Tanger (SKT) Risk Factors

As of December 31, 2023, through a co-ownership arrangement with a Canadian REIT, we have an ownership interest in two centers located in Canada. Our operating results and the value of our Canadian operations may be impacted by any unhedged movements in the Canadian dollar. Canadian ownership activities carry risks that are different from those we face with our domestic properties. These risks include: - adverse effects of changes in the exchange rate between the U.S. and Canadian dollar;- changes in Canadian political and economic environments, regionally, nationally, and locally;- challenges of complying with a wide variety of foreign laws;- changes in applicable laws and regulations in the United States that affect foreign operations;- property management services being provided directly by our 50/50 co-owner, not by us; and - obstacles to the repatriation of earnings and cash. Any or all of these factors may adversely impact our operations and financial results, as well as our overall business.

To the extent climate change causes changes in weather patterns, our properties in certain markets could experience, among other impacts, severe weather, rising sea levels and other natural disasters. Approximately, 42% of the square footage of our consolidated portfolio are located in coastal areas, which are at risk to be impacted by storms intensity and 14% of the square footage of our consolidated portfolio are in areas that are at risk to be impacted by rising sea levels. Over time, these conditions could result in volatile or decreased demand for retail space at certain of our properties or, in extreme cases, our inability to operate the properties at all. Climate change may also have indirect effects on our business by increasing the cost of (or making unavailable) insurance on favorable terms, or at all, increasing the cost of energy at our properties or requiring us to spend funds to repair and protect our properties against such risks. Changes in federal, state, and local legislation and regulation based on concerns about climate change, including compliance with "green" building codes, could result in increased capital expenditures on our existing properties and our new development properties (for example, to improve their energy efficiency and/or resistance to severe weather) or increased taxes and fees assessed on us or our properties, and in our and our tenants' increased compliance and other costs, without a corresponding increase in revenue, which may result in adverse impacts to our and our tenants' operating results. There can be no assurance that climate change and severe weather, or the potential impacts of these events on our tenants, will not have a material adverse effect on our properties, operations, or business.

The success of our business depends, in part, on the leadership and performance of our executive management team and key employees, including our CEO, some of whom operate without the existence of employment agreements or similar employment and severance arrangements. Many of our senior executives have extensive experience and strong reputations in the real estate industry, which aid us in identifying opportunities and partnering with tenants. Our ability to attract, retain and motivate talented employees, and develop talent internally, could significantly impact our future performance. Competition for these individuals is intense, and we cannot assure you that we will retain our executive management team and other key employees or that we will be able to attract, retain and/or develop other highly qualified individuals for these positions in the future. Additionally, the compensation and benefits packages we may need to offer to remain competitive for these individuals could increase the cost of replacement and retention. Losing any one or more of these persons could adversely affect our business, disrupt short-term operational performance, diminish our opportunities and weaken our relationships with lenders, business partners, existing and prospective tenants and others, which could have a material adverse effect on us.

We intend to grow our business in part through acquisitions and new developments. We compete with institutional pension funds, private equity investors, other REITs, small owners of outlet centers, specialty stores and others who are engaged in the acquisition, development or ownership of centers and stores. These competitors may succeed in acquiring or developing centers themselves. Also, our potential acquisition targets may find our competitors to be more attractive acquirers because they may have greater marketing and financial resources, may be willing to pay more, or may have a more compatible operating philosophy. If we pay higher prices for centers, our profitability may be reduced. We may also have to accept less favorable terms to acquire a center. For example, we may acquire assets subject to liabilities and without any recourse, or with only limited recourse, with respect to unknown liabilities, such as liabilities for the remediation of undisclosed environmental contamination; claims by tenants, vendors, or other persons dealing with the former owners of the assets; and claims for indemnification by general partners, directors, officers, and others indemnified by the former owners of the assets. Also, once we have identified potential acquisitions, such acquisitions are subject to the successful completion of due diligence, the negotiation of definitive agreements and the satisfaction of customary closing conditions. We cannot assure you that we will be able to reach acceptable terms with the sellers or that these conditions will be satisfied. The realization of any of the above risks could significantly and adversely affect our ability to meet our financial expectations, our financial condition, results of operations, and cash flows, our ability to pay dividends to our shareholders, the market price of our common shares, and our ability to satisfy our debt service obligations.

