Hilton Grand Vacations (HGV) Risk Analysis

The timeshare industry is highly competitive. The Hilton brands we use compete with the timeshare brands affiliated with major hotel chains in national and international venues, and we compete generally with the vacation rental options generally offered by the lodging and travel industry (e.g., hotels, resorts, home and apartment sharing services, and condominium rentals) and other options such as cruises. We also compete with other timeshare developers for sales of VOIs based principally on location, quality of accommodations, price, service levels and amenities, financing terms, quality of service, terms of property use, reservation systems, flexibility for VOI owners to exchange into time at other timeshare properties, or other travel rewards, including access to hotel loyalty programs, as well as brand name recognition and reputation. Our competitors include numerous other smaller owners and operators of timeshare resorts, as well as home and apartment sharing services that market available privately owned residential properties that can be rented on a nightly, weekly or monthly basis. In addition, we are in competition with national and independent timeshare resale companies and members reselling existing VOIs on the secondary market, which could reduce demand or prices for sales of new VOIs. We also compete with other timeshare management companies in the management of resorts on behalf of owners on the basis of quality, cost, types of services offered and relationship. We compete with other timeshare companies for off-site sales centers, through which we market our products to potential members, including in locations like high-traffic shopping centers and tourist attractions in leisure destinations. Finally, we also compete for property acquisitions (either for development or existing VOI inventory) and partnerships with entities that have similar investment objectives as we do. This competition could limit the number of, or negatively affect the cost of, suitable investment opportunities available to us. Our ability to remain competitive and to attract and retain members depends on our success in distinguishing the quality and value of our products and services from those offered by others. If we cannot compete successfully in these areas or if our marketing and sales efforts are not successful and we are unable to convert customers to a sufficient number of sales, this could negatively affect our operating profits and margins and our ability to recover the expense of our marketing programs and grow our business, diminish our market share and reduce our earnings.

Existing members have offered, and are expected to continue to offer, their VOIs for sale on the secondary market. The sale of VOIs has been made easier by recent development of virtual marketplaces assisting members with the sale of their VOIs. The prices at which these intervals are sold are typically less than the prices at which we would sell the intervals. As a result, these sales create additional pricing pressure on our sale of VOIs, which could cause our sales revenues and profits to decline. In addition, if the secondary market for VOIs becomes more organized or financing for such resales becomes more available, our ability to sell VOIs could be adversely affected and/or the resulting availability of VOIs (particularly where the VOIs are available for sale at lower prices than the prices at which we would sell them) could adversely affect our sales revenues. Further, existing members have been, and we anticipate will continue to be, increasingly targeted in deceptive sales or resale schemes, including social engineering campaigns attempting to defraud existing members (for example, offering alluring "exit program" opportunities) which also could adversely affect our ability to sell VOIs and ultimately our sales revenues. Development of a strong secondary market may also cause a decline in the volume of VOI inventory that we are able to repurchase, which could adversely affect our development margin, as we utilize this low-cost inventory source to supplement our inventory needs and help manage our cost of vacation ownership products.

We secure VOI inventory in part by developing new timeshare properties and new phases of existing timeshare properties. We have continued our construction activities as a critical source of developing new inventories that we sell and will continue to sell. Our ongoing involvement in the development of inventory presents a number of risks, including: - weakness in the capital markets limiting our ability to raise capital for completion of projects or for development of future properties or products;- construction costs and the costs of materials and supplies, to the extent they escalate faster than the pace at which we can increase the price of VOIs, adversely affecting our profits and margins;- construction delays, supply chain delays, labor shortages, zoning and other local, state or federal governmental approvals, particularly in new geographic areas with which we are unfamiliar, cost overruns, lender financial defaults, or natural or man-made disasters, such as earthquakes, tsunamis, hurricanes, floods, fires, volcanic eruptions and oil spills, increasing overall project costs, affecting timing of project completion or resulting in project cancellations;- any liability or alleged liability or resultant delays associated with latent defects in design or construction of projects we have developed or that we construct in the future adversely affecting our business, financial condition and reputation;- failure by third-party contractors to perform for any reason, exposing us to operational, reputational and financial harm; and - the existence of any title defects in properties we acquire. We also source inventory from third-party developers that are exposed to such risks, and the occurrence of any of these risks with respect to those third parties could have a material adverse effect on our access to the inventory sourced from these developers. In addition, developing new VOIs to market and sell requires us to register such VOIs in applicable states, which necessitates the incurrence of additional time and cost, and in many jurisdictions, the exact date of any such registration approvals cannot be accurately predicted. Any significant delays in timeshare project registration approvals will materially adversely impact our sales activities and thereby negatively impact our revenue. See "-Our business is regulated under a wide variety of laws, regulations and policies, and failure to comply with these regulations could adversely affect our business."

