Assurant (AIZ) Risk Factors

Our ability to attract, recruit, hire, motivate, develop and retain employees and clients depends upon our corporate culture. Our employees are the cornerstone of our culture and acts of misconduct by any employee, and particularly by senior management, could erode trust and confidence and damage our reputation. Our employees could engage or be accused of engaging in misconduct that subjects us to litigation, regulatory sanctions, financial costs and serious harm to our reputation or financial position. Employee misconduct could prompt regulators to allege or determine, on the basis of such misconduct, that we have not established an adequate program to inform employees of applicable rules or to detect and deter violations of such rules. It is not always possible to deter employee misconduct and the precautions we take to detect and prevent misconduct may not be effective. Misconduct by employees, or even unsubstantiated allegations, could have a material adverse effect on our financial position, reputation and business.

As we continue to improve operating efficiencies, we rely on vendors and other third parties, including independent contractors, to conduct business and provide services to our clients. We use vendors and other third parties for business, investment management, technology, operations, facilities management and other services. We take steps to monitor and regulate the performance of vendors and other third parties, including in our agreements with such parties, but our oversight controls could prove inadequate. Since we do not fully control the actions of vendors and other third parties, we are subject to the risk that their decisions or operations adversely impact us and replacing them could create significant delay and expense. If these vendors or other third parties fail to satisfy their obligations to us or if they fail to comply with legal or regulatory requirements in a high-quality and timely manner, our operations and reputation could be compromised, we may not realize the anticipated economic and other benefits from these arrangements, and we could suffer adverse legal, regulatory and financial consequences. In addition, these third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee or Company information or failure to comply with applicable law, could cause harm to our reputation or otherwise expose us to liability. An interruption in or the cessation of service by any service provider as a result of systems failures, capacity constraints, financial difficulties or for any other reason has occurred from time to time and could materially disrupt our operations, impact our ability to offer certain products and services and result in contractual or regulatory penalties, liability claims from clients or employees, damage to our reputation and harm to our business. If we are unable to attract and retain relationships with qualified vendors, independent contractors and other third-party service providers, or if changes in law or judicial decisions require independent contractors to be classified as employees, our business could be significantly adversely affected. To the extent we engage international vendors or third parties to provide services or carry out business functions, we are exposed to the risks that accompany operations in a foreign jurisdiction, including international economic and political conditions, foreign laws and regulations, fluctuations in currency values and increased risk of data breaches. For more information on the risks associated with the use of international vendors and third parties, see " – We face risks associated with our international operations."

Limited availability of credit, deteriorations of the global mortgage and real estate markets, declines in consumer confidence and consumer spending, including in Europe, increases in prices or in the rate of inflation, periods of high unemployment or labor shortages, persistently low or rapidly increasing interest rates, disruptive geopolitical events, including the Israel-Hamas war, China-Taiwan relations and supply chain disruptions, and other events outside of our control, such as a major epidemic or a pandemic, political or civil unrest, or the possibility of a U.S. government shutdown or default on its debt obligations, could contribute, and in some cases have contributed, to increased volatility and diminished expectations for the economy and the financial markets, including the market for our stock, and may materially adversely affect our business, results of operations and financial condition. Specifically, during periods of economic downturn: - individuals and businesses may (i) choose not to purchase our insurance products, extended service contracts and other products and services, (ii) terminate existing policies or contracts or permit them to lapse and (iii) choose to reduce the amount of coverage they purchase;- conditions in the markets in which we operate may deteriorate, impacting, among other things, consumer demand for the mobile devices, electronics, appliances, automobiles, housing and other products we insure, including the rate of introduction and success of new products, technologies and promotional programs that provide opportunities for growth;- clients are more likely to underperform expectations, experience financial distress and declare bankruptcy, which could have an adverse impact on the remittance of premiums from such clients and the collection of receivables from such clients for items such as unearned premiums and could otherwise expose us to credit risk;- claims on certain specialized insurance products tend to rise;- there is a risk of fraudulent insurance claims;- there may be an impairment in the value of our tangible and intangible assets and our investment portfolio may be adversely affected;- there may be fluctuations in the labor market and a negative impact on employee retention; and - our ability to access the capital markets on favorable terms or at all may be negatively impacted. General inflationary pressures and supply chain disruptions, including within the current environment, has and may continue to increase the costs of paying claims, including for materials and labor, particularly in our Global Housing and Global Automotive businesses. In addition, inflationary pressures and shortages in the labor market have increased, and may continue to increase, our labor costs, including employee wages, and changes in interest rates has impacted, and may continue to impact, our investment portfolio and capital. See " – Financial Risks – Our investment portfolio is subject to market risk, including changes in interest rates, that may adversely affect our results of operations and financial condition." Conversely, deflationary pressures may affect the pricing of our products and services.

