Diamond Hill Investment Group (DHIL) Risk Factors

The Company is dependent on the capacity and reliability of the communications, information, and technology systems supporting its operations, whether developed, owned, or operated internally by the Company or by third parties. Operational risks, such as trading or operational errors, interruption of the Company's financial, accounting, trading, compliance, and other data processing systems, the loss of data contained in such systems, or compromised systems due to cyberattack, could result in a disruption of the Company's business, liability to clients, regulatory intervention, or reputational damage, and thus, adversely affect its business.

The Company's success depends on highly skilled personnel, including portfolio managers, research analysts, and management, many of whom have specialized expertise and extensive experience in the investment management industry. Financial services professionals are in high demand, and the Company faces significant competition for qualified employees. Other than the Company's Chief Executive Officer, its employees do not have employment contracts and generally can terminate their employment at any time. The Company may not be able to retain or replace key personnel. To retain or replace its key personnel, the Company may be required to increase compensation, which would decrease its net income. The loss of key personnel could damage the Company's reputation and make it more difficult to retain and attract new employees and clients. A loss of client assets resulting from the departure of key personnel may materially decrease the Company's revenues and net income. Specifically, Charles Bath, a co-portfolio manager on our Large Cap strategy, which is our largest strategy by AUM and revenues, announced his retirement from the Company effective December 31, 2024. It is possible his departure could lead to increased redemptions resulting in a material decline in AUM and revenue. The Company has had a well-defined succession plan in place since 2018, when Austin Hawley was named co-portfolio manager on the Large Cap strategy. Mr. Hawley has worked closely with Mr. Bath for over 15 years, including the last six years as a co-portfolio manager.

The Company's ability to attract additional AUM is dependent on its relationship with third-party financial intermediaries. The Company compensates some of these intermediaries for access to investors and for various marketing services provided. These distribution sources and client bases may not continue to be accessible to the Company for reasonable terms, or at all. If such access is restricted or eliminated, it could have an adverse effect on the Company's results of operations. Fees paid to financial intermediaries for investor access and marketing services have generally increased in recent years. If such fee increases continue, refusal to pay them could restrict the Company's access to those client bases while paying them could adversely affect its profitability.

Negative public opinion can result from the Company's actual or alleged conduct in any number of activities, including trading practices, corporate governance and acquisitions, DEI issues, social media and other marketing activities, and actions taken by governmental regulators and community organizations in response to any of the foregoing. Negative public opinion could adversely affect the Company's ability to attract and maintain clients, could expose the Company to potential litigation or regulatory action, and could have a material adverse effect on its share price or result in heightened volatility.

As part of its business, the Company collects, processes, and transmits sensitive and confidential information about its clients and employees, as well as proprietary information about its business. The Company has policies and procedures pursuant to which it takes numerous security measures to prevent cyberattacks of various kinds as well as fraudulent and inadvertent activity by persons who have been granted access to such sensitive or confidential information. Nevertheless, the Company's systems, like all technology systems, remain vulnerable to unauthorized access, which can result in theft or corruption of information. In addition, the Company shares information with third party vendors upon whom it relies for various functions. The systems of such third parties also are vulnerable to cyber threats. Unauthorized access can come from unrelated third parties through the internet, from access to hardware removed from the Company's or those third parties' premises, or from employees acting intentionally or inadvertently. Cybersecurity incidents can involve, among other things: (i) deliberate attacks designed to corrupt the Company's information systems and make them unusable by the Company to operate its business; (ii) theft of information used by the perpetrators for financial and other gain; or (iii) inadvertent releases of information by employees or third parties with whom the Company does business. Cyberattacks that corrupt the Company's information systems and make them unusable could impair its ability to trade securities in its clients' accounts. Corruption of the systems of the Company's third-party vendors could impact the Company to the same extent as corruption of its own systems. If information about the Company's employees or clients is intentionally stolen or inadvertently made public, that information could be used to commit identity theft, obtain credit in an employee's or client's name, or steal from an employee or client. If information about the Company's business is obtained by unauthorized persons, whether through intentional attacks or inadvertent releases of information, it could be used to harm its competitive position. Whether information is corrupted, stolen, or inadvertently disclosed, and regardless of the type and nature of the information (e.g., proprietary information about the Company's business or personal information about clients or employees), it could have various adverse impacts on, and be materially harmful to, the Company, including the following: - The Company's reputation could be harmed, resulting in the loss of clients, vendors, and employees or making payments or concessions to such persons to maintain its relationships with them;- The Company's inability to operate its business fully, even if temporarily, and thus, fulfill contracts with clients or vendors, could result in termination of contracts and loss of revenue;- Harm suffered by clients or vendors whose contracts have been breached, or by clients, vendors, or employees whose information is compromised, could result in costly litigation against us;- The Company's need to focus attention on remediation of a cybersecurity issue could take its attention away from the operation of its business, resulting in lost revenue;- The Company could incur costs to repair systems made inoperable by a cyberattack and to make changes to its systems to reduce future cyber threats. Those changes could include, among other things, obtaining additional technologies as well as employing additional personnel and training employees;- The interruption of the Company's business or theft of proprietary information could harm its ability to compete; and - Any losses that the Company may be responsible to bear may not be covered by insurance. Any of the above potential impacts of a cybersecurity incident could have a material adverse effect on the Company's business, financial condition, and results of operations.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve clients while reducing costs. The Company's future success depends, in part, upon its ability to address client needs by using technology to provide products and services that will satisfy client demands, as well as to create additional efficiencies in its operations. The Company may not be able to implement effectively new technology-driven products and services or be successful in marketing these products and services to its clients. Failure to successfully keep pace with technological changes affecting the financial services industry could negatively affect the Company's growth, revenue, and profit.