Our operations are subject to the results of operations of our retail tenants. As noted above, a portion of our rental revenues are derived from percentage rents that directly depend on the sales volume of certain tenants. A number of companies in the retail industry, including some of our tenants, have declared bankruptcy or have voluntarily closed all or certain of their stores in recent years. The bankruptcy of a major tenant or number of tenants may result in the closing of certain affected stores or reduction of rent for stores that remain operating. If any of our tenants becomes a debtor in a case under the U.S. Bankruptcy Code, as amended, we cannot evict that tenant solely because of its bankruptcy. The bankruptcy court may authorize the tenant to reject and terminate its lease with us. Our claim against such tenant for uncollectible future rent would be subject to a statutory limitation that might be substantially less than the remaining rent actually owed to us under the tenant's lease. In addition, certain of our lease agreements include co-tenancy and/or sales-based provisions that may allow a tenant to pay reduced rent and/or terminate a lease prior to its natural expiration if we fail to maintain certain occupancy levels or retain specified named tenants, or if the tenant does not achieve certain specified sales targets. Our occupancy at our consolidated centers has remained stable at 97% at December 31, 2023 and 2022, respectively. If our occupancy declines, certain centers may fall below the minimum co-tenancy thresholds and could trigger many tenants ability to pay reduced rents, which in turn may negatively impact our results of operations. Re-leasing this space may take longer than our historical experience. In addition, we may be unable to replace the space at equal or greater rent, and/or we may incur significant tenant allowances to induce tenants to enter into leases. As such, the closings of a significant amount of stores could have a material adverse effect on our results of operations and could result in a lower level of funds for distribution to our shareholders.

Our primary source of revenue is derived from retail tenants, which means that we could be materially and adversely affected by conditions that materially and adversely affect the retail environment generally, including, without limitation: - domestic issues, such as government policies and regulations, tariffs, energy prices, market dynamics, rising interest rates, inflation and limited growth in consumer income as well as from actual or perceived changes in economic conditions, which can result from global events such as international trade disputes, a foreign debt crisis, foreign currency volatility, natural disasters, war, epidemics and pandemics, the fear of spread of contagious diseases, and civil unrest and terrorism;- levels of consumer spending, changes in consumer confidence, income levels, and fluctuations in seasonal spending in the United States and internationally;- supply chain disruptions and labor shortages;- consumer perceptions of the safety, convenience and attractiveness of our centers, including due to a heightened level of concern in public places due to risks associated with the transmission of disease, random acts of violence or consumer perception of increased risk of criminal activity;- the impact on our retail tenants and demand for retail space at our centers from the increasing use of the Internet by retailers and consumers, which accelerated during the COVID-19 pandemic;- the creditworthiness of our retail tenants and the availability of new creditworthy tenants and the related impact on our occupancy levels and lease income;- the willingness of retailers to lease space in our properties at attractive rents, or at all;- changes in applicable laws and regulations, including tax, environmental, safety and zoning;- changes in regional and local economies, which may be affected by increased rates of unemployment, increased foreclosures, higher taxes, decreased tourism, industry slowdowns, adverse weather conditions, and other factors;- increased costs of maintenance, insurance and operations (including real estate taxes); and - epidemics, pandemics or other public health crises, like the COVID-19 pandemic, and the governmental reaction thereto. To the extent that any or a portion of these conditions occur, they are likely to impact the retail industry, our retail tenants, the emergence of new tenants, the demand for retail space, market rents and rent growth, the vacancy levels at our properties, the value of our properties, which could directly or indirectly materially and adversely affect our financial condition, operating results and overall asset value. Additionally, a portion of our lease income is derived from overage rents based on sales over a stated base amount that directly depend on the sales volume of our retail tenants. Accordingly, declines in our tenants' sales performance could reduce the income produced by our properties. Over time, declines in our tenants' sales performance can also negatively impact our ability to sign new and renewal leases at desired rents.