Our international operations face economic, political, legal, compliance, regulatory, operational, supply chain and other risks. For example, we face the risk of restrictions on currency conversion and the repatriation of non-U.S. investments and earnings; burdens and costs of compliance with a variety of foreign laws and regulations and the associated risk and costs of non-compliance, including reputational harm; exposure to undeveloped or evolving legal systems, which may result in unpredictable or inconsistent application of laws and regulations, including export controls and exposure to commercial, political, legal or regulatory risks such as corruption; political, economic or other instability in countries in which we conduct business, including possible terrorist acts; the imposition of sanctions, tariffs, trade barriers or other protectionist laws or business practices that favor local competition, increase costs and may otherwise adversely affect our business; inflation and foreign exchange rate fluctuations; diminished ability to enforce our contractual rights; increased risk of data breaches; differences in cultural environments; changes in regulatory requirements, including changes in regulatory treatment of certain products or services; exposure to local economic conditions and its impact on our clients' performance and creditworthiness; and a competitive global labor market. If our business model is not successful in a particular country or region, or a country or region in which we do business experiences economic, political or other instability, we may lose all or part of our investment in that country or region. As we continue to scale our global operations and grow our international labor force within Global Capabilities Centers, our business becomes increasingly exposed to these and other risks, including where certain countries or regions have recently experienced economic or political instability, such as in Argentina and Brazil. As we engage with international clients, we may make certain up-front commission payments or similar cash outlays, which we may not recover if the business does not develop as we expect. These up-front payments are typically supported by various protections, such as letters of credit, letters of guarantee and real estate, but we may not fully or timely recover amounts owed to us as a result of difficulties in enforcing contracts or judgments in undeveloped or evolving legal systems and other factors. In addition, we rely on fronting carriers in certain countries to maintain their licenses and product approvals, satisfy local regulatory requirements and continue in business. If they fail to do so, our business, reputation, and relationships with our clients and their customers could be adversely affected. For additional information on the significant international regulations that apply to us and the risks relating thereto, see "Item 1 – Business – Regulation – International Regulation" in this Report, " – Business, Strategic and Operational Risks – Our mobile business is subject to the risk of declines in the value and availability of mobile devices, and to regulatory compliance and other risks," " – Legal and Regulatory Risks – We are subject to extensive laws and regulations, which increase our costs and could restrict the conduct of our business, and violations or alleged violations of such laws and regulations could have a material adverse effect on our reputation, business and results of operations," " – Legal and Regulatory Risks – Our business is subject to risks related to litigation and regulatory actions" and " – Legal and Regulatory Risks – The costs of complying with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation.."

