Shift Technologies (SFTGQ) Risk Analysis

Currently, our third-party value-added products consist of finance and vehicle protection products, which includes third-party financing of customers' vehicle purchases, as well as other value-added products, such as vehicle service contracts, guaranteed asset protection, and wheel and tire coverage. If we introduce new value-added products or expand existing offerings on our platform, such as insurance and/or insurance referral services, music services or vehicle diagnostic and tracking services and maintenance, we may incur losses or otherwise fail to enter these markets successfully. Entry into new markets may require us to compete with new companies, cater to new customer expectations, and comply with new complex regulations and licensing requirements, each of which will be unfamiliar. Accordingly, we could need to invest significant resources in market research, legal counsel, and our organizational infrastructure, and a return on such investments may not be achieved for several years, if at all. Additionally, failure to comply with applicable regulations or to obtain required licenses could result in penalties or fines. Further, we may fail in demonstrating the value of any new value-added product to customers, which would compromise our ability to successfully create new revenue streams or receive returns in excess of investments. Any of these risks, if realized, could materially and adversely affect our business, financial condition, and results of operations.

Our information technology has been and may in the future be subject to cyber-attacks, viruses, malicious software, break-ins, theft, computer hacking, phishing, employee error or malfeasance or other security breaches or loss of service. Hackers and data thieves are becoming increasingly sophisticated and large-scale and complex automated attacks are becoming more prevalent. Experienced computer programmers and hackers may be able to penetrate our security controls and misappropriate or compromise sensitive personal, proprietary or confidential information, create system disruptions or cause shutdowns. They also may be able to develop and deploy malicious software programs that attack our systems or otherwise exploit any security vulnerabilities. Our systems and the data stored on those systems also may be vulnerable to security incidents or security attacks, acts of vandalism or theft, coordinated attacks by activist entities, misplaced, blocked or lost data, human errors, or other similar events that could negatively affect our systems and the data stored on or transmitted by those systems, including the data of our customers or business partners. Further, third parties that provide services to us, such as hosted solution providers, also could be a source of security risks in the event of a failure of their own security systems and infrastructure. Our technology infrastructure may be subject to increased risk of slowdown or interruption as a result of integration with third-party services, including cloud services, and/or failures by such third parties, which may be out of our control. The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of existing or potential suppliers or players. As threats related to cyber-attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact our results of operations. Although we have insurance coverage for losses associated with cyber-attacks, as with all insurance policies, there are coverage exclusions and limitations, and our coverage may not be sufficient to cover all possible losses and claims, and we may still suffer losses that could have a material adverse effect on our business (including reputational damage). We could also be negatively impacted by existing and proposed U.S. laws and regulations, and government policies and practices related to cybersecurity, data privacy, data localization and data protection. In the event that we or our service providers are unable to prevent, detect, and remediate the foregoing security threats and vulnerabilities in a timely manner, our operations could be disrupted, or we could incur financial, legal or reputational losses arising from misappropriation, misuse, leakage, falsification or intentional or accidental release or loss of information maintained in our information systems and networks, including personal information of our employees and our customers. In addition, outside parties may attempt to fraudulently induce our employees or employees of our vendors to disclose sensitive information in order to gain access to our data. The number and complexity of these threats continue to increase over time. Although we develop and maintain systems and controls designed to prevent these events from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls, and processes require ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated. Despite our efforts, the possibility of these events occurring cannot be eliminated entirely.

