Macy's (M) Risk Factors

We conduct our retail merchandising business under highly competitive conditions. Although Macy's, Inc. is one of the nation's largest retailers, we have numerous and varied competitors at the national and local levels and digital competitors at the global level, including department stores, specialty stores, general merchandise stores, manufacturers' outlets and websites, off-price and discount stores, online retailers and catalogs, among others. Competition is characterized by many factors, including assortment, advertising, price, quality, service, location, reputation and credit availability. Any failure by us to compete effectively could negatively affect our business and results of operations. As consumers continue to migrate to digital shopping channels, we face pressures to not only compete from a price perspective with our competitors, some of whom sell the same products, but also to differentiate Macy's, Inc.'s merchandise offerings, services and shopping experiences to stay relevant as a modern department store in retail's ever-changing environment. Macy's launched On 34th and State of Day, new private brands, in 2023 and February 2024, respectively, and expects to refresh or replace all existing brands in its private brands portfolio through 2025. Macy's digital marketplace offers over 2,300 brands from third party sellers and the Company launched a Bloomingdale's marketplace in 2023 to introduce customers to new merchandise options. We continue to significantly invest in our omni-channel capabilities, seeking to improve the profitability of our digital business through delivery expense reduction, gross margin expansion and other initiatives to support digital sales growth. We continue to seek to improve the delivery experience of our customers with strategic investments to fulfill digital sales demand and elevated delivery speed expectations. Insufficient, untimely or misguided investments in these areas could significantly impact our profitability and growth. In addition, a significant decline of customer store traffic or migration of sales from brick-and-mortar stores to digital platforms could lead to additional store closures, restructuring and other costs that could adversely impact our results of operations and cash flows.

Our business depends on the orderly receipt and distribution of merchandise and effective management of our distribution and fulfillment centers. Unforeseen disruptions in operations due to fire, severe weather conditions (including those that may be caused by climate change), natural disasters, health pandemics or other catastrophic events, labor disagreements, or other shipping problems may result in the loss or unavailability of inventory and/or delays in the delivery of merchandise to our stores, fulfillment centers and customers.

We believe our reputation and brand image are partially based on the perception that we act equitably and honestly in dealing with our customers, employees, business partners and shareholders. Our reputation and brand image may be deteriorated by any incident that erodes the trust or confidence of our customers or the general public, particularly if the incident results in significant adverse publicity or governmental inquiry. Information about us, whether or not true, may be instantly posted on social media platforms at any time, which could adversely impact our reputation or brand image. The harm could be immediate without affording us an opportunity for redress or correction. Other brand risks include an active shooter incident at a location or injury or death at a parade or other branded event. If our reputation or brand image is damaged, our customers may refuse to continue shopping with us, potential employees may be unwilling to work for us, business partners may be discouraged from seeking future business dealings with us and, as a result, our business and results of operations may suffer.

We believe that our copyrights, trademarks, trade dress, trade secrets and similar intellectual property are important assets and key elements of our strategy, including those related to our private brand merchandise. We rely on copyright and trademark law, trade secret protection and confidentiality agreements with our employees, consultants, vendors and others to protect our proprietary rights. If the steps we take to protect our proprietary rights are inadequate, or if we are unable to protect or preserve the value of our copyrights, trademarks, trade secrets and other proprietary rights for any reason, our merchandise brands and business could be negatively affected.

