Brink's Company (BCO) Risk Factors

Our U.S. operations are subject to regulation by the U.S. Department of Transportation with respect to safety of operations and equipment and financial responsibility.  Intrastate operations in the U.S. are subject to regulation by state regulatory authorities and interprovincial operations in Canada are subject to regulation by Canadian and provincial regulatory authorities.  Our other international operations are regulated to varying degrees by the countries in which we operate.  Many countries have permit requirements for security services and prohibit foreign companies from providing different types of security services. Additionally, Brink's Capital LLC, a subsidiary of the Company, is federally registered as a "Money Services Business" with the U.S. Department of Treasury's Financial Crimes Enforcement Network and is currently registered and/or licensed in some, and may in the future be registered and/or licensed as a "money transmitter" or similar designation with various state or local jurisdictions in the U.S. related to delivering future products and services. These Registrations subject us to, among other things, having an effective anti-money laundering (AML) compliance program, record-keeping requirements and reporting requirements, and examination by state and federal regulatory agencies, and these and our other regulatory obligations may significantly increase our costs or impact our operations. Changes in laws or regulations could require a change in the way we operate, which could increase costs or otherwise disrupt operations.  In addition, failure to comply with any applicable laws or regulations could result in substantial fines or revocation of our operating permits and licenses.  If laws and regulations were to change or we failed to comply with any applicable laws or regulations, our business, financial condition, results of operations and cash flows could be materially and adversely affected.

We compete in industries that are subject to significant competition and pricing pressures in most markets.  In addition, our business model requires significant fixed costs associated with offering many of our services including costs to operate a fleet of armored vehicles and a network of secure branches.  Because we believe we have competitive advantages such as brand name recognition and a reputation for a high level of service and security, we resist competing on price alone.  However, continued pricing pressure from competitors, failure to achieve pricing based on the competitive advantages identified above and/or inability to offset inflationary cost increases through price increases could result in lost volume of business and have an adverse effect on our business, financial condition, results of operations and cash flows.  In addition, given the highly competitive nature of our industries, it is important to develop new solutions and product and service offerings to help retain and expand our customer base.  Failure to develop, sell and execute new solutions and offerings in a timely and efficient manner could also negatively affect our ability to retain our existing customer base or pricing structure and have an adverse effect on our business, financial condition, results of operations and cash flows.

We purchase insurance coverage for losses of customer valuables for amounts in excess of what we consider prudent deductibles and/or retentions.  Insurance is provided by different groups of underwriters at negotiated rates and terms.  Coverage is available to us in major insurance markets, although premiums charged are subject to fluctuations depending on market conditions.  Our loss experience and that of other companies in our industry affects premium rates.  We are not insured for losses below our coverage limits and recognize expense up to these limits for actual losses.  Our insurance policies cover losses from most causes, with the exception of war, nuclear risk and various other exclusions typical for such policies.  The availability of high-quality and reliable insurance coverage is an important factor in obtaining and retaining customers and managing the risks of our business.  If our losses increase, or if we are unable to obtain adequate insurance coverage at reasonable rates, our financial condition, results of operations and cash flows could be materially and adversely affected.

We are a leading global provider of cash and valuables management, digital retail solutions and ATM managed services, and our success and longevity are based to a large extent on our reputation for trust, reliability and integrity. Our reputation or brand, particularly the trust placed in us by our customers, could be negatively impacted in the event of perceived or actual breaches in our ability to conduct our business ethically, securely and responsibly. In addition, we have licensing arrangements that permit certain entities to use Brink's name and/or other intellectual property in connection with their businesses. If any of these entities experienced an actual or perceived breach in its ability to conduct its business ethically, securely or responsibly, it could have a negative effect on our name and/or brand. Any damage to our reputation or brand could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We have launched a number of initiatives to improve efficiencies and reduce operating costs.  Although we have achieved annual cost savings associated with these initiatives, we may be unable to sustain the cost savings that we have achieved.  In addition, if we are unable to achieve, or have any unexpected delays in achieving additional cost savings, our results of operations and cash flows may be adversely affected.  Even if we meet our goals as a result of these initiatives, we may not receive the expected financial benefits of these initiatives.