As described in greater detail in "Description of Business," our business is involved in the purchase and sale of used vehicles. Companies that provide listings, information, and lead generation, as well as car-buying and car-selling services designed to help potential customers and to enable dealers to reach these customers, produce significant competition to our business. Some of these companies include: - traditional used vehicle dealerships, including those which may increase investment in their technology and infrastructure in order to compete directly with our digital business model;- large, national car dealers, such as CarMax and AutoNation, which are expanding into online sales, including "omnichannel" offerings;- used car dealers or marketplaces that currently have existing ecommerce businesses or online platforms, such as Carvana and Vroom;- the peer-to-peer market, utilizing sites such as Facebook, Craigslist.com, eBay Motors and Nextdoor.com; and - sales by rental car companies directly to consumers of used vehicles which were previously utilized in rental fleets, such as Hertz Car Sales and Enterprise Car Sales. Internet and online automotive sites, such as Google, Amazon, AutoTrader.com, Edmunds.com, KBB.com, Autobytel.com, TrueCar.com, CarGurus, and Cars.com, could change their models to directly compete with us. In addition, automobile manufacturers such as General Motors, Ford, and Volkswagen could change their sales models to better compete with our model through technology and infrastructure investments. While such enterprises may change their business models and endeavor to compete with us, the purchase and sale of used vehicles through ecommerce presents unique challenges. Our competitors also compete in the online market through companies that provide listings, information, lead generation and car buying services designed to reach customers and enable dealers to reach these customers and providers of offline, membership-based car buying services such as the Costco Auto Program. We also expect that new competitors will continue to enter the traditional and ecommerce automotive retail industry with competing brands, business models and products and services, which could have an adverse effect on our revenue, business and financial results. For example, traditional car dealers could transition their selling efforts to the internet, allowing them to sell vehicles across state lines and compete directly with our online offering and no-negotiating pricing model. Our current and potential competitors may have significantly greater financial, technical, marketing and other resources than we have, and the ability to devote greater resources to the development, promotion and support of their businesses, platforms, and related products and services. Additionally, they may have more extensive automotive industry relationships, longer operating histories and greater name recognition than we have. As a result, these competitors may be able to respond more quickly to consumer needs with new technologies and to undertake more extensive marketing or promotional campaigns. If we are unable to compete with these companies, the demand for our used vehicles and value-added products could substantially decline. In addition, if one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could adversely affect our ability to compete effectively. We may not be able to compete successfully against current or future competitors, and competitive pressures may harm our business, financial condition and results of operations. Furthermore, if our competitors develop business models, products or services with similar or superior functionality to our platform, it may adversely affect our business. Additionally, our competitors could use their political influence and increase lobbying efforts to encourage new regulations or interpretations of existing regulations that would prevent us from operating in certain markets.

We expect our quarterly results of operations, including our revenue, cash flow, and net profit or loss, to vary significantly in the future based in part on, among other things, seasonal and cyclical patterns in vehicle sales in the United States. Vehicle sales generally exhibit seasonality, with sales increasing in the first quarter and continuing through the end of the summer, before exhibiting a steep drop in the fall. This seasonality historically corresponds with the timing of income tax refunds, which can provide a primary source of funds for customers' payments on used vehicle purchases. Used vehicle prices also exhibit seasonality, with used vehicles depreciating at a faster rate in the last two quarters of each year and a slower rate in the first two quarters of each year. COVID-19 and related supply chain disruptions have somewhat disrupted these seasonal patterns in 2021 and 2022, posing additional challenges to buying and selling inventory at favorable prices. Additionally, a significant portion of our expenses are fixed and do not vary proportionately with fluctuations in revenues. In total, our results in any quarter may not be indicative of the results we may achieve in any subsequent quarter or for the full year, and period-to-period comparisons of our results of operations may not be meaningful.

We are subject to income taxes in the United States, and our tax liabilities will be subject to the allocation of expenses in differing jurisdictions. Our future effective tax rates could be subject to volatility or adversely affected by a number of factors, including: - changes in the valuation of our deferred tax assets and liabilities;- expected timing and amount of the release of any tax valuation allowances;- expiration of or detrimental changes in research and development tax credit laws; or - changes in tax laws, regulations, or interpretations thereof. In addition, we may be subject to audits of our income, sales and other transaction taxes by U.S. federal and state authorities. Outcomes from these audits could have an adverse effect on our operating results and financial condition.