Through our sales, marketing activities, and use of third-party information, we collect and store certain non-public personal information that customers provide to purchase products or services, enroll in promotional programs, register on websites, or otherwise communicate to us. This may include phone numbers, driver license numbers, contact preferences, personal information stored on electronic devices, and payment information, including credit and debit card data. We gather and retain information about employees in the normal course of business. We may share sensitive Company data with vendors that assist with certain aspects of our business, such as social media and data analytics firms. In addition, our digital operations depend upon the transmission of confidential information over the internet, such as information permitting cashless payments. We employ safeguards for the protection of this information and have made significant investments to secure access to our information technology network, the importance of which has increased due to many of our colleagues working remotely. For instance, we have implemented authentication protocols, installed firewalls and anti-virus/anti-malware software, established data security breach preparedness and response plans, conduct continuous risk assessments, and mitigate software vulnerability with security patches. We also employ encryption and other methods to protect our data, promote security awareness with our employees and work with business partners in an effort to create secure and compliant systems. Protections we have in place to safeguard this information may be compromised as a result of third-party security breaches, theft, cyberattacks, including the use of malicious codes, worms, phishing, spyware, denial of service attacks and ransomware errors by employees or employees of third-party vendors, or contractors, misappropriation of data by employees, vendors or unaffiliated third-parties, or other irregularities that may result in persons obtaining unauthorized access to Company data. Retail data frequently targeted by cybercriminals includes consumer credit card data, personally identifiable information, including social security numbers, and health care information. For retailers, point of sale and e-commerce websites are often attacked through compromised credentials, including those obtained through phishing, vishing and credential stuffing. Other methods of attack include advanced malware, the exploitation of software and operating vulnerabilities, and physical device tampering/skimming at card reader units. We believe these attack methods will continue to evolve. In addition, the risk of cyber-based attacks is heightened with many of our employees working and accessing our technology infrastructure remotely. Cyber threats are increasing in scope, sophistication and frequency and bad actors are exploiting vulnerabilities to gain access to networks for the purpose of implementing ransomware, which is used to encrypt and steal data both from main and backup systems and causes public-facing business interruptions. Our ability to react, mitigate and restore services from an interruption of our systems and processes is key to avoiding adverse financial impacts resulting from loss of sales, services and the cost of paying a ransom. Remote work has also created additional challenges to our ability to protect remote workers, corporate networks and cloud environments. We are identifying, tracking and mitigating advanced phishing, malware and attempted credential compromises daily. These attacks are typically occurring on home networks and migrate to the corporate network. However, despite instituting controls for the protection of information, the techniques used to obtain unauthorized access, disable or degrade service change frequently and our systems and networks may nevertheless remain vulnerable to threats and attacks. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. Unauthorized parties may attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other forms of deception to employees, contractors, vendors and temporary staff. During the normal course of business, we have experienced and expect to continue to experience attempts to compromise our information systems. We may be unable to protect the integrity of our systems or company data. An alleged or actual unauthorized access or unauthorized disclosure of non-public personal information could: - materially damage our reputation and brand, negatively affect customer satisfaction and loyalty, expose us to individual claims or consumer class actions, administrative, civil or criminal investigations or actions, and infringe on proprietary information; and - cause us to incur substantial costs, including costs associated with remediation of information technology systems, customer protection costs and incentive payments for the maintenance of business relationships, litigation costs, lost revenues resulting from negative changes in consumer shopping patterns, unauthorized use of proprietary information or the failure to retain or attract customers following an attack. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be unavailable or insufficient to cover all losses or all types of claims that may arise in the continually evolving area of cyber risk.

As of February 3, 2024, the aggregate principal amount of our total outstanding indebtedness was $2,998 million. Our level of indebtedness could have important consequences for the holders of our debt and equity securities. For example, it could: - make it more difficult for us to satisfy our debt obligations;- increase our vulnerability to general adverse economic and external conditions;- impair our ability to obtain additional debt or equity financing in the future for working capital, capital expenditures, acquisitions or general corporate or other purposes;- require us to dedicate a material portion of our cash flows from operations to the payment of principal and interest on our indebtedness, thereby reducing the availability of our cash flows to fund working capital needs, capital expenditures, acquisitions and other general corporate purposes;- expose us to the risk of increased interest rates to the extent we make borrowings under our asset-based credit facility, which bears interest at a variable rate;- limit our flexibility in planning for, or reacting to, changes in our business and the industry in which we operate;- place us at a disadvantage compared to our competitors that have less indebtedness; and - limit our ability to adjust to changing market conditions. Any of these risks could materially impact our ability to fund our operations or limit our ability to expand our business, which could have a material adverse effect on our business, financial condition and results of operations.