We rely on our information technology ("IT") infrastructure, including the Brink's Global Information Security ("GIS") Program, which is designed to reduce risk by ensuring that computer systems are secure through protecting networks, systems, hardware, and data to mitigate cybersecurity risk and efficiently run our business.  If there were to be significant problems with our IT infrastructure, such as IT data center or system failures or unplanned system disruptions, failure to develop new technology platforms to support new initiatives and product and service offerings, or a failure of our GIS Program, it could halt or delay our ability to service our customers, hinder our ability to conduct and expand our business and require significant remediation costs. Remote work by our personnel and remote access to our systems have also increased significantly, which could increase our cybersecurity risk profile. We believe our cybersecurity risks will further increase as we expand services, complete mergers & acquisitions, and employ emerging technologies, mobile applications, third-party service providers and cloud-based services.  Hacking, phishing attacks, ransomware, insider threats, physical breaches or other actions may cause confidential information belonging to Brink's, its employees or customers to be misused. Moreover, the techniques used to obtain unauthorized access to networks or to sabotage systems change frequently and generally are not recognized until launched against a target. We may be unable to anticipate these emerging techniques, react in a timely manner, or implement adequate preventative measures. We have experienced cybersecurity incidents and unplanned system disruptions in the past, but none of these incidents or disruptions, individually or in the aggregate, have had a material adverse effect on our business, financial condition or results of operations. A significant cybersecurity incident that impacts our system, application or data center that houses sensitive and confidential data, including, but not limited to, personally identifiable information and business sensitive information, could have a material adverse effect on our business, financial condition, results of operations and cash flows. Additionally, such an incident may result in significant challenges and costs related to coordination with third-party service providers in order to resolve related issues. If our third-party providers do not respond in a timely manner to our needs, disaster recovery, business continuity and crisis management activities could be negatively impacted.  We have programs in place that are intended to identify, protect, detect, respond, and recover from cybersecurity incidents and breaches and that provides employee awareness training regarding cyber risks; however, due to evolving and advanced sophisticated attackers, cyber attacks remain increasingly difficult to detect and we may need to allocate additional resources to continue to enhance our information security measures and/or to investigate and remediate any security vulnerabilities. Cyber attacks and security breaches may also persist undetected over extended periods of time and may not be mitigated in a timely manner to minimize the impact of a cyber attacks or security breach. Any significant cybersecurity incident, involving Brink's or its third-party service providers, could damage our reputation, expose us to the risks of litigation and liability, disrupt our business or otherwise have a material adverse effect on our business, financial condition, results of operations and cash flows. Although the Company maintains cybersecurity insurance, the Company's insurance may not be adequate to cover all losses that may be incurred in the event of a significant disruption or failure of its information technology systems. As a global company we must adhere to applicable laws and regulations in numerous regions regarding data privacy, data protection, and data security. Privacy and data protection laws vary between countries and are subject to interpretation, which may create inconsistent or conflicting requirements. For example, the European Union's General Data Protection Regulation ("GDPR"), which became effective in May 2018, greatly increased the jurisdictional reach of European Union law. Since its inception, more geographies in which we operate have enacted laws similar to GDPR, including several countries in Asia and states in the U.S. For example, the California Consumer Privacy Act (the "CCPA"), which became effective on January 1, 2020, imposes stringent data privacy and data protection requirements regarding the personal information of California residents, and provides for penalties for noncompliance, as well as a private right of action from individuals for certain security breaches. Additionally, the California Privacy Rights Act, which became effective on January 1, 2023, significantly modified the CCPA and has resulted in further uncertainty. The GDPR and these other privacy and data protection laws impose requirements related to the handling of personal data, mandates public disclosure of certain data breaches, and provides for substantial penalties for non-compliance. Our efforts to comply with GDPR and other privacy and data protection laws may impose significant costs that are likely to increase over time. A breach of the GDPR or other such data protection regulations could result in regulatory investigations, reputational damages, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit). We could incur substantial penalties or be subject to litigation related to violation of existing or future data privacy laws, including representative actions and other class action-type litigation, which could amount to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm, all of which may have a material adverse effect on our business, financial condition, results of operations and cash flows.

We currently serve customers in more than 100 countries, including 52 countries where we operate subsidiaries. Seventy percent (70%) of our revenues in 2023 came from operations outside the U.S. We expect revenues outside the U.S. to continue to represent a significant portion of total revenues.  Business operations outside the U.S. are subject to political, economic and other risks inherent in operating in foreign countries, such as: - the difficulty of enforcing agreements, collecting receivables and protecting assets through foreign legal systems;- trade protection measures and import or export licensing requirements;- difficulty in staffing and managing widespread operations;- required compliance with a variety of foreign laws and regulations;- enforcement of our global compliance program in foreign countries with a variety of laws, cultures and customs;- varying permitting and licensing requirements in different jurisdictions;- foreign ownership laws;- changes in the general political and economic conditions in the countries where we operate, particularly in emerging markets;- threat of nationalization and expropriation;- higher costs and risks of doing business in a number of foreign jurisdictions;- laws or other requirements and restrictions associated with organized labor;- limitations on the repatriation of earnings;- fluctuations in equity, revenues and profits due to changes in foreign currency exchange rates, including measures taken by governments to devalue official currency exchange rates;- inflation levels exceeding that of the U.S; and - the inability to collect for services provided to government entities. We are exposed to certain risks when we operate in countries that have high levels of inflation, including the risk that: - the rate of price increases for services will not keep pace with the cost of inflation;- adverse economic conditions may discourage business growth which could affect demand for our services;- the devaluation of the currency may exceed the rate of inflation and reported U.S. dollar revenues and profits may decline; and - these countries may be deemed "highly inflationary" for U.S. generally accepted accounting principles ("GAAP") purposes. We manage these risks by monitoring current and anticipated political and economic developments, monitoring adherence to our global compliance program and adjusting operations as appropriate.  Changes in the political or economic environments of the countries in which we operate could have a material adverse effect on our business, financial condition, results of operations and cash flows.