CoStar Group (CSGP) Risk Factors

The success of our business depends in large part on our intellectual property, including intellectual property involved in our methodologies, databases, services and software. We rely on a combination of trademark, trade secret, patent, copyright and other laws, nondisclosure and noncompetition provisions, license agreements and other contractual provisions and technical measures to protect our intellectual property rights. However, current law may not provide for adequate protection of our databases and the actual data. In addition, legal standards relating to the validity, enforceability and scope of protection of proprietary rights in internet-related businesses are uncertain and evolving, and changes in these standards may adversely impact the viability or value of our proprietary rights. We find our proprietary content on competitors' sites. If we are not successful in protecting our intellectual property, including our content, our brands and our business, results of operations and financial condition could be harmed. The same would be true if a court found that our services infringe other persons' intellectual property rights. Any intellectual property lawsuits or threatened lawsuits in which we are involved, either as a plaintiff or as a defendant, have cost us and could continue to cost us a significant amount of time and money and distract management's attention from operating our business. In addition, if we do not prevail on an intellectual property claim, this could result in a change to our methodology or information, analytics and online marketplace services and could reduce our profitability. Effective trademark, trade secret, patent and copyright protection may not be available in every country in which we provide our services. The laws of certain countries do not protect proprietary rights to the same extent as the laws of the U.S. and, therefore, in certain jurisdictions, we may be unable to protect our intellectual property and our proprietary technology adequately against unauthorized third-party copying or use, which could harm our competitive position. This risk will increase as we continue to expand our business into new international jurisdictions.

Our business relies on IT Systems and involves the generation, collection, storage, processing and transmission of Confidential Information, including personal information and proprietary business information, by us and by third-party providers we rely on. We own and manage IT Systems but also rely on third-party managed IT Systems and a broad array of third-party products and services to support our business operations. An increasing number of organizations, including large merchants, businesses, technology companies and financial institutions, as well as government institutions, have disclosed security incidents, disruptions to, and breaches of their or third-party providers' IT Systems, some of which have involved sophisticated and highly targeted attacks, including on websites, mobile applications and infrastructure, following a trend of cyberattacks increasing in frequency and magnitude on a global basis. Our IT Systems, or those of third parties on which we rely, may be disrupted or damaged and our Confidential Information may be compromised, corrupted, lost or stolen. The tools and techniques (including artificial intelligence) used to obtain unauthorized, improper or illegal access to a target's systems, data or customers' data, disable or degrade services, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated. It may be difficult to detect, investigate or remediate such cyber attacks quickly and such attacks often are not recognized or detected until after they have been launched against a target. We expect that unauthorized parties will continue to attempt to gain access to or disrupt our IT systems or facilities through various means, including hacking into IT Systems or facilities or those of our customers or vendors, malware (including ransomware) or attempting to fraudulently induce (for example, through spear phishing attacks or social engineering) our employees, customers, vendors or other users of IT Systems into disclosing access credentials or other sensitive information, which may in turn be used to access our IT Systems. Numerous and evolving cybersecurity threats, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as advanced cyberattacks, phishing, social engineering schemes, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of bugs, misconfigurations or exploited vulnerabilities in software or hardware, could compromise the confidentiality, availability and integrity of Confidential Information and our IT systems. Our efforts to prevent, detect and respond to data security incidents, may not be effective due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. Further, the security measures and procedures our customers, vendors and other users of our systems have in place to protect IT Systems and Confidential Information may not be successful or sufficient to counter all data breaches, cyberattacks or system failures. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Our IT Systems may be vulnerable to cyberattacks or security breaches, and third parties may be able to access our, our customers' or our employees' Confidential Information, including personal or proprietary information, that is stored on or accessible through those systems. We have experienced and expect to continue to experience in the future, cyberattacks as well as breaches of our security measures due to human error, malfeasance, system errors or vulnerabilities or other irregularities. In the past, one of our vendors providing IT infrastructure management software was compromised by cyberattacks. We are regularly exposed to vulnerabilities in widely deployed third-party software that we use in the ordinary course of business, such as the Log4J vulnerability. While these vulnerabilities did not have a material adverse effect on our operations, they and similar incidents require us to devote time and resources to monitoring and remediation on a regular basis. In the past three years, we have not experienced a material cybersecurity incident, but any actual or perceived cybersecurity incidents or breaches of our security could result in any or all of the following, among other things, any of which could adversely affect our business and results of operations: - Interrupt our operations;- Result in our systems or services being unavailable;- Result in improper disclosures of data;- Result in improper payments;- Materially harm our reputation and brands;- Result in significant regulatory scrutiny, enforcement actions, legal proceedings and claims (including class action lawsuits) and other legal and financial exposure;- Cause us to incur significant remediation, system restoration, incident response and compliance costs;- Lead to loss of customer confidence in, or decreased use of, our products and services;- Divert the attention of management from the operation of our business; and - Result in significant contractual penalties or other payments as a result of third-party losses or claims. In addition, any cyberattacks or data security breaches affecting companies that we acquire our customers or vendors (including data center and cloud computing providers) could have similar negative effects on our business. Further, we may not be able to recover any or all damages suffered as a result of such security breach or other security incident from such third-party providers. Notwithstanding our efforts, there can be no assurance that vulnerabilities in widely deployed software will not materially harm our business. Any breach of our security measures or the loss, inadvertent disclosure or unapproved dissemination of Confidential Information about us or our customers, including the potential loss or disclosure of such information or data, could result in litigation, regulatory enforcement and potential liability for us, damage our brand and reputation or otherwise materially harm our business, financial condition or competitive position. The coverage under our insurance policies for cybersecurity and related issues may not be adequate to reimburse us for losses caused by cyberattacks or other security incidents or be available on economically reasonable terms or at all.