Our sales are significantly affected by changes in discretionary spending by consumers. Consumer spending may be affected by many factors outside of our control, including general economic conditions, consumer disposable income levels, consumer confidence levels, the availability, cost and level of consumer debt, consumer behaviors towards incurring and paying debt, the cost of basic necessities and other goods, the strength of the U.S. Dollar relative to foreign currencies and the effects of the weather, natural disasters or health pandemics. These factors can have psychological or economic impacts on consumers that affect their discretionary spending habits. Any decline in discretionary spending by consumers could negatively affect our business and results of operations. Unfavorable global, domestic or regional economic or political conditions and other developments and risks could negatively affect our business and results of operations. For example, unfavorable changes related to interest rates, rates of economic growth, fiscal and monetary policies of governments, inflation, deflation, tax rates and policy, unemployment trends, energy prices, and other matters that influence the availability and cost of merchandise, consumer confidence, spending and tourism could negatively affect our business and results of operations. Unstable political conditions, civil unrest, terrorist activities, armed conflicts or events of extreme violence, including any escalation of the conflict between Russia and Ukraine and the Israel-Hamas war, may disrupt commerce and could negatively affect our business and results of operations. We regularly maintain cash balances at third-party financial institutions in excess of the Federal Deposit Insurance Corporation (the "FDIC") insurance limit. The FDIC took control and was appointed receiver of Silicon Valley Bank and New York Signature Bank on March 10, 2023 and March 12, 2023, respectively, and JPMorgan Chase Bank assumed all deposits and substantially all assets of First Republic Bank on May 1, 2023. The Company did not have any direct exposure to Silicon Valley Bank, New York Signature Bank or First Republic Bank. However, if other banks and financial institutions enter receivership or become insolvent in the future in response to financial conditions affecting the banking system and financial markets, our ability to access our existing cash, cash equivalents and investments, or to draw on our existing lines of credit, may be threatened and could have a material adverse effect on our business and financial condition.

Extreme weather conditions, including those that may be caused by climate change, in the areas in which our stores are located could negatively affect our business and results of operations. For example, frequent or unusually heavy snowfall, ice storms, rainstorms or other extreme weather conditions over a prolonged period could make it difficult for our customers to travel to our stores and thereby reduce our sales and profitability. Our business is also susceptible to unseasonable weather conditions. For example, extended periods of unseasonably warm temperatures during the winter season or cool weather during the summer season could reduce demand for a portion of our inventory and thereby reduce our sales and profitability. In addition, extreme weather conditions could result in disruption or delay of production and delivery of materials and products in our supply chain and cause staffing shortages in our stores. Natural disasters such as hurricanes, tornadoes and earthquakes, or a combination of these or other factors, could damage or destroy our facilities or make it difficult for customers to travel to our stores, thereby negatively affecting our business and results of operations. The COVID-19 pandemic had a significant impact on the retail industry, including our business. Should we experience a regional or global pandemic or other public health crisis, including from a COVID-19 variant, influenza, Respiratory Syncytial Virus, other microorganism, infectious disease or other cause, it could have a significant negative impact on the Company's business, financial condition, results of operations and cash flows.

Changes in the credit and capital markets, including market disruptions, limited liquidity and interest rate fluctuations, may increase the cost of financing or restrict our access to this potential source of future liquidity. A downgrade in the ratings that rating agencies assign to the Company's short- and long-term debt has and may continue to negatively impact our access to the debt capital markets and increase our cost of borrowing. In addition, our asset-based credit facility requires us to maintain a specified fixed charge coverage ratio. Our ability to comply with the ratio may be affected by events beyond our control, including prevailing economic, financial and industry conditions. If our results of operations deteriorate to a point where we are not in compliance with our debt covenants, and we are unable to obtain a waiver, much of our debt would be in default and could become due and payable immediately. Our assets may not be sufficient to repay in full this indebtedness, resulting in a need for an alternate source of funding. We cannot make any assurances that we would be able to obtain such an alternate source of funding on satisfactory terms, if at all, and our inability to do so could cause the holders of our securities to experience a partial or total loss of their investments in the Company.

