Risk Factors Update Summary

• Enhanced cybersecurity processes implemented, including threat monitoring, annual reviews, and risk assessments.
• Addition of regulators to the list of entities our reputation could be damaged with, including financial institutions, card networks, and regulators.
• Comprehensive risk assessments conducted for critical vendors, focusing on cybersecurity practices.
• Inclusion of the potential impact of the EU Pillar Two Directive on our financial statements, with an effective tax rate of 15%.
• Incident response plan approved annually by the board, with 24/7 Global Security Operations Center.
• Mention of the need to raise additional funds to finance future capital needs, highlighting potential limitations in refinancing existing debt.
• Introduction of generative artificial intelligence risks, including the potential for unintended consequences, biases, and intellectual property disputes.
• Inclusion of the impact of geopolitical risks, such as the invasion of Ukraine by Russia, on consumer spending and supply chain costs.
• Addition of the need for enhanced cyber risk management standards and potential enforcement actions against distributors.
• Mention of the evolving regulatory environment and the need to comply with new laws and regulations, which could impact our ability to offer certain services.