CompoSecure (CMPO) Risk Factors

Regulatory uncertainty surrounding the digital asset environment, and the regulatory classification of such digital assets As digital assets have grown in both popularity and market size, governments around the world have reacted differently to digital assets, with certain governments deeming them illegal and others allowing their use and trade under certain circumstances. Currently, there is no uniformly applicable legal or regulatory regime governing digital assets in most jurisdictions, including the U.S. Certain adverse market events in the digital asset space over the past few years, such as the bankruptcy of FTX and its affiliates, and subsequent litigation and regulatory enforcement actions, have led to increased attention and scrutiny by regulators, legislators and market participants. Governments or regulatory authorities may impose new or additional licensing, registration or other compliance requirements on participants in the digital asset industry. Ongoing and future regulatory actions may impact our ability to develop and offer products involving the use of digital assets, including the Arculus Cold Storage Wallet, or may impose additional costs, which may be material, on us in connection with such products, and such impact may be material and adverse. For example, the Commodities Futures Trading Commission ("CFTC"), in a 2019 letter, made clear its view that digital assets generally are commodities, and as such, even spot trades in digital assets generally are subject to the CFTC's antifraud authority. Nevertheless, digital assets that are commodities also may be considered to be securities by the Securities and Exchange Commission ("SEC"), or may have been offered or sold in transactions that the SEC deems to be investment contracts and, therefore, securities. In the U.S., regulators, courts and lawmakers alike are grappling with these questions, and the legal landscape remains uncertain. While certain SEC staff (the "Staff") have stated that bitcoin, the digital asset with the largest market capitalization, ("BTC"), the native digital asset of the bitcoin blockchain, is not a security, there has been no definitive determination by the SEC or a court concerning whether the digital asset with the second largest market capitalization, ether ("ETH"), the native digital asset of the Ethereum blockchain, constitutes a security or was offered or sold pursuant to investment contracts. Additionally, the Staff has asserted that certain other digital assets are securities subject to the SEC's substantive and antifraud authority. Furthermore, derivatives on these digital assets, digital assets that represent certain derivatives, and certain leveraged, financed and margined transactions in digital assets, may be subject to substantive regulation by the CFTC and/or SEC, in addition to certain state and non-U.S. regulators. While the SEC staff has brought multiple enforcement actions against digital asset projects, including trading platforms that the SEC alleges were operating, among other things, as unregistered exchanges, thus far, such cases have not resolved the legal uncertainty in the U.S. concerning digital assets. Several of such recent enforcement actions are court cases that remain ongoing, and, to the extent that courts have rendered opinions, for example, in the SEC v. Ripple and SEC v. Terraform Labs/Do Kwon cases, both of which were filed and heard in the Southern District of New York, the applicable opinions, and the reasoning in support of them, have not necessarily been consistent with one another. The SEC's 2023 settlements with issuers of non-fungible tokens ("NFTs") could signal the SEC's interest in regulating the broader NFT market, including NFT trading platforms, to the extent that the SEC determines that certain NFTs are securities. In addition to a continued focus on digital asset issuers and centralized digital asset trading platforms, regulators and private plaintiffs alike have initiated actions against decentralized finance ("DeFi") projects, including decentralized autonomous organizations ("DAOs"), under various theories of liability. Among other things, DAOs have been characterized by certain plaintiffs as unincorporated associations or general partnerships, with some plaintiffs asserting that liability should be assigned to participants in DAO governance, while others have sought to establish joint and several liability for DAO members generally, including on negligence theories of liability. The CFTC has announced a commitment to pursue DeFi protocols operating unregistered platforms that allow U.S. persons to trade digital asset derivatives and, in 2023, settled charges against three different DeFi platforms for offering, or making available for trading, contracts based on various digital assets, including swaps and other derivatives, without registering with the CFTC. The SEC similarly appears focused on DeFi and has brought enforcement actions against DeFi projects in 2024. In addition, in April 2024, Uniswap Labs announced that it was served with a Wells Notice, suggesting that the SEC may bring an enforcement action against it. This is notable because the Uniswap Protocol reportedly is the largest decentralized trading and automated market making protocol on the Ethereum blockchain. In addition to the SEC's proposed rule change that would expand the definition of "exchange" to potentially include certain DeFi-related activities (see discussion under the heading "Regulatory Risks of Operating as an Unregistered Exchange or as Part of an Unregistered Exchange Mechanism" below), in 2023, SEC staff served as lead drafter of the International Organization of Securities Commissions' ("IOSCO") proposed recommendations concerning DeFi. The terms "DeFi" and "DAO" may be interpreted broadly to encompass a wide variety of projects, services and participants, and if a regulator or private plaintiff were to claim that Arculus is deemed to have participated in or