Grocery Outlet Holding (GO) Risk Factors

Employees at two Company-operated stores are represented by the United Food and Commercial Workers Union. Our employees and those of the IOs have the right at any time to form or affiliate with a union. As we continue to grow, enter different regions and operate distribution centers, unions may attempt to organize the employees of our different IOs or our distribution centers within certain regions. If we determine to open more Company-operated stores, we may have additional employees represented by unions. We cannot predict the adverse effects that any future organizational activities will have on our business, financial condition and operating results. If we or the IOs were to become subject to work stoppages, we could experience disruption in our operations and increases in our labor costs, either of which could materially adversely affect our business, financial condition and operating results.

The IOs order merchandise solely from us, which we, in turn, deliver to IOs on a consignment basis. As a result, we retain ownership of all merchandise until the point in time that merchandise is sold to a customer. The IOs, however, are responsible for inventory management at their stores. Any spoiled, damaged or stolen merchandise, markdowns or price changes impact gross profit and, therefore, IO commission. We generally split these losses equally with IOs, however, excessive levels of shrink are deducted from commissions paid to IOs. Excessive shrink generally indicates poor inventory management and the IO's failure to use due care to secure their store against theft. If IOs were to not effectively control or manage inventory in their stores, they could experience higher rates of inventory shrink which could have a material adverse effect on their financial health, which in turn, may materially and adversely affect our business and results of operations.

A critical differentiator of our business is our ability to offer value to our customers, including offering prices that are substantially below those offered by some of our competitors. We carefully monitor the market prices of our products in order to maintain our price advantage and reputation. Over the past couple years, we have experienced varying levels of inflation, resulting in part from various supply disruptions, increased shipping and transportation costs, increased commodity costs, increased labor costs in the supply chain and other disruptions caused by the recent economic environment, which we have not been able to fully offset through price increases. Our IOs have experienced increased costs related to labor and utilities, among others. If costs of goods continue to increase and our suppliers seek price increases from us, we may not be able to mitigate such increases and have sometimes, and may continue to, increase our prices, which could deter customer traffic and reduce the number and average basket size of customer transactions. Some of our larger competitors are in a better position to absorb cost increases while maintaining price competitiveness. If our competitors are more competitive on pricing relative to our pricing, we may lose customers and/or need to mark down prices. Our gross margins and profitability also may be adversely impacted by higher supply costs that we cannot fully pass along or if we need to lower product prices due to competition. As a result of our low-price model, the foregoing competitive pressures may reduce our profitability and materially adversely affect our business, financial condition and results of operations.

Our business model has traditionally relied on the sale of name-brand products at meaningful discounts to drive frequent store visits and net sales. Consumer acceptance of, and even preference for, private label products has been increasing, however, and a trend away from name-brand products could weaken our competitive position in the market. Private label products tend to be lower priced than name-brand products and, as a result, we may have more difficulty competing against private label products on the basis of price. While we have started to invest in developing and selling our own private labels, there can be no assurance that the performance of any such private label products would be sufficient to offset the potential decreased sales of name-brand products. In addition, as we invest in and deploy our private label products, we are subjected to various new risks and regulations including product liability claims, claims related to product labeling, claims related to rights of third parties and other risks associated with entities that source, sell and market exclusive private label offerings for retailers. Any failure to appropriately address some or all of these risks could have a material adverse effect on our sales, business, results of operations and financial condition.

We have actively pursued new store growth, including in new markets, and plan to continue doing so in the future. Our new store openings may not be successful or reach the sales and profitability levels of our existing stores, and may impact our ability to attract and develop potential IOs. Some new stores may be located in areas with different competitive and market conditions as well as different customer discretionary spending patterns than our existing markets. Some new stores and future new store opportunities may be located in new geographic areas where we have limited or no meaningful experience or brand recognition. We may experience a higher cost of entry in those markets as we build brand awareness and drive customers to incorporate us into their shopping habits. New store openings may negatively impact our financial results in the short-term due to the effect of store opening costs and lower sales and contribution to overall profitability during the initial period following opening. New stores, particularly those in new markets, build their sales volume, brand recognition and customer base over time and, as a result, for approximately 4-5 years, generally have lower margins and higher operating expenses as a percentage of sales than our more mature stores. New stores may not achieve sustained sales and operating levels consistent with our more mature store base on a timely basis or at all. This lack of performance may have a material adverse effect on our financial condition and operating results. We may not anticipate all of the challenges imposed by the expansion of our operations into new geographic markets. We may not manage our expansion effectively, and our failure to achieve or properly execute our expansion plans could limit our growth or have a material adverse effect on our business, financial condition and results of operations.

