hrol20241231_10k.htm
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549
FORM 10-K
☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
FOR THE FISCAL YEAR ENDED DECEMBER 31, 2024
OR
☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
FOR THE TRANSITION PERIOD FROM ____________ TO ____________
Commission File Number: 001-42202
High Roller Technologies, Inc.
(Exact name of registrant as specified in its charter)
(Address of principal executive office) (Zip Code)
(702) 509-5244
(Registrant’s telephone number, including area code)
Securities registered pursuant to Section 12(b) of the Act:
Title of each class Trading symbol(s) Name of each exchange on which registered
Common Stock, par value $0.001 per share ROLR NYSE American LLC
Securities registered pursuant to Section 12(g) of the Act: None
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐
If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐
Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒
The registrant was not a public company at June 30, 2024, the last business day of the registrant’s most recently completed second fiscal quarter, and therefore it cannot calculate the aggregate market value of its voting and non-voting common equity held by non-affiliates at such date. The registrant’s Common Stock began trading on the NYSE American LLC on October 23, 2024. The aggregate market value of the registrant’s Common Stock outstanding, other than shares held by persons who may be deemed affiliates of the registrant, at December 31, 2024, computed by reference to the closing price for the Common Stock on such date ($4.37), as reported on the NYSE American LLC, was $2.3 million.
As of March 20, 2025, there were 8,375,349 shares of the registrant’s common stock outstanding.
Table of Contents
HIGH ROLLER TECHNOLOGIES, INC. AND SUBSIDIARIES
ANNUAL REPORT ON FORM 10-K
TABLE OF CONTENTS
PAGE
PART I 1
Item 1. Business 1
Item 1A. Risk Factors 5
Item 1B. Unresolved Staff Comments 34
Item 1C. Cybersecurity 34
Item 2. Properties 35
Item 3. Legal Proceedings 35
Item 4. Mine Safety Disclosure 35
Item 6. [Reserved] 35
Item 7A. Quantitative and Qualitative Disclosures About Market Risk 44
Item 8. Financial Statements and Supplementary Data F-1
Item 9A. Controls and Procedures 45
Item 9B. Other Information 46
Item 9C. Disclosures Regarding Foreign Jurisdiction that Prevent Inspections 46
PART III 47
Item 10. Directors, Executive Officers and Corporate Governance 47
Item 11. Executive Compensation 53
Item 14. Principal Accountant Fees and Services 64
Item 15. Exhibits and Financial Statement Schedules 65
Signatures 66
i
Table of Contents
INTRODUCTORY NOTE
Forward-Looking Statements and Summary of Risk Factors
This Annual Report on Form 10-K (this “Annual Report”) contains forward-looking statements, about High Roller Technologies, Inc. and our industry that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this Annual Report, including statements regarding our future results of operations or financial condition, business strategy, and plans and objectives of management for future operations are forward-looking statements. In some cases, these statements can be identified by the use of forward-looking terminology such as “believes,” “estimates,” “anticipates,” “expects,” “plans,” “intends,” “may,” “could,” “might,” “will,” “should,” “approximately,” “project,” or “potential,” or negative or other variations of those terms or comparable terminology, although not all forward-looking statements contain these words.
Forward-looking statements involve risks and uncertainties because they relate to events, developments, and circumstances relating to High Roller Technologies, Inc., our industry, and/or general economic or other conditions that may or may not occur in the future or may occur on longer or shorter timelines or to a greater or lesser degree than anticipated. In addition, even if future events, developments and circumstances are consistent with the forward-looking statements contained in this report, they may not be predictive of results or developments in future periods. Although we believe that we have a reasonable basis for each forward-looking statement contained in this report, such information may be limited or incomplete. Our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all relevant information.
Forward-looking statements are not guarantees of future performance, and our actual results of operations, financial condition and liquidity, and the development of the industry in which we operate, may differ materially from the forward-looking statements contained in this report as a result of the following factors:
● our ability to obtain and maintain licenses with gaming authorities;
● our inability to recognize deferred tax assets and tax loss carryforwards;
● our ability to raise financing in the future;
● our success in retaining or recruiting officers, key employees or directors;
● the risks arising from doing business in foreign countries;
ii
Table of Contents
We have based the forward-looking statements contained in this Annual Report primarily on our current expectations, estimates, forecasts, and projections about future events and trends that we believe may affect our business, results of operations, financial condition, and prospects. Although we believe that we have a reasonable basis for each forward-looking statement contained in this Annual Report, we cannot guarantee that the future results, levels of activity, performance, or events and circumstances reflected in the forward-looking statements will be achieved or occur at all. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties, and other factors described in “Risk Factors” and elsewhere in this Annual Report. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report. The results, events, and circumstances reflected in the forward-looking statements may not be achieved or occur, and actual results, events, or circumstances could differ materially from those described in the forward-looking statements. Any forward-looking statements that we make in this report speak only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements made in this Annual Report to reflect events or circumstances after the date of this Annual Report, or to reflect new information, actual results, revised expectations or the occurrence of unanticipated events, except as may be required by applicable law. In this Annual Report, references to “we,” “us,” “our,” and the “Company” refer to High Roller Technologies, Inc. and its direct and indirect subsidiaries.
Summary of Risk Factors
Our business is subject to a number of risks, including risks that may prevent us from achieving our business objectives or may adversely affect our business, financial condition, results of operations, cash flows and prospects that you should consider before making a decision to invest in our securities. These risks are discussed more fully in the section titled “Risk Factors” in Item 1A, and include, the following:
● Competition in the online casino gaming industry is intense and, as a result, we may fail to attract and retain users who may be attracted to competing betting and gaming options, which may harm our operations and growth prospects.
● We launched our HighRoller.com domain name in January 2022 as our principal iCasino Platform and have re-purposed our legacy CasinoRoom.com into a marketing platform to provide lead generation to online casinos. We have a limited history of operations and financial information on which to assess our current business strategy and no assurance can be given of long-term growth and consumer acceptance in which event our future revenue and results of operations may decline.
● The success, including win or hold rates, of existing or future online wagering products depends on a variety of factors and is not completely controlled by us.
● If we fail to detect fraud or theft, including by our users and employees, our reputation may suffer, which could harm our brand and negatively impact our business, financial condition, results of operations and prospects and can result in government and civil investigations and litigations.
● Our growth prospects may suffer if we are unable to offer additional new and exciting gaming products. In addition, if we fail to make the right investment decisions in our offerings and technology platform, we may not attract and retain key users and our revenue and results of operations may decline.
● Recruitment and retention of our executives and key employees are vital to growing our business and meeting our business plans. Our inability to recruit executives or key employees, or the loss of any of our executives or other employees could harm our business.
● The nature of our business subjects us to taxation in a number of jurisdictions and changes in, or new interpretation of, tax laws, tax rulings or their application by tax authorities could result in additional tax liabilities and could materially affect our business, financial condition, results of operations and prospects.
● Our business operations are currently located outside of the United States, which subjects us to additional operational and regulatory risks that could adversely affect our operating results.
● Negative publicity or an adverse shift in public opinion regarding online casino wagering may adversely impact our business and user retention if such change in public opinion occurs in the market(s) that we operate in.
● Our business is subject to a variety of United States and foreign laws, many of which are in the process of being formulated and are constantly evolving. Any change in regulations or their interpretation, or the regulatory climate applicable to our products and services, could adversely impact our ability to operate our business, which could have a material adverse effect on our business, financial condition, results of operations and prospects.
● Our growth prospects depend on the legal status of real-money online iCasino gaming in various jurisdictions, and legalization may not occur in as many states as we expect or may occur at a slower pace than we anticipate or may be accompanied by legislative or regulatory restrictions or taxes that make it impracticable or less attractive to operate, which could adversely affect our future results of operations and make it more difficult to meet our expectations for financial performance.
● Failure to comply with regulatory requirements or to successfully obtain licenses or permits could adversely impact our ability to comply with licensing and regulatory requirements or to obtain or maintain licenses in other jurisdictions, and could cause financial institutions, online and mobile platforms and distributors to stop providing services to us.
● We rely on information technology and other systems and platforms, and failures, errors, defects or disruptions therein could diminish our brand and reputation, subject us to liability, disrupt our business, affect our ability to scale our technical infrastructure and adversely affect our operating results and growth prospects.
● Our product offerings and other software applications and systems, and certain third-party platforms that we use could contain undetected errors which could adversely affect our operating results.
● Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored therein could be accessed, publicly disclosed, lost or stolen. Any such access, disclosure, other loss or theft of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to users, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects.
● We rely on third-party payment processors to process deposits and withdrawals made by our users on our platform, and if we cannot manage our relationships with these third parties and other payment-related risks, our business, financial condition, results of operations and prospects could be adversely affected.
● We rely on other third-party service and content providers and if those third parties do not perform adequately or terminate their relationships with us, our costs may increase and our business, financial condition, results of operations and prospects could be adversely affected.
● If internet and other technology-based service providers experience service interruptions, our ability to conduct our business may be impaired and our business, financial condition, results of operations and prospects could be adversely affected.
● We identified material weaknesses in our internal control over financial reporting, and we may identify additional material weaknesses in the future that may cause us to fail to meet our reporting obligations. If we fail to remediate any material weaknesses or if we otherwise fail to establish and maintain effective control over financial reporting, our ability to accurately and timely report our financial results could be adversely affected.
● Economic downturns and political and market conditions beyond our control, including a reduction in consumer discretionary spending, could adversely affect our business, financial condition, results of operations and prospects.
● Our growth prospects and market potential will depend on our ability to obtain licenses to operate in a number of jurisdictions and to enter new markets, domestic and foreign, and if we fail to obtain these licenses our business, financial condition, results of operations and prospects could be impaired.
● We may encounter difficulties in managing our growth, which could adversely affect our operations.
● Our amended and restated certificate of incorporation, as amended (“Certificate of Incorporation”), designates the Chancery courts of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us, our directors, officers or employees.
iii
Table of Contents
PART I.
Item 1. BUSINESS
Overview
High Roller Technologies, Inc. (together, with its subsidiaries, unless the context otherwise indicates, “High Roller,” “we,” “us,” “our,” “ours”, or the “Company”) is an evolving and growth-oriented global online gaming operator. We offer a compelling real money online casino platform. The Company defines the term platform (“Platform”) as the fusion of its technical IP, commercial partnerships, and operational expertise including an in-house developed domain customizable frontend and content management system (CMS) which offers enhanced search engine optimization, direct API integrations, faster load times, and better scalability. The Company utilizes a third party player account management system (PAM) that offers a high level of control over game integrations, payment provider solutions, and overall player management. The Company’s experienced operational management team actively oversees engagement with its players and partners. The Company’s Platform is based around a set of gaming products, which the Company refers to as “iCasino” and is offered to players in select markets throughout the world. The Company offers a wide range of games, including many that are available in land-based casinos. The Company currently offers more than 4,400 games from over 70 providers, representing largely the entire range of iCasino games which the Company believes are most attractive to its player base including video slots, blackjack, roulette, baccarat, craps, and video poker. A number of the Company’s most popular games are available to play with a live dealer including blackjack, video poker, roulette, baccarat, craps, Game Shows, which is the fastest growing live casino segment, and other popular live games. One of our key strengths is a strong player acquisition pipeline, built through extensive industry specific marketing relationships and expertise. The Company’s offerings incorporate attractive graphics, targeted bonuses, and interactive social elements in a secure environment featuring rapid onboarding and payouts. The Company’s selections of games include but are not limited to those sourced from:
● Evolution Gaming
● Pragmatic Play
● Push Gaming
● No Limit City
● Play’n GO
● Relax Gaming
● Red Tiger Gaming
● Big Time Gaming
● Netent
● Quickspin
● Games Global
The Company was incorporated in Delaware on December 21, 2021 and the Company completed its initial public offering in October 2024.