Our performance largely depends on the talents and efforts of highly skilled individuals. Our future success depends on our continuing ability to identify, hire, develop, motivate, and retain highly skilled personnel for all areas of our organization. Competition in our industry for qualified employees is intense, and certain of our competitors have directly targeted our employees. Our compensation arrangements may not always be successful in attracting new employees and retaining and motivating our existing employees, and we may need to increase compensation in order to maintain our workforce. The loss of any members of our management team could adversely affect our strategic, member and guest relationships and impede our ability to execute our business strategies. If we cannot recruit, train, develop or retain sufficient numbers of talented employees, we could experience increased employee turnover, decreased member and guest satisfaction, low morale, inefficiency or internal control failures, which could materially reduce our profits. In addition, insufficient numbers of skilled employees at our properties could constrain our ability to maintain our current levels of business or successfully expand our business. We believe that our corporate culture fosters innovation, creativity, and teamwork. As our organization continues to grow, including as a result of any recent acquisitions and any future strategic acquisitions, and we are required to implement more complex organizational management structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture and attract and retain employees. This could negatively affect our future success.

We currently have timeshare properties located internationally in Europe, Mexico, the Caribbean, Canada and Asia. We also market our products and services in the Asia Pacific region, primarily in Japan and South Korea. In addition, as part of our business strategy, we intend to continue the expansion of our operations in Japan, including by continuing to market and sell VOIs at Sesoko and Odawara resorts and continuing to opportunistically develop additional property or acquire additional inventory, as well as explore further expansion opportunities in other countries located in the Asia Pacific region, Mexico, Europe and the Caribbean. Such activities may not be limited only to marketing efforts for existing international and U.S. properties and products in other countries, but may also include acquiring, developing, managing, marketing, offering and/or financing timeshare properties and VOI related products and services in such countries. Current and future international operations expose us to a number of additional challenges and risks are inherent in operating in countries other than the United States, such as: - compliance with laws of both United States and non-U.S. jurisdictions, including foreign ownership restrictions, import and export controls, tariffs, embargoes and changes in applicable tax law, and other laws affecting our acquisition, development, management, marketing, sales, financings, and related activities;- political or civil unrest, acts of terrorism, the threat of international boycotts or anti-U.S. legislation or sentiment and the identification of the Hilton brands as U.S. brands;- the negative impact of relationships between governments in those countries and the United States, which may result in or from undesirable trade, tariff, travel or other policies and regulations (including pursuant to policies of the new U.S. administration);- local economic risks in such countries including, but not limited to foreign currency exchange risks and the imposition of restrictions on currency conversion or the transfer of funds;- employee matters, including laws and regulations related to employment;- exposure to litigation in foreign jurisdictions and uncertainties as to local laws regarding, and enforcement of, contract and intellectual property rights; and - other difficulties involved in managing an organization doing business internationally. Expansion of our international operations into other countries and territories may result in greater inefficiencies in navigating the risks of operating internationally and could result in greater effects on our business than would be experienced by a company with greater international experience. These and other factors may materially adversely affect our business generally, future expansion plans, revenues from international operations, and costs and profits, as well as our financial condition.

During the COVID-19 pandemic, governments and other authorities in the United States and around the world took and implemented unprecedented measures, and businesses, organizations and individuals, including HGV, implemented a variety of measures in response that were required or were believed to be advisable, including, without limitation, temporarily closing businesses. The pandemic, as well as such measures, had a significant adverse impact on domestic and international travel, consumer demand for travel, commercial activities across the travel, lodging and hospitality industries, businesses generally, and consequently, on our business and operations. Any future variant of COVID-19 and/or new pandemic or epidemic that leads to similar measures, restrictions or responses could again materially and adversely impact our business, financial condition and operating results.

Under the terms of our license agreement with Hilton, we are required to obtain Hilton's consent to use its trademarks in circumstances specified in the license agreement. Hilton may reject a proposed project in certain circumstances. Any requirements to obtain Hilton's consent to our expansion plans, including the ongoing rebranding of the acquired Diamond resorts and planned rebranding of the acquired Bluegreen resorts to Hilton branded properties, or the need to identify and secure alternative expansion opportunities because Hilton does not allow us to use its trademarks with proposed new projects, may delay implementation of our expansion plans, cause us to incur additional expense or reduce the financial viability of our projects. Further, if Hilton does not permit us to use its trademarks in connection with our expansion plans, our ability to expand our Hilton-branded timeshare business would cease and our ability to remain competitive may be materially adversely affected. See "Risks Related to the Integration of Diamond-Our ability to integrate the acquired Diamond business could be harmed if Hilton does not consent to the use of its trademarks in connection with the rebranding of Diamond resorts," "Risks Related to the Integration of Bluegreen-Our ability to integrate the acquired Bluegreen business could be harmed if Hilton does not consent to the use of its trademarks in connection with the rebranding of Bluegreen resorts" and "Item 1. Business-Key Agreements with Hilton Worldwide Holdings."

