Thryv Holdings (THRY) Risk Factors

We expect to derive a substantial portion of our future revenue from the sale of subscriptions to our Thryv platform. The market for small business management solutions is still evolving, and competitive dynamics may cause pricing levels to change as the market matures and as existing and new market participants introduce new types of point applications and different approaches to enable businesses to address their respective needs. As a result, we may be forced to reduce the prices we charge for our Thryv platform and may be unable to renew existing client agreements or enter into new client agreements at the same prices and upon the same terms that we have historically. In addition, our growth strategy involves cross-selling to existing U.S. and international Marketing Services clients to increase the value of our client relationships over time as we expand their use of our services, onboard other parts of their organizations and upsell additional offerings and features. If our cross-selling efforts are unsuccessful or if our existing clients fail to expand their use of our Thryv platform or adopt additional offerings and features, our operating results may be materially adversely affected.

Our ability to increase revenue will depend, in large part, on our ability to increase sales from existing clients who do not utilize our Thryv platform and to sell our existing platform into new domestic and international markets. The success of our Thryv platform depends on several factors, including the introduction and market acceptance of our Thryv platform, the ability to maintain and to develop relationships with third-party service providers, and the ability to attract, to retain and to effectively train sales and marketing personnel. Any new solutions we develop or acquire may not be introduced in a timely or cost-effective manner and may not achieve the market acceptance necessary to generate significant revenue. Any new markets in which we attempt to sell our Thryv platform and add-ons, including new countries or regions, may not be receptive. Additionally, any expansion into new markets will require commensurate ongoing expansion of our monitoring of local laws and regulations, which increases our costs as well as the risk of the product not incorporating in a timely fashion or all the necessary changes to enable a client to be compliant with such laws. Our ability to further penetrate our existing markets depends on the quality of our Thryv platform and add-ons and our ability to design our solutions to meet consumer demand. Furthermore, our ability to increase sales from existing clients depends on our clients' satisfaction with our services and our clients' desire for additional solutions and to expand from single-point solutions to our comprehensive Thryv platform. If we are unable to sell solutions into new markets or to further penetrate existing markets, or to increase sales from existing clients, our revenue may not grow as expected, which could have a material adverse effect on our business, financial condition and results of operations. Furthermore, the success of any geographic expansion depends on our ability to customize products to integrate with third-party applications in that region and other market specific customizations, translate products for non-English speaking markets and provide customer service and training in local languages, which we may be unable to do successfully.

There is considerable patent and other intellectual property development activity in our industry. Our success depends upon our not infringing upon the intellectual property rights of others. Our competitors, as well as a number of other entities and individuals, including parties commonly referred to as "patent trolls," may own or claim to own intellectual property relating to our industry. From time to time, third parties may claim that we are infringing upon their intellectual property rights, and we may be found to be infringing upon such rights. In the future, others may claim that our Thryv platform and underlying technology infringe or violate their intellectual property rights. However, we may be unaware of the intellectual property rights that others may claim cover some or all of our technology or services. Our history of mergers and acquisitions may cause the appropriate licensing of IP rights of third parties on which we rely to be difficult to trace and prove over time. Any claims or litigation could cause us to incur significant expenses and, if successfully asserted against us, could require that we pay substantial damages or ongoing royalty payments, prevent us from offering our services, or require that we comply with other unfavorable terms. Even if we were to prevail in such a dispute, any litigation regarding our intellectual property could be costly and time-consuming and divert the attention of our management and key personnel from our business operations. Any such events could have a material adverse effect on our business, financial condition and results of operations.