Our information technology systems may in the future be attacked or breached by individuals or organizations intending to obtain sensitive data regarding our business, customers, employees, tenants or other third parties with whom we do business or disrupt our business operations and information technology systems. While we maintain some of our own critical information technology systems, we also depend on third-party providers for important information technology software, products and services relating to several key business functions, such as payroll, electronic communications and certain accounting and finance functions, among others. Many of these providers have likewise experienced and expect to continue to experience cyberattacks and other security incidents. A security compromise of our or our critical providers' information technology systems or business operations could occur through cyber-attacks or cyber-intrusions over the Internet, malware, ransomware, computer viruses, attachments to e-mails, persons inside our organization, or persons with access to systems inside our organization, due to malicious conduct, human error, negligence, and social engineering, as well as due to bugs, coding misconfigurations or other software vulnerabilities. Like many companies, we have experienced intrusions and threats to data and information technology systems, and the risk of a future security breach or disruption, particularly through cyber-attacks or cyber-intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. We use information technology systems to manage our centers and other business processes. Disruption of those systems, for example, due to ransomware, could adversely impact our ability to operate our business to provide timely service to our customers and maintain our relationships with our tenants. Accordingly, if such an attack or act of terrorism were to occur, our operations and financial results could be adversely affected. In addition, we use our information technology systems to protect confidential or sensitive customer, employee and Company information developed and maintained in the normal course of our business. Certain of these systems have been attacked, and any attack on such systems that results in the unauthorized release or loss of customer, employee or other confidential or sensitive data could have a material adverse effect on our business reputation, increase our costs of remediation and compliance (particularly in light of increased regulation of corporate data privacy and cybersecurity practices) and expose us to material legal claims and liability by private litigants (including class actions) and regulatory agencies. If the unauthorized release or loss of customer, employee or other confidential or sensitive data were to occur, our operations and financial results and our share price could also be adversely affected. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and confidential, proprietary, and sensitive data. While we have implemented security measures designed to safeguard our systems and confidential, proprietary, and sensitive data and to manage cybersecurity risks, there can be no assurance that these measures will be effective. We take steps to monitor and develop our information technology networks and infrastructure and invest in the development and enhancement of our controls designed to prevent, detect, respond to, and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact. We also have policies and procedures in place for the identification of cybersecurity incidents and technology vulnerabilities, and their timely elevation to executive management for remediation. Additionally, we take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Undetected and/or unremediated critical vulnerabilities that are exploited could pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Moreover, the security measures employed by third-party service providers may prove to be ineffective at preventing breaches of their systems, which in turn may impact our business and operations. We expect the frequency and intensity of cyberattacks to escalate in the future, particularly as threat actors become more sophisticated, for example, by deploying tools and techniques that are specifically designed to circumvent controls, to evade detection, and even to remove or obfuscate forensic evidence, all of which impedes our ability to detect, identify, investigate and remediate against cyberattacks. Continued remote and hybrid working arrangements also present additional cybersecurity risks given the prevalence of social engineering and vulnerabilities that are inherent in many non-corporate and home networks. It may not always be possible to anticipate, detect, or recognize threats to our systems, or to implement effective preventive measures against all security incidents. We may not be able to immediately address the consequences of a security incident. A successful breach of our computer systems, software, networks, or other technology assets could occur and persist for an extended period of time before being detected due to, among other things: -     the breadth of our operations and the high volume of transactions that our systems process;-     the wide breadth of software required to run our business, and the increase in supply chain attacks by advanced persistent threats;-     the large number of our business partners;-     the frequency and wide variety of sources from which a cyberattack can originate;-     the severity of cyberattacks; and -     the proliferation and increasing sophistication and types of cyberattacks. Furthermore, the extent of a particular cyberattack and the steps that we may need to take to investigate the attack may not be immediately clear. Therefore, in the event of an attack, it may take a significant amount of time before such an investigation can be completed. During an investigation, we may not necessarily know the extent of the damage incurred or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, which could further increase the costs and consequences of a cyberattack. Additionally, applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such disclosure requirements could lead to adverse consequences. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our data privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, proprietary, confidential, and/or sensitive information of the Company or our tenants could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative artificial intelligence technologies. Even if we are not targeted directly, cyberattacks on the U.S. or Canadian governments, financial markets, financial institutions, or other businesses, including our tenants, vendors, software creators, cloud providers, cybersecurity service providers, and other third parties upon which we rely, may occur, and such events could disrupt our normal business operations and networks in the future. In addition, laws, regulations, regulatory frameworks and industry standards related to cybersecurity and data privacy issues are developing rapidly, which may pose complex compliance challenges, lead to increased costs and potentially subject us to liability for violations. While we carry insurance related to cybersecurity events, our policies may not cover all of the costs and liabilities that could be incurred as the result of cyberattack or other security incident.