Coupang (CPNG) Risk Analysis

Under the amended Korean Commercial Code, effective July 2025, directors of a Korean company, such as Coupang Corp., owe a fiduciary duty to both the company itself and its stockholders. While this amendment expands the scope of directors' duties to include the interests of stockholders, the fundamental duty to the company itself remains in effect. Consequently, legal uncertainties exist regarding how these dual duties will be interpreted by Korean courts in the event of a conflict between the interests of the company and those of its majority stockholder. As a result, if circumstances arise in which the preservation of Coupang Corp.'s corporate value or solvency conflicts with the immediate interests of Coupang, Inc. or our stockholders, Coupang Corp. may still be restricted under applicable Korean law from acting in a manner that is in the best interest of Coupang, Inc., as its parent, or our stockholders. For example, providing guarantees or collateral by Coupang Corp. in favor of Coupang, Inc., as its parent, without a justifiable cause and on other than arm's-length terms may still constitute a breach of the directors' fiduciary duty to Coupang Corp. notwithstanding their expanded duty to stockholders. Approval by the board of directors of a Korean company is required for, among other things, all transactions between a director or major stockholder (including a 10% or more stockholder) and the company for the director's or the major stockholder's account. As a result, intercompany transactions between us and Coupang Corp. (or any other Korean subsidiary we may own, from time to time), could arise in which the directors of the Korean subsidiary are unable to prioritize ours or our stockholders' best interest due to their concurrent obligation to protect the subsidiary's separate corporate assets. Since substantially all of our operations are conducted by Coupang Corp., any such occurrence with respect to Coupang Corp. could adversely affect our business, financial condition, and results of operations.

From time to time, we are subject to claims, litigation, governmental audits, inspections, investigations, and other legal proceedings relating to issues such as employment and labor, worker classification and assignment, worker pay, hours and benefits, labor relations including union and collective bargaining issues, employment authorization and immigration, worker safety, intellectual property (including patent, trademark and copyright), product safety, personal injury, privacy, information security, tax compliance, import/export regulations, foreign exchange regulations, licenses and permits, food safety, medical products, drugs and devices, financial services, antitrust, intercompany transactions, securities regulation, and fair trade matters, consumer protection, and environmental issues. As a majority of our operations are based in Korea, we are, and may from time to time become subject to investigations by Korean government authorities, including investigations related to antitrust, fair trade, labor and employment and other matters. See the section titled "Business-Legal Proceedings" for additional information about these types of legal proceedings. Legal proceedings are inherently uncertain, and any judgment, ruling, fine, penalty or injunctive relief entered against us or any adverse settlement in current or other future matters could result in harm to our reputation, monetary damages, fines or other sanctions, consent decrees, injunctions, or orders requiring a change in our business practices or otherwise negatively affect our business, results of operations, and financial condition. Any claims against us, whether meritorious or not, could be time-consuming, result in costly litigation, be harmful to our reputation, require significant management attention, and divert significant resources. Further, under certain circumstances, we have contractual and other legal obligations to indemnify and to incur legal expenses on behalf of our business and commercial partners and current and former directors and officers.

Under Korean tax law, there is an inherent risk that Coupang Corp.'s transactions with its subsidiaries, affiliates or any other person or company that is related to us may be challenged by the Korean tax authorities if such transactions are viewed as having been made on terms that were not on an arm's-length basis. If the Korean tax authorities determine that any of its transactions with related parties were on other than arm's-length terms, it may not be permitted to deduct as expenses, or may be required to include as taxable income, or may be required to pay other taxes (including value-added taxes), any amount which is found to be undue financial support between related parties in such transaction, which may have adverse tax consequences for us and, in turn, may adversely affect our business, financial condition, and results of operations.

The Constitution of the Republic of Korea provides workers with rights to collective bargaining and collective action. Currently, some of our workforce are members of labor unions, with which we are currently negotiating collective bargaining agreements, and some of our workforce in Taiwan have begun unionization efforts. In addition, new laws in Korea grant certain of our non-employee service providers collective bargaining rights. Unionization of more of our employees or any of our independent delivery partners, actual or threatened strikes, work stoppages or slowdowns may occur and could have an adverse impact on our business, financial condition, or results of operations.