Our business is dependent on our data processing systems and our data centers operated by third-party providers. We rely on these systems to process, on a daily and time sensitive basis, a large number of complicated transactions. We electronically receive, process, store and transmit data and PII about our clients and our employees, as well as our vendors and other business partners, including names, social security numbers, credit card numbers and financial account numbers. We keep this information confidential. However, our websites, networks, applications and technologies and other information systems have in the past, and will continue to be targeted for sabotage, disruption, or data misappropriation. The uninterrupted operation of our information systems and our ability to maintain the confidentiality of PII and other client and individual information that resides on our systems are critical to the successful operation of our business. While we have information security and business continuity programs, these plans may not be sufficient to ensure the uninterrupted operation of our systems or to prevent unauthorized access to the systems by unauthorized third parties. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. These concerns about information security increase with the mounting sophistication of social engineering. Our network security hardening may be bypassed by phishing and other social engineering techniques that seek to use end-user behaviors to distribute computer viruses and malware into our systems, which might disrupt our delivery of services and make them unavailable and might also result in the disclosure or misappropriation of PII or other confidential or sensitive information. In addition, a significant cyber-security breach could prevent or delay our ability to process payment transactions. Any information security breach in our business processes or of our processing systems has the potential to impact our client information and our financial reporting capabilities, which could result in the potential loss of business and our ability to accurately report financial results. If any of these systems fail to operate properly or become disabled even for a brief period of time, we could potentially miss a critical filing period, resulting in potential fees and penalties, or lose control of client data, all of which could result in financial loss, a disruption of our businesses, liability to clients, regulatory intervention, or damage to our reputation. The continued occurrence of high-profile data breaches provides evidence of an external environment increasingly hostile to information security. If our security measures are breached as a result of third-party action, employee or subcontractor error, malfeasance or otherwise, and, as a result, someone obtains unauthorized access to client data, our reputation may be damaged, our business may suffer, and we could incur significant liability. We may also experience security breaches that may remain undetected for an extended period of time. Techniques used to obtain unauthorized access or to sabotage systems change frequently and are growing increasingly sophisticated. As a result, we may be unable to anticipate these techniques or to implement adequate preventative measures. This environment demands that we continuously improve our design and coordination of security controls throughout the Company. Our Board of Directors (the "Board"), in coordination with the Audit Committee, has primary responsibility for overseeing cyber-security risk management and the effectiveness of security controls. The Audit Committee receives quarterly reports identifying major risk area exposures, such as cyber-security. In the event that the Audit Committee identifies significant risk exposures, including with respect to cyber-security, it will present such exposure to the Board to assess our risk identification, risk management and mitigation strategies. Despite these efforts, it is possible that our security controls over data, training and other practices we follow may not prevent the improper disclosure of PII or other confidential information. Any issue of data privacy as it relates to unauthorized access to or loss of client and/or employee information could result in the potential loss of business, damage to our market reputation, litigation and regulatory investigation and penalties. There may be other such security vulnerabilities that come to our attention. Our continued investment in the security of our technology systems, continued efforts to improve the controls within our technology systems, business processes improvements and the enhancements to our culture of information security may not successfully prevent attempts to breach our security or unauthorized access to PII or other confidential, sensitive or proprietary information. In addition, in the event of a catastrophic occurrence, either natural or man-made, our ability to protect our infrastructure, including PII and other client data and to maintain ongoing operations could be significantly impaired. Our business continuity and disaster recovery plans and strategies may not be successful in mitigating the effects of a catastrophic occurrence. Insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance policies may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management's attention. If our security is breached, if PII or other confidential information is accessed, or if we experience a catastrophic occurrence, it could have a material adverse effect on our business, financial condition and results of operations.

Our solutions are inherently complex and may contain material defects or errors. Any defects in functionality or that cause interruptions in the availability of our Thryv platform and add-ons could result in: - loss or delayed market acceptance and sales;- breach of warranty or other contractual claims for damages incurred by clients;- loss of clients;- diversion of development and client service resources; and - injury to our reputation; The occurrence of any of these issues could have a material adverse effect on our business, financial condition and results of operations. In addition, the costs incurred in correcting any material defects or errors might be substantial. Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption, or cause the information that we collect to be incomplete or contain inaccuracies that our clients regard as significant. Furthermore, the availability or performance of our Thryv platform and add-ons could be adversely affected by a number of factors, including clients' inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services. We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our clients for damages they may incur resulting from certain of these events. Because of the nature of our business, our reputation could be harmed as a result of factors beyond our control. For example, because our clients access our Thryv platform and add-ons through their internet service providers, if a service provider fails to provide sufficient capacity to support our platform and add-ons or otherwise experiences service outages, such failure could interrupt our clients' access to or experience with our platform, which could adversely affect our reputation or our clients' perception of our platform's reliability or otherwise have a material adverse effect on our business, financial condition and results of operations. Our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention.