Launching Our Premium Brand HighRoller.com
In January 2022 we launched our premium brand HighRoller.com, replacing our legacy iCasino brand, CasinoRoom.com. Our subsidiary, Interstellar Entertainment NV, is licensed by the Curacao Gaming Control Board, under license number OGL/2024/1042/0564. Following the closing of our initial public offering, we intend also to apply for an Estonian gaming license. Pending receipt of an Estonian gaming license, we entered into several agreements with Happy Hour Solutions Ltd., an affiliated company and holder of an Estonian gaming license, including:
1
Table of Contents
We refer to these agreements collectively as the “Happy Hour Solutions Agreements.” The Happy Hour Solutions Agreements terminate on the earlier of our receipt of an Estonian gaming license or December 31, 2025. The Happy Hour Solutions Agreements as described above are qualified in their entirety by the agreements filed as exhibits to this Annual Report.
Our remote license and the Happy Hour Solutions Agreements provide us with the ability to generate revenues in certain jurisdictions within Europe, Asia-Pacific and the Americas.
We operate in a mix of remote licensed markets, which we refer to as Pre-regulated markets, where we may reasonably operate using international licenses, as well as locally licensed markets, which we refer to as Regulated markets, requiring a local license. We plan to launch into one or more locally regulated markets utilizing proceeds from our initial public offering, the first of which is Ontario. We have begun the process of obtaining a license in Ontario with a projected launch in the second half of 2025. We have applied for a gaming license in Malta which will give us an additional option for offering bets in certain pre-regulated markets. We previously held a gaming license in Malta which was surrendered in good standing and has not been operated under since 2022. We expect to receive this license in the second half of 2025.
Our vision is to be the premium online destination for high rollers around the world. We believe the highroller.com domain provides us with a strategic asset to build a brand appealing to high value customers. While our Platform allows us to scale highroller.com and other brands attracting additional demographics. Our founders, board of directors, and management collectively have over 100 years of iGaming experience, having founded, listed, and successfully exited a range of companies working in some of the most competitive global iGaming and e-commerce markets. Our branding and operational focus is to establish and continue to grow significant market share in the international online casino markets.
Our growth will be driven by attracting and acquiring new players, engaging our existing users, by entering new geographical markets, and implementing a multi-brand strategy. See “Growth Strategy” below. We believe that one of our main competitive strengths is rooted in our founding team’s proven expertise in digital performance marketing and operational excellence, along with the iCasino experience of our seasoned senior management.
Launch of HighRoller.com and Relaunch of CasinoRoom.com as an Affiliate Marketing Website
During the first quarter of 2022, we acquired HR Entertainment Ltd., a British Virgin Islands company, in order to obtain the premium HighRoller.com domain name and related intellectual property that we believe is a main component of our growth strategy. We consider this acquisition a principal lynchpin of our ongoing strategy of delivering one of the most exciting and immersive real money gaming experiences for the iCasino market. In July of 2024, we transitioned all gaming activities under the HighRoller.com domain name and all related intellectual property to our newly formed subsidiary, Interstellar Entertainment NV, a Curacao company, to comply with new regulations requiring a Curacao license to be held only by a Curacao company.
During the first quarter of 2022, we acquired Ellmount Entertainment Ltd., a Malta company, in order to obtain the CasinoRoom.com brand. We offered active Casino Room players the option to open accounts at HighRoller.com and commenced welcoming players onto what is in our view the more attractive iCasino platform.
During the first half of 2022, we rebranded our iCasino operations from CasinoRoom.com to HighRoller.com and concurrently commenced to reposition our legacy gaming operator “CasinoRoom.com” into an online casino ratings and reviews portal to generate high-value leads and targeted search engine traffic (SEO) for HighRoller.com and customer leads for other casinos particularly in markets that we do not serve. The new CasinoRoom.com affiliate model site further enables us to support any future brands we may launch or acquire with targeted traffic.
In March 2022, we relocated our principal offices from Stockholm, Sweden to Las Vegas, Nevada. We also maintain offices in Malta to support our administrative and operational activities.
Market Trends
Total addressable worldwide gambling market in 2024 was approximately $573 billion of which iGaming was approximately $106 billion or about 18.5% of total addressable worldwide gambling market. The market is expected to grow to $755 billion by 2029, of which iGaming is expected to account for $187 billion or approximately 25% of total addressable worldwide gambling market. This estimated growth in the iGaming market represents a compound annual growth rate of 12.3%.
2
Table of Contents
Our Business Model
We offer our customers a wide array of popular and exciting casino games from over 80 leading third-party game developers. Our mission is to offer consistently superior customer experience by (i) providing fast onboarding, easy log-in and re-log-in, (ii) assuring efficient and secure payment processing, (iii) providing prompt payouts on player winnings, (iv) providing an array of responsible gaming tools and AI models to ensure a safe gaming experience, (v) offering generous bonuses, bonus play and free spins on popular games, (vi) utilizing an interactive environment for player engagement leading to longer stays online and more play and (vii) maintaining 24/7/365 customer service to assure customer satisfaction.
We have also established a strategic partnership with Spike Up Media LLC, an affiliate of our founders and one of the leading global providers of online lead generation to iCasino operators. We believe that our association with Spike Up Media generates high quality, cost-effective lead generation providing us with higher lead to customer conversions, and attractive payment terms and revenue sharing which gives us an additional competitive advantage. Our current agreement with Spike Up Media allows for termination by either party at any time without penalty.
Our Growth Strategy
High Roller intends to achieve rapid, cost efficient and sustainable growth by utilizing high margin cash flow generated from online casino operations in our current international markets where we operate and to enter and grow sustainable revenues in newly regulated and soon to be regulated markets.
We are implementing a multi-brand strategy, facilitated by our in house developed scalable CMS and frontend that allows us to scale our business by duplicating our Platform strengths across multiple domains with individualized branding and different target markets. We believe that this multi-brand strategy allows us to compete for increased market share in markets where players have accounts with multiple iCasino operators by offering a selection of brands that target different demographics in addition to launching new brands that are locally targeted. We expect that we will be able to launch competitive new brands as we identify opportunities in our existing markets or new markets. We soft launched our second brand, Fruta.com, in December 2023, allowing select players to test Fruta.com prior to going live. We have successfully launched Fruta.com in our existing markets throughout 2024. We launched Fruta.com using our existing resources and gaming licenses.
While we plan to focus our resources on growing and improving our existing brands and entering new markets, we believe that the scalability of our Platform will continue to allow the Company to launch and support additional brands, if necessary, with our existing resources. Management anticipates that the growth of the brands and launches into new markets will provide access to new players within our target demographics and generate added revenue through existing player acquisition channels while maintaining the current cost structure with nominal incremental costs. Management believes that this strategy will have no material negative impact on financial condition, operations, liquidity, or capital position of the Company.
3
Table of Contents
Our Competitive Strengths
The Company is an evolving and growth-oriented online iCasino operator of B2C brands, leveraging its online operational and marketing expertise and assets as the foundation for what we believe to be a highly competitive growth model. We believe that the combination of our digital IP, commercial partnerships, operational expertise of our management team, and customer-centric approach that fosters loyalty are among our competitive strengths. Our Platform provides strong localization, ease of deposits and withdrawals, a bespoke player gaming experience, through our advanced technology. We use automated tools and machine learning to interact in real-time with our customers and to promote responsible gaming. Our in house developed AI-based reward system rewards players in real-time based on the players activity, games of choice, average transactions and their value segment. Additionally, one of our key strengths is a strong player acquisition pipeline, built through extensive industry specific marketing relationships and expertise.
Pre-regulated markets have lower thresholds to enter and higher operating margins as local regulation typically entails increased compliance requirements and higher taxation. Pre-regulated markets, however, generally carry more long-term uncertainty, as emerging regulation is yet unclear. We are able to use proceeds from operations in Pre-regulated markets to invest into Regulated markets building long-term sustainable profits. We previously operated our legacy CasinoRoom.com iCasino operations in a number of Pre-regulated markets through a previously held gaming license in Malta. After transitioning to our highroller.com website, we surrendered our Malta gaming license associated with the CasinoRoom.com operations but have since applied for a gaming license in Malta under our new operational structure. We currently operate our HighRoller.com iCasino operations principally through our Curacao gaming license and through the agreements we have with Happy Hour Solutions, a subsidiary of Happy Hour Entertainment Holdings Ltd., which holds the Estonian gaming license. For both of these remote gaming licenses, licensors impose few territorial restrictions. Daniel Bradtke, one of the principals of Happy Hour Entertainment Holdings Ltd., serves as a member of our board of directors and Ben Clemes, who became our CEO on January 1, 2024, has previously served as a Portfolio Partner at Happy Hour Solutions.
We compete for customers by having optimized the HighRoller.com product for social media, including live streaming with interactive play allowing fans to bet side by side with their favorite streamers, which is an emerging feature within our industry. We believe that through a combination of more immersive play that has built-in virality and our focus on VIP customer experience and support all on our safe and secure platform, we can attract and retain a growing number of real money players.
Human Capital
Our Employees. As of March20, 2025, we employed 59 persons working across offices in North America and Europe. Of these, four were employed in the United States and 55 were employed in Malta. Our qualified and experienced team includes six persons in senior management and the balance engaged in operations, accounting, social media and marketing, customer service, technological support and the balance in other administrative responsibilities. We also utilize a number of consultants for financial reporting, regulatory and other operational matters.
We believe that we maintain a satisfactory working relationship with our employees, and we have experienced no significant labor disputes or any difficulty in recruiting staff for our operations. None of our employees are represented by a labor union.
Employee Engagement, Talent Development and Benefits. We believe that our future success largely depends upon our continued ability to attract and retain highly skilled employees. We provide our employees with competitive salaries and bonuses, and opportunities for equity ownership.
Available Information
High Roller files annual, quarterly, and current reports, proxy statements, and all amendments to these reports and other information with the SEC. High Roller makes available free-of-charge, on or through its website at https://ir.highroller.com, all SEC filings, as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC . The information on High Roller’s website is not incorporated by reference in this Annual Report. Reports, proxy statements, and other information regarding issuers that file electronically with the SEC, including High Roller’s filings, are also available to the public from the SEC’s website at http://www.sec.gov.
4
Table of Contents
Item 1A.RISK FACTOR
Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information contained in this Annual Report, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and the related notes thereto, before making a decision to invest in our common stock. These risks and uncertainties are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us. If any of the following risks occur, our business, financial condition, results of operations and prospects could be materially and adversely affected. In that event, the price of our common stock could decline, and you could lose part or all of your investment. You should not interpret our disclosure of any of the following risks to imply that such risks have not already materialized.
Risks Related to Our Business
Competition in the retail and online iCasino industry is intense and, as a result, we may fail to attract and retain users, which may negatively impact our operations and growth prospects.
The industries in which we operate are characterized by intense competition. We compete against other providers of retail or online iCasino gaming, as well as against providers of online and mobile entertainment and leisure products more generally. Other companies producing online gaming and/or interactive entertainment products and services are often established and well-financed, and other well-capitalized companies may introduce competitive services. Our competitors may spend more money and time on developing and testing products and services, undertake more extensive marketing campaigns, adopt more aggressive pricing or promotional policies or otherwise develop more commercially successful products or services than ours, which could negatively impact our business. Our competitors may also develop products, features, or services that are similar to ours or that achieve greater market acceptance. Such competitors may also undertake more far-reaching and successful product development efforts or marketing campaigns or may adopt more aggressive pricing policies. Furthermore, in the future, new competitors, whether licensed or not, may enter the online iCasino gaming industries. If we are not able to maintain or improve our market share, or if our offerings do not continue to be popular, our business, financial condition, results of operations and prospects could be adversely affected.
Competitive pressures may also adversely affect our margins. For example, as we expand the competition may increase, and we may need to increase our marketing expenses, thereby lowering our margins, in order to compete.