facilitated DeFi- or DAO-related activities that were in violation of applicable law, there may be significant associated risks, including the potential for joint and several liability. Recently, the SEC staff has brought enforcement actions against alleged digital assets dealers and brokers. For instance, in March 2024, the SEC announced a cease-and-desist order against ShapeShift AG for allegedly acting as an unregistered dealer. Additionally, in June 2024, the SEC charged Consensys Software Inc. in the Eastern District of New York for, among other things, allegedly operating as an unregistered broker through its MetaMask Staking and MetaMask Swaps services, and the case remains ongoing. While, as discussed elsewhere in these Risk Factors, we do not believe that our activities are of a nature that would constitute acting as an unregistered broker or dealer under U.S. law, the SEC staff appears to be focused on alleged brokers and dealers in the digital assets space. In addition to the U.S. regulatory questions before the courts, multiple Congressional digital asset-related bills have been published, including some with a focus on digital asset market structure. While multiple bills describe joint oversight by the SEC and CFTC over the digital assets markets and focus on market structure, at this time, it is unclear whether any of these bills ultimately will become law. Moreover, given recent geopolitical conflict and instability, certain U.S. legislators and regulators have signaled heightened concerns about national security and the importance of "know your customer" ("KYC"), anti-money laundering ("AML"), counter financing of terrorism ("CFT") and sanctions checks and compliance, including concerns about potential use by certain terrorist groups of digital assets to fund their operations or evade U.S. sanctions. In addition to the introduction of potential digital asset-focused legislation in Congress aimed at addressing such concerns, regulators have focused on enforcement. In 2022 and 2023, OFAC, sanctioned digital assets market participants alleged to have supported sanctioned countries and/or terrorist operations, and, in 2023, the U.S. Treasury's FinCEN, pursuant seldom-used powers granted to it under Section 311 of the USA PATRIOT Act, designated an entire class of transactions, namely transactions associated with digital asset mixers, as being of primary money laundering concern. In addition, the U.S. Treasury, the IRS and other agencies also continue to propose new rules and guidance applicable to digital assets,.such as regulations on tax information reporting and withholding obligations. In June 2024, the U.S. Treasury finalized a rule requiring digital assets brokers to report additional information concerning users' digital assets sales and trades. While such rule primarily addressed reporting requirements for custodial brokers, the accompanying release stated that the U.S. Treasury and the IRS anticipate issuing additional rules later in the year establishing reporting requirements for non-custodial brokers. In July 2024, the U.S. Supreme Court overturned established administrative law precedent through three key decisions (collectively, the "Administrative Decisions"). In so ruling, the Court abandoned the requirement that courts defer to regulatory agencies' interpretations of ambiguous statutory language; overturned regulatory agencies' ability to impose civil penalties in administrative proceedings and have extended the statute of limitations within which entities may challenge agency actions. The lasting effects of such decisions may vary based on judicial districts and circuits; the SEC and other regulators, including FinCEN, may face increasing legal challenges, delays, and changes to its proposed and existing rules, regulations, policies, decisions and other guidance, including guidance that we may have relied upon. The Administrative Decisions also may lead to an increase in litigation against regulatory agencies, which may create additional legal and regulatory uncertainty and have a negative impact on our business operations. In sum, these U.S. federal regulators and courts, and various U.S. state and non-U.S. regulators, are still developing their frameworks for regulating digital assets. If we are found to have supported purchase and swap transactions in the Arculus Cold Storage Wallet for digital assets which are subsequently determined to be securities, it is possible that we could be viewed as inadvertently acting as an unlicensed broker-dealer, which could subject us to, among other things, regulatory enforcement actions, censure, monetary fines, restrictions on the conduct of the Arculus business operations and/or rescission/damages claims by customers who use the Arculus Cold Storage Wallet. Our failure to comply with applicable laws or regulations, or the costs associated with defending any action alleging our noncompliance with applicable laws or regulations, could materially and adversely affect us, our business and our results of operations. Further, a particular digital asset's status as a "security" or the treatment of digital currency for tax purposes, in any relevant jurisdiction is subject to a high degree of uncertainty and potential inconsistency across regulatory regimes, and if we are unable to properly characterize a digital asset (or a digital asset-related transaction) or assess our tax treatment, we may be subject to regulatory scrutiny, investigations, fines, and other penalties, which may adversely affect our business, operating results, and financial condition. In order to determine whether a particular digital asset is a security (or whether transactions in such digital assets would constitute an offer or sale of a security), prior to supporting purchase and swap transactions on the Arculus Cold Storage Wallet in such digital asset, we rely upon legal and regulatory analysis of legal counsel with expertise in the digital asset industry. While the methodology we have