We compete for business, clients, customers, agents and other distribution relationships with many insurance companies, warranty and protection companies, financial services companies, mobile device repair and logistics companies, technology and software companies and specialized competitors that focus on one market, product or service. Some of our competitors may offer a broader array of products and services than we do or be better able to tailor those products and services to customer needs, including through better technology systems or infrastructure, or may have greater diversity of distribution resources, better brand recognition, more competitive pricing, lower costs, greater financial strength, more resources or higher ratings. There is a risk that purchasers may be able to obtain more favorable terms and offerings from competitors, vendors or other third parties, including pricing and technology. Additionally, customers may turn to our competitors as a result of our or our client's failure, or perceived failure, to deliver on customer expectations, product or service flaws, technology issues, gaps in operational support or other issues affecting customer experience. As a result, competition may adversely affect the persistency of our policies, our ability to sell products and provide services, maintain client relationships, and our revenues and results of operations, which has occurred from time to time. To remain competitive in many of our businesses, we must anticipate and respond effectively to changes in customer preferences, new industry standards, evolving distribution models, disruptive technology developments and alternate business models. The evolving nature of consumer needs and preferences and improvements in technology could result in a reduction in consumer demand and in the prices of the products and services we offer. Our competitive position may be impacted if we are unable to deploy, in a cost effective and competitive manner, technology such as artificial intelligence and machine learning, or if our competitors collect and use data which we do not have the ability to access or use. In addition, across many of our businesses, we must respond to the threat of disruption by traditional players, such as insurers, as well as from new entrants, such as "Insurtech" start-up companies and others. These players are focused on using technology and innovation to simplify and improve the customer experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the markets in which we operate. In order to maintain a competitive position, we must continue to invest in new technologies and new ways to deliver our products and services. If we do not anticipate and respond effectively to changes in customer preferences, new industry standards, evolving distribution models, disruptive technology developments and alternative business models, our business and results of operations could be adversely impacted.

We communicate with and distribute our products and services ultimately to individual customers. From time to time, regulators, consumer advocacy groups, the media and individual customers may focus their attention on our products and services, which may subject us to negative publicity. We may be negatively affected if another company in one of our industries or in a related industry, or if one of our clients, engages in practices that subject our industry or businesses to negative publicity. Negative publicity may result from judicial inquiries, unfavorable outcomes in lawsuits, social media, regulatory or governmental actions with respect to our products or services and industry commercial practices. For example, regulators may submit queries to assess practices in the insurance sector that potentially disadvantage people of color or historically underrepresented groups in certain insurance lines of business, or whether customers have received fair value from our products and services. In addition, there is increased investor and regulatory focus on sustainability matters, including diversity, equity and inclusion, and commitment to long-term sustainability and efforts related to climate. A failure or perceived failure in our achievement of various sustainability initiatives and goals we announce from time to time, or an actual or perceived increase in related risks as a result of our or our industry's business activities, may subject us to negative publicity. Negative publicity may cause increased regulation and legislative scrutiny of industry practices as well as increased litigation or enforcement action by civil and criminal authorities. Additionally, negative publicity may increase our costs of doing business and adversely affect our profitability by impeding our ability to market our products and services, constraining our ability to price our products appropriately for the risks we are assuming, requiring us to change the products and services we offer or increasing the regulatory burdens under which we operate.

