Baldwin Insurance Group (BWIN) Risk Analysis

We rely on third parties, and in some cases subcontractors, to provide services, data, and information, such as technology, information security, billing systems, funds transfers, data processing and administration and support functions, that are critical to our business operations. These third parties include correspondents, agents and other brokerage and intermediaries, insurance markets, data providers, plan trustees, payroll service providers, benefits administrators, software and system vendors, health plan providers, investment managers and providers of human resources, among others. As we do not fully control the actions of these third parties, we are subject to the risk that their decisions, actions or inactions may adversely impact us and replacing these service providers could create significant delays and expenses. Because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or to which they may have access. Due to applicable laws and regulations or contractual obligations, we may be held responsible for security breaches, cyberattacks or other similar incidents attributed to our vendors as they relate to the information we share with them or to which we grant them access. A failure by third parties to comply with service level agreements or regulatory or legal requirements in a high-quality and timely manner, particularly during periods of our peak demand for their services, could result in economic and reputational harm to us. In addition, we face risks as we transition from in-house functions to third-party support functions and providers, or vice versa, that there may be disruptions in service or other unintended results that may adversely affect our business operations. These third parties face their own technology, operating, business, and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, colleague, consumer, or Company information, could cause harm to our reputation. An interruption in or the cessation of service by any service provider as a result of systems failures, data breaches or other cybersecurity incidents, capacity constraints, financial difficulties, or for any other reason could disrupt our operations, impact our ability to offer certain products and services, and result in contractual or regulatory fines or penalties, liability claims from clients, or colleagues, damage to our reputation, and harm to our business.

For the year ended December 31, 2024, two insurance company partners accounted for an aggregate of approximately 19% of our total core commissions and fees. Should either of these insurance company partners seek to terminate their respective arrangements with us or in the case of material financial impairment of such insurance company partners, we could be forced to move our business to other insurance company partners and additional expense and loss of market share could possibly result.

Our commission income (including profit-sharing contingent commissions and override commissions) can vary quarterly or annually due to the timing of policy renewals and the net effect of new and lost business production. We do not control the factors that cause these variations. Specifically, clients' demand for insurance products can influence the timing of renewals, new business and lost business (which includes policies that are not renewed and cancellations). In addition, we rely on our insurance company partners for the payment of certain commissions. Quarterly and annual fluctuations in commissions and fees based on increases and decreases associated with the timing of new business, policy renewals and payments from our insurance company partners may adversely affect our financial condition, results of operations and cash flows. Profit-sharing contingent commissions are special revenue-sharing override commissions paid by our insurance company partners based on the attainment of certain metrics such as the profitability, volume or growth of the business placed with such companies generally during the prior year. These are not guaranteed payments and our insurance company partners may change the calculations or potentially elect to stop paying them at all on an annual basis. Over the last two years contingent commissions generally have been in the range of 7.0% to 9.0% of the year's total core commissions and fees. Increases in loss ratios experienced by our insurance company partners will result in a decreased profit to them and may result in decreases in payments of contingent or profit-sharing commissions to us. Due to, among other things, potentially poor macroeconomic conditions, the inherent uncertainty of loss in our clients' industries and changes in underwriting criteria (including profitability, volume or growth thresholds), due in part to the high loss ratios experienced by our insurance company partners, we cannot predict the payment of these profit-sharing contingent commissions. Further, we have no control over the ability of our insurance company partners to estimate loss reserves, which affects our ability to make profit-sharing calculations. Override commissions are paid by our insurance company partners based on the attainment of certain metrics such as the profitability, volume or growth of the business that we place with them and are generally paid over the course of the year or in the beginning of the following year. Because profit-sharing contingent commissions and override commissions materially affect our commissions and fees, any decrease in their payment to us could adversely affect our results of operations, profitability and our financial condition. See "-Our business had historically been highly concentrated in the Southeastern United States. While we still maintain a concentration in the Southeastern United States, our rapid growth has resulted in our having several regional concentrations of our business, such that adverse economic conditions, natural disasters, loss trends or regulatory changes in one of these regions could adversely affect our financial condition."