We operate in the global entertainment and gaming industries within the broader entertainment industry with our business-to-consumer (“B2C”), offerings such as online casino wagering, social gaming, and our B2B offerings through our Casino Room platform and other services. Our users face a vast array of entertainment choices. Other forms of entertainment, such as television, movies, sporting events and in-person casinos, are more well-established and may be perceived by our users to offer greater variety, affordability, interactivity and enjoyment. We compete with these other forms of entertainment for the discretionary time and income of our users. If we are unable to sustain sufficient interest in our online casino wagering, and social gaming platforms in comparison to other forms of entertainment, including new forms of entertainment, our business, financial condition, results of operations and prospects could be adversely affected.
In addition, our ability to achieve growth in revenue in the future will depend, in large part, upon our ability to attract new users to our offerings and retain existing users of our offerings, as well as continued user adoption of online casino more generally. Growth in the online casino and gaming industries and the level of demand for and market acceptance of our product offerings will be subject to a high degree of uncertainty. We cannot assure that consumer adoption of our product offerings will continue or exceed current growth rates, that the industry will achieve more widespread acceptance or that we will be able to retain our customers if we are unable to keep pace with technological innovation and customer experiences.
Our business depends on the success, including win or hold rates, of existing and future online gaming products, which rely on a variety of factors and are not completely controlled by us.
The online casino gaming industries are characterized by an element of chance. Our revenue is impacted by variations in the hold percentage (the ratio of net win to total amount wagered), or actual outcome, on the online casino games that we offer to our customers. We use the hold percentage as an indicator of an online casino game’s performance against its expected outcome. Although each online casino game generally performs within a defined statistical range of outcomes, actual outcomes may vary for any given period, particularly in the short term however should normalize over time to the return to player percentage as designed by the game mathematics combined with the outcome from the random number generator.
5
Table of Contents
In the short term, for online casino wagering, the element of chance may affect win rates (hold percentages); these win rates, may also be affected in the short term by factors that are largely beyond our control, such as the mix of games played or wagers placed, the financial resources of customers, the volume of wagers placed and the amount of time spent playing. For online casino games, it is possible a game will malfunction or is otherwise misprogrammed to pay out wins in excess of the game’s mathematical design and award errant prizes. Factors that are nominally within our control, such as the level of incentives or bonuses or comps given to customers, might, for various reasons both within and beyond our control, not be well-managed and hence in turn might impact win rates. Similarly, inadvertently over-incentivizing customers can convert a casino game that would otherwise have been expected to be profitable for us into one with a positive expectation for the player.
As a result of the variability in these factors, the actual win rates on our online casino gaming offerings may differ from the theoretical win rates we have estimated and could result in the winnings of our online casino gaming customers exceeding those anticipated. The variability of win rates (hold rates) also has the potential to negatively impact our business, financial condition, results of operations, prospects and cash flows. For casino games there can be no assurance that existing casino game features will always be allowed or that new casino game features will be allowed or that regulators will not seek to constrain the operation of games in any way, for example by limiting the rate or speed of game play. If game features or other relevant aspects of casino game design are constrained then our business, financial condition, results of operations, prospects and cash flows might be negatively impacted.
Our success also depends in part on our ability to anticipate and satisfy user preferences in a timely manner. As we operate in a dynamic environment characterized by rapidly changing industry and legal standards, our products are subject to changing consumer preferences that cannot be predicted with certainty. We need to continually introduce new offerings and identify future product offerings that complement our existing platforms, respond to our users’ needs and improve and enhance our existing platforms to maintain or increase our user engagement and growth of our business. We may not be able to compete effectively unless our product selection keeps up with trends in the digital gaming industries in which we compete, or trends in new gaming products.
Our forecasts, including for revenues, market share, expenses and profitability, are subject to significant risks, assumptions, estimates and uncertainties and may therefore differ materially from our expectations.
We operate in rapidly changing and competitive industries, and our forecasts are subject to the risks and assumptions made by management with respect to our industries. Operating results are difficult to forecast because they generally depend on our assessment of the timing of adoption of future legislation and regulations by different states and countries, which are uncertain. Furthermore, if we invest in the development of new products or distribution channels that do not achieve significant commercial success, whether because of competition or otherwise, we may not recover the often substantial “up front” costs of developing and marketing those products and distribution channels or recover the opportunity cost of diverting management and financial resources away from other products or distribution channels.
Additionally, as described below under “— Economic downturns and political and market conditions beyond our control, including a reduction in consumer discretionary spending, could adversely affect our business, financial condition, results of operations and prospects,” our business may be affected by reductions in consumer spending from time to time as a result of a number of factors which may be difficult to predict. Moreover, while casino operations are largely unaffected by seasonality in aggregate as online casino gaming is largely an individual activity unaffected by external calendars we believe that there is however some evidence that seasonality effects may occur at the time of certain major national holidays and/or vacation periods, as a result of which our revenue and cash flows could be adversely affected during times of the year when customers are more likely to engage in other non-gaming activities. This may result in decreased revenue levels, and we may be unable to adopt measures in a timely manner to compensate for any unexpected shortfall in income. This inability could cause our operating results in a given quarter to be higher or lower than expected. If actual results differ from our estimates, analysts and investors may negatively react and our stock price could be materially impacted.
6
Table of Contents
If we fail to detect fraud or theft, including by our users and employees, our reputation may suffer, which could harm our brand and reputation and negatively impact our business, financial condition, results of operations and prospects and can subject us to investigations and litigation.
We may incur losses from various types of financial fraud, including use of stolen or fraudulent credit card data, claims of unauthorized payments by a user and attempted payments by users with insufficient funds. Bad actors use increasingly sophisticated methods to engage in illegal activities involving personal information, such as unauthorized use of another person’s identity, account information or payment information and unauthorized acquisition or use of credit or debit card details, bank account information and mobile phone numbers and accounts. Under current credit card practices, we may be liable for use of funds on our Platform with fraudulent credit card data, even if the associated financial institution approved the credit card transaction.
Acts of fraud or other forms of cheating by our gaming customers may involve various tactics, including collusion with our employees and the exploitation of loopholes in our promotional bonus schemes. Successful exploitation of our systems could have negative effects on our product offerings, services and user experience and could harm our reputation. Additionally, we may inadvertently send overly generous promotional schemes that users or regulators force us to honor. Failure to discover such acts or schemes in a timely manner could result in harm to our operations. In addition, negative publicity related to such schemes could have an adverse effect on our reputation, potentially causing a material adverse effect on our business, financial condition, results of operations and prospects. In the event of the occurrence of any such issues with our existing Platform or product offerings, substantial engineering and marketing resources and management attention, may be diverted from other projects to correct these issues, which may delay other projects and the achievement of our strategic objectives.
In addition, any misappropriation of, or access to, users’ or other proprietary information or other breach of our information security could result in legal claims or legal proceedings, including regulatory investigations and actions, or liability for failure to comply with privacy and information security laws, including for failure to protect personal information or for misusing personal information, which could disrupt our operations, force us to modify our business practices, damage our reputation and expose us to claims from our users, regulators, employees and other persons, any of which could have an adverse effect on our business, financial condition, results of operations and prospects.
Despite the measures we have taken to detect and reduce the occurrence of fraudulent or other malicious activity on our platform, we cannot guarantee that any of our measures will be effective or will scale efficiently with our business. Our failure to adequately detect or prevent fraudulent transactions could harm our reputation or brand, result in litigation or regulatory action and lead to expenses that could adversely affect our business, financial condition, results of operations and prospects.
Our current and projected performance relies upon high-bandwidth data capabilities and disruptions in the availability of these may negatively impact our business, financial conditions, results of operations and prospects.
Our products require high-bandwidth data capabilities for placement of time-sensitive wagers. If high-bandwidth capabilities do not continue to grow or grow more slowly than generally anticipated, particularly for mobile devices, our user growth, retention, and engagement may be negatively impacted. In addition, the adoption of any laws or regulations that adversely affect the growth, popularity, or use of the Internet, including laws governing Internet neutrality, could decrease the demand for our products and increase our cost of doing business. Specifically, any laws that would allow Internet providers to impede access to content, or otherwise discriminate against content providers like us over their data networks, could have a material adverse effect on our business, financial condition, results of operations, and prospects.
7
Table of Contents
Additionally, if any of the third-party platforms used for distribution of our product offerings were to limit or disallow advertising on their platforms for whatever reason or technologies are developed that block the display of our ads, our ability to generate revenue could be negatively impacted. These changes could materially impact our business activities and practices, and if we or our advertising partners are unable to timely and effectively adjust to those changes, there could be an adverse effect on our business, financial condition, results of operations and prospects.
We rely on third-party service providers such as (i) providers to validate the identity and identify the location of our customers, (ii) payment processors to process deposits and withdrawals made by our customers into our platforms, (iii) marketing and customer communications systems providers, (iv) casino content, product and technology providers, and (v) other outsourced services providers, among others. If our third-party providers do not perform adequately or terminate their relationships with us, our costs may increase and our business, financial condition and results of operations could be adversely affected.
There is no guarantee that the third-party geolocation and identity verification systems that we rely on will perform adequately or will be effective. We rely on our geolocation and identity verification systems to ensure that we are in compliance with certain laws and regulations, and any service disruption to those systems would prohibit us from operating our Platform and would adversely affect our business. Additionally, incorrect or misleading geolocation and identity verification data with respect to our current or potential customers received from third-party service providers may result in us inadvertently allowing access to our offerings to individuals who should not be permitted to access them, or otherwise inadvertently deny access to individuals who should be able to access our offerings, in each case based on inaccurate identity or geographic location determination. Our third-party geolocation service providers rely on their ability to obtain information necessary to determine geolocation from mobile devices, operating systems, and other sources. Changes, disruptions or temporary or permanent failure to access such sources by our third-party service providers may result in their inability to accurately determine the location of our customers. Moreover, our inability to maintain our existing contracts with third-party service providers, or to replace them with equivalent third parties, may result in our inability to access geolocation and identity verification data necessary for our day-to-day operations. If any of these risks materializes, we may be subject to disciplinary action, fines, lawsuits, and our business, financial condition, results of operations and prospects could be adversely affected.
We also rely on a limited number of third-party payment processors to process deposits and withdrawals made by our customers on our Platform. If any of our third-party payment processors terminates its relationship with us or refuses to renew its agreement with us on commercially reasonable terms, we would need to find an alternate payment processor and may not be able to secure similar terms or replace such payment processor in an acceptable time frame. Further, the software and services provided by our third-party payment processors may not meet our expectations, contain errors or vulnerabilities, be compromised or experience outages. Any of these risks could cause us to lose our ability to accept online payments or other payment transactions or make timely payments to customers on our platform, any of which could make our Platform less trustworthy and convenient and adversely affect our ability to attract and retain our customers.
Our payments are made by credit card, debit card or through other third-party payment services, which subjects us to certain regulations and to the risk of fraud. We may in the future offer new payment options to customers that may be subject to additional regulations and risks and/or may incur higher transaction charges. We are also subject to a number of other laws and regulations relating to the payments we accept from our customers, including with respect to money laundering, money transfers, privacy and information security. Although we have implemented processes and have dedicated teams to ensure compliance with applicable rules and regulations, there have in the past, and there may be in the future, incidences where certain relevant information relating to “know your customer” (“KYC”) and/or anti-money laundering (“AML”) is not detected or established. If we fail to comply with applicable rules and regulations, we may be subject to civil or criminal penalties, fines and/or higher transaction fees and may lose our ability to accept online payments or other payment card transactions, which could make our offerings less convenient and attractive to our customers. If any of these events were to occur, our business, financial condition, results of operations and prospects could be adversely affected.
8
Table of Contents
For example, if we are deemed to be a money transmitter as defined by applicable regulation, we could be subject to certain laws, rules and regulations enforced by multiple authorities and governing bodies in the United States and numerous state and local agencies who may define money transmitter differently. For example, certain U.S. states may have a more expansive view of who qualifies as a money transmitter. Additionally, we could be subject to additional laws, rules and regulations related to the provision of payments and financial services, and if we expand into new jurisdictions, the various regulations and regulators governing our business that we are subject to will expand as well. In addition to fines, penalties for failing to comply with applicable rules and regulations could include criminal and civil proceedings, forfeiture of significant assets or other enforcement actions. We could also be required to make changes to our business practices or compliance programs as a result of regulatory scrutiny.