We rely on the uninterrupted and secure operation of our technology systems, including information technology systems and operational technology systems, to operate our business and securely process, transmit and store electronic information. This electronic information includes confidential and other sensitive information, including personal data, that we receive from our customers, vendors and other third parties. Our technology systems and safety control systems and those of our vendors and other third parties with whom we share sensitive information are vulnerable to, and in some cases have been subject to, damage or interruption from a variety of external threats, including cybersecurity incidents, computer viruses, malware and ransomware, as well as targeted attacks against our employees, which have been increasing in frequency. Cybersecurity incidents are rapidly evolving and becoming increasingly sophisticated, partly due to the growing use of artificial intelligence by malicious actors. We are at risk of attack, and from time to time have been the subject of an attack, by a growing list of adversaries, including state-sponsored organizations, organized crime, hackers and "hacktivists" (activist hackers), through the use of increasingly sophisticated methods of attack, including long-term, persistent attacks referred to as advanced persistent threats, attacks via yet unknown vulnerabilities referred to as zero-day threats and credential harvesting attacks against our employees. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures, resulting in potential data loss or other damage to technology systems. As the breadth and complexity of the technologies we use continue to grow, and as a result of the remote and hybrid work arrangements for a significant portion of our employees, the risk of security breaches and cybersecurity incidents has increased. Our systems have also been subject to compromise from internal threats such as improper action by employees and third parties who may have otherwise legitimate access to our systems. Our call centers subject us to additional risk from internal threats due to access to personal data. Moreover, we face the ongoing challenge of managing access controls in a complex environment. Remote and hybrid work arrangements, including the use of personal devices and home networks that are not managed by the organization's security control framework, bypass certain physical security controls for our employees and the employees of our vendors who have access to sensitive information. While additional controls have been put in place, they may not be sufficient to discover compromises that occur due to the loss of physical controls. The latency of a compromise is often measured in months, and we may not be able to detect a compromise in a timely manner. We could experience significant financial and reputational harm as a result of operational resiliency issues, including if our technology systems are breached, sensitive client or Company data are compromised, modified, rendered inaccessible for any period of time or made public, or if we fail to make adequate disclosures to the public or law enforcement agencies following any such event. Our data protection measures may not be effective to protect our network and systems from external and internal threats. Should an attacker gain access to our network using compromised credentials of an authorized user or otherwise, or gain entry as a result of a zero-day exploit or other vulnerabilities that may exist in our systems environment, which has occurred from time to time, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data. Certain measures that could increase the security of our systems take significant time and resources to deploy broadly and may not be effective against an attack. Additionally, our policies, procedures and technical safeguards may be insufficient to prevent or detect improper access to confidential, personal or proprietary information and other cybersecurity incidents, assess the severity or impact of any such incidents or appropriately respond in a timely manner. The inability to implement, maintain and upgrade effective protective measures and other safeguards or adequately respond to a breach could have a material adverse effect on our business. Although we continue to invest in security and engage in best practices for software development, code vulnerabilities may still be introduced into production environments. Our technology systems must be continually patched and upgraded to protect against vulnerabilities, including zero-day threats, and we are at risk that cyber attackers exploit these vulnerabilities before they have been addressed. Due to the large number and age of the systems and platforms that we operate and the increased frequency with which vendors issue security patches to their products, the need to test patches and, in some cases coordinate with clients and vendors, before they can be deployed, we are at risk that we cannot deploy these patches to remediate these vulnerabilities in a timely and effective manner. We are dependent on vendors and other third parties, such as cloud service providers, to keep their systems patched in order to protect our data. We have vendors and other third parties who receive data from us in connection with the services we offer our customers. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud hosted by third-party providers. We are at risk of a cybersecurity incident involving a vendor or other third party, which could result in a breakdown of such third party's data protection measures or access to our infrastructure through the third party. To the extent that a vendor or third party suffers a cybersecurity incident that compromises their operations, our data and our customers' data could be compromised or we may experience service interruption. Any failure related to these activities and operational resiliency could have a material adverse effect on our business. The process of integrating the technology systems of the businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses in an acquired entity's technology systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cybersecurity incident. We may be unable to integrate the systems of the businesses we acquire into our environment in a timely manner, which could further increase these risks until such integration takes place. We have from time to time experienced cybersecurity incidents, such as malware incursions, distributed denial of service attacks, hardware misconfigurations, zero-day exploits, credential harvesting, social engineering attacks, employee misconduct and incidents resulting from human error, such as loss of portable and other data storage devices. Like many companies, we are subject to regular phishing email and social media engineering campaigns directed at our employees that have become more sophisticated and successful, partly through the use of artificial intelligence, and can result in malware infections and financial and data losses. Although some of these incidents have resulted in data loss and other damages, to date, they have not had a material adverse effect on our business or operations. In the future, these types of incidents could result in confidential, restricted personal or proprietary information being lost or stolen, modified, rendered inaccessible for any period of time, or made public, including client, employee or Company data, which could have a material adverse effect on our business. Improper access to or disclosure of sensitive client or Company information, which has occurred from time to time, could harm our reputation and subject us to significant liability under our contracts, as well as under existing or future laws, rules and regulations. In the event of a cybersecurity incident, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. In addition, our liability insurance policy, which includes cyber insurance, may not be sufficient in type or amount to fully cover us against claims and costs related to security breaches, cybersecurity incidents, and other related data and system incidents.