TSMC (TSM) Risk Factors

We may, from time to time, distribute rights to our shareholders, including rights to acquire securities. Under our ADS deposit agreement, the depositary bank will not distribute rights to holders of ADSs unless the distribution and sale of rights and the securities to which these rights relate are either exempt from registration under the United States Securities Act of 1933, as amended, (the "Securities Act"), with respect to all holders of ADSs, or are registered under the provisions of the Securities Act. Although we may be eligible to take advantage of certain exemptions for rights offerings by certain foreign companies, we can give no assurance that we can establish an exemption from registration under the Securities Act, and we are under no obligation to file a registration statement with respect to any such rights or underlying securities or to endeavor to have such a registration statement declared effective. Accordingly, holders of ADSs may be unable to participate in our rights offerings and may experience dilution of their holdings as a result. If the depositary bank is unable to sell rights that are not exercised or not distributed or if the sale is not lawful or reasonably practicable, it will allow the rights to lapse, in which case you will receive no value for these rights.

Even though we have established a comprehensive internet and computing security network, we cannot guarantee that our computing systems which control or maintain vital corporate functions, such as our manufacturing operations and enterprise accounting, would be completely immune to crippling cyberattacks. In the event of a serious cyberattack, our systems may lose important corporate data or our production lines may be shut down pending the resolution of such attack. Major cyberattacks could also lead to loss or divulgence of trade secrets and other sensitive information, such as proprietary information of our customers and other stakeholders and personal information of our employees. While we seek to continuously review and assess our cybersecurity policies and procedures to ensure their adequacy and effectiveness, we cannot guarantee that we will not be susceptible to new and emerging risks and attacks in the evolving landscape of cybersecurity threats. For example, as AI continues to evolve, cyber-attackers could also use AI to develop malicious codes and sophisticated phishing attempts. Malicious hackers may also try to introduce computer viruses, corrupted software or ransomware into our network systems to disrupt our operations, blackmail us to regain control of our computing systems, or spy on us for sensitive information. These attacks may result in us having to pay damages for our delayed or disrupted orders or incur significant expenses in implementing remedial and improvement measures to further enhance our cybersecurity network, and may also expose us to significant legal liabilities arising from or related to legal proceedings or regulatory investigations associated with such breaches. In the past, we experienced and may in the future be subject to attack by malicious software. We have implemented and continually update rigorous cybersecurity measures to prevent and minimize harm caused by such attacks. See "Item 16K. Cybersecurity" for a further discussion. While these ongoing enhancements further improve our cybersecurity defense solutions, there can be no assurance that we are immune to cyberattacks. In addition, we employ certain third-party service providers for us and our affiliates worldwide with whom we need to share highly sensitive and confidential information to enable them to provide the relevant services. While we require such third-party service providers to strictly fulfill the confidentiality and/or internet security requirements in our service agreements with them, there is no assurance that each of them will comply with such obligations. Moreover, such third-party service providers may also be susceptible to cyberattacks. If we or our service providers are not able to timely resolve the respective technical difficulties caused by such cyberattacks, or ensure the integrity and availability of our data (and data belonging to our customers and other third parties) or maintain control of our or our service providers' computing systems, our commitments to our customers and other stakeholders may be materially impaired and our results of operations, financial condition, prospects and reputation may also be materially and adversely affected.

We perform long-term market demand forecasts for our products and services to manage our overall capacity. Based on our market demand forecasts, we have continued to add capacity to meet market needs for our products and services, including in Taiwan, in Arizona, U.S., in Nanjing, China, in Kumamoto, Japan and in Dresden, Germany. Implementing these capacity expansion plans will increase our costs, and the increases may be substantial. For example, we would need to build new facilities, purchase additional equipment and hire and train personnel to operate the new equipment. If we do not increase our net revenue accordingly, our financial performance may be adversely affected by these increased costs. See "Item 4. Information on The Company – Capacity Management and Technology Upgrade Plans" for a further discussion. In addition, market conditions are dynamic and our market demand forecasts may change significantly at any time. During periods of decreased demand, certain manufacturing lines or tools in some of our manufacturing facilities may be suspended or shut down temporarily. However, if demand subsequently increases rapidly over a short period of time, we may not be able to restore the capacity in a timely manner to take advantage of the upturn. In such circumstances, our financial performance and competitiveness may be adversely affected.