We are subject to various federal, state and local laws, rules, regulations, inquiries and initiatives in connection with both our core business operations and our credit card and other ancillary operations (including the Credit Card Act of 2009 and the Home Owners' Loan Act of 1933). Recent and future developments relating to such matters could increase our compliance costs and adversely affect the profitability of our credit card and other operations. Our effective tax rate is impacted by a number of factors, including changes in federal or state tax law, interpretation of existing laws and the ability to defend and support the tax positions taken on historical tax returns. Certain changes in any of these factors could materially impact the Company's effective tax rate and net income. The Inflation Reduction Act was enacted on August 16, 2022 and includes a number of provisions that may impact the Company, including a corporate alternative minimum tax on certain large corporations, incentives to address climate change mitigation and other non-income tax provisions, including an excise tax on the repurchase of our stock. We are assessing these impacts on our consolidated financial statements. We are also subject to anti-bribery, customs, child labor, truth-in-advertising and other laws, including consumer protection regulations and zoning and occupancy ordinances that regulate retailers generally and/or govern the importation, promotion and sale of merchandise and the operation of retail stores and warehouse facilities. Although we undertake to monitor changes in these laws, if these laws change without our knowledge, or are violated by importers, designers, manufacturers, distributors or agents, we could experience delays in shipments and receipt of goods or be subject to fines or other penalties under the controlling regulations, any of which could negatively affect our business and results of operations. In addition, we are regularly involved in various litigation matters that arise in the ordinary course of our business. Adverse outcomes in current or future litigation could negatively affect our financial condition, results of operations and cash flows. Changes in applicable environmental regulations, including increased or additional regulations to limit carbon emissions or other greenhouse gases may result in increased compliance costs, capital expenditures and other financial obligations which could affect our profitability. In addition, our business is subject to complex and rapidly evolving laws addressing data privacy and data protection and companies are under increased regulatory scrutiny with respect to these matters. The Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data. The interpretation and application of existing laws regarding data privacy and data protection are in flux and many states are considering new regulations in this area. Data privacy laws enacted in California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, New Jersey, Delaware and New Hampshire (as of February 1, 2024) and other applicable U.S. privacy laws or new state or federal laws may limit our ability to collect and use data, require us to modify our data processing practices or result in the possibility of fines, litigation or orders which may have an adverse effect on our business and results of operations. The burdens imposed by these and other laws and regulations that may be enacted, or new interpretations of existing laws and regulations, may also require us to incur substantial costs to reach compliance or change the manner in which we use data.

