SpringBig Holdings (SBIG) Risk Factors

We are subject to regulation by various federal, state, provincial, local and foreign governmental authorities, including those responsible for monitoring and enforcing employment and labor laws, anti-bribery laws, lobbying and election laws, securities laws and tax laws. These laws and regulations are subject to change over time and thus we must continue to monitor and dedicate resources to ensure continued compliance. In addition, our business is subject to regulation by various federal, state, provincial and foreign governmental agencies responsible for monitoring and enforcing privacy and data protection laws and regulations. Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring disclosure of breaches); federal and state consumer protection and employment laws; the Health Insurance Portability and Accountability Act of 1996, or HIPAA; and European and other foreign data protection laws. We receive, store, process, and use personal information and other user content. The regulatory framework for privacy issues worldwide, including in the United States, is rapidly evolving and is likely to remain uncertain for the foreseeable future, as many new laws and regulations regarding the collection, use and disclosure of personally identifiable information, or PII, and other data have been adopted or are under consideration and existing laws and regulations may be subject to new and changing interpretations. In the United States, the Federal Trade Commission and many state attorneys general are applying federal and state consumer protection laws to impose standards for the online collection, use and dissemination of data. The California Consumer Privacy Act of 2018, or CCPA imposes significant additional requirements with respect to the collection of personal information from California residents. The CCPA, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. It remains unclear what, if any, modifications will be made to this legislation or how it will be interpreted. Additionally, a new privacy law, the California Privacy Rights Act, or CPRA, significantly modified the CCPA, which has resulted in further uncertainty and requiring us to incur additional costs and expenses. The CPRA created a new California state agency charged with enforcing state privacy laws, and there is uncertainty about potential enforcement actions that the new agency may take in the future. The effects of the CCPA and the CPRA remain far-reaching, and depending on final regulatory guidance and related developments, may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We are also currently subject to a variety of, and may in the future become subject to additional U.S. federal, state and local laws and regulations on advertising that are continuously evolving and developing, including the Telephone Consumer Protection Act, or the TCPA, the Telemarketing Sales Rule, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, or the CAN-SPAM Act, and, at the state level, the CCPA (as described above), the Virginia Consumer Data Protection Act of 2021, or VCDPA, and the Colorado Privacy Act, or CPA. Many states are discussing potentially adopting similar comprehensive privacy legislation and we expect many of these will be implemented over the course of the next few years. These laws and regulations directly impact our business and require ongoing compliance, monitoring and internal and external audits as they continue to evolve, and may result in ever-increasing public and regulatory scrutiny and escalating levels of enforcement and sanctions. Subsequent changes to data protection and privacy laws and regulations could also impact how we process personal information and, therefore, limit the effectiveness of our product offerings or our ability to operate or expand our business, including limiting strategic relationships that may involve the sharing of personal information. Many foreign countries and governmental bodies, including Canada and other relevant jurisdictions where we conduct or may, in the future, conduct business, have laws and regulations concerning the collection and use of PII and other data obtained from their residents or by businesses operating within their jurisdiction. These laws and regulations often are more restrictive than those in the United States Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of data that identifies or may be used to identify or locate an individual, such as names, email addresses and, in some jurisdictions, internet protocol addresses and other types of data. In Canada, the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, governs the collection, use and disclosure of PII in many provinces in Canada, and though it is silent with respect to territorial reach, the Federal Court of Canada has found that PIPEDA will apply to businesses established in other jurisdictions if there is a "real and substantial connection" between the organization's activities and Canada. Provincial privacy commissioners take a similar approach to the interpretation and application of provincial private-sector privacy laws equivalent to PIPEDA. Further, Canada has robust anti-spam legislation. Organizations sending commercial electronic messages to individuals must either have express consent from the individual in the prescribed form or the situation must qualify as an instance of implied consent or other authorization set out in Canada's Anti-Spam Legislation, or CASL. The penalties for non-compliance under CASL are significant and the regulator, the Canadian Radio- Television and Telecommunications Commission, is active with respect to enforcement. Although we are working to comply with those federal, state, provincial and foreign laws and regulations, industry standards, governmental standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our applications or platform. Any failure or perceived failure by us or our contractors to comply with federal, state, provincial or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, or any actual or suspected security incident, whether or not resulting in loss of, unauthorized access to, or acquisition, alteration, destruction, release or transfer of PII or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity and could cause employees, clients and consumers to lose trust in us, which could have an adverse effect on our reputation and business. Any inability or perceived inability (even if unfounded) on our part to adequately address privacy, data protection, and information security concerns, or comply with applicable laws, regulations, policies, industry standards, governmental standards, contractual obligations, or other legal obligations, could result in additional cost and liability to us, damage our reputation, inhibit sales, restrict our ability to utilize collected personal information, and adversely affect our business. We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, Canada and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Future laws, regulations, standards and other obligations, or amendments or changes in the interpretation of existing laws, regulations, standards and other obligations, could impair our or our clients' ability to collect, use, disclose or otherwise process information relating to employees or consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our client and consumer bases and increase revenue. Such laws and regulations may require us to implement privacy and security policies, permit users to access, correct and delete personal information stored or maintained by such companies, inform individuals of security breaches that affect their personal information, and, in some cases, obtain individuals' consent to use PII or other data for certain purposes. In addition, a foreign government could require that any data collected in a country not be transferred or disseminated outside of that country, or impose restrictions or conditions upon such dissemination, and we may face difficulty in complying with any such requirements for certain geographic regions. Indeed, many privacy laws, such as those in force in Canada, already impose these requirements. If we fail to comply with federal, state, provincial and foreign data privacy laws and regulations, our ability to successfully operate our business and pursue our business goals could be harmed. Furthermore, due to our acceptance of credit cards, we are subject to the Payment Card Industry Data Security Standard (also known as the "PCI-DSS"), which is designed to protect the information of credit card users. In the event our determinations are challenged and found to have been incorrect, we may be subject to unfavorable publicity or claims by one or more state attorneys general, federal regulators, or private plaintiffs, any of which could damage our reputation, inhibit sales and adversely affect our business.