Over the years, our customer profile and the nature of our customers' business have changed dramatically. While we generate revenue from hundreds of customers worldwide, our ten largest customers in 2021, 2022 and 2023 accounted for approximately, 71%, 68% and 70% of our net revenue in the respective year. Our largest customer in 2021, 2022 and 2023 accounted for 26%, 23% and 25% of our net revenue in the respective year. Our second largest customer in 2021, 2022 and 2023 accounted for 10%, less than 10% and 11% of our net revenue in the respective year. A more concentrated customer base will subject our revenue to seasonal demand fluctuations from our large customers and cause different seasonal patterns in our business. This customer concentration results in part from the changing dynamics of the electronics industry with the structural shift to mobile and high performance computing devices and applications and software that provide the content for such devices. There are only a limited number of customers who are successfully exploiting this new business model paradigm. Also, we have seen changes in the nature of our customers' business models in response to this new business model paradigm. For example, there is a growing trend among system companies designing their own semiconductors and working directly with the semiconductor foundries, which makes their products and services more marketable in a changing consumer market. Also, since the global semiconductor industry has become increasingly competitive, some of our customers have engaged in industry consolidations in order to remain competitive. Such consolidations have taken the form of mergers and acquisitions. If more of our major customers consolidate, this will further decrease the overall number of our customer pool. In addition, regulatory restrictions, such as export controls directed at our major customers, could impact our ability to supply products to those customers or reduce those customers' demand for our products and services and thus impact their business operations. The loss of, or significant curtailment of purchases by, one or more of our top customers including curtailments due to increased competitive pressures, industry consolidation, changes in applicable regulatory restrictions, product designs, manufacturing sourcing or outsourcing policies or practices of these customers, the timing of customer inventory adjustments, or changes in our major customers' business models, may adversely affect our results of operations and financial condition.

In recent times, several major systemic political, economic and financial crises negatively affected global business, banking and financial sectors, including the semiconductor industry and markets. Since 2018, there have been political and trade tensions among a number of the world's major economies. These tensions have resulted or may result in the implementation of tariff, non-tariff trade barriers, sanctions, export controls and other measures that have been particularly impactful to the semiconductor industry and related markets. Prolonged or increased use of such measures may negatively impact the growth of the global economy and the semiconductor industry, resulting in declines in electronic products sales from which we generate our income through our products and services. Also, any increase in the use of export control restrictions and sanctions to target certain countries and entities, any expansion of the extraterritorial jurisdiction of such measures, or complete or partial ban on semiconductor products sales to certain entities could impact not only our ability to continue supplying products to those customers, but also our customers' demand for our products, and could even lead to changes in semiconductor supply chains. For example, the U.S. tightened its export control measures against Huawei Technology Co. Ltd. and its affiliates (collectively, "Huawei") in 2020. To comply with relevant laws and regulations, we have discontinued shipment of products to Huawei since September 2020. Since February 2022, there have been expansive sanctions and export controls imposed by several countries and regions against Russia, including certain individuals and entities, in connection with the military conflict in Ukraine. In October 2022 and October 2023, the U.S. adopted additional export controls over specified countries (including China) under the U.S. Export Administration Regulations ("U.S. EAR") on certain advanced computing integrated circuits ("ICs"), computer commodities that contain such ICs, and certain semiconductor manufacturing items, as well as controls on transactions involving items for supercomputer and semiconductor manufacturing end-uses. The new controls add new license requirements for items subject to the U.S. EAR where the items are destined to a semiconductor fabrication facility in China that fabricates ICs meeting specified advanced node parameters as well as for U.S. persons' activities supporting such facility or semiconductor manufacturing items. In October 2022, we secured a one-year general authorization from the U.S. government, which allows us to maintain our fab's operations in Nanjing, China. This general authorization has been renewed and extended to be effective until May 31, 2024. We are also applying for a Validated End-User (the "VEU") authorization for our Nanjing fab, which, once obtained, would be a permanent authorization that allows us to receive exports of eligible items from the U.S. without separate licenses. However, there is no assurance that we will be able to obtain the VEU authorization for our Nanjing fab or that the obtained general authorization will not be terminated in the future. On the other hand, measures adopted by an affected country to counteract the impact of another country's actions or regulations could lead to significant legal liability to multinational corporations including our own. For example, in January 2021, China adopted a blocking statute that, among other matters, entitles Chinese entities incurring damages from a multinational's compliance with foreign laws to seek civil remedies. As of the date of this annual report, our current results of operations have not been materially affected by the expanded export control regulations or the novel rules or measures adopted to counteract them. Nevertheless, depending on future developments in global trade tensions and military conflicts, such regulations, rules, or measures may have an adverse impact on our business and operations, and we may incur significant legal liability and financial losses as a result. Any future systemic political, economic or financial crisis or market volatility, including but not limited to interest rate and foreign exchange rate fluctuations, inflation or deflation or changes in economic, fiscal and monetary policies in major economies, could cause revenue or profits for the semiconductor industry as a whole to decline dramatically. If the economic conditions or financial conditions of our customers were to deteriorate, the demand for our products and services may decrease and additional accounting related allowances may be required, which could reduce our operating income and net income. In addition, sufficient external financing may not be available to us on a timely basis, on commercially reasonable terms to us, or at all. If sufficient external financing is not available when we need such financing to meet our capital requirements, we may be forced to curtail our expansion, modify plans or delay the deployment of new or expanded services until we obtain such financing. In conclusion, any of these events, including any future global systemic crisis or further escalation of trade tensions as described above, could materially and adversely affect our results of operations.