transition, and without further increases in originations, our new installations in California may continue to decline compared to prior periods, which could have a material adverse effect on our business operations and financial performance. Further, if support diminishes materially for solar policy related to rebates, tax credits, bill crediting, or other incentives, our ability to obtain external financing on acceptable terms, or at all, could be materially adversely affected. These types of funding limitations could lead to inadequate financing support for the anticipated growth in our business. Furthermore, growth in residential solar energy depends in part on macroeconomic conditions, retail prices of electricity and customer preferences, each of which can change quickly. Declining macroeconomic conditions, including in job markets and residential real estate markets, could contribute to instability and uncertainty among customers and impact their financial wherewithal, credit scores or interest in entering into long-term contracts, even if such contracts would generate immediate and long-term savings. Furthermore, market prices of retail electricity generated by utilities or other energy sources could decline for a variety of reasons, as discussed further below. Any declines in macroeconomic conditions, changes in retail prices of electricity or changes in customer preferences would adversely impact our business. Achieving net zero emissions by 2050 will require an unprecedented transformation of American energy systems and the adoption of a wide variety of clean energy, storage, and home electrification solutions. Our successful deployment of such products will depend on several factors outside our control, including shifting market conditions and policy frameworks. Our failure to adapt to changing market conditions, to compete successfully with existing or new competitors, and to adopt new or enhanced offerings could limit our growth and have a material adverse effect on our business and prospects.

We depend significantly on our brand and reputation for high-quality solar service offerings, engineering and customer service to attract customers and grow our business. If we fail to continue to deliver our solar service offerings within the planned timelines, if our solar service offerings do not perform as anticipated or if we damage any customers' properties or cancel Projects, our brand and reputation could be significantly impaired. We also depend greatly on referrals from customers for our growth. Therefore, our inability to meet or exceed customers' expectations would harm our reputation and growth through referrals. We have at times focused particular attention on expeditiously growing our direct sales force and our solar partners, leading us in some instances to hire personnel or partner with third parties who we may later determine do not fit our company culture and standards. Given the sheer volume of interactions our direct sales force and our solar partners have with customers and potential customers, it is also unavoidable that some interactions will be perceived by customers and potential customers as less than satisfactory and result in complaints. If we cannot manage our hiring and training processes to limit potential issues and maintain appropriate customer service levels, our brand and reputation may be harmed and our ability to grow our business would suffer. In addition, if we were unable to achieve a similar level of brand recognition as our competitors, some of which may have a broader brand footprint, more resources and longer operational history, we could lose recognition in the marketplace among prospective customers, suppliers and partners, which could affect our growth and financial performance. Our growth strategy involves marketing and branding initiatives that will involve incurring significant expenses in advance of corresponding revenue. We cannot assure you that such marketing and branding expenses will result in the successful expansion of our brand recognition or increase our revenue. We are also subject to marketing and advertising regulations in various jurisdictions, and overly restrictive conditions on our marketing and advertising activities may inhibit the sales of the affected products.

As of December 31, 2024, California represented over 45% of our customer base. This concentration of our customer base and operational infrastructure could lead to our business and results of operations being particularly susceptible to adverse economic, regulatory, political, weather and other conditions in this market and in other markets that may become similarly concentrated, in particular the east coast, where we have seen significant growth recently. Recent changes to net metering policy and the tariff structure in California in December 2022 have created additional uncertainty and challenges, given the size of our customer base in California. Originations in California continue to be below levels prior to the NBT transition, and without further increases in originations, our new installations in California may continue to decline compared to prior periods, which could have a material adverse effect on our business operations and financial performance. Our corporate and sales headquarters are located in San Francisco, California, an area that has a heightened risk of earthquakes and nearby wildfires. We may not have adequate insurance, including business interruption insurance, to compensate us for losses that may occur from any such significant events. A significant natural disaster, such as an earthquake or wildfire, or a public health crisis, such as a pandemic, or civil unrest could have a material adverse impact on our business, results of operations and financial condition. In addition, acts of terrorism or malicious computer viruses could cause disruptions in our or our solar partners' businesses or the economy as a whole. To the extent that these disruptions result in delays or cancellations of installations or the deployment of our solar service offerings, our business, results of operations and financial condition would be adversely affected.