Additionally, our payment processors require us to comply with payment card network operating rules, which are set and interpreted by the payment card networks. The payment card networks could adopt new operating rules or interpret or reinterpret existing rules in ways that might prohibit us from providing certain offerings to some customers, be costly to implement or difficult to follow. We have agreed to reimburse our payment processors for fines they are assessed by payment card networks if we or the customers on our Platform violate these rules. Any of the foregoing risks could adversely affect our regulatory licensure, business, financial condition, results of operations and prospects.
Additionally, outages in our connectivity with our payment processors or their connectivity with downstream processors and networks might inhibit our ability to successfully process deposits and withdrawals on behalf of our customers. Errors in any of these systems may cause transactions to be processed multiple times or not at all, which may in turn result in customers being overcharged, overpaid or not paying us. Overcharging customers might result in representations, returns or chargebacks which might in turn jeopardize our relationships with our payment processors and potentially lead to fines and additional transaction costs or even the termination of our relationships with our payment processors. If we do not detect these errors timely then we might over-credit to or under-deduct from our customers’ casino accounts which might in turn result in customers being inadvertently given risk-free opportunities to play and thereby potentially win even larger amounts. We cannot guarantee that we will detect such outages or errors timeously nor that we will be able to recover any resulting losses from customers or third-party providers. Any attempts by us to recover such losses from our customers may cause our customers to have a negative experience and our brand or reputation may be negatively affected, and our customers may be less inclined to continue or resume utilizing our products or recommend our Platform to other potential customers. As such, any such outages or errors could harm our reputation, business, financial condition, results of operations, cash flows and prospects.
Furthermore, if any of our payment processors terminates its relationship with us or refuses to renew its agreement with us on commercially reasonable terms, we might need to find an alternate provider. Given the occasionally unique benefits and features of different payment options, exact replacement might not be possible, and we may not be able to secure similar terms or benefits or features or replace such payment processors in an acceptable time frame. Any of these risks could increase our costs and adversely affect our business, financial condition, results of operations or prospects. Further, any negative publicity related to any of our payment processors, including any publicity related to regulatory concerns, could adversely affect our reputation and brand, and could potentially lead to increased regulatory or litigation exposure.
We rely on third-party service providers for components of our marketing and customer communications processes and systems. Failures or outages in these systems may inhibit our ability to acquire new customers or retain existing customers. The nature of these processes means that certain customer personal information may be transmitted through these systems. If these systems are compromised in any way, then customer personal data might be compromised and in turn our customers’ perception of our reliability and security might be impacted. Any of the foregoing risks could adversely affect our business, financial condition, results of operations and prospects.
We rely on third-party providers for all of our casino games. These third parties are responsible for the design, development and maintenance of these games. In the past there have been outages during which time one or more games have been unavailable. There have also been incidents where errors in the design or development or maintenance of these games has result in erroneous payouts to customers, including instances where games have erroneously produced positive expected returns to customers and hence losses for the casino. We cannot be certain that we will always detect such outages and errors timeously nor that we will be able to recover any losses resulting from errors either from customers or third-party providers. Any outages or attempts by us to recover such losses from errors from our customers may cause our customers to have a negative experience and our brand or reputation may be negatively affected, and our customers may be less inclined to continue or resume utilizing our products or recommend our Platform to other potential customers. As such, any such outages and errors could harm our reputation, business and operating results.
9
Table of Contents
Furthermore, if any of our casino game suppliers terminates its relationship with us or refuses to renew its agreement with us on commercially reasonable terms, we might need to find an alternate provider. Given the unique design of each casino game, exact replacement would not be possible, and we may not be able to secure similar terms or product features or extent of product range or replace such providers in an acceptable time frame. Any of these risks could increase our costs and adversely affect our business, financial condition, results of operations or prospects. Further, any negative publicity related to any of our third-party casino game supplier partners, including any publicity related to regulatory concerns, could adversely affect our reputation and brand, and could potentially lead to increased regulatory or litigation exposure.
We may have difficulty accessing the services of banks, credit card issuers and payment processing services providers due to the nature of our business, which may make it difficult for players to effect transactions with financial institutions when making deposits or withdrawals from our platform.
Although financial institutions and payment processors are permitted to provide services to us and others in our industry, banks, credit card issuers and payment processing service providers may be hesitant to offer banking and payment processing services to real money gaming. Consequently, businesses involved in our industry, including our own, may encounter difficulties in establishing and maintaining banking and payment processing relationships with a full scope of services and generating market rate interest. Similarly, our customers’ banks and/or credit card providers might decline to allow our customers to effect transactions with online gaming or might block such attempted transactions. If we are unable to maintain our bank accounts or our customers are unable to use their credit cards, bank accounts or e-wallets to make deposits and withdrawals from our platforms, it would be difficult for us to operate our business and increase our operating costs, and would pose additional operational, logistical and security challenges which could result in an inability to implement our business plan and harm our business, financial condition, results of operations and prospects.
Our growth prospects may suffer if we are unable to develop successful game offerings or if we fail to pursue new and exciting additional game offerings. In addition, if we fail to make the right investment decisions in our offerings and technology platform, we may not attract and retain players and our revenue and results of operations may decline.
Ellmount Entertainment Ltd, was founded over a decade ago, under the laws of Malta, and was primarily focused on iGaming product offerings. We have repurposed Ellmount Entertainment into a marketing company during the first quarter 2022, and since then have transitioned existing customers to our HighRoller.com domain. We are focused on expanding the user base and we anticipate expanding further as new product offerings mature and as we pursue our growth strategies. The iGaming industry is characterized by continuous technological change, evolving regulatory and industry standards, frequent new product offerings and changes in customer expectations. To keep pace with the technological developments, achieve product acceptance and remain relevant to users, we will need to continue introducing new products and services as well as enhanced functionality on our existing suite of products and services. We must continually adapt to changing business environments and competing technologies and products. To the extent we are not able to adapt to new technologies and/or standards, experience delays in implementing such technologies or fail to accurately predict emerging technological trends, we may lose customers.
10
Table of Contents
The lack of public company experience of our management team could adversely impact our ability to comply with the reporting requirements of U.S. securities laws, which could have a materially adverse effect on our business.
Our officers have limited public company experience, which could impair our ability to comply with legal and regulatory requirements such as those imposed by Sarbanes-Oxley Act. These responsibilities include complying with federal securities laws and making required disclosures on a timely basis. Any of these deficiencies, weaknesses or lack of compliance could have a materially adverse effect on our ability to comply with the reporting requirements of the Exchange Act, which is necessary to maintain our public company status. If we were to fail to fulfill those obligations, our ability to continue as a U.S. public company would be in jeopardy in which event you could lose your entire investment in our Company.
As a public company, we are committed to maintaining robust internal controls and compliance with the Sarbanes-Oxley Act (SOX) to ensure the accuracy and reliability of our financial reporting, upholding transparency and preventing fraud by implementing rigorous procedures for data security and access controls.
The requirements of being a public company may strain our resources and divert management’s attention, and the increases in legal, accounting, cyber security, insurance and compliance expenses may be greater than we had anticipated. As a public company (and particularly after we are no longer an “emerging growth company”), we will incur significant legal, accounting and other expenses that the Company did not incur as a private company. We are subject to the reporting requirements of the Exchange Act and will be required to comply with the applicable requirements of the Sarbanes-Oxley Act and the Dodd- Frank Wall Street Reform and Consumer Protection Act, as well as the rules and regulations subsequently implemented by the SEC and the listing standards of, including changes in corporate governance practices and the establishment and maintenance of effective disclosure and financial controls. Compliance with these rules and regulations can be complex and burdensome. Our management and other personnel need to devote a substantial amount of time to these compliance initiatives. Moreover, these rules and regulations increase our historical legal and financial compliance costs and make some activities more time-consuming and costly. For example, becoming a public company has made it more difficult and more expensive for us to obtain director and officer liability insurance, and could also make it more difficult for us to attract and retain qualified members of the board of directors of the Company (the “Board”) as compared to High Roller as a private company. In particular, we expect to incur significant expenses and devote substantial management effort toward ensuring compliance with the requirements of Section 404 of the Sarbanes-Oxley Act, which will increase when we are no longer an “emerging growth company.” We have hired, and may need to continue to hire, additional accounting and financial staff, and engage outside consultants, all with appropriate public company experience and technical accounting knowledge, and maintain an internal audit function, which will increase our operating expenses. Moreover, we could incur additional compensation costs in the event that we decide to pay cash compensation closer to that of other public companies, which would increase our general and administrative expenses and could materially and adversely affect our profitability. We continue to evaluate these rules and regulations and cannot predict or estimate the amount of additional costs we may incur or the timing of such costs.
As a private company, we were not required to document and test our internal controls over financial reporting, our management was not required to certify the effectiveness of our internal controls and our independent registered public accounting firm was not required to opine on the effectiveness of our internal control over financial reporting. As an “emerging growth company,” we continue to be, exempt from certain of the SEC’s internal control reporting requirements. However, we will lose our emerging growth company status after 5 years and become subject to certain additional internal control over financial reporting management and auditor attestation requirements in the year in which we are deemed to be a large accelerated filer, which would occur once we are subject to Exchange Act reporting requirements for 12 months, have filed at least one SEC annual report and the market value of our common equity held by nonaffiliates exceeds $700 million as of the end of the prior fiscal year’s second fiscal quarter. In such event, we may not be able to complete our evaluation, testing and any required remediation in a timely fashion.
In order to seek an initial public offering and related listing on a national stock exchange, the Company, which until December 2021 was domiciled and had operated exclusively outside of the United States, effected a recapitalization into a Delaware corporation as its parent holding company as of December 21, 2021, and in February and March 2022 completed the branding and launching of its online casino platform. In 2021 and prior, the Company’s business, operations, assets, banking, accounting, legal, financial, and tax compliance were not subject to the securities and tax laws and regulations of the United States. As such, the Company’s accounting, financial and tax compliance systems had not been designed to be compliant with the securities and tax laws and regulations of the United States. In conjunction with the Company’s efforts to complete an initial public offering, the Company initiated efforts to prepare, for the first time, consolidated financial statements in accordance with GAAP and then be audited for the years ended December 31, 2022 and 2021 in accordance with U.S. GAAP and SEC reporting standards, as a result of which certain issues were identified that indicated the existence of deficiencies in the Company’s internal ability to prepare such consolidated financial statements, reflecting material weakness in the Company’s internal control over financial reporting.
During 2023, the Company expanded its financial and accounting staff, which included adding a Chief Financial Officer, a Controller, a Director of Accounting and Financial Reporting, as well as requisite supporting staff. As a result, the Company believes that it has adequate staff resources to address accounting and reporting requirements under U.S. GAAP and SEC reporting standards, and to implement internal controls. The Company has also retained the services of qualified outside consultants with expertise to perform specific accounting and finance tasks or functions, and to assist in the design and installation of accounting and internal control systems. The Company has not yet completed the process to establish adequate internal controls over financial reporting, and it expects that this process will continue through the remainder of 2025, and possibly longer. No assurance can be given that these efforts will be sufficient to fully develop and implement adequate disclosure controls and procedures and internal controls over financial reporting.
11
Table of Contents
In addition, our current internal controls and any new internal controls that we develop may become inadequate because of design-related issues and changes in our business, including increased complexity resulting from any revenue sharing arrangements and international expansion. Any failure to implement and maintain effective internal controls over financial reporting could adversely affect the results of assessments by our independent registered public accounting firm and their attestation reports, as well as impact their reviews and audits of our consolidated financial statements. If we are unable to certify the effectiveness of our internal controls or remedy the identified material weakness, or if our internal controls have any additional material weaknesses, we may not detect errors timely, our consolidated financial statements could be misstated, and we could be subject to regulatory scrutiny and a loss of confidence by stakeholders, which could harm our business and adversely affect the market price of our securities.