We are subject to litigation, regulatory investigations and claims arising in the ordinary course of our business operations. The risks associated with these matters often may be difficult to assess or quantify and the existence and magnitude of potential claims often remain unknown for substantial periods of time. While we have insurance coverage for some of these potential claims, others may not be covered by insurance, insurers may dispute coverage or any ultimate liabilities may exceed our coverage. We may be subject to actions and claims relating to the sale, solicitation and negotiation of insurance, including the suitability of such products and services, as well as denials of coverage from our insurance company partners. Actions and claims may result in the rescission of such sales; consequently, our insurance company partners may seek to recoup commissions paid to us, which may lead to legal action against us. The outcome of such actions cannot be predicted and such claims or actions could have a material adverse effect on our business, financial condition and results of operations. We are subject to laws and regulations, as well as regulatory investigations. The insurance industry has been subject to a significant level of scrutiny by various regulatory bodies, including state Attorneys General offices and state departments of insurance, concerning certain practices within the insurance industry. These practices include, without limitation, the receipt of contingent commissions by insurance brokers and agents from insurance companies and the extent to which such compensation has been disclosed, the collection of agency fees, which we define as fees separate from commissions charged directly to clients for efforts performed in the issuance of new insurance policies, bid rigging and related matters. From time to time, our subsidiaries receive informational requests from governmental authorities. There have been a number of revisions to existing, or proposals to modify or enact new, laws and regulations regarding insurance agents and brokers. These actions have imposed or could impose additional obligations on us with respect to our products sold. Some insurance companies have agreed with regulatory authorities to end the payment of contingent commissions on insurance products, which could impact our commissions that are based on the volume, consistency and profitability of business generated by us. We cannot predict the impact that any new laws, rules or regulations may have on our business, financial condition and results of operations. Given the current regulatory environment and the number of our subsidiaries operating in local markets throughout the country, it is possible that we will become subject to further governmental inquiries and subpoenas and have lawsuits filed against us. Regulators may raise issues during investigations, examinations or audits that could, if determined adversely, have a material impact on us. The interpretations of regulations by regulators may change and statutes may be enacted with retroactive impact. We could also be materially adversely affected by any new industry-wide regulations or practices that may result from these proceedings. Our involvement in any investigations and lawsuits would cause us to incur additional legal and other costs and, if we were found to have violated any laws, we could be required to pay fines, damages and other costs, perhaps in material amounts. Regardless of final costs, these matters could have a material adverse effect on us by exposing us to negative publicity, reputational damage, harm to client relationships or diversion of personnel and management resources. In addition, we may from time to time be subject to certain litigation brought by one or more of our stockholders. The outcome of any such litigation, particularly class action lawsuits, is difficult to assess or quantify. Plaintiffs in these types of lawsuits may seek recovery of very large or indeterminate amounts, and the magnitude of the potential loss relating to such lawsuits, including the possibility of having attorney's fees awarded, may remain unknown for substantial periods of time. The cost to defend such litigation may be significant. There may also be adverse publicity associated with litigation, regardless of whether the allegations are valid or whether we are ultimately found liable. As a result, litigation may materially adversely affect our businesses, financial condition and results of operations.