The Company's business is subject to a variety of federal securities laws, including the Advisers Act, the 1940 Act, the Securities Act, the Exchange Act, the Sarbanes-Oxley Act of 2002, the U.S. PATRIOT Act of 2001, and the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, each as amended. In addition, the Company is subject to significant regulation and oversight by the SEC. Changes in legal, regulatory, accounting, tax, and compliance requirements could have a significant effect on the Company's operations and results, including, but not limited to, increased expenses and reduced investor interest in certain funds and other investment products that the Company offers. The Company continually monitors legislative, tax, regulatory, accounting, and compliance developments that could impact its business. The Company and its directors, officers, and employees could be subject to lawsuits or regulatory proceedings for violations of such laws and regulations, which could result in the payment of fines or penalties and cause reputational harm to the Company, which could negatively affect its financial condition and results of operations, as well as divert management's attention from its operations.

The Company is subject to federal, state, and local income taxes in the United States. Tax authorities may disagree with certain positions that the Company has taken or may implement changes in tax policy, which may result in the assessment of additional taxes on the Company. The Company regularly assesses the appropriateness of its tax positions and reporting. The Company cannot provide assurances, however, that tax authorities will agree with the positions it has taken, or that the Company will accurately predict the outcomes of audits, and the actual outcomes of these audits could be unfavorable.

Natural disasters, outbreaks of epidemics or pandemics, terrorist attacks, extreme weather events or other unpredictable events could adversely affect the Company's revenues, expenses, and net income by: - Decreasing investment valuations in, and returns on, the investment portfolios that the Company manages and its corporate investments, thus, causing reductions in revenue;- Causing disruptions in national or global economies that decrease investor confidence and make investment products generally less attractive;- Reducing the availability of key personnel necessary to conduct the Company's business activities;- Interrupting the Company's business operations or those of critical service providers;- Triggering technology delays or failures; and/or - Requiring substantial capital expenditures and operating expenses to restore the Company's operations. The Company has developed various backup systems and contingency plans but cannot be assured that those preparations will be adequate in all circumstances that could arise, or that material interruptions and disruptions will not occur. The Company also relies to varying degrees on outside vendors for service delivery in addition to technology and disaster contingency support. There is a risk that these vendors will not be able to perform in an adequate and timely manner. If the Company loses the availability of employees, or if it is unable to respond adequately to such an event in a timely manner, revenues, expenses, and net income could be negatively impacted. Specifically, the effects of the outbreak of the novel coronavirus (COVID-19) in early 2020 negatively affected the global economy, the U.S. economy, and the global financial markets, and demonstrated that pandemics may disrupt the Company's operations, which could have an adverse effect on the Company's business, financial condition, and results of operations. Although the long-term effects of the pandemic cannot be predicted, previous occurrences of other pandemic and epidemic diseases had an adverse effect on the economies of those countries in which they were most prevalent. A recurrence of an outbreak of any kind of epidemic, communicable disease or virus or major public health issue could cause a slowdown in the levels of economic activity generally, which would adversely affect the Company's business, financial condition and operations.