Recruitment and retention of our employees, including certain key employees, are vital to growing our business and meeting our business plans. The loss of any of our key executives or other key employees could harm our business.
We depend on a limited number of key personnel to manage and operate our business. The leadership of our current executive officers has been a critical element of our success and the departure, death or disability of any one of our executive officers or other extended or permanent loss of any of their services, or any negative market or industry perception with respect to any of them or their loss, could have a material adverse effect on our business. We cannot provide assurance that we will be able to attract or retain such highly qualified, and experienced personnel in the future. In addition, the loss of employees or the inability to hire necessary skilled employees could result in significant disruptions to our business, and the integration of replacement personnel could be time-consuming and expensive and cause additional disruptions to our business. If we do not succeed in attracting, hiring, and integrating excellent personnel, or retaining and motivating existing personnel, we may be unable to grow effectively and our business, financial condition, results of operations and prospects could be adversely affected.
Due to the nature of our business, we are subject to taxation in a number of jurisdictions and changes in, or new interpretation of, tax laws, tax rulings or their application by tax authorities could result in additional tax liabilities and could materially affect our business, financial condition, results of operations and prospects.
Our tax obligations are varied and include United States federal, state and international taxes due to the nature of our business. The tax laws that are applicable to our business are subject to interpretation, and significant judgment is required in determining our worldwide provision for income taxes. In the course of our business, there will be many transactions and calculations where the ultimate tax determination is uncertain. For example, compliance with the 2017 United States Tax Cuts and Jobs Act (“TCJA”) may require the collection of information not regularly produced within our Company, the use of estimates in our consolidated financial statements, and the exercise of significant judgment in accounting for its provisions. As regulations and guidance evolve with respect to the TCJA, and as we gather more information and perform more analysis, our results may differ from previous estimates and may materially affect our consolidated financial statements.
The gaming industry represents a significant source of tax revenue to the jurisdictions in which we operate. Gaming companies and B2B providers in the gaming industry (directly and/or indirectly by way of their commercial relationships with operators) are currently subject to significant taxes and fees in addition to normal corporate income taxes, and such taxes and fees are subject to increase at any time. From time to time, various legislators and other government officials have proposed and adopted changes in tax laws, or in the administration or interpretation of such laws, affecting the gaming industry. In addition, any worsening of economic conditions and the large number of jurisdictions with significant current or projected budget deficits, many of which have been made worse due to COVID-19, could intensify the efforts of governments to raise revenues through increases in gaming taxes and/or other taxes. It is not possible to determine with certainty the likelihood of changes in tax laws or in the administration or interpretation or enforcement of such laws. Any material increase, or the adoption of additional taxes or fees, could have a material adverse effect on our business, financial condition, results of operations and prospects.
Additionally, tax authorities may impose indirect taxes on Internet-related commercial activity based on existing statutes and regulations which, in some cases, were established prior to the advent of the Internet. Tax authorities may interpret laws originally enacted for mature industries and apply it to newer industries, such as ours. The application of such laws may be inconsistent from jurisdiction to jurisdiction. Our in-jurisdiction activities may vary from period to period which could result in differences in nexus from period to period.
We are subject to periodic review and audit by domestic and foreign tax authorities. Tax authorities may disagree with certain positions we have taken or that we will take, and any adverse outcome of such a review or audit could have a negative effect on our business, financial condition, results of operations and prospects. Although we believe that our tax provisions, positions and estimates are reasonable and appropriate, tax authorities may disagree with certain positions we have taken. In addition, economic and political pressures to increase tax revenue in various jurisdictions may make resolving tax disputes favorably more difficult.
12
Table of Contents
We have business operations located outside of the United States, which subjects us to additional costs and risks that could adversely affect our operating results.
Our operations are located in multiple jurisdictions and we may in the future pursue to expand into other additional markets. Compliance with international and local laws and regulations that apply to our operations increases our cost of doing business. As a result of our operations, we are subject to a variety of risks and challenges in managing an organization operating in various countries, including those related to:
● challenges caused by distance as well as language and cultural differences;
● general economic downturns;
● regulatory changes;
● political unrest, terrorism and the potential for other hostilities;
● overlapping or changes in tax regimes;
● reduced protection for intellectual property rights in some countries.
If we are unable to expand or adequately staff and manage our existing development operations, we may not realize, in whole or in part, the anticipated benefits from these initiatives (including lower development expenses), which in turn could materially adversely affect our business, financial condition, results of operations and prospects.
Our business includes significant international operations, and we are likely to be exposed to foreign currency transaction and translation risks. As a result, changes in the valuation of any major currency with which we conduct business in relation to other currencies could have positive or negative effects on our profitability and financial position.
Our global operations are likely to expose us to foreign currency transaction and translation risks. Currency transaction risk occurs in conjunction with purchases and sales of products and services that are made in currencies other than the local currency of the subsidiary involved, for example if the parent company pays, or transfers euro to a subsidiary in order to fund its expenses in local currencies. Currency translation risks occurs when the income statement and balance sheet of a foreign subsidiary is converted into currencies other than the local currency of the company involved, for example when the results of these subsidiaries are consolidated in the results of a parent company with a different reporting currency.
Due to our international operations, a significant portion of our business is denominated in foreign currencies. As a result, fluctuations in foreign currency and exchange rates may have an impact on our business, results of operations and financial position. Foreign currency exchange rates have fluctuated and may continue to fluctuate. Significant foreign currency exchange rate fluctuations may negatively impact our international revenue, which in turn affects our consolidated revenue. Currencies may be affected by internal factors, general economic conditions and external developments in other countries, all of which can have an adverse impact on a country’s currency. Currently, we are not party to any hedging transactions intended to reduce our exposure to exchange rate fluctuations. We may seek to enter into hedging transaction in the future, but we may be unable to enter into these transactions successfully, on acceptable terms or at all. We cannot predict whether we will incur foreign exchange losses in the future. Further, significant foreign exchange fluctuations resulting in a decline in the respective local currency may decrease the value of our foreign assets, as well as decrease our revenues and earnings from our foreign subsidiaries, which would reduce our profitability and adversely affect our financial position.
13
Table of Contents
We are currently operating in a period of economic uncertainty and capital markets disruption, which has been significantly impacted by geopolitical instability due to the ongoing military conflict between Russia and Ukraine.
U.S. and global markets are experiencing volatility and disruption following the escalation of geopolitical tensions and the start of the military conflict between Russia and Ukraine and Israel and Hamas. In February 2022, Russia launched a full-scale military invasion of Ukraine. Although the length and impact of the ongoing military conflict is highly unpredictable, the conflict in Ukraine and Middle East could lead to market disruptions, including significant volatility in commodity prices, and credit and capital markets. These military actions and the resulting sanctions could adversely affect the global economy and financial markets and lead to instability and lack of liquidity in capital markets, potentially making it more difficult for us to obtain additional funds. Any of the abovementioned factors could affect our business, prospects, financial condition, and operating results. The extent and duration of the military action, sanctions and resulting market disruptions are impossible to predict, but could be substantial. Any such disruptions may also magnify the impact of other risks described in this Annual Report.
Negative publicity of us or an adverse shift in public opinion regarding online casino wagering may adversely impact our business and user retention.
We operate in a public-facing industry where negative publicity, including from our customers, whether or not justified, can spread rapidly through, among other things, social media. To the extent that we are unable to respond timeously and appropriately to negative publicity or to the extent our responses to negative publicity are not fairly published or not positively received, our reputation and brands could be harmed. Moreover, even if we are able to respond in a timely and appropriate manner, we cannot predict how negative publicity may affect our reputation and business.
A negative change in the public’s opinion of online casino, or how politicians and other governmental authorities view online casino wagering could result in future legislation or new regulations restricting or prohibiting certain (or all) online casino wagering activities in certain jurisdictions, the result of which may negatively impact our business, financial condition, results of operations and prospects. Further, negative publicity of us or our product offerings, Platform or user experience in online casino wagering industry generally could lead to new restrictions and limitations on us and online casino wagering generally, which may have a negative impact on our business, financial condition, results of operations and prospects.
We and our employees also use social media to communicate externally. There is risk that the use of social media by us or our employees to communicate about our business or for any other purpose even in a personal capacity may give rise to negative publicity or liability or result in public exposure of personal information of our employees or customers, each of which could affect our reputation, revenue, business, results of operations and financial condition.
14
Table of Contents
We rely on several different marketing channels to acquire and retain customers and to promote our iCasino brands and our products. If we are not able to effectively acquire and retain customers via such channels then our business and operating results may be harmed.
In addition to our relationship with Spike Up Media, we utilize a variety of marketing initiatives, which may include traditional marketing channels (such as print), digital marketing (such as online display advertising, search engine marketing, social media and “affiliates” marketing) and retention marketing (including via email, text messages and social media). Traditional marketing channels are by their nature difficult to measure. Digital marketing is typically more measurable but somewhat more complex to undertake. Retention marketing is subject to customer consent which is not always granted or may be revoked. Our ability to execute on our marketing plans is subject to regulatory constraints in each market and it is not unusual for marketing-related regulations to change from time to time. If our ability to monitor and measure performance of any of these channels is compromised or if our ability to execute our plans in any of these channels is in any way inhibited then our ability to acquire and retain customers could be harmed and our business, financial condition, results of operations, cash flows and prospects may suffer.
In some regions and for some of our initiatives we may rely extensively on independent third-party marketers, known as “affiliates”. “Affiliates” is an industry term that describes independent third-parties which assist the Company to acquire new customers and which are generally paid on a revenue-share or cost-per-acquisition basis. Despite the word “affiliates”, these are independent parties that are not otherwise affiliated with the Company in the ordinary sense of the word. Notwithstanding that in some jurisdictions for license purposes we are deemed to control these “affiliates” marketers, their actions in the marketing of our brands are not directly within our control and hence actions, errors, omissions or intentional malfeasance on their part may cause damage to our brands, our business, our prospects and our financial results before we are able to detect such actions, errors, omissions or intentional malfeasance and/or do anything to mitigate the effects thereof. In particular, we can be held accountable by regulatory authorities for actions by such third parties in contravention of our license in a given jurisdiction, which in turn may lead to fines, license suspension, loss of license or other censure, which may in turn harm our business, our prospects and/or our financial performance. Our agreements with such marketers sometimes make us obliged to pay them an ongoing share of revenues derived from customers that they introduce to us, or sometimes such that we are required to pay them a “cost per acquisition” capitation fee for each customer introduced, or sometimes a combination of both. Such third-party “affiliates” are under no obligation to continue introducing customers to us, but we may be obliged to continue to pay them future revenue shares, where applicable, nonetheless.
In some regions we may make use of search engine marketing ("SEM", which is the purchase of advertising against keywords on search engines) and search engine optimization ("SEO", which is the adaptation of our websites and employment of other techniques in order to achieve more favorable rankings when customers search for gaming-related keywords on search engines). Search engines such as Google regularly change their internal proprietary and confidential algorithms by which SEM and SEO operate and typically do so in ways that are not predictable as to timing or effect. If we fail to adapt our marketing methods to these changes or if our competitors do so better than we do then our business, financial condition, results of operations, cash flows and prospects may suffer.
Several of our marketing channels rely on being able to successfully track customers across different websites and apps and/or to augment our own data with additional marketing data for purposes of measuring and monitoring the effectiveness of our marketing campaigns and/or effectively adapting or executing on our marketing campaigns. The ability to do this is under threat of restrictive legislation in some jurisdictions and technology platform providers such as Google and Apple have taken steps to restrict such tracking and augmentation and we expect that further restrictions may be added in future. Such restrictions may hamper our ability to acquire or retain customers and thereby cause our business, financial condition, results of operations, cash flows and prospects to suffer.