We maintain confidential, personal and proprietary information relating to our Company, our colleagues, our insurance company partners, our vendors and our actual and prospective clients. This information could include personally identifiable information, protected health information, such as information regarding the medical history of clients, financial information, and other categories of sensitive or protected information. We are subject to laws, rules, regulations, orders, industry standards, contractual obligations and other legal obligations relating to the collection, use, retention, security, transfer, storage, disposition and other processing of this information. These requirements may also apply to transfers of information among our affiliates, as well as to transactions we enter into with unaffiliated third-parties. Cybersecurity risks have significantly increased in recent years, in part, because of the proliferation of new technologies, the use of the internet and telecommunications technologies to exchange information and conduct transactions, and the increased sophistication and activities of computer hackers, organized crime, terrorists, and other external parties, including foreign state actors. We have in the past and may in the future be subject to cyberattacks. Future cyberattacks could include computer viruses, malicious or destructive code, phishing attacks, social engineering attacks, denial of service or information, improper access by employees or third-party partners or other security breaches that have or could in the future result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our confidential, proprietary, personal, and other information concerning colleagues, clients, insurance company partners, vendors or consumers, or otherwise materially disrupt our network access or business operations. Cybersecurity breaches, cyberattacks and other similar incidents, including, among other things, computer viruses, denial of service or information attacks, ransomware attacks, credential stuffing, social engineering, human error, fraud, unauthorized parties gaining access to our information technology systems, malware infections, phishing campaigns and vulnerability exploit attempts could disrupt the security of our internal systems and business applications or those of our vendors and impair our ability to provide services to our clients and protect the privacy of their data. Any such incidents may also compromise confidential business information, result in intellectual property or other confidential or proprietary information being lost or stolen, including client, colleague or Company data, which could harm our reputation, competitive position or otherwise adversely affect our business. Cyber threats are constantly evolving, which makes it more difficult to detect cybersecurity incidents, assess their severity or impact in a timely manner, and successfully defend against them. The hybrid and remote work environment is increasing the attack surface available to criminals, as more companies and individuals work remotely and otherwise work online. Consequently, the risk of a cybersecurity incident has increased, and as cybersecurity threats evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate or remediate any information security vulnerabilities, security breaches, cyberattacks or other similar incidents. We cannot provide assurances that our preventative efforts, or those of our vendors or service providers, will be successful, and we may not be able to anticipate all security breaches, cyberattacks or other similar incidents, detect or react to such incidents in a timely manner, implement guaranteed preventive measures against such incidents, or adequately remediate any such incident. Although we maintain policies, procedures and technical safeguards designed to protect the security and privacy of confidential, personal and proprietary information, we cannot eliminate the risk of, and have in the past experienced, improper access to or disclosure of personally identifiable information and related costs to mitigate the consequences from such events. It is possible that the measures we implement, including our security controls over personal data and training of colleagues on data security, may not prevent improper access to, disclosure of or misuse of confidential, personal or proprietary information. This could cause harm to our reputation, create legal exposure or subject us to liability under laws that protect personal data, resulting in increased costs or loss of commissions and fees. In addition, improper access to or disclosure of personal and proprietary information could occur in a target we acquire prior to the acquisition or as a result of actions taken prior to the acquisition or during the integration period. Even if we receive indemnification for such events (which may not be the cure), such events could cause harm to our reputation, create legal exposure or subject us to liability under laws that protect personal data. The occurrence of any security breach, cyberattack or other similar incident with respect to our or our vendors' systems, or our failure to make adequate or timely disclosures to the public, regulators, law enforcement agencies or affected individuals, as applicable, following any such event, could cause harm to our reputation, subject us to additional regulatory scrutiny, expose us to civil litigation, fines, damages or injunctions or subject us to liability under applicable data privacy, cybersecurity and other laws, rules and regulations, resulting in increased costs or loss of commissions and fees, any of which could have a material adverse effect on our business, financial condition and results of operations. Additionally, we cannot be certain that our insurance coverage will be adequate for cybersecurity liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim. We are subject to complex and frequently changing laws, rules and regulations in the various jurisdictions in which we operate relating to the collection, use, retention, security, transfer, storage, disposition and other processing of personal information. For example, legislators in the United States have passed new and more robust cybersecurity legislation in light of the recent broad-based cyberattacks at a number of companies. These and similar initiatives around the country could increase the cost of developing, implementing or securing our networks, tools, systems and other information technology assets and require us to allocate more resources to improved technologies, adding to our information technology and compliance costs. Ensuring that our collection, use, retention, security, transfer, storage, disposition and other processing of personal information complies with applicable laws, regulations, rules and standards regarding data privacy and cybersecurity in relevant jurisdictions can increase operating costs, impact the development of new products or services, and reduce operational efficiency. At