We rely heavily on our brands, which we believe are key assets of our company. Awareness and differentiation of our brands are important for attracting and expanding the number of users of, and subscribers to, our online marketplaces, such as the LoopNet Network, the Apartments.com Network, our Homes.com and OnTheMarket residential marketplaces, the Land.com Network and our CoStar Showcase. We continue to invest significantly in sales and marketing as we seek to grow the numbers of users of, subscribers to and advertisers on, our marketplaces. Our methods of advertising may not be successful in increasing brand awareness or, ultimately, be cost-effective. If we are unable to maintain or enhance user and advertiser awareness of our brands, or if we are unable to recover our marketing and advertising costs through increased usage of our services and increased advertising on our websites, our business, results of operations and financial condition could be adversely affected.

Our products and services access and use listings data through MLS memberships and must comply with each MLS's rules and compliance requirements to maintain their access to listings data and remain a member in good standing. Each MLS has adopted its own rules, policies, and agreement terms governing, among other things, how MLS data may be used and how listings data must be displayed on our websites and mobile applications. MLS members are also subject to compliance operations requirements and, as a result, must respond to complaints lodged by the MLS or other MLS participants on required timelines. MLS rules vary among markets and are in some cases inconsistent between MLSs, such that we are required to customize our websites, mobile applications, or services to accommodate differences between MLS rules. Handling complaints received by MLS members across markets may create heightened operational or financial risks with short response and resolution deadlines. Complying with the rules and compliance requirements of each MLS requires significant investment, including personnel, technology and development resources, and the exercise of considerable judgment. Rules and compliance requirements of MLSs may be changed across markets, including potential for targeted changes in response to our operations. If we are deemed to be noncompliant with an MLS's rules or to have provided improper responses to or resolution of complaints, we may face disciplinary sanctions by that MLS, which could include monetary fines, restricting or terminating our access to that MLS's data, or other disciplinary measures. The loss or degradation of this listings data could materially and adversely affect traffic to our websites and mobile applications, which could severely harm our business, results of operations and financial condition.

New tax laws or regulations, or changes in existing laws or regulations, or the manner of their interpretation or enforcement, could increase our cost of doing business. In addition, from time to time, U.S. and foreign tax authorities, including state and local governments, consider legislation that could increase our effective tax rate. Further, the Organization for Economic Co-operation and Development has a framework to implement a global minimum corporate tax of 15% for companies with global revenues and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January 1, 2025. While it is uncertain whether the U.S. will enact legislation to adopt Pillar 2, certain countries in which we operate have adopted legislation, and other countries are in the process of introducing legislation to implement Pillar 2. Although we do not expect Pillar 2 to have a material impact on our effective tax rate or our consolidated results of operations, financial position, and cash flows at this time, certain implementation details have yet to be developed, and the enactment of certain of these changes has not yet taken effect in all jurisdictions in which we operate. As a result, these changes may have adverse consequences for us, may increase our compliance costs and may increase the amount of tax we are required to pay in certain jurisdictions.

Global economic uncertainties or downturns could adversely affect our business and results of operations, including financial and credit market fluctuations, changes in economic policy, increased inflation and responsive actions, rising interest rates or a period of elevated interest rates, labor shortages, supply chain disruptions, trade uncertainty, political unrest, geographical instability or other impacts from the macroeconomic environment. These macroeconomic conditions could cause a decrease in customer spending and negatively affect the rate of growth of our business. The real estate market may be adversely impacted by many different factors, including lower than expected job growth or job losses resulting in reduced real estate demand; reduced real estate demand due to continued remote work policies or a period of elevated interest rates; rising interest rates, inflation, slowing transaction volumes and other macroeconomic trends that negatively impact investment returns; excessive speculative new construction in localized markets resulting in increased vacancy rates and diminished rent growth; unanticipated disasters or global health events; and other adverse events such as decreased growth in the working age population resulting in reduced demand for all types of real estate. In response to concerns over inflation, the U.S. Federal Reserve raised interest rates in each quarter of 2022 and the first, second and third quarters 2023. A downturn in the real estate market, including as a result of increased interest rates or a decline in leasing activity and absorption rates may affect our ability to generate revenues and may lead to more cancellations by our current or future customers, either of which could cause our revenues or our revenue growth rate to decline and reduce our profitability. A depressed real estate market has a negative impact on our core customer base, which could decrease demand for our information, analytics and online marketplaces. Also, companies in this industry may consolidate, often in order to reduce expenses. Consolidation, or other cost-cutting measures by our customers, may lead to cancellations of our information, analytics and online marketplace services by our customers, reduce the number of our existing clients, reduce the size of our target market or increase our clients' bargaining power, all of which could cause our revenues to decline and reduce our profitability. If cancellations, reductions of services and failures to pay increase, and we are unable to offset the resulting decrease in revenues by increasing sales to new or existing customers, our revenues may decline or grow at lower rates.