Our business is subject to numerous and frequently changing federal, state and local laws and regulations. We routinely incur significant costs in complying with these regulations. The complexity of the regulatory environment in which we and the IOs operate and the related cost of compliance are increasing due to additional legal and regulatory requirements, our expanding operation and increased enforcement efforts and the future application of certain of these legal requirements to our business may be uncertain. New or existing laws, regulations and policies, liabilities arising thereunder and the related interpretations and enforcement practices, particularly those dealing with environmental protection and compliance, climate change, wage and hour and other employment-related laws, taxation, zoning and land use, workplace safety, public health, community right-to-know, product safety or labeling, food safety, alcohol and beverage sales, vitamin and supplements, information security and privacy, among others, may result in significant added expenses or may require extensive system and operating changes that may be difficult to implement and/or could materially increase our cost of doing business. For example, we or the IOs have had to comply with recent new laws in many of the states or counties in which we operate regarding recycling, waste, minimum wages, sick time, vacation, plastic bag and straw bans and sugar taxes. In addition, we and the IOs are subject to environmental laws, including but not limited to hazardous waste laws, regulations related to refrigeration and stormwater, pursuant to which we and/or the IOs could be liable or to which we could be strictly and jointly and severally liable, regardless of our knowledge of or responsibility. Approximately 11% of sales in fiscal 2023 were in the form of EBT payments and a substantial portion of these payments may be related to benefits associated with the Supplemental Nutritional Assistance Program ("SNAP"). Accordingly, changes in EBT regulations by the U.S. Department of Agriculture or in SNAP benefits by Congress could adversely affect our financial performance. The registration and ongoing compliance requirements for SNAP participation are fairly complex and each of the IOs holds their registration under the name of their business entity and is responsible for ensuring their employees consistently comply with all SNAP rules. Failure to comply can result in de-registration by USDA which, for stores located in areas with high percentages of SNAP customers, can have a significant negative financial impact. We cannot assure you that we or the IOs will comply promptly and fully with all laws, regulations, policies and the related interpretations that apply to our stores. Untimely compliance or noncompliance with applicable regulations or untimely or incomplete execution of a required product recall, can result in the imposition of penalties (including loss of licenses, eligibility to accept certain government benefits such as SNAP or significant fines or monetary penalties), civil or criminal liability, damages, class action litigation or other litigation, in addition to reputational damage. Even with adequate insurance and indemnification, any claims of non-compliance could significantly damage our reputation and consumer confidence in products we sell. In addition, the failure of such products to comply with applicable regulatory and legislative requirements could prevent us from marketing the products or require us to recall or remove such products from our stores.

From time to time, we are subject to allegations, and may be party to legal claims and regulatory proceedings, relating to our business operations. Such allegations, claims and proceedings may be brought by third parties, including our customers, suppliers, employees, governmental or regulatory bodies or competitors, and may include class actions. In recent years, companies have experienced an increase in the number of significant discrimination and harassment and wage and hour claims generally. The outcome of litigation, particularly class action lawsuits, is difficult to assess or quantify. Plaintiffs in these types of lawsuits may seek recovery of very large or indeterminate amounts, and the magnitude of the potential loss relating to such lawsuits may remain unknown for substantial periods of time. While our IOs and suppliers may indemnify us for certain adverse outcomes, we may still bear significant expenses related to such proceedings.