A portion of our sales are dependent on our ability to import finished goods from other countries into Korea. Substantially all of our import operations are subject to customs requirements. The countries from which some of our products are manufactured or exported, or into which our products are imported, may from time to time impose quotas, duties, tariffs, or other restrictions on imports (including restrictions on manufacturing operations) or adversely modify existing restrictions. Changes in Korea, China, the United States, and other governments regarding international trade, including import and export regulations, tariffs, and international trade agreements, may negatively impact our business. Imports are also subject to unpredictable foreign currency variation which may increase our cost of sales. Adverse changes in these import costs and restrictions, or failure by our suppliers to comply with customs regulations or similar laws, could harm our business. Our operations are also subject to the effects of international trade agreements and regulations, which may impose requirements that adversely affect our business, such as setting quotas on products that may be imported from a particular country. Our ability to import products in a timely and cost-effective manner may also be affected by conditions at ports or issues that otherwise affect transportation and warehousing providers, such as port and shipping capacity, labor disputes, severe weather, or increased security requirements in Korea and other countries. These issues could delay importation of products or require us to locate alternative ports or transportation or warehousing providers to avoid disruption to customers. These alternatives may not be available on short notice or could result in higher costs, which could have a material adverse impact on our business, financial condition, and results of operations. If our ability to import goods from other countries is negatively impacted by domestic or international trade regulations (including any future customs requirements, tariffs, and quotas implemented in Korea or other countries), our ability to maintain a diverse selection of products for our customers and to be able to timely deliver products consistent with our customers' expectations could be harmed, which could materially and adversely impact our future revenue and growth.

Factors such as inflation, increased food costs, increased labor and employee benefit costs, increased rental costs, or increased energy costs have increased, and may continue to increase, our operating costs and those of our suppliers and independent contractors. Many of the factors affecting suppliers and independent contractors are beyond the control of these parties. In many cases, these increased costs may cause suppliers and independent contractors to spend less time providing services to our customers or to seek alternative sources of income and may cause some suppliers or independent contractors to cease operations altogether. Likewise, these increased costs may cause suppliers and independent contractors to pass costs on to us and our customers by increasing prices, which would likely cause order volume to decline, and may cause suppliers or independent contractors to cease operations altogether. Any of these factors could adversely affect our business and results of operations.

The protection of our intellectual property rights may require the expenditure of significant financial, managerial, and operational resources. The steps we take to protect our intellectual property may not adequately protect our rights or prevent third parties from infringing or misappropriating our proprietary rights. Any of our current or future patents, trademarks or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. Our pending patent and trademark applications may never be granted. Additionally, the process of obtaining patent protection is expensive and time-consuming, and the amount of compensation for damages can be limited in certain jurisdictions. Further, we may not be able to prosecute or otherwise obtain all necessary or desirable patent or trademark applications at a reasonable cost or in a timely manner. Even if issued, these patents or trademarks may not adequately protect our intellectual property, as the legal standards relating to the validity, enforceability and scope of protection of patent, trademark and other intellectual property rights are applied on a case-by-case basis and it is generally difficult to predict the results of any litigation relating to such matters. Additionally, others may independently develop or otherwise acquire equivalent, "design-around" or superior technology or intellectual property rights. We may be unable to prevent third parties from infringing upon, misappropriating or otherwise violating our intellectual property rights and other proprietary rights. Any litigation, whether or not it is resolved in our favor, could result in significant expense to us and divert the efforts of our technical and management personnel, which may materially and adversely affect our business, financial condition, and results of operations. Although our terms of use prohibit the sale of counterfeit items or any items infringing upon third parties' intellectual property rights in our marketplace and we have implemented measures to exclude goods that have been determined to violate our terms of use, we may not be able to detect and remove every item that may infringe on the intellectual property rights of third parties. As a result, we have received in the past, and may receive in the future, complaints alleging that certain items listed or sold on our apps or websites infringe upon the intellectual property rights of third parties, which could lead to actual disputes and lawsuits relating to intellectual property infringement. The online retail industry is characterized by vigorous protection and pursuit of intellectual property rights, which has resulted in protracted and expensive litigation or investigations for many companies. We are currently party to litigation or disputes related to intellectual property rights of third parties, and we expect we will continue to be subject to such litigation, disputes, and investigations in the future, some of which may be material. Any intellectual property litigation or investigations to which we might become a party, or for which we are required to provide indemnification, may require us to, among other things, (i) cease selling certain products, (ii) make substantial payments for legal fees, settlement payments, or other costs or damages, (iii) change our processes or technology, obtain license(s), which may not be available on reasonable terms or at all, to use the relevant technology or process, or (iv) redesign the allegedly infringing processes to avoid infringement, misappropriation or violation. Whether or not these claims are resolved in our favor, they could divert the resources of our management and adversely affect our reputation, business, financial condition, and results of operations.