Our international operations and expansion subject us to additional business risks, including: currency exchange rate fluctuations; difficulty in adapting to the differing business practices and laws in foreign countries, including differing laws regarding privacy and data protection; difficulty in managing foreign operations; limited protection for intellectual property rights in some countries; difficulty in collecting accounts receivable and longer collection periods; costs of enforcing contractual obligations; impact of recessions in economies outside the U.S.; geopolitical instability, terrorism and war; and potentially adverse tax consequences. In addition, international expansion imposes additional burdens on our executive and administrative personnel, systems development, research and sales departments and general managerial resources. If we are not able to manage our international operations successfully, we may incur higher expenses and our profitability may be reduced. Finally, the investment required for additional international expansion sometimes exceeds the profit generated from such expansion, which reduces our profitability and may adversely affect our financial position.

A portion of our business is denominated in foreign currencies. We translate sales and other results denominated in foreign currency into U.S. dollars for our financial statements. During periods of a strengthening U.S. dollar, our reported international sales and earnings could be reduced because foreign currencies may translate into fewer U.S. dollars. Foreign currency exchange rates have fluctuated and may continue to fluctuate. Significant foreign currency exchange rate fluctuations may negatively impact our international revenue, which in turn affects our consolidated revenue. Currently, we are not party to any hedging transactions intended to reduce our exposure to exchange rate fluctuations. We may seek to enter into hedging transactions in the future, but we may be unable to enter into these transactions successfully, on acceptable terms or at all. We cannot predict whether we will incur foreign exchange losses in the future. Further, significant foreign exchange rate fluctuations resulting in a decline in the respective local currency may decrease the value of our foreign assets, as well as decrease our revenues and earnings from our foreign subsidiaries, which would reduce our profitability and adversely affect our financial position.

Our ability to attract agents and consumers to our Homes.com Network, its websites and mobile applications and other residential real estate tools depends, to some degree, on us providing timely access to comprehensive and accurate real estate listings and information. We get listings data primarily from MLSs in the markets we serve. We also source listings data from public records, other third-party listing providers, and other sources. Many of our agreements with real estate listing providers may be terminated with limited notice or cause. Many of our competitors and other real estate websites have similar access to MLSs and listing data and may be able to source certain real estate information faster or more efficiently than we can. Because MLS participation is voluntary, brokers and homeowners may decline to post their listings data to their local MLS or may seek to change or limit the way that data is distributed. Another industry participant or group could create a new listings data service, which could impact the relative quality or quantity of information of our listing providers. The loss of existing relationships with MLSs and other listing providers, whether due to termination of agreements, loss of MLS memberships, or otherwise, changes to our rights to use or timely access listing data or an inability to continue to add new listing providers or changes to the way real estate information is shared, may negatively impact our listing data quality. This could markedly decrease the quantity and quality of the sale and rental data we provide, reduce customer confidence in our products and services and cause customers to go elsewhere for real estate listings and information, which could severely harm our business, results of operations and financial condition.

In December 2021, we announced our plans to expand our research and technology center in Richmond, Virginia. These plans have required and will continue to require significant capital expenditures over the next several years and our business plans may change. Future changes in growth or fluctuations in cash flow may also negatively impact our ability to finance this project. Additionally, actual capital expenditures could vary materially from our projected capital expenditures, which could negatively impact our business, operating results and financial condition. If we are provided with any grants, tax credits, abatements or other incentives related to this expansion effort and do not meet requirements associated with those incentives, we may not be able to benefit from those incentives, which could cause the cost of the project to be significantly more than anticipated or significantly increase our taxes above what we currently expect. To date, we have financed construction with cash on hand and plan to finance the remainder of construction in the same way. Use of cash on hand to finance construction has and will continue to reduce the amount of cash available for other corporate uses and could also reduce our ability to meet our scheduled debt service obligations or to meet the covenants required to borrow additional funds under our 2020 Credit Agreement. Any of the foregoing may adversely affect our financial position and results of operations.