Tucows (TCX) Risk Factors

As a host of content through our Exact Hosting business, and to a lesser extent as a registrar of domain names services, we may be subject to potential liability for illegal activities by our resellers' customers on their websites. We provide an automated service that enables users to register domain names. We do not monitor or review, nor does our accreditation agreement with ICANN require that we monitor or review, the appropriateness of the domain names we register for our customers or the content of their websites, and we have no control over the activities in which these customers engage. While we have policies in place to terminate domain names or to take other action if presented with evidence of illegal conduct, customers could nonetheless engage in prohibited activities without our knowledge. Several bodies of law may be deemed to apply to us with respect to various customer activities. Because we operate in a relatively new and rapidly evolving industry and since our industry is characterized by rapid changes in technology and in new and growing illegal activity, these bodies of laws are constantly evolving. Some of the laws that apply to us with respect to certain customer activities include the following: - The CDA generally protects online service providers, such as Tucows, from liability for certain activities of their customers, such as posting of defamatory or obscene content, unless the online service provider is participating in the unlawful conduct. Notwithstanding the general protections from liability under the CDA, we may nonetheless be forced to defend ourselves from claims of liability covered by the CDA, resulting in an increased cost of doing business.   - The DMCA provides recourse for owners of copyrighted material who believe that their rights under U.S. copyright law have been infringed on the Internet. Under the DMCA, we generally are not liable for infringing content posted by third parties. However, if we receive a proper notice from a copyright owner alleging infringement of its protected works by web pages for which we provide hosting services, and we fail to expeditiously remove or disable access to the allegedly infringing material, fail to post and enforce a digital rights management policy or a policy to terminate accounts of repeat infringers, or otherwise fail to meet the requirements of the safe harbor under the DMCA, the owner may seek to impose liability on us.   - Although established statutory law and case law in these areas to date generally have shielded us from liability for customer activities, court rulings in pending or future litigation may serve to narrow the scope of protection afforded us under these laws. In addition, laws governing these activities are unsettled in many international jurisdictions, or may prove difficult or impossible for us to comply with in some international jurisdictions. Also, notwithstanding the exculpatory language of these bodies of law, we may be embroiled in complaints and lawsuits which, even if ultimately resolved in our favor, add cost to our doing business and may divert management's time and attention. Finally, other existing bodies of law, including the criminal laws of various states, may be deemed to apply or new statutes or regulations may be adopted in the future. Our insurance may not be adequate to compensate or may not cover us at all in the event we incur liability for damages due to data and content carried on or disseminated through our network. Any costs not covered by insurance that are incurred as a result of this liability or alleged liability, including any damages awarded and costs of litigation, could harm our business and prospects.   - Domain name registrars also face potential tort law liability for their role in wrongful transfers of domain names. The safeguards and procedures we have adopted may not be successful in insulating us against liability from such claims in the future. In addition, we face potential liability for other forms of "domain name hijacking," including misappropriation by third parties of our network of customer domain names and attempts by third parties to operate websites on these domain names or to extort the customer whose domain name and website were misappropriated. Furthermore, our risk of incurring liability for a security breach on a customer website would increase if the security breach were to occur following our sale to a customer of an SSL certificate that proved ineffectual in preventing it. Finally, we are exposed to potential liability as a result of our private domain name registration service, wherein we become the domain name registrant, on a proxy basis, on behalf of our customers. While we have a policy of providing the underlying information and reserve the right to cancel privacy services on domain names giving rise to domain name disputes including when we receive reasonable evidence of an actionable harm, the safeguards we have in place may not be sufficient to avoid liability in the future, which could increase our costs of doing business.   - There have been ongoing legislative developments and judicial decisions concerning trademark infringement claims, unfair competition claims and dispute resolution policies relating to the registration of domains. To help protect ourselves from liability in the face of these ongoing legal developments, we have taken the following precautions:   - our standard registration agreement requires that each registrant indemnify, defend and hold us harmless for any dispute arising from the registration or use of a domain registered in that person's name; and   - since December 1, 1999, we have required our resellers to ensure that all registrants are bound to the UDRP as approved by ICANN. Despite these precautions, we cannot be assured that our indemnity and dispute resolution policies will be sufficient to protect us against claims asserted by various third parties, including claims of trademark infringement and unfair competition. New laws or regulations concerning domains and registrars may be adopted at any time. Our responses to uncertainty in the industry or new regulations could increase our costs or prevent us from delivering our domain registration services over the Internet, which could delay growth in demand for our services and limit the growth of our revenues. New and existing laws may cover issues such as: - pricing controls;   - the creation of additional generic top-level domains and country code domains;   - consumer protection;   - cross-border domain registrations;   - trademark, copyright and patent infringement;   - domain dispute resolution; and   - the nature or content of domains and domain registration. An example of legislation passed in response to novel intellectual property concerns created by the Internet is the ACPA enacted by the United States government in November 1999. This law seeks to curtail a practice commonly known in the domain registration industry as cybersquatting. A cyber squatter is generally defined in the ACPA as one who registers a domain that is identical or similar to another party's trademark, or the name of another living person, with the bad faith intent to profit from use of the domain. The ACPA states that registrars may not be held liable for registration or maintenance of a domain for another person absent a showing of the registrar's bad faith intent to profit from the use of the domain. Registrars may be held liable, however, if they do not comply promptly with procedural provisions of the ACPA. For example, if there is litigation involving a domain, the registrar is required to deposit a certificate representing the domain registration with the court. If we are held liable under the ACPA, any liability could have a material adverse effect on our business, financial condition and results of operations.