used, and expect to continue to use, to determine if purchase and swap transactions in a digital asset will be supported in the Arculus Cold Storage Wallet is ultimately a risk-based assessment, it does not preclude legal or regulatory action based on the presence of a security. Because the Arculus Cold Storage Wallet may facilitate purchase and swap transactions in digital assets which could be classified as "securities," our business may be subject to additional risk because such digital assets are subject to heightened scrutiny including under customer protection, anti-money laundering, counter terrorism financing and sanctions regulations. To the extent the Arculus Cold Storage Wallet supports purchase and swap transactions in any digital assets that are deemed to be securities under any of the laws of the U.S. or another jurisdiction , or in a proceeding in a court of law or otherwise, it may have adverse consequences. To counter such risks, we may have to remove Arculus Cold Storage Wallet support for purchase and swap transactions in certain digital assets if and when such digital assets are designated as securities, which could hurt our business. Alternatively, we may be required to partner with third-party registered securities broker/dealers to facilitate securities trading by Arculus customers, and we may be unsuccessful in efforts to establish such a partnership. In addition, we do not presently intend to effect or otherwise facilitate trading in securities by our Arculus customers through the use of our Arculus Cold Storage Wallet if such activities would require the use of a registered broker-dealer or investment adviser. Although we are establishing policies and procedures to ensure that our Arculus business activities do not result in us inadvertently acting as an unregistered broker-dealer or investment adviser, there can be no assurance that such policies and procedures will be effective. If we are found by relevant regulatory agencies to have inadvertently acted as an unregistered broker-dealer with respect to purchase and swap transactions in particular digital assets, we would expect to immediately cease supporting purchase and swap transactions in those digital assets unless and until either the digital asset at issue is determined by the SEC or a judicial ruling to not be a security or we partner with a third-party registered broker-dealer or investment adviser, acquire a registered broker-dealer or investment adviser or register the Company as a securities broker-dealer or investment adviser, any of which we may elect not to do or may not be successful in doing. For any period of time during which we are found to have inadvertently acted as an unregistered broker-dealer or investment adviser, we could be subject to, among other things, regulatory enforcement actions, monetary fines, censure, restrictions on the conduct of our Arculus business operations and/or rescission/damages claims by customers who use the Arculus Cold Storage Wallet. Our failure to comply with applicable laws or regulations, or the costs associated with defending any action alleging our noncompliance with applicable laws or regulations, could materially and adversely affect us, our business and our results of operations. We do not believe the storage and peer-to-peer/send & receive functionality provided by the Arculus Cold Storage Wallet involves purchases, sales or other transactions effected by us (or any party other than the sender and the recipient). Further, we are not compensated for such user-directed activities. However, it is possible that regulators may determine that user-directed peer-to-peer transfers using the Arculus Cold Storage Wallet would require registration and compliance with broker-dealer and/or securities exchange regulations. Regulatory Risks of Operating as an Unregistered Exchange or as Part of an Unregistered Exchange Mechanism Any venue that brings together purchasers and sellers of digital asset which are characterized as securities in the United States is generally subject to registration as a national securities exchange, or must qualify for an exemption, such as by being operated by a registered broker-dealer as an alternative trading system (or ATS). To the extent that any venue accessed via the Arculus Cold Storage Wallet is not so registered (or appropriately exempt), we may be unable to permit continued support for purchase and swap transactions for digital assets which become subject to characterization as securities and due to operation of an unregistered exchange or as part of an unregistered exchange mechanism, we could be subject to significant monetary penalties, censure or other actions that may have a material and adverse effect on us. While we do not believe that the Arculus Cold Storage Wallet, which facilitates purchase and swap transactions in certain digital assets, is itself a securities exchange or ATS or is part of an unregistered exchange mechanism, regulators may determine that this is the case, and we would then be required to register as a securities exchange or qualify and register as an ATS, either of which could cause us to discontinue our purchase and swap support for such digital assets or otherwise limit or modify Arculus Cold Storage Wallet functionality or access. In September 2022, the SEC proposed a rule change concerning the definition of "exchange." While it is not yet clear whether or in what form such proposed rule change may be adopted, it is possible that a change to the definition of "exchange" could result in regulators determining that the Arculus Cold Storage Wallet is functioning as a securities exchange or ATS or is part of an unregistered exchange mechanism, in which case, the potential registration requirements, or cessation, limitation or other modifications contemplated above could become necessary or advisable. Any such discontinuation, limitation or other modification could negatively impact our business, operating results, and financial condition.

