Essential Properties Realty (EPRT) Risk Analysis

From time to time, we may become party to various lawsuits, claims and other legal proceedings. These matters may involve significant expense and may result in judgments or settlements, which may be significant. There can be no assurance that insurance will be available to cover losses related to legal proceedings or that our tenants will meet any indemnification obligations that they have to us. Litigation may result in significant defense costs and potentially significant judgments against us, some of which are not, or cannot be, insured against. Resolution of these types of matters against us may result in our having to pay significant fines, judgments or settlements, which, if uninsured, or if the fines, judgments, and settlements exceed insured levels, could materially and adversely affect us.

Most of our portfolio is leased to tenants operating service-oriented or experience-based businesses at our properties. As of December 31, 2024, the largest industries in our portfolio were restaurants (including quick service, casual dining and family dining), car washes, early childhood education, medical and dental services, entertainment (including movie theaters), automotive service, equipment rental and sales, and convenience stores. As of December 31, 2024, tenants operating in those industries represented approximately 84.3% of our annualized base rent. EquipmentShare, Crunch Fitness, Chicken N Pickle, YesWay, Captain D's, Super Star Car Wash, Pops Mart, Tidal Wave Auto Spa, Festival Foods, and Red Robin Gourmet Burgers & Brews represent the largest concepts in our portfolio. These types of businesses depend on the willingness of consumers to physically patronize their businesses and use discretionary income to purchase their products or services. To the extent that consumer behavior changes in a manner that reduces patronage of service-based and/or experience-based businesses, for example due to public health concerns, many of our tenants would be adversely affected and their ability to meet their obligations to us could be impaired. Additional adverse economic conditions and other developments that discourage consumer spending, such as high unemployment levels, wage stagnation, interest rates, inflation, tax rates and fuel and energy costs, may have an adverse impact on the results of operations and financial conditions of our tenants and their ability to pay rent to us.

We rely on information systems across our operations and corporate functions, including finance and accounting, and depend on such systems to ensure payment of obligations, collection of cash, data warehousing to support analytics, and other various processes and procedures. Our ability to efficiently manage our business depends significantly on the reliability and capacity of these systems. Security breaches, cyber attacks, or disruption, of our or our third-party service providers' physical or information technology infrastructure, networks and related management systems could result in, among other things, a breach of our networks and information technology infrastructure, the misappropriation of our or our tenants' proprietary or confidential information, interruptions or malfunctions in our or our tenants' operations, misstated financial reports, violations of loan covenants, an inability to monitor compliance with REIT qualification requirements, breach of our legal, regulatory or contractual obligations, our inability to access or rely upon critical business records, unauthorized access to our facilities or other disruptions in our operations. Numerous sources can cause these types of incidents, including physical or electronic security breaches; viruses, ransomware or other malware; hardware vulnerabilities; accident or human error by our own personnel or third parties; criminal activity or malfeasance (including by our own personnel); fraud or impersonation scams perpetrated against us or our partners or tenants; or security events impacting our third-party service providers or our partners or tenants. We recognize the increasing volume of cyber attacks and employ commercially reasonable efforts to provide reasonable assurance such attacks are appropriately mitigated. We may be required to expend significant financial resources and management time to protect against or respond to such breaches. Techniques used to breach security change frequently and are generally not recognized until launched against a target, so we may not be able to promptly detect that a security breach or unauthorized access has occurred. We also may not be able to implement security measures in a timely manner or, if and when implemented, we may not be able to determine the extent to which these measures could be circumvented. If an actual or perceived security breach occurs, the market's perception of our security measures could be harmed and we could lose current and potential tenants, and such a breach could be harmful to our brand and reputation. Any breaches that may occur could expose us to increased risk of lawsuits, material monetary damages, potential violations of applicable privacy and other laws, penalties and fines, harm to our reputation and increases in our security and insurance costs. In the event of a breach resulting in loss of data, such as personally identifiable information or other such data protected by data privacy or other laws, we may be liable for damages, fines and penalties for such losses under applicable regulatory frameworks despite not handling the data. We cannot guarantee that any backup systems, regular data backups, security protocols, network protection mechanisms and other procedures currently in place, or that may be in place in the future, will be adequate to prevent network and service interruption, system failure, damage to one or more of our systems or data loss in the event of a security breach or attack. In addition, the regulatory framework around data custody, data privacy and breaches varies by jurisdiction and is an evolving area of law with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the United States. We may not be able to limit our liability or damages in the event of such a loss. Data protection legislation is becoming increasingly common in the United States at both the federal and state level and may require us to further modify our data processing practices and policies. Compliance with existing, proposed and recently enacted laws and regulations can be costly; any failure to comply with these regulatory standards could subject us to legal and reputational risks. Misuse of or failure to secure personal information could also result in violation of data privacy laws and regulations, proceedings against the Company by governmental entities or others, fines and penalties, or damage to our reputation and credibility with regulators, tenants and investors.