We collect, store, process, and use personal information and other customer data, and we rely in part on third parties that are not directly under our control to manage certain of these operations. For example, we rely on encryption, storage and processing technology developed by third parties to securely transmit, operate on and store such information. Due to the volume and sensitivity of the personal information and data we and these third parties manage and expect to manage in the future, as well as the nature of our customer base, the security features of our information systems are critical. We expend significant resources to protect against security breaches and may need to expend more resources in the event we need to address problems caused by potential breaches. Any failure or perceived failure to maintain the security of personal and other data that is provided to us by customers and vendors could harm our reputation and brand and expose us to a risk of loss or litigation and possible liability, any of which could adversely affect our business, financial condition and results of operations. Additionally, concerns about our practices with regard to the collection, use or disclosure of personal information or other privacy-related matters, even if unfounded, could harm our business, financial condition and results of operations. We have in the past experienced security vulnerabilities, though such vulnerabilities have not had a material impact on our operations. While we have implemented security procedures and virus protection software, intrusion prevention systems, access control and emergency recovery processes to mitigate risks like these with respect to information systems that are under our control, they are not fail-safe and may be subject to breaches. Further, we cannot ensure that third parties upon whom we rely for various services will maintain sufficient vigilance and controls over their systems. Our inability to use or access those information systems at critical points in time, or unauthorized releases of personal or confidential information, could unfavorably impact the timely and efficient operation of our business, including our results of operations, and our reputation, as well as our relationships with our customers, employees or other individuals whose information may have been affected by such cybersecurity incidents. There are numerous federal, state and local laws regarding privacy and the collection, processing, storing, sharing, disclosing, using and protecting of personal information and other data, the scope of which are changing and expanding as we move into new markets, subject to differing interpretations, and which may be costly to comply with, inconsistent between jurisdictions or conflicting with other rules. We are also subject to specific contractual requirements contained in third-party agreements governing our use and protection of personal information and other data. We generally seek to comply with industry standards and are subject to the terms of our privacy policies and the privacy- and security-related obligations to third parties. We strive to comply with applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data protection, to the extent possible. However, it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Additionally, new regulations could be enacted with which we are not familiar. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers or other third parties, or our privacy-related legal obligations or any compromise of security that results in the unauthorized release or transfer of sensitive information, which may include personally identifiable information or other customer data, may result in governmental enforcement actions, litigation or public statements against us by consumer advocacy groups or others and could cause customers, vendors and receivable-purchasers to lose trust in us, which could have a material adverse effect on our business, financial condition and results of operations. Additionally, if vendors, developers or other third parties that we work with violate applicable laws or our policies, such violations may also put customers' or vendors' information at risk and could in turn harm our business, financial condition and results of operations. We expect that new industry standards, laws and regulations will continue to be proposed and implemented regarding privacy, data protection and information security where we do business. For example, the California Consumer Privacy Act (the "CCPA"), which went into effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent state privacy legislation in the U.S., which could increase our potential liability and adversely affect our business. Further, if individual U.S. states pass data privacy laws that place different obligations or limitations on the processing of personal data of individuals in those states, it will become more complex to comply with these laws and our compliance costs may increase. A significant data breach or any failure, or perceived failure, by us to comply with any federal, state or local privacy or consumer protection-related laws, regulations or other principles or orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in claims, investigations, proceedings or actions against us by governmental entities or others or other penalties or liabilities or require us to change our operations and/or cease using certain data sets. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement or payment companies about the incident and may need to provide some form of remedy, such as refunds, for the individuals affected by the incident.

The market for used cars in the United States is affected by general business and economic conditions. The United States economy often experiences periods of instability, and this volatility may result in reduced demand for our vehicles and value-added products, reduced spending on vehicles, the inability of customers to obtain credit to finance purchases of vehicles, and decreased consumer confidence to make discretionary purchases. Consumer purchases of vehicles generally decline during recessionary periods and other periods in which disposable income is adversely affected. Purchases of used vehicles are discretionary for consumers and have been, and may continue to be, affected by negative trends in the economy and other factors, including rising interest rates, the cost of energy and gasoline, the availability and cost of consumer credit, reductions in consumer confidence and fears of recession, stock market volatility, increased regulation and increased unemployment. Increased environmental regulation has made, and may in the future make, the used vehicles that we sell more expensive and less desirable for consumers. In the event of a sustained revenue decline suffered by participants in the automotive markets, our competitors may attempt to increase their sales by reducing prices or increasing marketing expenditures, car manufacturers may increase incentives to stimulate new car sales, and rental car companies may seek to reduce the sizes of their rental car fleets by selling vehicles, each of which may depress used car values. Additionally, increases in unemployment rates may increase the number of loan and lease defaults, leading to repossessions, which are typically then re-sold by lenders in the wholesale market, which also may depress used car values. While lower used vehicle prices reduce our cost of acquiring new inventory, lower prices could lead to reductions in the value of inventory we currently hold, which could have a negative impact on gross profit. Moreover, any significant changes in retail prices due to scarcity or competition for used vehicles could impact our ability to source desirable inventory for our customers, which could have a material adverse effect on our results of operations and could result in fewer used-car sales and lower revenue. Furthermore, any significant increases in wholesale prices for used vehicles could have a negative impact on our results of operations by reducing wholesale margins. In addition, changing trends in consumer tastes, negative business and economic conditions and market volatility may make it difficult for us to accurately forecast vehicle demand trends, which could cause us to increase our inventory carrying costs and could materially and adversely affect our business, financial condition and results of operations.