the federal level, we are subject to, among other laws, rules and regulations, the Gramm-Leach-Bliley Act ("GLBA"), which requires financial institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and, in some cases, enables retail customers to opt out of the sharing of certain personal information with unaffiliated third parties. The GLBA also requires financial institutions to implement an information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of nonpublic personal information, which can include customer records and information. We are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to data privacy and cybersecurity. Data privacy and cybersecurity are also areas of increasing state legislative focus and we are, or may in the future become, subject to various state laws and regulations regarding data privacy and cybersecurity. For example, the California Consumer Protection Act of 2018 (the "CCPA"), which became effective on January 1, 2020, applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. The CCPA gives California residents the right to, among other things, request disclosure of information collected about them and whether that information has been sold to others, request deletion of personal information (subject to certain exceptions), opt out of the sale of their personal information, and not be discriminated against for exercising these rights. The CCPA contains several exemptions, including an exemption applicable to personal information that is collected, processed, sold or disclosed pursuant to the GLBA. Further, effective in most material respects starting on January 1, 2023, the California Privacy Rights Act ("CPRA") has significantly modified the CCPA, including by expanding California residents' rights with respect to certain sensitive personal information. The CPRA also creates a new state agency which will be vested with authority to implement and enforce the CCPA and the CPRA. Other states where we do business, or may in the future do business, or from which we otherwise collect, or may in the future otherwise collect, personal information of residents have adopted or are considering adopting similar laws. For example, Virginia and Colorado have recently adopted comprehensive data privacy laws similar to the CCPA, which went into effect in January and July of 2023, respectively. In addition, some states have passed laws that include affirmative data security obligations that may govern the ways in which we protect consumer information. For example, Massachusetts law requires, among other things, that covered entities develop, implement, and maintain a comprehensive, written information security program that is designed to protect personal information and that includes specific prescribed safeguards. Further, laws in all 50 U.S. states and U.S. territories generally require businesses to provide notice under certain circumstances to individuals (whether customers, prospects, employees, or otherwise) whose personal information has been improperly accessed, disclosed or otherwise compromised as a result of a data breach. Certain state laws and regulations may be more stringent, broader in scope, or offer greater individual rights, with respect to personal information than federal or other state laws and regulations, and such laws and regulations may differ from each other, which may complicate compliance efforts and increase compliance costs. Cybersecurity and data privacy laws are constantly evolving, and we may be required to modify our practices regularly in an effort to maintain our compliance with applicable law. We are subject to the UK General Data Protection Regulation ("UK GDPR") and may in the future be subject to the General Data Protection Regulation ("GDPR"), which protect the personal data of individuals residing in the United Kingdom and the European Union (whether customers, prospects, employees, or otherwise), respectively. Under the UK GDPR and the GDPR, we are required, as applicable, among other obligations, to protect personal data using appropriate technical, administrative, and organizational measures, to identify and maintain legal bases for processing personal data, to give effect to data subject rights (including, for example, deletion, correction, and objection to or restriction of processing in certain circumstances), to ensure that anyone we authorize to process personal data on our behalf is bound by appropriate duties of confidentiality, to engage subprocessors pursuant to written agreements obligating them to protect personal data in accordance with the UK GDPR or GDPR, as applicable, and controller instructions, and to transfer personal data solely pursuant to authorized transfer mechanisms, including, where required, the Standard Contractual Clauses. We are also subject to Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), and its provincial analogues in British Columbia and Alberta. Under PIPEDA, and its provincial counterparts, we are required, among other things, to designate a privacy officer to be responsible for ensuring our compliance with relevant legislation, to notify data subjects of the purposes for which their personal information will be processed, to publicly disclose information about our policies and practices relating to the management of personal information, and to effect data subjects' requests to exercise their rights. We are also subject to Bermuda's Personal Information Protection Act ("PIPA"). Under PIPA, we are required, among other things, to appoint a data protection officer responsible for ensuring compliance with PIPA, to effect data subject rights (including for example and under certain circumstances, the right to access, the right to correct, the right to erasure, and the right to object, etc.), to establish appropriate legal bases for processing personal data, and to assess the level of protection provided by an overseas third-party recipient of personal data in advance of any transfer to any such third party. Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy or cybersecurity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other documentation that provide promises and assurances about privacy, data protection and cybersecurity can subject us to potential federal or state action if they are found to be deceptive, unfair, insufficient, or misrepresentative of our actual practices. Any actual or perceived failure to adhere to, or successfully implement processes in response to, changing legal or regulatory requirements in this area or to comply with our privacy policies could result in legal liability, including litigation (including class actions), claims, proceedings, regulatory fines, penalties or other sanctions, governmental investigations, enforcement actions, the expenditure of substantial costs, time and other resources, damage to our reputation in the marketplace and other adverse impacts, any of which could have a material adverse effect on our business, financial condition and results of operations.