We rely on encryption and authentication technology in an effort to securely transmit and store data about our customers, merchants, suppliers, advertisers, and others, including personally identifiable information, as well as other confidential and proprietary information but such measures cannot provide absolute security and may fail to operate as intended or be circumvented. Data loss, breaches, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our or our vendors' or customers' technology, products, and systems have in the past, and could in the future, result in the inadvertent or unauthorized use or disclosure of information or otherwise enable third parties to gain unauthorized access to this information. For instance, we have experienced data incidents in the past, including the Incident, and the inadvertent exposure of limited customer information within our app that occurred during an upgrade in 2021. For more information about the Incident, see the risk factor titled "We have experienced, and may again experience, data incidents involving the unauthorized or improper access to proprietary, confidential, or customer data, and may experience cybersecurity or data incidents involving unauthorized or improper use of, disclosure of, alteration of, or destruction of, proprietary, confidential, or customer data, any of which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities." In addition, our apps, websites, networks, and systems are subject to security threats, including hacking of our systems, denial-of-service attacks, viruses, malicious software, ransomware, break-ins, phishing attacks, social engineering, security breaches, or other attacks and similar disruptions that may jeopardize the security of information stored in or transmitted by our apps, websites, networks, and systems, or that we otherwise maintain. It may be difficult to determine the best way to investigate, mitigate, contain, and remediate the harm caused by a data incident. Such efforts may not be successful, and we may make errors or fail to take necessary actions. Such risks extend not only to our own apps, websites, networks, and systems, but also to those of third-party service providers and our customers, contractors, business partners, vendors, and other third parties. There can be no assurance that future incidents will not have material adverse effects on our business, financial condition, and results of operations. Moreover, techniques used to obtain unauthorized access to or sabotage systems change frequently and are becoming increasingly sophisticated and may not be known until launched against us or our third-party service providers, increasing the difficulty of detecting and defending against such threats. We have observed an increase in the frequency of the security threats we and our third-party service providers face, and we expect these activities to continue to increase. Geopolitical tensions or conflicts, such as the conflict between Russia and Ukraine, and the increased adoption of AI technologies, may further heighten the risk of cybersecurity incidents. In addition, security breaches can also occur as a result of non-technical issues, including intentional or inadvertent breaches by our employees or former employees (such as was the case in the Incident) or by persons with whom we have commercial relationships. As a result of any security breach, our reputation and brand could be damaged, our business could suffer, we could be required to expend significant capital and other resources to alleviate problems caused by such breaches, and we could be exposed to a risk of loss, litigation, or regulatory action (including under laws related to privacy, data use, data protection, data security, network security, and consumer protection) and possible liability. Actual or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants. Any compromise or breach of our security measures, or those of our third-party service providers, could violate applicable privacy, data security, and other laws, cause significant legal and financial exposure, cause adverse publicity, interfere with customers' ability to use our apps, websites, networks, and systems, interfere with customer transactions and order fulfillment, and a create a loss of confidence in our security measures, which could have an adverse effect on our business, financial condition, and results of operations. Inadequate account security or organizational security practices, including those of companies we have acquired or those of the third-parties we utilize, may result in unauthorized access to our systems and data, including customer systems and data. For example, passwords may not be rotated and employee access may not be updated or removed on a timely basis. Employees or third parties may intentionally compromise our security or systems or reveal confidential information. We are also subject to regulations relating to privacy and use of confidential, sensitive, and personal information of our consumers, including, among others, Korea's Personal Information Protection Act ("PIPA"), Korea's Act on the Promotion of Information, Korea's Communications Network Utilization and Protection of Information Act, Korea's Credit Information Act and China's Personal Information Protection Act. PIPA requires consent by the consumer with respect to the use of his or her data and requires the persons responsible for management of personal data to take the necessary technological and managerial measures to prevent data breaches and, among other duties, to notify the Personal Information Protection Commission of any data breach incidents within 24 hours. Failure to comply with PIPA in any manner may subject the individuals responsible to personal liability for not obtaining such consent in an appropriate manner or for such breaches, including even negligent breaches, and violators face varying penalties ranging from monetary penalties to imprisonment. We are also subject to regulations regarding privacy and use of confidential, sensitive, and personal information of our employees and service providers. We strive to take the necessary technological and managerial measures to comply with applicable laws, including the implementation of privacy policies concerning the collection, use, and disclosure of subscriber data on our apps and websites, and we regularly review and update our policies and practices. Despite these efforts to comply with applicable laws, these rules are complex and evolving, subject to interpretation by government regulators which may change over time and therefore we are subject to the risk of claims by regulators of failure to comply. Any failure, or perceived failure, by us to comply with such policies, laws, regulations, and other legal obligations and regulatory guidance could adversely affect our reputation, brand, and business, and may result in claims, proceedings, or actions, including criminal proceedings, against us and certain of our executive officers by governmental entities or others or other liabilities. Any such claim, proceeding, or action could hurt our reputation, brand, and business, force us to incur significant expenses in defense of such proceedings, distract our management, increase our costs of doing business, result in a loss of employees, customers, or merchants, and could have an adverse effect on our business, financial condition, and results of operations. Moreover, we are also subject to other data privacy and protection laws regulating the collection, use, retention, disclosure, transfer, and processing of personal information, such as the California Consumer Privacy Act, the California Privacy Rights Act, similar laws in other states in the United States, the United Kingdom's General Data Protection Regulation, and the European Union's General Data Protection Regulation. The potential effects of these laws are far-reaching, continue to evolve, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses to comply with the obligations imposed by the governments of the jurisdictions in which we do business or seek to do business and we may be required to make significant changes in our business operations, all of which may adversely impact our business. These and other privacy and cybersecurity laws may carry significant potential penalties for noncompliance. We may also be contractually liable to indemnify and hold harmless third parties from the costs or consequences of non-compliance with any laws, regulations or other legal obligations relating to privacy or consumer protection or any inadvertent or unauthorized use or disclosure of data that we store or handle as part of operating our business. In addition, legislative and regulatory bodies, or self-regulatory organizations, may expand or change their interpretations of current laws or regulations, or enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection, and consumer protection. Any such changes may force us to incur substantial costs or require us to change our business practices. This could compromise our ability to pursue our growth strategy effectively and may harm our ability to attract new customers or retain existing customers, or otherwise adversely affect our business, financial condition, and results of operations. Additionally, some providers of consumer devices and web browsers have implemented, or announced plans to implement, means to make it easier for Internet users to prevent the placement of cookies or to block other tracking technologies, which could, if widely adopted, result in the use of third-party cookies and other methods of online tracking becoming significantly less effective. The regulation of the use of these cookies and other current online tracking and advertising practices or a loss in our ability to make effective use of services that employ such practices could adversely affect our business, financial condition, and results of operations.

