Diebold Nixdorf (DBD) Risk Factors

The Company is subject to compliance with various laws and regulations, including worldwide anti-bribery laws. Anti-bribery laws generally prohibit companies, and third parties acting on their behalf, from engaging in bribery or making or receiving other improper payments to another person or entity, including government officials for the purpose of obtaining or retaining business or gaining an unfair business advantage or inducing a person to act improperly or rewarding them for doing so. The FCPA also requires proper record keeping and characterization of such payments in the Company's reports filed with the SEC. The Company's employees and agents are required to comply with these laws. The Company operates in many parts of the world that have experienced governmental and commercial corruption to some degree, and strict compliance with anti-bribery laws may conflict with local customs and practices. Non-US companies, including some that may compete with the Company, may not be subject to the FCPA or other anti-bribery laws and may follow local customs and practices. Accordingly, such companies may be more likely to engage in activities prohibited by the anti-bribery laws which apply to the Company, which could have a significant adverse impact on the Company's ability to compete for business in such countries. Despite the Company's commitment to legal compliance and corporate ethics, it cannot ensure that its policies and procedures will always protect it from intentional, reckless or negligent acts committed by its employees or agents. Violations of these laws, or allegations of such violations, could disrupt the Company's business and result in financial penalties, debarment from government contracts and other consequences that may have a material adverse effect on its reputation, business, financial condition or results of operations. Future changes in anti-bribery or economic sanctions laws and enforcement could also result in increased compliance requirements and related expenses that may also have a material adverse effect on its business, financial condition or results of operations.

It is possible that our having filed for bankruptcy and our recent emergence from the Restructuring Proceedings could adversely affect our business and relationships with customers, employees and suppliers. Due to uncertainties, many risks exist, including the following: - our suppliers could terminate their relationship or require financial assurances or enhanced performance;- our ability to renew existing contracts and compete for new business may be adversely affected;- our ability to attract, motivate and/or retain key executives and employees may be adversely affected;- employees may be distracted from performance of their duties or more easily attracted to other employment opportunities;- competitors may take business away from us, and our ability to attract and retain customers may be negatively impacted; and - we have four new directors on our Board of Directors that have limited experience with the Company or our management team, and as a result go-forward operations plans and strategy may differ materially from past practice. The occurrence of one or more of these events could have a material and adverse effect on our operations, financial condition and reputation. We cannot assure you that having been subject to the Restructuring Proceedings will not adversely affect our operations in the future.

In order to be successful, the Company must attract, retain and motivate executives and other key employees, including those in managerial, professional, administrative, technical, sales, marketing and IT support positions. It also must keep employees focused on its strategies and goals. Hiring and retaining qualified executives, engineers and qualified sales representatives are critical to its future, and competition for experienced employees in these areas can be intense. In addition, we have seen a decline in the qualified labor applicant pool since the start of the COVID-19 pandemic and increased competition for qualified labor. The failure to hire or loss of key employees could have a significant impact on the Company's operations. Tax Liability Risks.

The Company relies on other companies, including subcontractors and suppliers, to provide and produce raw materials, integrated components and sub-assemblies and production commodities included in, or used in the production of, its products. If one or more of the Company's subcontractors or suppliers experiences delivery delays or other performance problems, it may be unable to meet commitments to its customers or incur additional costs. In some instances, the Company depends upon a single source of supply. Any service disruption from one of these suppliers, either due to circumstances beyond the supplier's control, such as geo-political developments or public health concerns, or as a result of performance problems or financial difficulties, could have a material adverse effect on the Company's ability to meet commitments to its customers or increase its operating costs. The Company manufactures a substantial amount of its products in Paderborn, Germany, and Manaus, Brazil. In addition, certain of our products are manufactured in China and India. Any damage suffered by these critical locations and manufacturing plants could negatively impact our business and results of operations. While the Company maintains insurance policies that provide coverage up to certain limits for some of the potential risks and liabilities associated with its business, it does not maintain insurance policies for all risks and liabilities.

While the Company achieved significant savings from its DN Now initiatives that concluded in 2021, as well as from the incremental $150.0 plus cost savings plan which commenced in 2022, these savings may not be sustainable, which may adversely affect its operating results and cash flow. The Company's initiatives consisted of a number of work streams designed to improve operational efficiency and sustainably increase profits and cash flows. Although the Company achieved a substantial amount of annual cost savings through 2022, it may be unable to sustain the annual cost savings from the work streams that it has previously implemented. and its results of operations and cash flows may be adversely affected.