In the ordinary course of business, we and the IOs collect, store, process, use and transmit confidential business information and certain personal information relating to customers, employees and suppliers. All customer payment data is encrypted, and we do not store such data in our systems. We rely in part on commercially available systems, software, hardware, services, tools and monitoring to provide security for collection, storage, processing and transmission of personal and/or confidential information. It is possible that cyber attackers might compromise our security measures and obtain the personal and/or confidential information of the customers, employees and suppliers that we hold or our business information. Moreover, an employee, contractor or third party with whom we work or to whom we outsource business operations may fail to monitor their or our systems effectively, may fail to maintain appropriate safeguards, may misuse the personal and/or confidential information to which they have access, may attempt to circumvent our security measures, may purposefully or inadvertently allow unauthorized access to our or their systems or to personal and/or confidential information or may otherwise disrupt our business operations. We and our customers could suffer harm if valuable business data or employee, customer and other proprietary information were corrupted, lost or accessed or misappropriated by third parties due to a security failure in our systems or those of our suppliers or service providers. It could require significant expenditures to remediate any such failure or breach, severely damage our reputation and our relationships with customers and suppliers, result in unwanted media attention and lost sales and expose us to risks of litigation and liability. In addition, as a result of recent security breaches and ransomware attacks at a number of prominent retailers, the media and public scrutiny of information security and privacy has become more intense and the regulatory environment has become increasingly uncertain, rigorous and complex. As with most companies, we have experienced cyber-attacks, attempts to breach our systems and other similar incidents, none of which were material in fiscal 2023. As a result, we have incurred significant costs and will continue to incur such costs to monitor and safeguard our systems. We may incur significant costs if there is an unauthorized disclosure of personal information and we may not be able to comply with new regulations. In addition, various federal, state and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection, information security and consumer protection. For example, the California Consumer Privacy Act ("CCPA"), which became effective on January 1, 2020, established a new privacy framework for covered businesses. In November 2021, California voters passed Proposition 24, also known as the California Privacy Rights Act ("CPRA"), which amends and expands the CCPA. The CCPA and CPRA provide new and enhanced data privacy rights to California residents, such as giving California consumers and employees the right to access and/or delete their personal information, affording consumers and employees the right to opt out of certain sales of personal information, as well as sharing for cross context behavioral advertising, and prohibiting covered businesses from discriminating against consumers (e.g., charging more for services) for exercising any of their CCPA/CPRA rights. The CPRA went into effect January 1, 2023 and added definitions for "sensitive information" as well as "contractors," and bolstered the requirements for agreements that cover the exchange of data. CPRA also established a California Privacy Protection Agency, which is responsible for enforcement activities, rulemaking, and public awareness related to privacy and data protection. Any failure to comply with the laws and regulations surrounding the protection of personal information, privacy and data security could subject us to legal and reputational risks and costs, including significant fines for non-compliance, any of which could have a negative impact on revenues and profits. Because we and the IOs accept payments using a variety of methods, including cash and checks, credit and debit cards, Electronic Benefit Transfer ("EBT") cards and gift cards, we may be subject to additional rules, regulations, compliance requirements and higher fraud losses. For certain payment methods, we or the IOs pay interchange and other related card acceptance fees, along with additional transaction processing fees. We and the IOs rely on third parties to provide payment transaction processing services, including the processing of credit cards, debit cards, EBT cards and gift cards, and it could disrupt our business if these companies become unwilling or unable to provide these services to us, experience a data security incident or fail to comply with applicable laws, rules and industry standards. We are also subject to payment card association operating rules, including data security rules, certification requirements and rules governing electronic funds transfers, which could change over time. For example, we and the IOs are subject to Payment Card Industry Data Security Standards, which contain compliance guidelines and standards with regard to our security surrounding the physical and electronic storage, processing and transmission of individual cardholder data. In addition, if our internal systems are breached or compromised, we and the IOs may be liable for card re-issuance costs, subject to fines and higher transaction fees and lose our ability to accept credit and/or debit card payments from our customers, and our business and operating results could be materially adversely affected.