We use AI, machine learning, and related technologies in our business, and we expect to continue to incorporate AI and machine learning into our business operations and expect to continue to invest significant resources in AI and machine learning tools. Our investment in AI and machine learning tools and technologies may not provide the anticipated benefits, and the increasing use of AI and machine learning technologies present many challenges and risks to our business. Flaws in AI algorithms or datasets or the failure to implement adequate safeguards may lead to unintended consequences, such as operational disruptions, data loss, actual or perceived bias, or erroneous decision-making, which could adversely impact our customer relationships, brand, or business operations, and result in lost sales or higher costs. Introducing new AI and machine learning tools may also increase the risk of data security breaches or other cybersecurity threats, improper handling of private or sensitive information, inadvertent loss of our intellectual property rights or allegations of infringement of third parties' rights, any of which could result in adverse consequences, including costly claims, litigation, regulatory investigations, and penalties. Our competitors' increasing use of AI and machine learning technology may also adversely affect our business and if our competitors incorporate AI and machine learning into their business, services, and products more rapidly or more successfully than us, it could hinder our ability to compete effectively and adversely affect our results of operations. In addition, the legal and regulatory environment surrounding AI and machine learning technology is evolving and complex. Regulation of AI tools and their use, such as the European Union's Artificial Intelligence Act adopted in 2024 and Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust, can be expected to intensify in many countries and regions. Compliance with the evolving regulatory landscape may entail significant costs, require us to change aspects of our technologies or business practices, or otherwise negatively affect us. Any of these or other emerging risks associated with AI or machine learning could materially and adversely affect our reputation, business, and results of operations.

