Donnelley Financial Solutions (DFIN) Risk Analysis

On October 1, 2016, DFIN became an independent publicly traded company through the Separation. In 2020, LSC, which separated from RRD at the same time as DFIN, filed for business reorganization under Chapter 11 of the U.S. Bankruptcy Code and stopped making required withdrawal liability payments to multiemployer pension plans from which RRD had withdrawn prior to the Separation. Responsibility for certain pre-Separation withdrawal liability obligations was assigned to the parties, including LSC (the "LSC MEPP Liabilities") during the Separation, however, the Company and RRD remained jointly and severally liable for the LSC MEPP Liabilities pursuant to laws and regulations governing multiemployer pension plans. If RRD fails to make required payments in respect of the remaining LSC MEPP Liabilities or RRD fails to make required payments in respect of the RRD MEPP liabilities, the Company may become obligated to make such payments, which may negatively impact the Company's cash flows and results of operations. In addition, the Company's MEPP liabilities could also be affected by the financial stability of other employers participating in such plans and decisions by those employers to withdraw from such plans in the future.

Global supply chain challenges leading to decreased availability of paper and other raw materials and the costs of these resources due to sourcing difficulties or otherwise have increased DFIN's costs in the past and may do so in the future. The Company may not be able to pass these costs on to clients through higher prices. Moreover, rising raw materials costs, including potential tariffs on imported paper and raw materials, and any consequent impact on pricing, could lead to a decrease in demand for DFIN's services and products.

The Company does not generally have long-term contracts for traditional services and products within the CM-CCM and IC-CCM segments and, therefore, relies on those clients continued use of DFIN's services and products. As a result, client retention, particularly during periods of declining transactional volume, is an important part of the Company's strategic business plan. There can be no assurance that clients will continue to use DFIN's services and products to meet their ongoing needs, particularly in the face of competitors' services and products offerings, or that their needs for those services will not be impacted by regulatory changes. Although some of the Company's software contracts are multi-year, both multi-year contracts and contracts that are less than one year are subject to renewals. As a result, there can be no assurance that clients will continue to use DFIN's software solutions to meet their ongoing needs. Client retention rates may decline due to a variety of factors, including: - the Company's inability to demonstrate to clients the value of its solutions;- the price, performance and functionality of DFIN's solutions;- the availability, price, performance and functionality of competing services and products;- clients ceasing to use or anticipating a declining need for the Company's services in their operations;- consolidation in the Company's client base;- the effects of economic downturns and global economic conditions;- technology and application failures and outages, interruption of service, security breaches or fraud, which could adversely affect the Company's reputation and the Company's relations with its clients; or - reductions in clients' spending levels. If the Company's retention rates are lower than anticipated or decline for any reason, the Company's net sales may decrease and the Company's profitability may be harmed, which could negatively impact the Company's business, results of operations, financial position and cash flows.

A high level of customer support is critical for the successful marketing, sale and retention of DFIN's solutions. If the Company is unable to provide a level of customer support and service to meet or exceed clients' expectations, the Company could experience a loss of clients and market share, a failure to attract new clients, including in new geographic regions, and increased service and support costs and a diversion of resources. Risks related to the Company's support and service offerings, similar to other software solution providers, include implementation risks caused by insufficient or incorrect information provided by clients, insufficient client expectation management, inadequate contracting and consumption models for services and support; deviations from standard terms and conditions or other communication deficiencies during service delivery. Any of these results could negatively impact the Company's business, reputation, results of operations, financial position and cash flows.