We seek to maintain and develop new software or technology where appropriate to better serve our clients. This includes developing new software, technology, and automated systems (including, but not limited to, billing systems) to support our insurance products. Notwithstanding these upgrades and the proliferation of technology and technology-based risk and control systems, our businesses ultimately rely on people as our greatest resource, and, from time to time, they have in the past and may in the future make mistakes or engage in violations of applicable policies, laws, rules or procedures that are not always caught immediately by our technological processes or by our controls and other procedures, which are intended to prevent and detect such errors or violations. We have in the past and in the future could experience operational incidents caused by human error due to failure to properly utilize software or technology or adhere to applicable policies and procedures, calculation errors, mistakes in addressing emails, errors in software or model development or implementation, or simple errors in judgment. Operational incidents could result in financial losses as well as misappropriation, corruption, or loss of confidential client specific information, including social security numbers, private health information, payment card numbers, or bank account information. Such an incident could significantly negatively impact our reputation, customers, clients, businesses or results of operations and financial condition. Cyber-related and other operational incidents can also result in legal and regulatory proceedings, fines, and other costs.

Our reputation is one of our key assets. We advise our clients on and provide services related to a wide range of subjects and our ability to attract and retain clients depends greatly on the external perceptions of our level of service, trustworthiness, business practices, financial condition and other subjective qualities. If a client is not satisfied with our services, it could cause us to incur additional costs and impair profitability or lose the client relationship altogether, which may negatively impact other clients' perception regarding us. Our success is also dependent on maintaining a good reputation with existing and potential colleagues, investors, insurance company partners, vendors, regulators and the communities in which we operate. Negative perceptions or publicity regarding these or other matters, including our association with clients or business partners who themselves have a damaged reputation, or from actual or alleged conduct by us or our colleagues, could damage our reputation. Any of these matters could have a material adverse effect on our business, financial condition and results of operations.

We are exposed to various risks arising out of natural disasters, including earthquakes, hurricanes, fires, floods, landslides, tornadoes, typhoons, tsunamis, hailstorms, explosions, climate events or weather patterns and public health crises, epidemics or pandemic health events, as well as man-made disasters, including acts of terrorism, military actions, cyber-terrorism, explosions and biological, chemical or radiological events, and associated governmental responses. The continued threat of terrorism and ongoing military actions may cause significant volatility in global financial markets, and a natural or man-made disaster could trigger an economic downturn in the areas directly or indirectly affected by the disaster. These consequences could, among other things, result in a decline in business and may also subject any capitalized insurance facilities in which we choose to participate, to increased claims expenses from those areas. They could also result in reduced underwriting capacity of our insurance and reinsurance company partners, making it more difficult for our colleagues and contracted agents to place business. Disasters also could disrupt public and private infrastructure, including communications and financial services, which could disrupt our ordinary business operations. Any increases in loss ratios due to natural or man-made disasters could impact our contingent commissions, which are primarily driven by both growth and profitability metrics. A natural or man-made disaster also could disrupt the operations of our counterparties or result in increased prices for the products and services they provide to us. Finally, a natural or man-made disaster could increase the incidence or severity of E&O claims against us, or other incidents, claims, risks, exposures and/or liabilities that require us to make claims against our insurance policies. See "-Our business had historically been highly concentrated in the Southeastern United States. While we still maintain a concentration in the Southeastern United States, our rapid growth has resulted in our having several regional concentrations of our business, such that adverse economic conditions, natural disasters, loss trends or regulatory changes in one of these regions could adversely affect our financial condition."