Our future business and financial performance depends on continued demand for the types of goods and services that we and our merchants offer. The popularity of certain products, including apparel, beauty, food, and consumer electronics, may vary over time due to perceived availability, subjective value, seasonality (including the impact and timing of holidays), and/or general societal trends. A decline in the demand for certain products or services we or our merchants sell could materially and adversely affect our revenue. For example, demand for luxury product offerings, which we have recently expanded, can be particularly variable due to changes in consumer preferences and may be particularly susceptible to recessions or other economic downturns. In addition, a temporary or sudden surge in demand for certain products may temporarily inflate the volume of those products listed on or purchased through our apps and websites, placing a significant strain on our infrastructure and throughput capacity. These trends may also cause significant fluctuations in our results of operations from period to period. A failure to timely identify or effectively respond to changing consumer preferences and spending patterns, an inability to keep adequate inventory of the type of products being purchased by customers, failure to grow and retain the members of our WOW membership programs, or a failure or inability to obtain or offer appropriate categories of products and services could negatively affect our relationship with customers and the demand for our products and services. Our ability to identify, develop, and effectively manage sourcing relationships with qualified, economically stable suppliers and merchants who satisfy our requirements, and our ability to acquire sufficient amounts of products in a timely and cost-efficient manner is critical to our business. Significant changes to, or a failure to develop and maintain, sourcing relationships with a broad and deep supplier base could materially and adversely affect our business, financial condition, and results of operations. Further, we also offer our customers private-label products on our apps and websites. Selling private-label products subjects us to additional and/or heightened risks, including but not limited to, risks of: potential product liability and mandatory or voluntary product recalls; potential liability arising from our commercial relationships with the manufacturers of our private-label products; potential liability for incidents, including, but not limited to, the injuries of our subcontractors' employees at manufacturing sites that we do not control; failure to successfully protect our intellectual property rights and the rights of applicable third parties; harm to our reputation and brand image; increased regulatory scrutiny and fines related to subcontracting and our pricing and advertising practices with respect to private-label products; and other risks generally encountered by entities that source, market, and sell private-label products.

Relations between Korea and North Korea have fluctuated over the years. Tension between Korea and North Korea may increase or change abruptly as a result of current and future events. In particular, there have been heightened security concerns in recent years stemming from North Korea's nuclear weapon and ballistic missile programs as well as its hostile military actions against Korea. Further tensions in North Korean relations could develop due to a leadership crisis, breakdown in high-level inter-Korea contacts or military hostilities. Alternatively, tensions may be resolved through reconciliatory efforts, which may include peace talks, alleviation of sanctions or reunification. We cannot assure you that any future negotiations will result in a final agreement on North Korea's nuclear program, including critical details such as implementation and timing, or that the level of tensions between Korea and North Korea will not escalate. Any increase in the level of tension between Korea and North Korea, an outbreak in military hostilities or other actions or occurrences, could adversely affect our business, prospects, financial condition, and results of operations and could lead to a decline in the price per share of our Class A common stock.

Health epidemics, such as the COVID-19 pandemic, have resulted in, and may in the future result in supply chain disruptions including those of our vendors and suppliers, constraints in logistics and fulfillment related labor costs including costs to attract and retain employees, modification of our operations, adjustments to our services and technology and other responses. The ultimate impact of any health epidemic on our business depends on many factors and uncertainties outside of our control, including, but not limited to: - the severity and duration of any such health epidemic in areas in which we operate;- evolving macroeconomic factors, including general economic uncertainty, unemployment rates, inflation and recessionary pressures;- changes in labor markets affecting us and our suppliers;- unknown consequences on our business performance and initiatives stemming from the substantial investment of time and other resources to the pandemic response;- the impact of governmental restrictions;- the long-term impact of the epidemic on our business, including consumer behaviors;- disruption and volatility within the financial and credit markets; and - the pace and extent of the ultimate recovery from the epidemic.