Maintaining our existing customer relationships and being able to establish new relationships is critical to our success across all our segments, regardless if that customer is an end consumer wanting Gigabit Fiber or Fixed Wireless Internet service to their home, a telecommunication provider, or a leading global domain reseller. Long-term success is dependent upon our sustained ability to generate sufficient revenue from our customers based on their use of our services and ability to respond to churn by retaining existing customers and adding new customers. With significant investments across our segments, be it in the continued build out of our Fiber Network across the United States, our development of our Wavelo or Domains Platforms, our performance and financial results could be negatively impacted if we are unable to realize the return on these investments by failing to attract customers or retain customers to the services we offer. Our retail mobile services has limited influence over the small subset of subscribers on the MNO contract retained by the Company as part of the DISH Purchase Agreement, and we may be unable to effectively respond to churn or attract a sufficient level of new customers to meet the minimum commitments with this MNO partner. Failing to meet the minimum commitments could cause our retail mobile services to incur significant, and recurring, penalties until such a time that the contract is complete. These penalties would negatively impact our operational performance and financial results if enforced by the MNO. Based on the size of the small subset of customers retained as part of the DISH Purchase Agreement, their limited network usage and our limited negotiating ability, the Company has accrued $0.3 million of penalties associated with the minimum commitment shortfall during the twelve months ended December 31, 2023. The Company expects to incur penalties throughout the year ending December 31, 2024 ("Fiscal 2024") and thereafter until the contract is complete. Historically, the Company has been unable to renegotiate the penalties down or at all, with the only successful renegotiation related to partial deferral of penalty escalation into later years of the contract term. Regarding Wavelo, DISH is our main customer and represents the majority of our revenues until such time that we are able to scale our services to other customers. With the majority of our revenues concentrated with one customer, we are exposed to significant risk if we are unable to maintain this customer relationship or establish new relationships with other MNOs or MVNOs in the future. Additionally, our revenues are directly tied to the subscriber volumes of DISH's MVNO or MNO networks, so our profitability is contingent on the ability of DISH to continue to add and retain subscribers onto our platform. If any of these events occur, our operational performance and financial results may be adversely affected.

Across all of our business segments, regardless if those services operate on a postpaid or prepaid basis, we are exposed to the risks associated with credit card and other online payment technologies, chargebacks and fraud associated with these payment types. A substantial majority of our revenue originates from online credit card transactions. Under current credit card industry practices, we are liable for fraudulent and disputed credit card transactions because we do not obtain the cardholder's signature at the time of the transaction, even though the financial institution issuing the credit card may have authorized the transaction. Under credit card association rules, penalties may be imposed at the discretion of the association. Any such potential penalties would be imposed on our credit card processor by the association. Under our contract with our processor, we are required to reimburse our processor for such penalties. Our current level of fraud protection, based on our fraudulent and disputed credit card transaction history, is within the guidelines established by the credit card associations. However, we face the risk that one or more credit card associations may, at any time, assess penalties against us or terminate our ability to accept credit card payments from customers, which would have a material adverse effect on our business, financial condition and results of operations. Furthermore, for our postpaid businesses, namely the Tucows Corporate - Mobile Services and Ting segment, our success depends on our ability to manage credit risk while attracting new customers with profitable usage patterns. Both of these segments have relatively short operating histories and there can be no assurance that it will be able to manage credit risk or generate sufficient revenue to cover its postpaid-related expenses, including losses arising from its customers' failure to make payments when due. We manage credit risk exposure using techniques that are designed to set terms and limits for the credit risk it accepts. The techniques we use may not accurately predict future defaults due to, among other things, inaccurate assumptions or fraud. Our ability to manage credit risk may also be adversely affected by legal or regulatory changes, competitors' actions, consumer behavior, and inadequate collections staffing or techniques. While we continually seek to improve our assumptions and controls, the failure to manage credit risk appropriately may materially adversely affect our profitability and ability to grow.

Following the sale of the majority of our Ting Mobile customer base on August 1, 2020, we retained a small subset of mobile customers to which we continue to provide retail mobile services through our partnership with our MNO supplier. The Company is subject to minimum purchase commitments with our MNO supplier through a "take or pay" arrangement. Between August 17, 2024 and February 16, 2026, the Company has committed to pay $24.1 million under the "take or pay" arrangement. If we are unable to grow the Ting Mobile subscriber base or renegotiate the contract, our cost of revenues could grow significantly, and may result in a significant increase to the Company's net loss.