15
Table of Contents
Risks Related to Government Regulation
Our business is subject to a variety of United States and foreign laws, many of which are unsettled and still developing. Any change in regulations or their interpretation, or the regulatory climate applicable to our products and services, or changes in tax rules and regulations or interpretation thereof related to our products and services, could adversely impact our ability to operate our business, which could have a material adverse effect on our business, financial condition, results of operations and prospects.
We are subject to laws and regulations relating to real-money online casino wagering in the jurisdictions in which we conduct our business or in some circumstances, of those jurisdictions in which we offer our product offerings. We are also subject to the general laws and regulations that apply to all e-commerce businesses, such as those related to privacy and personal information, tax and consumer protection. These laws and regulations vary from one jurisdiction to another and future legislative and regulatory action, court decisions or other governmental action, which may be affected by, among other things, political pressures, attitudes and climates, as well as personal biases, may have a material impact on our operations and financial results. In particular, some jurisdictions have introduced regulations attempting to restrict or prohibit online gaming, while others have taken the position that online gaming should be licensed and regulated and have adopted or are in the process of considering legislation and regulations to enable that to happen. Additionally, some jurisdictions in which we may operate could presently be unregulated or partially regulated and therefore more susceptible to the enactment or change of laws and regulations.
Future legislative and regulatory action, and court decisions or other governmental action, may have a material impact on our operations and financial results. Governmental authorities could view us as having violated local laws, despite our efforts to obtain all applicable licenses or approvals. Further, there is risk that governmental authorities or courts could determine that our casino offerings constitute unauthorized gambling or that legislation is enacted in jurisdictions in which we operate casino offerings that makes our casino offerings unauthorized gambling, which could negatively impact our operations and business results. There is also a risk that civil and criminal proceedings, including class actions brought by or on behalf of prosecutors or public entities or incumbent monopoly providers, or private individuals, could be initiated against us, Internet service providers, credit card and other payment processors, financial institutions, advertisers and others involved in the online casino and gaming industries. Such potential proceedings could involve substantial litigation expense, penalties, fines, seizure of assets, injunctions or other restrictions being imposed upon us or our licensees or other business partners, while diverting the attention of key executives. Such proceedings could have a material adverse effect on our business, financial condition, results of operations and prospects, as well as impact our reputation.
There can be no assurance that legally enforceable legislation will not be proposed and passed in jurisdictions relevant or potentially relevant to our business to prohibit, legislate or regulate various aspects of the online casino and retail and online gaming industries (or that existing laws in those jurisdictions will not be interpreted negatively). Compliance with any such legislation may have a material adverse effect on our business, financial condition, results of operations and prospects, either as a result of our determination that a jurisdiction should be blocked, or because a local license or approval may be costly for us or our business partners to obtain and/or such licenses or approvals may contain other commercially undesirable conditions.
In the United States, the Unlawful Internet Gambling Enforcement Act of 2006 (“UIGEA”) prohibits among other things, the acceptance by a business of a wager by means of the Internet where such wager is prohibited by any federal or state law where initiated, received or otherwise made. Under UIGEA severe criminal and civil sanctions may be imposed on the owners and operators of such systems and on financial institutions that process wagering transactions. The law contains a safe harbor for wagers placed within a single state (disregarding intermediate routing of the transmission) where the method of placing the wager and receiving the wager is authorized by that state’s law, provided the underlying regulations establish appropriate age and location verification.
The Illegal Gambling Business Act (“IGBA”) makes it a crime to conduct, finance, manage, supervise, direct or own all or part of an “illegal gambling business” and the Travel Act makes it a crime to use the mail or any facility in interstate commerce with the intent to “distribute the proceeds of any unlawful activity,” or “otherwise promote, manage, establish, carry on, or facilitate the promotion, management, establishment, or carrying on, of any unlawful activity.” For there to be a violation of either the IGBA or the Travel Act there must be a violation of underlying state law.
16
Table of Contents
Until 2011, there was uncertainty as to whether the Federal Wire Act of 1961 (the “Wire Act”) prohibited states from conducting intrastate lottery transactions via the Internet if such transactions crossed state lines. In late 2011, the Office of Legal Counsel (the “OLC”) of the United States Department of Justice (“DOJ”) issued an opinion which concluded that the prohibitions of the Wire Act were limited to sports gambling and thus did not apply to state lotteries at all (the “2011 DOJ opinion”). Following the issuance of the 2011 DOJ opinion, within the past few years, state-authorized Internet casino gaming has been launched in Delaware, New Jersey and Pennsylvania and has been approved in Michigan and state authorized online poker has been launched in Nevada. In 2018, at the request of the Criminal Division, the OLC reconsidered the 2011 DOJ opinion’s conclusion that the Wire Act was limited to sports gambling. On January 14, 2019, the OLC published a legal opinion dated November 2, 2018 (the “2018 DOJ opinion”), which concluded that the 2011 DOJ opinion had incorrectly interpreted the Wire Act. In the 2018 DOJ opinion, the OLC concluded that the restrictions on the transmission in interstate or foreign commerce of bets and wagers in the Wire Act were not limited to sports gambling but instead applied to all bets and wagers. The OLC also found that the enactment of the UIGEA described above did not modify the scope of the Wire Act. The OLC acknowledged that its conclusion in the 2018 DOJ opinion, which was contrary to the 2011 DOJ opinion, will make it more likely that the executive branch’s view of the law will be tested in the courts. At this time, we are unable to determine whether the 2018 DOJ opinion will be upheld by the courts, or what impact it will have on us or our customers.
Our growth prospects depend on the legal status of real-money online casino gaming in various jurisdictions, and legalization may not occur in as many jurisdictions as we expect or may occur at a slower pace than we anticipate or may be accompanied by legislative or regulatory restrictions or taxes that make it impracticable or less attractive to operate, which could adversely affect our future results of operations and make it more difficult to meet our expectations for financial performance.
A number of jurisdictions do not prohibit, have legalized, or are currently considering legalizing, real-money gaming, and our growth, business, financial condition, results of operations and prospects are significantly dependent upon the legalization of real-money gaming expanding to new jurisdictions. Our business plan is partially based upon real-money gaming becoming legal for a specific percent of the population on a yearly basis; however, this may not occur as we have anticipated. Additionally, if a large number of additional jurisdictions enact real-money gaming legislation and we are unable to obtain or are otherwise delayed in obtaining the necessary licenses to operate online gaming websites in such jurisdictions where such games are legalized, our future growth in online gaming could be materially impaired.
As we enter into new jurisdictions, local authorities may legalize real-money online gaming in a manner that is unfavorable to us. As a result, we may encounter legal, regulatory and political challenges that are difficult or impossible to foresee and which could result in an unforeseen adverse impact on planned revenues or costs associated with the new opportunity. Jurisdictions that have established state-run monopolies may limit opportunities for private sector participants like us. Jurisdictions may also impose substantial tax rates on online gaming revenue. Such taxes would make it more costly and less desirable for us to launch in a given jurisdiction, while tax increases in any of our existing jurisdictions may adversely impact our profitability.
Therefore, even in cases in which a jurisdiction purports to license and regulate online gaming, the licensing and regulatory regimes can vary considerably in terms of their business-friendliness and at times may be intended to provide incumbent operators with advantages over new licensees. Therefore, some “liberalized” regulatory regimes are considerably more commercially attractive than others.
Failure to comply with regulatory requirements or to successfully obtain a license or permit applied for could adversely impact our ability to comply with licensing and regulatory requirements or to obtain or maintain licenses in other jurisdictions, or could cause financial institutions, online and mobile platforms and distributors to stop providing services to us.
Compliance with the various regulations applicable to real-money wagering is costly and time-consuming. Regulatory authorities at the non-United States, United States federal, state and local levels have broad powers with respect to the regulation and licensing of realmoney gaming operations and may revoke, suspend, condition or limit our real-money gaming licenses, impose substantial fines on us and take other actions, any one of which could have a material adverse effect on our business, financial condition, results of operations and prospects. These laws and regulations are dynamic and subject to potentially differing interpretations, and various legislative and regulatory bodies may expand current laws or regulations or enact new laws and regulations regarding these matters. We will strive to comply with all applicable laws and regulations relating to our business. It is possible, however, that these requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules. Noncompliance with any such law or regulations could expose us to claims, proceedings, litigation and investigations by private parties and regulatory authorities, as well as substantial fines and negative publicity, each of which may materially and adversely affect our business, financial condition, results of operations and prospects.
17
Table of Contents
Any real-money gaming license could be revoked, suspended or conditioned at any time. The loss of a license in one jurisdiction could trigger the loss of a license or affect our eligibility for such a license in another jurisdiction, and any of such losses, or potential for such loss, could cause us to cease offering some or all of our offerings in the impacted jurisdictions. We may be unable to obtain or maintain all necessary registrations, licenses, permits or approvals, and could incur fines or experience delays related to the licensing process, which could adversely affect our operations. Our delay or failure to obtain or maintain licenses in any jurisdiction may prevent us from distributing our offerings, increasing our customer base and/or generating revenues. We cannot assure you that we will be able to obtain and maintain the licenses and related approvals necessary to conduct our online casino wagering operations. Any failure to maintain or renew our existing licenses, registrations, permits or approvals could have a material adverse effect on our business, financial condition, results of operations and prospects.
Additionally, a gaming regulatory body may refuse to issue or renew a gaming license or restrict or condition the same, based on our past or present activities or our current or former directors, officers, employees, stockholders or third parties with whom we have relationships, which could adversely affect our business, financial condition, results of operations and prospects. If additional gaming regulations are adopted in a jurisdiction in which we operate, such regulations could impose restrictions or costs that could have a significant adverse effect on us. From time to time, various proposals are introduced in the legislatures of some of the jurisdictions in which we have existing or planned operations that, if enacted, could adversely affect our directors, officers, key employees, or other aspects of the company’s operations. To date, we believe we have obtained all governmental licenses, findings of suitability, registrations, permits and approvals necessary for our operations. However, we can give no assurance that any additional licenses, permits and approvals that may be required will be given or that existing ones will be renewed or will not be revoked. Renewal is subject to, among other things, continued satisfaction of suitability requirements of our directors, officers, key employees and stockholders. Any failure to renew or maintain our licenses or to receive new licenses when required would have a material adverse effect on our business, financial condition, results of operations and prospects.
Our inability to continue to conduct gaming operations under license from the Government of Curacao could adversely impact our online gaming operations in various jurisdictions and adversely affect our financial condition and operating cash flows.
The Government of Curacao has been in the process of modernizing its gambling legislation and has created a new independent licensing and supervisory authority for all games of chance. Gaming operators that wish to acquire an online gaming license in Curacao must apply directly to the Curacao Gaming Control Board. This process replaces the prior master license and sublicense system, as the Curacao Gaming Control Board will issue and maintain all licenses directly.
With regard to our gaming activities based on our prior Curacao sublicense, the Government of Curacao had previously approved four master license holders, based on National Decrees, and all operators and prospective operators interested in Curacao online gaming licenses were required to apply for a sublicense from one of those master license holders. We previously obtained our gaming sublicense with Gaming Services Provider N.V., holder of a Master License granted by the Central Government of Curaçao. This sublicense provided us with the ability to operate iCasino games, as well as poker, betting, lottery and other games of chance, and had been extended through July 30, 2024.
As part of this change in gambling legislation, the Curacao Gaming Control Board has mandated that in order to receive a license under the new system, the applying entity must be domiciled in Curacao. In March 2024 we applied through our Interstellar Entertainment NV subsidiary, an entity incorporated in Curacao, to obtain a license directly from the government of Curacao and we received a license in July 2024. The loss of our Curacao license could significantly interfere with our online gaming operations, and could have a material adverse impact on our financial condition and operating cash flows. Furthermore, in such event, we could be unable to conduct online gaming operations for an indeterminate period of time, and there can be no assurances that we would be able to identify legally sufficient alternatives to be able to conduct our gaming operations at their current levels.
