Sands China (SCHYY) Risk Factors

Our revenues in Macao are denominated in patacas, the legal currency of Macao, and HK dollars. The Macao pataca is pegged to the HK dollar (which is pegged to the US$) and, in many cases, is used interchangeably with the HK dollar in Macao. Although currently permitted, we cannot assure you patacas will continue to be freely exchangeable into U.S. dollars. Also, our ability to convert large amounts of patacas into U.S. dollars over a relatively short period may be limited. We are currently prohibited from accepting wagers in Renminbi, the legal currency of China. There are also restrictions on the remittance of the Renminbi from mainland China and the amount of Renminbi that can be converted into foreign currencies, including the pataca and HK dollar. Restrictions on the remittance of the Renminbi from mainland China may impede the flow of gaming customers from mainland China to Macao, inhibit the growth of gaming in Macao and negatively impact our gaming operations. There is no assurance incremental mainland Chinese regulations will not be promulgated in the future that have the effect of restricting or eliminating the remittance of Renminbi from mainland China. Further, if any new mainland Chinese regulations are promulgated in the future that have the effect of permitting or restricting (as the case may be) the remittance of Renminbi from mainland China, then such remittances will need to be made subject to the specific requirements or restrictions set out in such rules.

We face global cybersecurity and information security threats, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. Cyber-attacks and information security breaches may include, but are not limited to, attempts to access information, including legally protected information about people including customers and company information, computer malware such as viruses, denial of service, ransomware attacks that encrypt, exfiltrate, or otherwise render data unusable or unavailable in an effort to extort money or other consideration as a condition to purportedly returning the data to a usable form, operator errors or misuse, or inadvertent releases of data or documents, and other forms of electronic and non-electronic information security breaches. Our business requires the collection and retention of large volumes of data and non-electronic information, including credit card numbers and other legally protected information about people in various information systems we maintain and in those maintained by third parties with whom we contract and may share data. We also maintain important internal company information such as legally protected information about our employees and information relating to our operations. The integrity and protection of that legally protected information about people and company information are important to us. Our collection of such legally protected information about people and company information is subject to extensive regulation by private groups such as the payment card industry as well as domestic and foreign governmental authorities, including gaming authorities. If a cybersecurity or privacy event occurs, we may be unable to satisfy applicable laws and regulations or the expectation of regulators, employees, customers or other impacted individuals. Privacy and cybersecurity laws and regulations are developing and changing frequently, and vary significantly by jurisdiction. Many applicable laws and regulations protecting privacy and addressing cybersecurity have not yet been interpreted by regulators or courts, which causes uncertainty. We may incur significant costs in our efforts to comply with the various applicable privacy and cybersecurity laws and regulations as they emerge and change. Also, privacy and cybersecurity laws and regulations may limit our ability to protect individuals, including customers and employees. For example, these laws and regulations may restrict information sharing in ways that make it more difficult to obtain or share information concerning at-risk individuals. Compliance with applicable privacy laws and regulations also may adversely impact our ability to market our products, properties, and services to our guests and patrons. In addition, non-compliance by us, or potentially by third parties with which we share information, with any applicable privacy and cybersecurity law or regulation, including accidental loss, inadvertent disclosure, unauthorized access or dissemination, or breach of security may result in damage to our reputation and could subject us to fines, penalties, required corrective actions, lawsuits, payment of damages, or restrictions on our use or transfer of data. We are subject to different regulators' and others' interpretations of our compliance with these new and changing laws and regulations. In addition, LVS, our parent, has experienced a sophisticated criminal cybersecurity attack in the past, including a breach of its information technology systems in which customer and company information was compromised and certain company data may have been destroyed, and LVS or we may experience additional cybersecurity attacks in the future, potentially with more frequency or sophistication. We rely on proprietary and commercially available systems, software, tools, and monitoring to provide security for processing, transmission, and storage of customer and employee information, such as payment card and other confidential or proprietary information. We also rely extensively on computer systems to process transactions, maintain information, and manage our businesses. Disruptions in the availability of our computer systems, through cyber-attacks or otherwise, could impact our ability to service our customers and adversely affect our revenues and results of operations. For instance, there has been an increase in criminal cybersecurity attacks against companies where customer and company information has been compromised and company data has been destroyed. Our information systems and records, including those we maintain with third-party service providers, as well as the systems of other third parties that share data with us under contractual agreements, may be subject to cyber-attacks and information security breaches. Our third-party information system service providers and other third parties that share data with us pursuant to contractual agreements face risks relating to cybersecurity and privacy similar to ours, and we do not directly control any of such parties' information security or privacy operations. For example, the systems currently used for the transmission and approval of payment card transactions, and the technology utilized in payment cards themselves, all of which can put payment card data at risk, are determined and controlled by the payment card industry, not us. A significant theft, destruction, loss or fraudulent use of legally protected information about people or company information maintained by us or by a third-party service provider or other third party that shares data with us pursuant to contractual agreement could have an adverse effect on our reputation, cause a material disruption to our operations and management team and result in remediation expenses (including liability for stolen assets or information, repairing system damage and offering incentives to customers or business partners to maintain their relationships after an attack) and regulatory fines, penalties and corrective actions, or lawsuits by regulators, third-party service providers, third parties that share data with us pursuant to contractual agreements and/or people whose data is or may be impacted. Such theft, destruction, loss or fraudulent use could also result in litigation by shareholders alleging our privacy protections and protections against cyber-attacks were insufficient, our response to an attack was faulty or insufficient care was taken in ensuring we were able to comply with cybersecurity, privacy or data protection regulations, protect information, identify risks and attacks, or respond to and recover from a cyber-attack, or by customers and other parties whose information was subject to such attacks. Advances in computer software capabilities and encryption technology, new tools, and other developments, including continuously evolving attack methods that may exploit vulnerabilities based on these advances, may increase the risk of a security breach or other intrusion. In addition, we may incur increased cybersecurity and privacy protection costs that may include organizational changes, deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants. There can be no assurance the insurance we have in place relating to cybersecurity and privacy risks will be sufficient in the event of a major cybersecurity or privacy event. Any of these events could have a material adverse effect on our business, financial condition, results of operations and cash flows.