We have identified certain climate change-related risks that may impact our business over the short-, medium- and long-term. The nature of these risks depends on both the physical aspects of climate change as well as legal, regulatory, and market requirements, pressure to reduce our carbon footprint and our ability to understand and respond to rapidly evolving developments. Climate change and related measures could have adverse impacts on the Company's business, financial condition and results of operations, including, but not limited to: - Regulatory Risks. Unfavorable global, domestic or regional economic or political conditions and other developments and risks could negatively affect our business and results of operations. For example, energy or carbon policies (both existing and emerging) that apply to our energy suppliers have the ability to impact indirect costs to our operations through shifts in energy prices. Recent and future developments in regional cap-and-trade programs such as the Regional Greenhouse Gas Initiative (RGGI), which sets a declining limit on emissions from regulated power plants within the RGGI states, could increase our energy costs and affect the profitability of operations. The RGGI program spans 11 states and includes Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Rhode Island, Vermont, and Virginia. In 2020, Macy's, Inc. reported energy data for 217 locations across these states and could experience increases in the cost of energy in these regions as a result of the RGGI program. From 2021 to 2022, Macy's, Inc. experienced a 22% electricity cost increase across its sites located in RGGI states. Current environmental and climate-related regulation, both at the state and federal levels, are monitored as part of our enterprise risk management process. New and emerging regulatory initiatives in the U.S. related to climate change and ESG could adversely affect our business. On March 6, 2024, the SEC adopted a final rule that will require registrants to disclose certain climate-related information in annual reports. The final rule will be effective for certain parts of our annual reports for fiscal 2025 and 2026 and could lead to increased costs and complexities associated with our SEC reporting. - Reputational Risk. Maintaining our Company's reputation and brand image at a high level is critical to our operations and financial results. Reputational risk in relation to climate-related issues encompasses both supply chain issues and our position and progress toward cleaner energy production and consumption. We rely upon a diverse, global network of suppliers and vendors within our supply chain that may expose us to risks from a reputational and brand perspective. We utilize the Sustainable Apparel Coalition's Higg Index, a suite of tools for the standardized measurement of value chain sustainability. Data is collected from multiple tiers in our Macy's private brand apparel and home textile supply chains as part of our continued efforts to identify brand risk and advocate for sustainability improvements, including energy/greenhouse gas efficiency. Macy's private brands supply chain is and will continue to be impacted by climate change related weather events that may cause supply disruptions. We also use the Higg Index to collect data about the likely resiliency of our supply chains and as an engagement tool to strengthen relationships and make continuous improvement. We face increasing pressure to demonstrate our products are environmentally-friendly. Our efforts to mitigate that risk include using materials or processes that are third-party certified for environmentally-friendly attributes like OEKO-TEX as well as trademarked fibers like TENCEL™ and REPREVE. Macy's and Bloomingdale's have curated sitelets online to help strengthen Macy's, Inc.'s position of being identified as a responsible retailer, committed to climate-related and broader environmental topics. These mitigation efforts may not be successful. - Technology Risk. We monitor developments in technology associated with climate change to determine the potential risks involved with maintaining a business-as-usual scenario or to evaluate opportunities for technological advancements or innovation. While the adoption of new technology to combat climate change has the potential to be a business opportunity, the resources associated with implementing this technology introduce financial risk to our organization. For example, upfront costs associated with efficiency projects such as LED lighting retrofits could negatively affect our business results if projected returns on investments are not met. Before adopting new technology, we evaluate the immediate costs and balance them with how long it will take to recoup the investment as well as how likely it is for that return to be realized. - Risk Related to Resource Use. There is increasing scrutiny on the use of resources, particularly energy sources and energy use. Pressure from regulators, consumers and other stakeholders to find alternatives and/or energy-efficient solutions to sharply reduce our use of natural resources is escalating. We continue to look for ways to address these issues and continue to explore developing best practices within the industry. Through memberships in industry groups such as the Sustainable Apparel Coalition, we are working to reduce the environmental and social impact of apparel and footwear products around the world. The use of recycled material textiles emits fewer greenhouse gas emissions and conserves water and energy as compared to making virgin fiber. Additionally, we have rolled out a framework to measure the social and environmental performance of more than 500 facilities, benchmarking by facility type to allow comparison of performance against that of peers. Macy's, Inc.'s greatest opportunity for energy reduction continues to be through our lighting. Since 2010, across Macy's and Bloomingdale's store locations, total energy consumption has been reduced by more than 19.7% through LED lighting retrofits. - Extreme Weather Events and Natural Disasters. The risk of extreme weather events is integrated into our climate change–related enterprise risk management assessment. Our business could be affected by extreme weather conditions, regional or global health pandemics or natural disasters. Extreme weather conditions, such as frequent or unusually heavy snowfall, ice storms, rainstorms or natural disasters such as wildfire over a prolonged period could make it difficult for our customers to travel to our stores and thereby reduce our sales and profitability. Natural disasters such as hurricanes, tornadoes and earthquakes could damage or destroy our facilities, thereby negatively affecting our business and results of operations. Our business is also susceptible to unseasonable weather conditions, which could reduce demand for a portion of our inventory and reduce sales and profitability. In addition, extreme weather conditions could result in disruption or delay of production and delivery of materials and products in our supply chain or impact staffing in our stores.