18
Table of Contents
In some jurisdictions, our key executives, certain employees or other individuals related to the business will be subject to licensing or compliance requirements. Failure by such individuals to obtain the necessary licenses or comply with individual regulatory obligations could cause the business to be non-compliant with its obligations, or imperil its ability to obtain or maintain licenses necessary for the conduct of the business.
As part of obtaining real-money gaming licenses, the responsible gaming authority will generally determine suitability of certain directors, officers and employees and, in some instances, significant stockholders. The criteria used by gaming authorities to make determinations as to who requires a finding of suitability or the suitability of an applicant to conduct gaming operations varies among jurisdictions, but generally requires extensive and detailed application disclosures followed by a thorough investigation. Gaming authorities typically have broad discretion in determining whether an applicant should be found suitable to conduct operations within a given jurisdiction. If any gaming authority with jurisdiction over our business were to find an applicable officer, director, employee or significant stockholder of ours unsuitable for licensing or unsuitable to continue having a relationship with us, we would be required to sever our relationship with that person. Furthermore, such gaming authorities may require us to terminate the employment of any person who refuses to file required applications. Either result could have a material adverse effect on our business, financial condition, results of operations and prospects.
Risks Related to Intellectual Property and Data Security
We rely on information technology and other systems and platforms, and failures, errors, defects or disruptions therein could diminish our brand and reputation, subject us to liability, disrupt our business, affect our ability to scale our technical infrastructure and adversely affect our operating results and growth prospects. Our product offerings and other software applications and systems, and certain third-party platforms that we use could contain undetected errors.
Our technology infrastructure is critical to the performance of our Platform and product offerings and to user satisfaction. We devote significant resources to network and data security to protect our systems and data. However, our systems may not be adequately designed with the necessary reliability and redundancy to avoid performance delays or outages that could be harmful to our business. We cannot assure you that absolute security will be provided by the measures we take to: prevent or hinder cyber-attacks and protect our systems, data and user information; to prevent outages, data or information loss, and fraud; and to prevent or detect security breaches. Such measures include a disaster recovery strategy for server and equipment failure, back-office systems and the use of third parties for certain cybersecurity services. We have experienced, and we may in the future experience, website disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, human or software errors and capacity constraints. To date, such disruptions, individually and in the aggregate, have not had a material impact us; however, future disruptions from unauthorized access to, fraudulent manipulation of, or tampering with our computer systems and technological infrastructure, or those of third parties, could result in a wide range of negative outcomes, each of which could materially adversely affect our business, financial condition, results of operations and prospects. At this stage of our development, our board of directors, as a group, will actively oversee cybersecurity risks and will be committed to the prevention, timely detection and mitigation of the effects of any such incidents on our company’s operations. While our board of directors will oversee cybersecurity risk management, our management will be responsible for day-to-day risk management processes. Our board of directors has tasked our Chief Technology Officer and other management with the responsibility to manage our cybersecurity initiatives including with respect to our customer data and game suppliers databases. Our board of directors will receive regular reports from management, including our Chief Technology Officer, on material cybersecurity risks and the degree of our company’s exposure to those risks. Management will also work with third-party service providers to maintain appropriate controls. While we believe this approach is the most effective approach for addressing our cybersecurity risks at this time we cannot assure that it will be adequate to our evolving growth needs.
19
Table of Contents
Additionally, our product offerings may contain errors, bugs, flaws or corrupted data, and these defects may become apparent only after their launch and could result in a vulnerability that could compromise the security of our systems. If a particular product offering is unavailable when users attempt to access it or navigation through our platforms is slower than they expect, users may be unable to use our product offerings as desired and may be less likely to return to our platforms as often, if at all. Furthermore, programming errors, defects and data corruption could disrupt our operations, adversely affect the experience of our users, harm our reputation, cause our users to stop utilizing our platforms, divert our resources or delay market acceptance of our product offerings, any of which could result in legal liability to us or harm our business, financial condition, results of operations and prospects. Insufficient business continuity management could diminish our brand and reputation, subject us to liability, disrupt our business and adversely affect our operating results and growth prospects, and failure of planned availability and continuity solutions and disaster recovery when activated in response to an incident could result in system interruptions and degradation of service.
If our user base and engagement continue to grow, and the amount and types of product offerings continue to grow and evolve, we will need an increasing amount of technical infrastructure, including network capacity and computing power, to continue to satisfy our users’ needs. Such infrastructure expansion may be complex, and unanticipated delays in completing these projects or availability of components may lead to increased project costs, operational inefficiencies, or interruptions in the delivery or degradation of the quality of our product offerings. In addition, there may be issues related to this infrastructure that are not identified during the testing phases of design and implementation, which may become evident only after we have started to fully use the underlying equipment or software, that could further degrade the user experience or increase our costs. As such, we could fail to continue to effectively scale and grow our technical infrastructure to accommodate increased demands. In addition, a lack of resources (e.g., hardware, software, personnel and service providers) could result in an inability to scale our services to meet business needs, system interruptions, degradation of service or operational mistakes. Our business also may be subject to interruptions, delays or failures resulting from adverse weather conditions, other natural disasters, power loss, terrorism, cyber-attacks, public health emergencies (such as COVID-19) or other catastrophic events.
We believe that if our users have a negative experience with our product offerings, or if our brand or reputation is negatively affected, users may be less inclined to continue or resume utilizing our product offerings or to recommend our Platform to other potential users. As such, a failure or significant interruption in our service could harm our reputation, our business, financial condition, results of operations and prospects.
Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such access, disclosure, other loss or theft of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to users, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects.
The secure maintenance and transmission of user information is a critical element of our operations. Our information technology and other systems that maintain and transmit user information, or the systems of third-party service providers and business partners, may be compromised by a malicious third-party penetration of our network security, or the network security of a third-party service provider or business partner, or impacted by intentional or unintentional actions or inactions by our employees, or the actions or inactions of a third-party service provider or business partner. As a result, our users’ information may be lost, disclosed, accessed or taken without such users’ consent. We have experienced attempts to breach our systems and other similar incidents in the past. For example, we have been and expect that we will continue to be subject to attempts to gain unauthorized access to or through our information systems or those we develop for our customers, whether by our employees or third parties, including phishing attacks by computer programmers and hackers who may develop and deploy viruses, worms or other malicious software programs. To date these attacks have not had a material impact on our operations or financial results, but we cannot provide assurance that they will not have a material impact in the future, including by overloading our systems and network and preventing our product offering from being accessed by legitimate users.
20
Table of Contents
We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit confidential and sensitive information. Advances in computer capabilities, new technological discoveries or other developments may result in the whole or partial failure of this technology to protect transaction data or other confidential and sensitive information from being breached or compromised. In addition, websites are often attacked through compromised credentials, including those obtained through phishing and credential stuffing. Our security measures, and those of our third-party service providers, may not detect or prevent all attempts to breach our systems, denial-of-service attacks, viruses, malicious software, break-ins, phishing attacks, social engineering, security breaches or other attacks and similar disruptions that may jeopardize the security of information stored in or transmitted by our websites, networks and systems or that we or such third parties otherwise maintain, including payment card systems, which may subject us to fines or higher transaction fees or limit or terminate our access to certain payment methods. We and such third parties may not anticipate or prevent all types of attacks until after they have already been launched. Further, techniques used to obtain unauthorized access to or sabotage systems change frequently and may not be known until launched against us or our third-party service providers.
In addition, security breaches can also occur as a result of non-technical issues, including intentional or inadvertent breaches by our employees or by third parties. These risks may increase over time as the complexity and number of technical systems and applications we use also increases. Breaches of our security measures or those of our third-party service providers or cybersecurity incidents could result in: unauthorized access to our sites, networks and systems; unauthorized access to and misappropriation of user information, including users’ personally identifiable information, or other confidential or proprietary information of ourselves or third parties; viruses, worms, spyware or other malware being served from our sites, networks or systems; deletion or modification of content or the display of unauthorized content on our sites; interruption, disruption or malfunction of operations; costs relating to breach remediation, deployment of additional personnel and protection technologies, response to governmental investigations and media inquiries and coverage; engagement of third-party experts and consultants; or litigation, regulatory action and other potential liabilities. In the past, the online gaming industry has experienced social engineering, phishing, malware and similar attacks and threats of denial-of-service attacks, none of which to date have been material to our business; however, such attacks could in the future have a material adverse effect on our operations. If any of these breaches of security should occur and be material, our reputation and brand could be damaged, our business may suffer, we could be required to expend significant capital and other resources to alleviate problems caused by such breaches, and we could be exposed to a risk of loss, litigation or regulatory action and possible liability. We cannot guarantee that recovery protocols and backup systems will be sufficient to prevent data loss. Actual or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants.
In addition, any party who is able illicitly to obtain a user’s password could access the user’s transaction data or personal information, resulting in the perception that our systems are insecure. Any compromise or breach of our security measures, or those of our third-party service providers, could violate applicable privacy, data protection, data security, network and information systems security and other laws and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, results of operations and prospects. We continue to devote significant resources to protect against security breaches or we may need to in the future to address problems caused by breaches, including notifying affected users and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.
Failure to protect or enforce our intellectual property rights, the confidentiality of our trade secrets and confidential information, or the costs involved in such enforcement could harm our business, financial condition, results of operations and prospects.
We rely on trademark, copyright, trade secret and domain-name-protection laws to protect our rights in intellectual property. However, third parties may knowingly or unknowingly infringe our rights in intellectual property, third parties may challenge intellectual property rights held by us, and pending and future trademark may not be approved. In any of these cases, we may be required to expend significant time and expense to prevent infringement of or to enforce our rights. Notwithstanding our intellectual property rights, there can be no assurance that others will not offer products or services that are substantially similar to ours and compete with our business.
21
Table of Contents
Circumstances outside our control could pose a threat to our intellectual property rights. For example, effective intellectual property protection may not be available in the United States or other countries in which we operate or intend to operate our business. Also, the efforts we have taken to protect our intellectual property rights may not be sufficient or effective, and any significant impairment of our intellectual property rights could harm our business or our ability to compete. If we are unable to protect our proprietary offerings and features, competitors may reverse engineer and/or copy them. Additionally, protecting our intellectual property rights is costly and time-consuming. Any unauthorized use of our intellectual property or disclosure of our confidential information or trade secrets could make it more expensive to do business, thereby harming our operating results. Furthermore, if we are unable to protect our intellectual property rights or prevent unauthorized use or appropriation by third parties, the value of our brands and other intangible assets may be diminished, and competitors may be able to more effectively mimic our product offerings and services. Any of these events could seriously harm our business, financial condition, results of operations and prospects.
Our collection, storage and use, including sharing and international transfers, of personal data are subject to applicable data protection and privacy laws, and any actual or perceived failure to comply with such laws may harm our reputation and business or expose us to fines, civil claims (including class actions), and other enforcement action. The protection of personal information is becoming increasingly regulated and changes in applicable laws may require changes to our policies, practices, procedures and personnel which may require material expenditures and harm our financial condition and results of operations.
We are, and will increasingly become as we seek to expand our business, subject to numerous domestic and foreign laws, regulations, rules and standards, as well as associated industry standards, policies and contractual or other obligations, relating to the collection, use, storage, safeguarding, retention, security, destruction, disclosure, transfer, and/or other processing of personal data (collectively, “Processing”) in the jurisdictions in which we operate (collectively, “Data Protection Requirements”). These Data Protection Requirements often vary significantly by jurisdiction. While we have taken steps to comply with Data Protection Requirements, we cannot assure you that our efforts to achieve and remain in compliance have been and/or will continue to be, fully successful. If we fail, or are perceived to have failed, to address or comply with any such Data Protection Requirements, this could result in enforcement actions against us that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some Processing of personal data or orders to destroy or not use personal data. Further, individuals or other relevant stakeholders could bring a variety of claims against us for our actual or perceived failure to comply with the Data Protection Requirements. Any of these events could have a material adverse effect on our reputation, business, or financial condition, and could lead to a loss of actual or prospective customers, collaborators or partners; result in an inability to Process personal data or to operate in certain jurisdictions; limit our ability to develop or commercialize current or prospective offerings or services; or require us to revise or restructure our operations.
