TTEC Holdings (TTEC) Risk Analysis

Cyberattacks. Our business involves the use, storage, and transmission of clients', their customers', and our employees' information. We also monitor and support information technology systems for certain clients through cloud-based and on-client-premises managed services model. While we believe that we take reasonable security measures to prevent the unauthorized access to our information technology systems and to our clients' systems, and to protect the privacy of personal and proprietary information that we access and store, our security controls over our systems have not prevented in the past and may not prevent in the future improper access to these systems or unauthorized disclosure of this information. Such unauthorized access or disclosure could subject, and in the past has subjected us to significant liability under relevant laws, our contracts, and our licenses to perform certain regulated services; and could harm our reputation, resulting in material impacts to our operations, loss of future revenue and business opportunities. These risks may further increase as our business model now relies on a higher percentage of work delivered from home, in addition to our traditional delivery center model. The risks may also increase, as we expand geographically into new locations, where cybersecurity is difficult to assure. In recent years, there have been an increasing number of high-profile security breaches at companies and government agencies, when hackers, cyber criminals and state actors launch a broad range of ransomware, data exfiltration, and other cyberattacks targeting information technology systems. Information security breaches, computer viruses, service interruption, loss of business data, DDoS (distributed denial of service) attacks, ransomware and other cyberattacks on any of our systems or on our clients' systems, through our channels, have and in the future could disrupt our normal operations, our cloud platform digital offerings, our clients' on-premise managed service offerings, and our corporate functions, impeding our ability to provide critical services to our clients and financial reporting of our results of operations. Techniques used by cyber criminals to obtain unauthorized access, disable or degrade services, or sabotage systems evolve frequently and may not immediately be detected, and we may be unable to implement adequate preventative measures. For example, in 2021, we experienced two significant cybersecurity incidents. One involved a global supply chain compromise that impacted thousands of companies worldwide, including a TTEC Digital subsidiary and its managed services clients. Another involved a ransomware attack that temporarily disrupted the TTEC Engage business. Although neither of these incidents resulted in material impact on our results of operations in 2021, there can be no assurances that future cybersecurity incidents, which are unavoidable, would not have material impact on our results of operations. Following these cybersecurity incidents, we have made and continue to make significant investments to enhance our information technology environment, but there can be no assurances that investments made to date and the investments planned to be made in the future would be sufficient to prevent future cybersecurity incidents. Cybersecurity events may have cascading effects that unfold over time and result in additional costs, including costs associated with investigations, government enforcement actions, regulatory investigations, fines and penalties, contractual claims, performance penalties, litigation, financial judgement or settlements in excess of insurance, disputes with insurance carriers concerning coverage and the availability of cyber insurance in the future, loss of clients' trust, future business cancelations and other losses. Any client perceptions that our systems or the information system environments that we support for our clients are not secure could result in a material loss of business and revenue and could damage our reputation and competitiveness. Cyber fraud. As others, we are experiencing an increase in frequency of cyber fraud attempts, including phishing attempts, and so-called "social engineering" attacks, which typically seek unauthorized access into the environment, money transfers or unauthorized information disclosure. We train our employees to recognize these attacks and have implemented proactive risk mitigation measures to curb them. There are no assurances, however, that these attacks, which are growing in sophistication and frequency, would not deceive our employees, resulting in a material loss and impacts to our operations and corporate functions. While we believe we have taken reasonable measures to protect our systems and processes from unauthorized intrusions and cyber fraud, we cannot be certain that advances in cybercriminal capabilities, discovery of new system vulnerabilities, and attempts to exploit such vulnerabilities will not compromise or breach the technologies protecting our systems and the information that we manage and control, which could result in damage to our systems, our reputation, and our profitability.

The pressure on ‘speed to market' for AI and GenAI deployment presents risks and challenges to the business. The rapid evolution of AI/GenAI require us to expend resources to develop new service offerings and implement controls that allow us to utilize GenAI effectively, including investing in processes and professionals with the skills necessary to execute our AI strategy. If we are too slow to market or are otherwise unable to deploy AI and GenAI quickly and effectively into our offerings, we could fall behind our competitors and our ability to win and retain business could be materially impacted, negatively affecting our results of operations and our reputation as innovators. Deploying AI too rapidly without appropriate controls may result in poor client adoption, liability, and reputational damage. Leveraging AI to potentially improve the internal functions and operations of our business presents further opportunities and risks. The use of AI to support business operations carries inherent risks related to data privacy and security, inadvertent discrimination or other unintended consequences that could result in liability and harm to our reputation.

We are increasingly incorporating AI technologies into our business and have endeavored to stand up appropriate governance and controls for their use. As with many disruptive technologies, however, AI presents risks and unintended consequences that could affect its adoption. Social, ethical and regulatory issues related to the use of AI/GenAI in our offerings may result in reputational harm, liability impacts on our results of operations. Most AI solutions are evolving and are not infallible, and issues with data sourcing, technology integration, decision-making bias of AI algorithms, security challenges, protection of privacy for personal identifiable information, content labeling and an effective use governance has not yet been perfected. While efforts are being made to deploy AI/GenAI responsibly with appropriate controls, our ability to do so effectively cannot be guaranteed. If our solutions incorporating AI/GenAI are flawed, they may cause harm to our clients or their customers and could impact our reputation and results of operations. The regulatory landscape surrounding AI and GenAI technologies is rapidly evolving, and how these technologies will be regulated remains uncertain. Such regulations may result in significant risks and operational costs which would impact our profitability and results of operations.