We maintain clients in a variety of industries, including healthcare, financial services, the public sector and telecommunications. Regulators in certain industries have adopted, and may in the future adopt, regulations or interpretive positions regarding the use of cloud computing and other outsourced services. The costs of compliance with, and other burdens imposed by, industry-specific laws, regulations and interpretive positions may limit our clients' use and adoption of our services and reduce overall demand for our services. Compliance with these regulations may also require us to devote greater resources to support certain clients, which may increase costs and lengthen sales cycles. For example, some financial services regulators have imposed guidelines for use of cloud computing services that mandate specific controls or require financial services enterprises to obtain regulatory approval prior to outsourcing certain functions. If we are unable to comply with these guidelines or controls, or if our clients are unable to obtain regulatory approval to use our services where required, our business may be harmed. In addition, an inability to satisfy the standards of certain voluntary third-party certification bodies that our clients may expect, such as an attestation of compliance with the New York SHIELD Law, CCPA, Payment Card Industry ("PCI") Data Security Standards, may have an adverse impact on our business and results. Furthermore, we and our clients in the healthcare industry are regulated by HIPAA, which establishes privacy and security standards that limit the use and disclosure of protected health information ("PHI") and requires the implementation of administrative, physical and technical safeguards to ensure the confidentiality, integrity and availability of individually identifiable health information in electronic form, as well as breach notification procedures for breaches of PHI and penalties for violation of HIPAA's requirements for entities subject to its regulation. We work to maintain compliance with the relevant industry-specific certifications or other requirements or standards relevant to our clients, but if in the future we are unable to achieve or maintain such certifications, requirements or standards, it may harm our business and adversely affect our results. Further, in some cases, industry-specific laws, regionally-specific, or product-specific laws, regulations, or interpretive positions may also apply directly to us as a service provider. The interpretation of many of these statutes, regulations and rulings is evolving in the courts and administrative agencies and an inability to comply may have an adverse impact on our business and results. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business. For example, there are various statutes, regulations and rulings relevant to the direct email marketing and text-messaging industries, including the CAN-SPAM Act, Telephone Consumer Protection Act ("TCPA") and related FCC orders. The TCPA and FCC rulings impose significant restrictions on the ability to utilize telephone calls and text messages to mobile telephone numbers as a means of communication, when the prior express consent of the person being contacted has not been obtained or proof of such consent not properly maintained. We may in the future be subject to one or more lawsuits, containing allegations that one of our platforms or clients using our platform violated industry-specific regulations and any determination that we or our clients violated such regulations could expose us to significant damage awards that could, individually or in the aggregate, materially adversely affect our business.

We have material pension liabilities, some of which represent underfunded liabilities under our frozen pension plans. Changes in the interest rate environment, inflation, mortality rate assumptions or unfavorable changes in applicable laws or regulations could materially change the timing and amount of required plan funding. Additionally, a material deterioration in the funded status of the plans could significantly increase our pension expenses, potentially impacting our cash flow and profitability in the future.