We may become subject to DdoS attacks, a technique used by hackers to take an internet service offline by overloading its servers. In addition, ransomware attacks against businesses of all sizes are becoming increasingly common. Further, we may face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Our platform may be subject to DdoS, ransomware or other cybersecurity attacks in the future and we cannot guarantee that applicable recovery systems, security protocols, network protection mechanisms and other procedures are or will be adequate to prevent network and service interruption, system failure or data loss. Moreover, our platform could be breached if vulnerabilities in our platform are exploited by unauthorized third parties or others. Techniques used to obtain unauthorized access change frequently, and the size of DdoS attacks and the number and types of ransomware attacks are increasing. As a result, we may be unable to implement adequate preventative measures or stop such attacks while they are occurring. A DdoS attack, ransomware attack or security breach could delay or interrupt service to our clients and consumers and may deter the utilization of our platform. We also use information technology and security systems to maintain the physical security of our facilities and to protect our proprietary and confidential information, including that of our clients, consumers, and employees. Accidental or willful security breaches or other unauthorized access to our facilities or information systems, or viruses, loggers, malware, ransomware, or other malfeasant code in our data or software, could compromise this information or render our systems and data unusable. Additionally, we rely on third-party "cloud-based" providers and we are therefore dependent on the security systems of these providers. Any security breaches or other unauthorized access to our service providers' facilities or systems, or viruses, loggers, malware, ransomware or other malfeasant code in their data or software, could expose us to information loss, and misappropriation of confidential information, and other security breaches. In addition, our employees, contractors, or other third parties with whom we do business may attempt to circumvent security measures in order to misappropriate personal information, confidential information or other data, or may inadvertently release or compromise such data. Because the techniques used to obtain unauthorized access to or sabotage security systems, or to obtain unauthorized access to data we or our contractors maintain, change frequently and are often not recognized until after an attack, we and our service providers may be unable to anticipate the techniques or implement adequate preventative measures. Any actual or perceived DdoS attack, ransomware attack, security breach or other unauthorized access could damage our reputation and brand, result in decreased utilization of our platform, expose us to fines and penalties, government investigations, and a risk of litigation and possible liability, require us to expend significant capital and other resources to alleviate any resulting problems and otherwise to remediate the incident, and require us to expend increased cybersecurity protection costs. We expect to incur significant costs in an effort to detect and prevent security breaches and other security-related incidents. Numerous state, federal and foreign laws and regulations require companies to notify individuals and/or regulatory authorities of data security breaches involving certain types of personal data. Any disclosures of security breaches, pursuant to these laws or regulations or otherwise, could lead to regulatory investigations and enforcement and negative publicity, and may cause our clients and consumers to lose confidence in the effectiveness of our data security measures. Additionally, our discovery of any security breach or other security-related incident, or our provision of any related notice, may be delayed or be perceived to have been delayed. Any of these impacts or circumstances arising from an actual or perceived attack, breach or other unauthorized access could materially and adversely affect our business, financial condition, reputation and relationships with clients and consumers. Furthermore, while our errors and omissions insurance policies include liability coverage for certain of these matters, if we experienced a significant security incident, we could be subject to claims or damages that exceed our insurance coverage. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material and adverse effect on our business, including our financial condition, operating results, and reputation.