To reduce these risks, the Company has programs and measures in place designed to detect and help safeguard against cybersecurity attacks. Although we have implemented cybersecurity measures designed to detect and limit the risk of unauthorized access to our systems and acquisition of, loss, modification of, use, access to, or disclosure of our data, threat actors are using evolving, sophisticated, and ever-changing techniques to obtain unauthorized access to systems and data. The types and motivations of threat actors that may attempt to access our systems also are evolving and expanding, and include sophisticated nation-state sponsored and organized cyber-criminals, who are targeting the financial services and manufacturing industries. Our position as a product and solution provider to the financial services industry may cause an attacker to attempt to infiltrate our systems in order to carry out supply chain attacks against the industry. As a result, the risk of cyberattack is increasing. An attack, disruption, intrusion, denial of service, theft or other data or cybersecurity incident (such as phishing attack, virus, ransomware, or other malware installation), or an inadvertent act by an employee or contractor, could result in unauthorized access to, acquisition of, loss, disclosure, or modification of, our systems, products, and data (or our third-party service provider's systems, products, and data), which may result in operational disruption, loss of business, claims (including by customers, financial institutions, cardholders, and consumers), costs and reputational harm that could negatively affect our operating results. The Company could incur significant expenses in investigating and addressing cybersecurity incidents, including the expenses of deploying additional personnel, enhancing or implementing additional protection measures, training employees or hiring consultants, and such incidents could divert the attention of our management and key personnel from our business operations. Further, remedial measures may later prove inadequate to prevent or reduce the impact of new or emerging threats. The Company may face regulatory investigations or litigation relating to cybersecurity incidents, which may be costly to defend and which, if successful, may require the Company to pay damages and fines, incur expenses to comply with consent orders or injunctions, and/or change its business practices. The Company also is subject to risks associated with cyberattacks involving our own supply chain. We may also detect, or may receive notice from third parties (including governmental agencies and those in our supply chain) of potential vulnerabilities in our information technology systems, our products, or third-party products used in conjunction with our products. Even if these potential vulnerabilities do not affect our products, services, data, or systems, their existence or claimed existence could adversely affect customer confidence and our reputation in the marketplace, causing us to lose existing or potential customers. To the extent such vulnerabilities require remediation, such remedial measures could require significant resources, may not be implemented before such vulnerabilities are exploited, and may not prevent or reduce the risk. As the cybersecurity landscape evolves, we may also find it necessary to make significant further investments to protect data and infrastructure. We maintain cybersecurity insurance intended to cover some of these risks, but this insurance may not be sufficient to cover all of our losses from future cybersecurity incidents the Company may experience. We have experienced cybersecurity incidents in the past, but none of these incidents, individually or in the aggregate, has had a material adverse effect on our business, reputation, operations or products. The Company routinely investigates security events that may or may not turn into a cybersecurity incident. We have in place various information technology protections designed to detect and reduce cybersecurity incidents, although there can be no assurance that our protections will be successful. The Company also regularly evaluates its protections against cybersecurity incidents, including through self-assessments and third-party assessments, and takes steps to enhance those protections in response to specific threats and as part of the Company's information security program. There can be no assurance, however, that the Company will be able to prevent, reduce the risk of, or remediate all future cybersecurity incidents or that the cost associated with responding to any such incident or impact of such incident will not be significant or material. Portions of the Company's IT infrastructure also may experience interruptions, delays or cessations of service or produce errors in connection with systems integration or migration work that takes place from time to time. The Company may not be successful in implementing new systems, and transitioning data and other aspects of the process could be expensive, time consuming, disruptive and resource-intensive. Such disruptions could adversely impact the ability to fulfill orders, service customers and interrupt other processes and, in addition, could adversely impact the Company's ability to maintain effective internal control over financial reporting. Delayed sales, lower margins, lost customers or diminished investor confidence resulting from these disruptions could adversely affect the Company's financial results, stock price and reputation. The Company's actual or perceived failure to comply with increasing and increasingly stringent laws, regulations and contractual obligations relating to privacy, data protection and information security could harm the Company's reputation, subject the Company to significant fines and liability or loss of business, and decrease demand for the Company's services. The Company and its customers are subject to privacy, data protection, and information security laws and regulations (Data Protection Laws) in the United States and in jurisdictions around the globe that restrict the collection, use, disclosure, transfer and processing of personal data, including financial data. For example, the Company and its customers are subject, without limitation, to the European Union General Data Protection Regulation (GDPR), the U.K. General Data Protection Regulation, the California Consumer Privacy Act (CCPA) and its amendments, and the Brazilian Lei Geral de Proteção de Dados. Failure to comply with these laws could result in material legal exposure and business impact, including the loss of customers and decreased demand for our products and services. The GDPR, for example, imposes onerous accountability obligations on companies, with penalties for non-compliance of up to the greater of €20 and four percent of annual global revenue. The GDPR, and other Data Protection Laws, also grant corrective powers to supervisory authorities, including the ability to impose a limit on processing personal data or ability to order companies to cease operations. The Data Protection Laws are part of an evolving global data protection landscape in which the number, complexity, requirements, and consequences of non-compliance with these laws are increasing. This landscape includes legislative proposals recently adopted or currently pending in the United States, at both the federal and state levels (including by banking agencies), as well as in other jurisdictions, implementing new or additional requirements for data protection that could increase compliance costs, the cost and complexity of delivering our services, and significantly affect our business. Additionally, the interpretation and application of new data protection laws and regulations in many cases is uncertain, and our legal and regulatory obligations in such jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. Complying with these evolving and varying standards, and implementing the required operational changes as a result of such standards, could require significant expense and effort and may require us to change our business practices or the functionality of our products and services in a manner adverse to our customers and our business. In addition, violations of these laws can result in governmental investigations, significant fines, penalties, claims by regulators or other third parties, imposition of limits on the processing of data, and damage to our brand and business. Like other global companies, to conduct its operations, the Company transfers data across international borders. Transferring personal data across international borders is complex and subject to legal and regulatory requirements. In many cases, the laws and regulations governing such transfers apply not only to transfers between unrelated third parties but also to transfers between the Company and its subsidiaries. Other companies have been subject to active litigation and enforcement with respect to data transfers in a number of jurisdictions around the world, the decisions resulting form these actions could have an adverse impact on our ability to process and transfer personal data as part of our business operations. Some countries have also enacted or are enacting data localization laws that prohibit or significantly restrict the transfer of data out of the country. If, as a result of changing laws or regulatory decisions, we cannot transfer data from some jurisdictions or implement valid mechanisms for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal data from Europe or elsewhere, and we may be required to increase our personal data or other data processing capabilities in the Europe Union and/or elsewhere at significant expense. In addition to our legal obligations, our contractual obligations relating to privacy, data protection and information security have become increasingly prevalent and stringent due to changes in laws and regulations, requirements in the financial services industry. Certain Data Protection Laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. If we are unable to comply with our contractual obligations, this could impact our reputation and result in liabilities and loss of business.