The nature of our products is highly complex. As a result, we cannot guarantee that defects will not occur from time to time. We may incur extensive costs as a result of these defects and any resulting claims. For example, product recalls, writing down defective inventory, replacing defective items, lost sales or profits, and third-party claims can all give rise to costs incurred by us. We may also face liability for judgments and/or damages in connection with product liability and warranty claims. Damage to our reputation could occur if defective products are sold into the marketplace, which could result in further lost sales and profits. To the extent that we rely on purchase orders to govern our commercial relationships with our customers, we may not have specifically negotiated the allocation of risk for product liability obligations. Instead, we typically rely on warranties and limitations of liability included in our standard forms of order acceptance, invoice and other contract documents with our customers. Similarly, we obtain products and services from suppliers, some of which also use purchase order documents which may include limitations on product liability obligations with respect to their products and services. As a result, we may bear all or a significant portion of any product liability obligations rather than transferring this risk to our customers. Our reputation could be harmed and there could be a material adverse effect on our business, financial condition and results of operations if such risks materialize.

Our payment obligations under the Tax Receivable Agreement may be accelerated in the event of certain changes of control and will be accelerated in the event we elect to terminate the Tax Receivable Agreement early. The accelerated payments will relate to all relevant tax attributes that would subsequently be available to us. The accelerated payments required in such circumstances will be calculated by reference to the present value (at a discount rate equal to the lesser of 15% of all future payments that holders of Holdings Class B Units or other recipients would have been entitled to receive under the Tax Receivable Agreement, and such accelerated payments and any other future payments under the Tax Receivable Agreement will utilize certain valuation assumptions, including that we will have sufficient taxable income to fully utilize the deductions arising from the increased tax deductions and tax basis and other benefits related to entering into the Tax Receivable Agreement and sufficient taxable income to fully utilize any remaining net operating losses subject to the Tax Receivable Agreement on a straight line basis over the shorter of the statutory expiration period for such net operating losses and the five-year period after the early termination or change of control. In addition, recipients of payments under the Tax Receivable Agreement will not reimburse us for any payments previously made under the Tax Receivable Agreement if such tax basis and our utilization of certain tax attributes is successfully challenged by the IRS (although any such detriment would be taken into account in future payments under the Tax Receivable Agreement). Our ability to achieve benefits from any existing tax basis, tax basis adjustments or other tax attributes, and the payments to be made under the Tax Receivable Agreement, will depend upon a number of factors, including the timing and amount of our future income. As a result, even in the absence of a change of control or an election to terminate the Tax Receivable Agreement, payments under the Tax Receivable Agreement could be in excess of 90% of our actual cash tax benefits. Accordingly, it is possible that the actual cash tax benefits realized by us may be significantly less than the corresponding Tax Receivable Agreement payments or that payments under the Tax Receivable Agreement may be made years in advance of the actual realization, if any, of the anticipated future tax benefits. There may be a material negative effect on our liquidity if the payments under the Tax Receivable Agreement exceed the actual cash tax benefits that we realize in respect of the tax attributes subject to the Tax Receivable Agreement and/or payments to us by Holdings are not sufficient to permit us to make payments under the Tax Receivable Agreement after it has paid taxes and other expenses. We may need to incur additional indebtedness to finance payments under the Tax Receivable Agreement to the extent our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement as a result of timing discrepancies or otherwise, and these obligations could have the effect of delaying, deferring, or preventing certain mergers, asset sales, other forms of business combinations, or other changes of control.