The cannabis marketing and software services market is rapidly evolving and is currently characterized by intense competition, due in part to relatively low barriers to entry. We expect competition to further intensify in the future as cannabis continues to be legalized and regulated, new technologies are developed and new participants enter the cannabis CRM and marketing solutions market. Competitors for individual components of our service platforms include businesses both within and outside of the cannabis industry. These include businesses focused on marketing and customer engagement, commerce and POS solutions, and SaaS or other technology solutions for brands and retailers. In addition, if legal market for cannabis becomes more accepted and/or the regulatory regime for cannabis evolves, it may eliminate existing barriers preventing our clients from using traditional marketing and advertising channels. This could result in increased competition in our industry from both products and solutions offered by internet search engines and advertising networks, like Google, social media platforms, like Instagram and Facebook, various other newspaper, television, media companies, outdoor billboard advertising, and online merchant platforms, as well as new participants entering into the cannabis CRM and marketing services market. Such potential competitors may have substantially greater financial, technical, and other resources than existing market participants. Additionally, as consumers and cannabis industry clients demand richer data, integrations with other cannabis industry participants such as point-of-sale providers may become increasingly important. If we are unable to complete such new integrations as quickly as our competitors, or improve our existing integrations based on legacy systems, we may lose market share to such competitors. Our current and future competitors may also enjoy other competitive advantages, such as greater name recognition, more varied or more focused offerings, better market acceptance, and larger marketing budgets. Additionally, as the legalization of cannabis continues, cannabis cultivators, product manufacturers and distributors could experience consolidation as existing cannabis businesses seek to obtain greater market share and purchasing power and new entrants seek to establish a significant market presence. Consolidation of the cannabis markets could reduce the size of our potential client base and give remaining clients greater bargaining or purchasing power. This may in turn erode the prices for access to our services and platform and result in decreased margins. Further, heightened competition between cannabis businesses could ultimately have a negative impact on the viability of individual market participants, which could reduce or eliminate their ability to purchase our services and solutions. If we are unable to compete effectively for any of these reasons, we may be unable to maintain our operations or develop our products and solutions, and as a result our business and operating results may be adversely affected.

We believe that our business is highly dependent on the SpringBig brand identity and our reputation, which is critical to our ability to attract and retain clients and consumers. We also believe that the importance of our brand recognition and reputation will continue to increase as competition in the markets in which we operate continues to develop. Our success in this area will depend on a wide range of factors, some of which are within our control and some of which are not. The factors affecting our brand recognition and reputation that are within our control include the following: - the efficacy of our marketing efforts;- our ability to maintain a high-quality, innovative, and error- and bug-free platform and similarly high quality client service;- our ability to maintain high satisfaction among clients (and our clients' consumers);- the quality and perceived value of our platforms and services;- successfully implementing and developing new features and revenue streams;- our ability to obtain, maintain and enforce trademarks and other indicia of origin that are valuable to our brand;- our ability to successfully differentiate our platforms and services from competitors' offerings;- our ability to continue to integrate with POS systems;- our ability to provide our clients with accurate and actionable insights from the consumer data and feedback collected through our platform;- our compliance with laws and regulations;- our ability to address any environmental, social, and governance expectations of our various stakeholders;- our ability to provide client support; and - any actual or perceived data breach or data loss, or misuse or perceived misuse of our platforms. In addition, our brand recognition and reputation may be affected by factors that are outside our control, such as: - actions of competitors or other third parties;- consumers' experiences with retailers or brands using our platform;- public perception of cannabis and cannabis-related businesses;- positive or negative publicity, including with respect to events or activities attributed to us, our employees, partners or others associated with any of these parties;- interruptions, delays or attacks on our platforms; and - litigation or regulatory developments. Damage to our reputation and loss of brand equity from one or more of the factors listed above may reduce demand for our platform and have an adverse effect on our business, operating results and financial condition. Moreover, any attempts to rebuild our reputation and restore the value of our brand may be costly and time-consuming, and such efforts may not ultimately be successful.