We rely on third-party service providers for many integral aspects of our business. A failure on the part of any of our third-party service providers to fulfill its contracts with us could result in a material adverse effect on our business, financial condition or results of operations. We depend on our third parties for many services, including, but not limited to: Development and delivery of Thryv modules We utilize third-party service providers for a variety of components and feature sets and related intellectual property underlying or incorporated in the Thryv platform. Additionally, we utilize third-party service providers for the development and maintenance of our Thryv platform, as well as hosting the Thryv platform itself through a third party's relationship with a cloud services provider. We also rely on a third-party solution for order entry and monthly payment processing for Thryv orders. Any decline in the quality of, or delay in delivery of, modules or other software produced by such third-party service providers could result in reduced revenue, cause an increase in operational costs to switch providers, subject us to liability, or cause clients to fail or be unable to renew their subscriptions, any of which could materially adversely affect our business. Typically, our license agreements with third-party service providers are not exclusive and/or do not extend to all territories in which we may wish to do business in the future, and in certain cases, our third-party service providers have the right to distribute features developed for our Thryv platform in their own software offerings, which could adversely impact select functionality of our platform as well as adversely affect our business, our ability to compete with our competitors, and our ability to generate revenue. If our agreements with our third-party service providers expire or are terminated, we may face loss of functionality or costs associated with replacing the relevant technology. Such expiration or termination may also disrupt our business, leading to liability to customers or loss of business. Upkeep of data centers We host our consumer-facing internet sites, which are a major source of low-cost fulfillment traffic for our clients and serve most of our digital service clients from data centers operated by third-party providers, primarily Amazon Web Services. While we control and have access to our servers and all of the components of our network that are located in our external data centers, we do not control the operation of these facilities. The owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms, or at all. These third parties may also seek to cap their maximum contractual liability, resulting in Thryv being financially responsible for losses caused by their actions or omissions. Additionally, we host our internal systems through data centers that we operate and lease in Texas and Virginia. If we are unable to renew our agreements with our third-party providers or to renew our leases on commercially reasonable terms, or if one of our data center operators is acquired, we may be required to transfer our servers and other infrastructure to new data center facilities, and we may incur significant costs and possible service interruption in connection with any such transfer. Both our third-party data centers and data centers that we lease and operate are subject to break-ins, sabotage, intentional acts of vandalism and other misconduct. Any such acts could result in a breach of the security of our or our clients' data. Problems faced by our third-party data center locations, with the telecommunications network providers with whom we or they contract, or with the systems by which our telecommunications providers allocate capacity among their customers, including us, could adversely affect the experience of our clients. We have periodically experienced service disruptions in the past, and we may experience interruptions or delays in our service in the future. Our third-party data centers' operators could also decide to close their facilities without adequate notice. In addition, any financial difficulties, such as bankruptcy, faced by our third-party data center operators or any of the third-party service providers with whom we or they contract may have negative effects on our business, the nature and extent of which are difficult to predict. Additionally, if our data centers are unable to keep up with our growing needs for capacity, this could adversely affect the growth of our business. While we maintain both redundancy and disaster recovery protocols, any changes in third-party service levels at our data centers or any security breaches, errors, defects, disruptions, or other performance problems with our Thryv platform and add-ons could adversely affect our reputation, damage our clients' stored files, result in lengthy interruptions in our services, or otherwise result in damage or losses to our clients for which they may seek compensation from us. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the data center services we use. Interruptions in our services might reduce our revenues, cause us to issue refunds to clients for prepaid and unused subscription services, subject us to potential liability, or adversely affect our renewals. Monitoring of changes to applicable laws We and our third-party providers must monitor for any changes or updates in laws that are applicable to the solutions that we or our third-party providers provide to our clients. In addition, we are reliant on our third-party providers to modify the solutions that they provide to our clients to enable our clients to comply with changes to such laws and regulations. If our third-party providers fail to reflect changes or updates in applicable laws in the solutions that they provide to our clients in a timely manner, we could be subject to negative client experiences, harm to our reputation, loss of clients, claims for any fines, penalties or other damages suffered by our clients and other financial harm. Printing of directories In our U.S. and international Marketing Services segments, we depend on third parties to supply paper and to print, publish and distribute our directories. In connection with these services, we rely on the systems and services of our third-party service providers, their ability to perform key functions on our behalf in a timely manner and in accordance with agreed levels of service and their ability to attract and retain sufficient qualified personnel to perform services on our behalf. There are a limited number of these providers with sufficient scale to meet our needs. A failure in the systems of one of our key third-party service providers, or their inability to perform in accordance with the terms of our contracts or to retain sufficient qualified personnel, could have a material adverse effect on our business, prospects, financial condition, results of operations and cash flow. If we were to lose the services of any of our key third-party providers, we would be required to hire and train sufficient personnel to perform these services or to find an alternative service provider. In some cases, it would be impractical for us to perform these functions, including the printing of our directories. In the event we were required to perform any of the services that we currently outsource, it is unlikely that we would be able to perform them without incurring additional costs. A failure on the part of any of our third-party service providers could result in a material adverse effect on our business, financial condition and results of operations.

While we and our third-party providers host our Thryv platform and serve most of our digital clients on cloud services, should we experience a local or regional disaster or other business continuity problem, such as an earthquake, hurricane, flood, terrorist attack, pandemic, security breach, cyber-attack, power loss, telecommunications failure or other natural or man-made disaster, our ability to continue to operate will depend, in part, on the availability of our personnel, our office facilities and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience operational challenges with regard to particular areas of our operations, such as key executive officers or personnel that could have a material adverse effect on our business. We regularly assess and take steps to improve our existing business continuity plans and key management succession. However, a disaster on a significant scale or affecting certain of our key operating areas within or across regions, or our inability to successfully recover should we experience a disaster or other business continuity problem, could materially interrupt our business operations and result in material financial loss, loss of human capital, regulatory actions, reputational harm, damaged client relationships or legal liability.