Our patents, trade secrets and other intellectual property rights are critical to our business. Our ability to safeguard our proprietary product designs and production processes against misappropriation by third parties is necessary to maintain our competitive position within our industry. Therefore, we routinely enter into confidentiality agreements with our employees, consultants and strategic partners to limit access to, and distribution of, our proprietary information in an effort to safeguard our proprietary rights and trade secrets. However, such efforts may not adequately protect our intellectual property against infringement and misappropriation by unauthorized third parties. Such third parties could interfere with our relationships with customers if they are successful in attempts to misappropriate our proprietary information or copy our products designs, or portions thereof. Additionally, because some of our customers purchase products on a purchase order basis and not pursuant to a detailed written contract, where we do not have the benefit of written protections with respect to certain intellectual property terms beyond standard terms and conditions, we may be exposed to potential infringement of our intellectual property rights. Enforcing our intellectual property rights against unauthorized use may be expensive and cause us to incur significant costs, all of which could adversely affect our business, financial condition and results of operations. There is no assurance that our existing or future patents will not be challenged, invalidated or otherwise circumvented. The patents and intellectual property rights we obtain, including our intellectual property rights which are formally registered in the United States and abroad, may be insufficient to provide meaningful protection or commercial advantage. Moreover, we may have difficulty obtaining additional patents and other intellectual property protections in the future. Effective patent, trademark, service mark, copyright and trade secret protection may not be available in every country in which we provide our products or services. Any of the foregoing factors may have a material adverse effect on our business.

Cybersecurity markets are experiencing significant and fast-paced technological change, evolving industry standards and customer needs. The Company's Arculus Authenticate solutions represent a new and innovative approach to identity protection, and may not achieve widespread market acceptance. Other methods, technologies, products or services may offer similar or better authentication solutions than our hardware authentication solutions. If the Company is unable to adapt to such changes, our ability to compete effectively may be adversely impacted, which could have a negative effect on our business, financial condition or results of operations. In addition, there is a risk that the Arculus Authenticate solutions may not provide protection against all or a sufficient amount of the ever-changing security vulnerabilities, exploits or cyber attacks. Internal and external factors, including possible defects in the Company's products, or system failures in services provided by third parties for use with Arculus Authenticate solutions, could cause the Company's products and/or services to become vulnerable to security attacks which could result in the loss of identity protection for businesses and consumers. As the Arculus Authenticate solutions include hardware tokens which are expected to be replaced from time to time as needed (similar to payment cards), the Company does not intend to provide remote updates or upgrades to its hardware products. There is, therefore, a risk that the Company's hardware authentication products could become ineffective against evolving cybersecurity threats. Any such developments, real or perceived, may have a negative impact on our reputation, which could have a negative effect upon our business, financial condition or results of operations.

As a company engaged in manufacturing and distribution, we are subject to the risks inherent in such activities, including disruptions or delays in supply chain or information technology, product quality control, as well as other external factors over which we have no control. Some of the key components used in the manufacture of our products are metals, NFC-enabled and EMV chips, which we source from several key suppliers. We obtain our components from multiple suppliers located in the United States and abroad, on a purchase order basis. Changes in the financial or business condition of our suppliers and/or development partners could subject us to losses or adversely affect our ability to bring products to market. Additionally, the failure of our suppliers and/or development partners to comply with applicable standards, perform as expected, and deliver goods and services in a timely manner in sufficient quantities could adversely affect our customer service levels and overall business. Any increases in the costs of goods and services for our business may also adversely affect our profit margins, particularly if we are unable to achieve higher price increases or otherwise increase cost or operational efficiencies to offset the higher costs. Additionally, we partner with third-party partners to offer certain Arculus products and services to our customers. If any of these third parties experiences operational interference or disruptions, fails to perform its obligations and meet our expectations, experiences a cybersecurity incident, fails to comply with applicable regulatory and/or licensing requirements which may evolve over time, or is subject to regulatory enforcement proceedings concerning their operations, the operations of Arculus solutions could be disrupted or otherwise adversely affected.

A small number of distribution partners currently deliver a significant percentage of our products and services to customers. We intend to continue devoting resources in support of our distribution partners, but there are no guarantees that these relationships will remain in place over the short-or long-term. In addition, we cannot be assured that any of these distribution partners will continue to generate current levels of customer demand. A loss of any of these distribution partners could have a material adverse effect on our business, financial condition and results of operations.