Our growth depends, in large part, on the willingness of clients to outsource customer care and management services to companies like us. There can be no assurance that the customer care outsourcing trend will continue especially in the current economic climate; and clients may elect to perform these services in-house or rely on emerging technologies for some of the services they currently outsource to us. Reduction in demand for our services and increased competition from other providers, technologies and in-house service alternatives could create pricing pressures and excess capacity that would have an adverse effect on our business, financial condition, and results of operations.

Our credit agreement includes a number of financial and operating restrictions. For example, our credit agreement requires us to meet financial ratios, including leverage ratios and an interest coverage ratio, among others. Our credit agreement also contains provisions that restrict our ability to, among other things, create liens on our assets; dispose of assets; engage in mergers or consolidations, and pay dividends or to make other distributions to our stockholders, or repurchase shares of our common stock. These provisions may competitively disadvantage us relative to other companies, and adversely impact our ability to conduct our business. Potential important opportunities or transactions, such as significant acquisitions, may require the consent of our lenders.  In addition, our failure to comply with these covenants could result in a default under the credit agreement.

Over the last several years, we significantly expanded our work from home remote delivery. Some of the services we provide are subject to stringent regulatory requirements, and our inability to continuously monitor how our employees deliver services, when working remotely, may impact our compliance in certain lines of business. Remote service delivery, in certain lines of our business, may also expose us, our clients, and their customers to a heightened risk of fraud, because early detection of inappropriate behavior could be impaired, when employees work outside of our delivery centers. For example, in 2023, we discovered what we believe to be an isolated wage arbitrage scheme: a few remote employees held multiple jobs, used non-employees to perform their work, and shared wages. Our investigation did not uncover evidence that this unauthorized access to clients' systems and customer data resulted in harm, as the goal of the scheme appeared to be access to wages and not misuse of data; but notifications to affected clients, their customers, and relevant regulatory agencies resulted in litigation. In response to the incident, we implemented enhanced employee identification and geolocation measures to monitor identity and work location for employees who work remotely, and to expedite detection and mitigation of potential similar schemes in the future. While we believe these mitigation measures to be sufficient, there can be no assurances that our detection and prevention measures will always be adequate to eliminate other possible schemes. Employees who work from home rely on residential communication and internet providers that may not be as resilient as commercial providers and may be more susceptible to service interruptions and cyberattacks, which may also make our information technology systems vulnerable, when interfacing with these residential environments. Although we have continuously evolved our business continuity and disaster recovery plans and processes to focus beyond our delivery centers to include remote delivery, these plans and processes may not work effectively in a distributed remote delivery model, where weather impacts, internet access and power grid downtime may be difficult to manage and where system redundancies are not possible. Over the years, we have established strong operational and administrative controls over our business that focused on our physical locations; and although these controls are evolving to reflect our growing mix of delivery centers and remote delivery, they may not always provide effective safeguards for a large-scale work from home delivery model. We may not be effective in timely updating our existing controls nor implementing new controls tailored to the work from home environment. For these and other reasons, our clients may be unwilling to continue to allow us to deliver our services remotely. If we are unable to manage our work from home environment effectively to address these and other risks unique to remote service delivery, or if we cannot maintain client confidence in our work from home environment, our reputation and results of operations may be impacted. Remote work for an extended period of time may impact our culture and employee engagement within our Company, which could affect productivity and our ability to retain employees critical to our operations. Certain jurisdictions where we do business have regulations specific to work from home, which adds complexity and cost to our service delivery. All these various risks and uncertainties can have impacts on our operations and financial results.

An important component of our business strategy is our global delivery model and our continuous international expansion. In 2023, we derived approximately 30% of our revenue from operations outside of the United States. We deliver services to clients from 22 countries on six continents and the expansion to at least five additional countries is being considered in coming years. Conducting business outside of the United States and in many global locations at the same time is subject to a variety of risks, including: - inconsistent regulations, licensing requirements, prescriptive labor rules, corrupt business practices, restrictive export control and immigration laws, which may result in inadvertent violation of laws that we may not be able to immediately detect or correct; and which may increase our cost of operations as we endeavor to comply with laws that differ from one country to another;- uncertainty of tax regulations in countries where we do business may affect our costs of operation;- longer payment cycles, especially during economic downturn, could impact our cash flows and results of operations;- political and economic instability, and unexpected changes in regulatory regimes could adversely affect our ability to deliver services and our ability to repatriate cash;- currency exchange rate fluctuations and restrictions on currency movement or negative tax consequences triggered by such movement could adversely affect our results of operations, if we are forced to maintain assets in currencies other than U.S. dollars, while our financial results are reported in U.S. dollars; and if we are forced to maintain assets in currencies other than those that we use for payment of our operating expenses;- infrastructure challenges and lack of sophisticated disaster and pandemic preparedness in some countries where we do business may impact our service delivery; and - armed conflicts, terrorist attacks or civil unrest in some of the regions where we do business, and the resulting need for enhanced security measures may impact our ability to deliver services, threaten the safety of our employees, and increase our costs of operations. While we monitor and endeavor to mitigate in a timely manner the relevant regulatory, geopolitical, and other risks related to our operations outside of the United States, we cannot assess with certainty what impact such risks are likely to have over time on our business, and we can provide no assurance that we will always be able to mitigate these risks successfully and avoid adverse impact on our business and results of operations.