The hotel, resort and casino businesses are highly competitive. Our operations currently compete with numerous other casinos located in Macao. Additional Macao facilities announced by our competitors and the increasing capacity of hotel rooms in Macao could add to the competitive dynamic of the market. Our operations will also compete to some extent with casinos located elsewhere in Asia, including Singapore, South Korea, Malaysia, Philippines, Australia, Cambodia and elsewhere in the world, including Las Vegas, as well as online gaming and cruise ships that offer gaming. Our operations also face increased competition from new developments in Malaysia, Australia and South Korea. In addition, certain countries have legalized, and others may in the future legalize, casino gaming, including Japan, Taiwan, Thailand and Vietnam. The proliferation of gaming venues, especially in Southeast Asia, could have a significant and adverse effect on our financial condition, results of operations and cash flows.

We engage a number of third parties to provide gaming operating systems for the facilities we operate. As a result, we rely on such third parties to provide uninterrupted services to us in order to run our business efficiently and effectively. In the event one of these third parties experiences a disruption in its ability to provide such services to us (whether due to technological difficulties or power problems), this may result in a material disruption at the gaming facilities in which we operate and have a material adverse effect on our business, financial condition, results of operations and cash flows. Any unscheduled interruption in our technology services is likely to result in an immediate, and possibly substantial, loss of revenues due to a shutdown of our gaming operations, cloud computing and gaming systems. Such interruptions may occur as a result of, for example, catastrophic events or rolling blackouts. Our systems are also vulnerable to damage or interruption from earthquakes, floods, typhoons, fires, telecommunication failures, terrorist attacks, computer viruses, computer denial-of-service attacks and similar events.