Our future success depends on our ability to recruit, train, retain and motivate key personnel, including our CEO, Jeffrey Harris, our CFO, Paul Sykes, and certain other key members of management. Competition for qualified personnel in the technology industry is intense. Additionally, we face challenges in attracting, retaining and motivating highly qualified personnel due to our relationship to the cannabis industry, which is rapidly evolving and has varying levels of social acceptance. Any failure to attract, train, retain and motivate qualified personnel could materially harm our operating results and growth prospects.

We cannot guarantee that our systems, protocols, and practices will prevent all unauthorized or illegal activities by our clients. Our success depends in part on our clients' ability to operate consistently with the regulatory and licensing requirements of each state, local, and regional jurisdiction in which they operate. We have policies and procedures to review cannabis license information for operational cannabis retail clients to ensure validity and accuracy of such license information. We cannot ensure that the conduct of our clients, who are third parties, and their actions could expose them to legal sanctions and costs, which would in turn, adversely affect our business and operations.

Insurance that is otherwise readily available, such as general liability and directors' and officers' insurance, is more difficult for us to find and is more expensive or contains significant exclusions because our clients are cannabis industry participants. There are no guarantees that we will be able to find such insurance coverage in the future or that the cost will be affordable to us. If we are forced to operate our business without such insurance coverage, it may prevent us from entering into certain business sectors, may inhibit our growth, and may expose us to additional risk and financial liabilities. If we experience an uninsured loss, it may result in loss of anticipated cash flow and could materially adversely affect our results of operations, financial condition, and business.

Our performance is subject to global economic conditions and economic conditions in one or more of our key markets, which impact spending by our clients and consumers. A majority of our clients' access to capital, liquidity and other financial resources is constrained due to the regulatory restrictions applicable to cannabis businesses. As a result, these clients may be disproportionately affected by economic downturns. Clients may choose to allocate their spending to items other than our platform, especially during economic downturns. Economic conditions may also adversely impact retail sales of cannabis. Declining retail sales of cannabis could result in our clients going out of business or deciding, to stop using our platform to conserve financial resources or move to different marketing solutions. Negative economic conditions may also affect third parties with whom we have entered into relationships and upon whom we depend in order to grow our business. Furthermore, economic downturns could also lead to limitations on our ability to obtain debt or equity financing on favorable terms or at all, reduced liquidity, decreases in the market price of SpringBig's securities, decreases in the fair market value of our financial or other assets, and write-downs of and increased credit and collectability risk on our trade receivables, any of which could have a material adverse effect on our business, operating results or financial condition. Negative economic conditions may be created or exacerbated by catastrophic events or health crises, including, among others, re-occurrence of the COVID-19 pandemic or similar wide-spread public health crises.

Our operations depend, in part, on our ability to protect our operations against damage or interruption from natural disasters, power or telecommunications failures, criminal acts and similar events. Despite precautions taken at our facilities, the occurrence of a natural disaster, an act of terrorism, vandalism or sabotage, spikes in usage volume or other unanticipated problems could result in lengthy interruptions in the availability of our platform. Even with current and planned disaster recovery arrangements, our business could be harmed. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could further reduce revenue, subject us to liability and lead to decreased usage of our platform and decrease sales of our marketing services, any of which could harm our business.