Maintaining the confidentiality, integrity and availability of DFIN's systems, software and solutions is an issue of critical importance for the Company and its clients and users who rely on DFIN's systems to prepare regulatory filings and store and exchange large volumes of information, much of which is proprietary, confidential and may constitute material nonpublic information. Given DFIN's systems contain material nonpublic information about public reporting companies and potential M&A activities prior to its public release, the Company has been, and expects it will continue to be, a target of hacking or cybercrime. Inadvertent disclosure of the information maintained on DFIN's systems (or on the systems of the vendors on which the Company relies) due to human error, breach of the systems through hacking, cybercrime or a leak of confidential information due to employee misconduct, could seriously damage the Company's reputation, could cause it to expend significant resources responding to requests from government agencies and customers and could cause significant reputational harm for the Company and its clients. The Company's technologies, systems, networks and software have been and continue to be subject to cybersecurity threats and attacks, which range from uncoordinated individual attempts to sophisticated and targeted measures directed at the Company. The risk of a security breach or disruption, particularly through cyber attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased and the Company has in the past and may in the future be subject to security breaches. The Company's customers and employees have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate login credentials, including passwords, or to introduce viruses or other malware programs to its information systems, the information systems of its vendors or third-party service providers and/or its customers' computers. Though the Company endeavors to mitigate these threats through product improvements, use of encryption and authentication technology and customer and employee education, such cyber attacks against the Company or its vendors and third-party service providers remain a serious issue. Further, to access the Company's services and products, the Company's customers use their own electronic devices that are beyond DFIN's security control systems. Techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until executed against a target. Similar to other software solutions, DFIN's software may be vulnerable to these types of attacks. Breaches and other inappropriate access can be difficult to detect and any delay in identifying them could increase their harm. An attack of this type could disrupt the proper functioning of the Company's software solutions, cause errors in the output of clients' work, allow unauthorized access to sensitive, proprietary or confidential information and other undesirable or destructive outcomes. As a result of these types of risks and attacks, the Company has implemented and continuously reviews and updates systems, processes and procedures to protect against unauthorized access to or use of data and to prevent data loss. For example, the Company continues to refresh relevant security standards to reflect changes in current security threats, monitors DFIN systems for cyber threats, continues to update intrusion and detection capabilities and refreshes mandatory information security awareness training content, including awareness around phishing. However, the ever-evolving threats mean the Company and its third-party service providers and vendors must continually evaluate and adapt their respective systems and processes and overall security environment. There is no guarantee that these measures will be adequate to safeguard against all data security breaches, system compromises or misuses of data. Furthermore, DFIN's systems allow the Company to share information that may be confidential in nature to its clients across the Company's offices and remote working locations worldwide. This design allows the Company to increase global reach for its clients and increase its responsiveness to client demands, but also increases the risk of a security breach or a leak of such information as it allows additional points of access to information by increasing the number of employees and facilities working on certain jobs. In addition, DFIN's systems leverage third-party outsourcing arrangements, which expedites the Company's responsiveness but exposes information to additional access points. Malicious software, sabotage, ransomware and other cybersecurity breaches of the types described below could cause an outage in DFIN's infrastructure, which could lead to a substantial delay of service and ultimately downtimes, recovery costs and client claims. The occurrence of an actual or perceived information leak or breach of security could cause the Company's reputation to suffer, clients to stop using DFIN's services and products offerings, the Company to have to respond to requests from government agencies and customers in connection with such event and the Company to face lawsuits and potential liability, any of which could cause DFIN's financial performance to be negatively impacted. The Company has incurred, and expects to continue to incur, expenses to prevent, investigate and remediate security breaches and vulnerabilities, including deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants. Though the Company maintains professional liability insurance that includes coverage if a cybersecurity incident were to occur, there can be no assurance that insurance coverage will be available, responsive, or that the available coverage will be sufficient to cover losses and claims related to any cybersecurity incidents the Company may experience. Any of the security concerns could negatively impact the Company's results of operations, financial position and cash flows.

DFIN's services and products may contain undetected errors or scalability limitations during their life cycle, but particularly when first introduced or as new versions are released to the market. The Company releases enhanced versions of products including platforms during various stages of development. Despite production testing by the Company and operational testing by current and potential clients, errors may not be found in new services and products until after commencement of commercial availability or use, resulting in a loss of or a delay in market acceptance, a need for additional non-billable customer service and support to ameliorate the error, damage to the Company's reputation, client dissatisfaction and decline in net sales and operating income.

The Company is exposed to market risks resulting from changes in the currency exchange rates of the currencies in the countries in which it does business. Although operating in local currencies may limit the impact of currency rate fluctuations on the operating results of non-U.S. activities, fluctuations in such rates may affect the translation of these results into DFIN's financial statements. To the extent borrowings, sales, purchases, net sales and expenses or other transactions are not in the applicable local currency, the Company may enter into foreign currency spot and forward contracts to hedge the currency risk. Management cannot be sure, however, that its efforts at hedging will be successful, and such efforts could, in certain circumstances, lead to losses.