We rely heavily on computer, internet-based and mobile information and communications systems operated by us or our service providers to collect, process, transmit and retain large volumes of customer data, including credit card numbers and other personally identifiable information, reservation information and mailing lists, as well as personally identifiable information of our employees. There has been an increase in the number and sophistication of criminal cybersecurity attacks against companies where customer and other sensitive information has been compromised. Our information systems and records, including those we maintain with our service providers and vendors, have been, and likely will continue to be, subject to such cyber-attacks and technology disruptions, which include efforts to hack or breach security measures in order to obtain or misuse information or cause business disruption, including through, for example, phishing attempts, brute force attacks, denial of service attacks, exploiting software vulnerabilities (including "zero-day attacks"), viruses or other malicious code, "ransomware" or other malware, and supply chain attacks. In addition, social engineering attacks, including through phishing, are becoming increasingly sophisticated due to a variety of factors, including threat actors' use of artificial intelligence tools. Third parties with whom we do business and to whom we may provide customer data have been the subject of cyber-attacks. In addition, increasingly complex systems and software are subject to failure, operator error or malfeasance, or inadvertent releases of data that may materially impact our information systems and records. For instance, security breaches could result in the dissemination of member and guest credit card information, which could lead to affected members and guests experiencing fraudulent charges. To date, we have seen no material impact on our business or operations from these attacks or events. However, the ever-evolving threats mean we and our third-party service providers and vendors must continually evaluate and adapt our respective systems and processes and overall security environment, as well as those of any companies we may acquire. There is no guarantee that these measures will be adequate to safeguard against all data security breaches, system compromises or misuses of data. The integrity and protection of customer and employee data is critical to us. We could make faulty decisions if that data is inaccurate or incomplete. Customers and employees also have a high expectation that we and our service providers will adequately protect their personal information. A significant theft, loss, loss of access to, or fraudulent use of customer, employee, or company data could adversely impact our reputation, and could result in significant remedial and other expenses, fines, and/or litigation. Breaches in the security of our information systems or those of our service providers or vendors or other disruptions in data services could lead to an interruption in the operation of our systems or require us to consider changes to our customer data or payment systems, resulting in operational inefficiencies, additional expense and a loss of profits. Our collection and use of customer information are governed by extensive and evolving privacy laws and regulations that are constantly evolving and may differ significantly depending on jurisdiction. Compliance with these laws and regulations involves significant costs, which may increase in the future and which may negatively impact our ability to provide services to our customers, and a failure by us or our service providers to comply with privacy regulations may subject us to significant remedial and other expenses, fines, or litigation, as well as restrictions on our use or transfer of data. Many jurisdictions have enacted or are enacting laws requiring companies to notify regulators or individuals of data security incidents involving certain types of personal data. These mandatory disclosures regarding security incidents often lead to widespread negative publicity, and the risk of reputational harm may be magnified and/or distorted through the rapid dissemination of information over the internet, including through news articles, blogs, chat rooms, and social media sites. Any security incident, whether actual or perceived, could harm our reputation, erode customer confidence in the effectiveness of our data security measures, negatively impact our ability to attract or retain customers, or subject us to third-party lawsuits, regulatory fines or other action or liability, which could materially and adversely affect our business and operating results. Further, effective December 18, 2023, the SEC requires public companies to disclose material cybersecurity incidents that they experience on a Current Report on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance. If we fail to comply with these requirements we could incur regulatory fines in addition to other adverse consequences to our reputation, business, financial condition and results of operations. Our business could be subject to stricter obligations and greater fines and private causes of action under the enactment of data privacy laws, including but not limited to, the European Union General Data Protection Regulation and the California Consumer Privacy Act. Our systems and the systems operated by our service providers may be unable to satisfy changing regulatory requirements and customer and employee expectations and/or may require significant additional investments or time to do so. The steps we take to deter and mitigate risks related to cybersecurity may not provide the intended level of protection. In particular, it may be difficult to anticipate or immediately detect such incidents and the damage caused thereby. We may be required to expend significant additional resources in the future to modify and enhance our protective measures. Although we carry cyber/privacy liability insurance that is designed to protect us against certain losses related to cybersecurity risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in connection with cyber-attacks, security breaches, and other related breaches. In addition, the third party service providers and partners on which we rely (including those that may be in possession of our sensitive information) face cybersecurity risks, some of which may be different than the risks we face, and we do not directly control any of such service providers' information security operations, including the efforts that they may take to mitigate risks or the level of cyber/privacy liability insurance that they may carry. See Part I, Item 1C. "Cybersecurity."

Our business model and competitive conditions in the timeshare industry demand the use of sophisticated technology and systems, including those used for our marketing, sales, reservation, inventory management and property management systems, and technologies we make available to our members and more generally to support our business. In particular, an increasing number of potential customers select products based on the providers' technology and ease of interfacing with the provider. We must refine, update and/or replace these technologies and systems with more advanced systems on a regular basis. If we cannot do so as quickly as our competitors or within budgeted costs and time frames, our business could suffer. We also may not achieve the benefits that we anticipate from any new technology or system, and a failure to do so could result in higher than anticipated costs or could harm our operating results.