For example, the European Union’s General Data Protection Regulation (“GDPR”) applies to any Processing operations carried out in the context of the activities of an establishment in the EEA, as well as to any other Processing operations relating to the offering of goods or services to individuals in the EEA and/or the monitoring of individuals’ behavior in the EEA. Also, notwithstanding the United Kingdom’s withdrawal from the EU, by operation of the so called ‘UK GDPR’ (i.e., the GDPR as it continues to form part of the law of the United Kingdom by virtue of section 3 of the EU (Withdrawal) Act 2018 and as subsequently amended) (“UK GDPR”) the GDPR continues to apply in substantially equivalent form to Processing operations carried out in the context of the activities of an establishment in the United Kingdom and any other Processing relating to the offering of goods or services to individuals in the United Kingdom and/or monitoring of individuals’ behavior in the United Kingdom. Consequently, any reference we make to the GDPR also refers to the UK GDPR in the context of the United Kingdom, unless the context indicates otherwise.
The GDPR further provides that EEA Member States may introduce specific, supplementary requirements related to the Processing of “special categories of personal data”; as well as personal data related to criminal offences or convictions. In the United Kingdom, the UK Data Protection Act 2018 complements the UK GDPR in this regard. This fact may lead to greater divergence on the law that applies to the Processing of such personal data across the EEA and/or United Kingdom, which may increase our costs and overall compliance risk.
22
Table of Contents
The GDPR and such supplementary requirements impose stringent data privacy and security requirements. In particular, the GDPR imposes several requirements relating to ensuring there is a lawful basis for Processing personal data, extends the rights of individuals to whom the personal data relates, materially expands the definition of what is expressly noted to constitute personal data, requires additional disclosures about how personal data is to be used, imposes limitations on retention of personal data, imposes strict rules on the transfer of personal data out of the EEA/UK to most third countries, creates mandatory data breach notification requirements in certain circumstances and establishes onerous new obligations on service providers, or processors, who Process personal data simply on behalf of others. It also significantly increased penalties for noncompliance.
Additionally, following the United Kingdom’s withdrawal from the European Union on January 31, 2020 and end of the post-Brexit transition period on December 31, 2020, as noted above, the United Kingdom has introduced the UK GDPR which currently makes the privacy regimes of the EEA and United Kingdom similar, though it is possible that either the European Union, and consequently those further states that make up the remainder of the EEA, or United Kingdom could elect to change their approach and create differences in legal requirements and regulation in this area. On June 28, 2021, the European Commission issued an adequacy decision under the GDPR which allows transfers (other than those carried out for the purposes of United Kingdom immigration control) of personal data from the EEA to the United Kingdom to continue without restriction for a period of four years ending June 27, 2025.
After that period, the adequacy decision may be renewed, however, only if the United Kingdom continues to ensure an adequate level of data protection. During these four years, the European Commission will continue to monitor the legal situation in the United Kingdom and could intervene at any point if the United Kingdom deviates from the level of data protection in place at the time of issuance of the adequacy decision. If the adequacy decision is withdrawn or not renewed, transfers of personal data from the EEA to the United Kingdom will require a valid ‘transfer mechanism’ and we may be required to implement new processes and put new agreements in place (such as the then-current form of the European Commission-issued Standard Contractual Clauses), to enable transfers of personal data from the EEA to the United Kingdom to continue.
We are also subject to the Data Protection (Bailiwick of Guernsey) Law, 2017 (as amended) (the “Guernsey DP Law”), which largely follows GDPR and requires us to control and process personal data only for proper purposes and in accordance with statutory data protection principles, and the Data Protection Law of Colombia, which requires the consent of the customer to their data being transmitted outside of Colombia.
Because our products and services rely on the movement of data across national boundaries, global privacy and data security concerns could result in additional costs and liabilities to us or inhibit sales of our products and/ or services globally. In particular, European data protection laws, such as the GDPR, generally prohibit the transfer of personal data from the EEA, United Kingdom and Switzerland to the United States, and most other countries, known as ‘third countries’, in respect of which the European Commission or other relevant regulatory body has not issued a so-called ‘adequacy decision’, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.
One of the primary safeguards used for transfers of personal data to the United States was the E.U.-U.S. Privacy Shield framework administered by the U.S. Department of Commerce. On July 16, 2020, the Court of Justice of the European Union, or CJEU, in a decision known as ’Schrems II’, invalidated the EU-U.S. Privacy Shield, under which personal data could be transferred from the EEA and the United Kingdom to U.S. entities that had self-certified under the Privacy Shield. To align with the CJEU’s decision in respect of the E.U.-U.S. Privacy Shield, on September 8, 2020, the UK government similarly invalidated the use of the EU-U.S. Privacy Shield as a mechanism for lawful personal data transfers from the United Kingdom to the United States under the UK GDPR and the Swiss Federal Data Protection and Information Commissioner announced that the Swiss-U.S. Privacy Shield regime was also inadequate for the purposes of personal data transfers from Switzerland to the U.S. entities who had self-certified under the Swiss Privacy Shield. The CJEU Schrems II decision mentioned above also cast doubt on the ability to use one of the primary alternatives to the E.U.-U.S. Privacy Shield and Swiss-U.S. Privacy Shield, namely, the European Commission’s Standard Contractual Clauses, lawfully to transfer personal data to the United States and most other third countries.
23
Table of Contents
On June 4, 2021, the European Commission published new versions of the Standard Contractual Clauses. These must be used for all new transfers of personal data from the EEA to third countries starting September 27, 2021, and all existing transfers of personal data from the EEA to third countries relying on the existing versions of the Standard Contractual Clauses must be replaced by December 27, 2022. A transition period set for the adoption of the updated standard clauses ended on December 27, 2022. The implementation of the new Standard Contractual Clauses will necessitate significant contractual overhaul of our data transfer arrangements with partners, sub-processors and vendors. Use of both the existing and the new Standard Contractual Clauses must, following the Schrems II decision, now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional supplementary technical, organizational and/or contractual measures and/or contractual provisions may need to be put in place; however, the nature of these additional measures is currently uncertain. At present, there are few if any viable alternatives to the Privacy Shield and the Standard Contractual Clauses and there remains some uncertainty with respect to the nature and efficacy of such supplementary measures in ensuring an adequate level of protection of personal data.
As such, our transfers of personal data to third countries may not comply with European data protection laws and may increase our exposure to the GDPR’s heightened sanctions for breaching of its cross-border data protection rule, including fines of up to 4% of annual global revenue or €20 million ($21.2 million), or 4% of annual global revenue of the preceding year, whichever is higher, and injunctions against transfers. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the Standard Contractual Clauses can and cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate and/or engage providers and/or otherwise transfer personal data, it could affect the manner in which we receive and/or provide services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results and generally increase compliance risk. Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of operating our business.
In recent years, U.S. and European lawmakers and regulators have expressed concern over electronic marketing and the use of third-party cookies, web beacons and similar technology for online behavioral advertising. On June 20, 2019, the U.K.’s Information Commissioner (the “ICO”) published a report setting out its views on advertising technology, specifically the use of personal data in “real time bidding”, and the key privacy compliance challenges arising from it. In its report, which is a status update rather than formal guidance, several key deficiencies were noted and marked for formal regulatory action. However, in May 2020, the ICO paused its investigation into real time bidding and the advertising technology industry, as it sought to prioritize activities responding to the COVID-19 pandemic. The ICO’s investigation resumed in January 2021. We are likely to be required to expend further capital and other resources to ensure compliance with the findings of the ICO’s report on advertising technology, and any relevant changing laws and regulations. While we have numerous mitigation controls in place, advertisements produced by us may be erroneously served on websites that are not suitable for the advertising content of a casino (e.g., websites predominantly aimed at children). There is also a risk that such advertisements are viewed by people who do not want to view them, or who have taken measures not to receive them (for example, individuals on “self-exclusion” lists). In each case this may have adverse legal and reputational effects on our business.
In the EU, rules relating to electronic direct marketing are currently set out in the ePrivacy Directive, which is likely to be replaced by a new ePrivacy Regulation. While no official time frame has been given for the ePrivacy Regulation, there will be a transition period after the ePrivacy Regulation is agreed for compliance. As of the date of this Annual Report it is still undergoing legislative processes and has not been officially adopted by the EU. The ePrivacy Regulation will be directly implemented into the laws of each of the EU Member States, without the need for further enactment. When implemented, the ePrivacy Regulation is expected to alter rules on thirdparty cookies, web beacons and similar technology for online behavioral advertising and to impose stricter requirements on companies using these tools. Regulation of cookies and web beacons may lead to broader restrictions on our online activities, including efforts to understand followers’ Internet usage and promote ourselves to them. The current draft of the ePrivacy Regulation significantly increases fining powers to the same levels as the GDPR. Given the delay in finalizing the ePrivacy Regulation, certain regulators have issued guidance (including ICO and French data protection regulators) on the requirement to seek strict opt-in, unbundled consent to use all nonessential cookies and similar technologies and the requirement to increase the standard of transparency relating to use of cookies and similar technologies. Our cookie consent management functionality and cookies notices may not meet the standards outlined in such guidance.
24
Table of Contents
In the United States, the federal government, including Congress, the Federal Trade Commission and the Department of Commerce, has announced that it is reviewing the need for greater regulation for the collection of information concerning consumer behavior on the internet, including regulation aimed at restricting certain targeted advertising practices. Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination, and security practices that appear to be unfair or deceptive. Numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and processing of state residents’ personal data.
For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020. The CCPA establishes a new privacy framework for covered businesses such as ours and may require us to modify our data processing practices and policies and incur compliance related costs and expenses. The CCPA provides new and enhanced data privacy rights to California residents, such as affording consumers the right to access and delete their information and to opt out of certain sharing and sales of personal information. The law also prohibits covered businesses from discriminating against consumers (for example, charging more for services) for exercising any of their CCPA rights. The CCPA imposes severe statutory penalties for certain violations of the law as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. It remains unclear how various provisions of the CCPA will be interpreted and enforced.
In November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020 (“CPRA”). The CPRA further expands the CCPA with additional data privacy compliance requirements that may impact our business, and establishes a regulatory agency dedicated to enforcing those requirements. The Stop Hacks and Improve Electronic Data Security Act, otherwise known as the SHIELD Act, is a New York State bill, the data protection portions of which became effective on March 23, 2020. The SHIELD Act requires companies to adopt reasonable safeguards to protect the security, confidentiality, and integrity of private information. A company should implement a data security program containing specific measures, including risk assessments, employee training, vendor contracts, and timely data disposal. Laws like the SHIELD Act, the CPRA and the CCPA may lead other states to pass comparable legislation, with potentially greater penalties, and more rigorous compliance requirements relevant to our business. For example, Virginia has enacted the Consumer Data Protection Act and Colorado has enacted the Colorado Privacy Act, each of which may impose obligations similar to or more stringent than those we may face under other data protection laws. Compliance with any newly enacted privacy and data security laws or regulations may be challenging and cost and time-intensive, and we may be required to put in place additional mechanisms to comply with applicable legal requirements.
Although we have implemented certain policies and procedures, and continue to review and improve such policies and procedures, that are designed to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail, or are perceived to have failed, to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations and penalties (including potential suspension or loss of licensure), enforcement notices requiring us to change the way we use personal data or our marketing practices or other liabilities such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Fines are significant in some countries (e.g., the GDPR introduced fines of up to €20 million or up to 4% of the total worldwide annual revenue of the preceding financial year, whichever is higher) as well as litigation, compensation claims by affected individuals (including class action type litigation where individuals suffer harm), regulatory investigations and enforcement notices that could require us to change the way we use personal data.
25
Table of Contents
Our processing of cardholder data is subject, in addition to data protection and privacy laws, to strict industry standards and security procedures. Compliance with the requirements to process cardholder data can be onerous and may require the implementation of new procedures, policies and security measures or the amendment of existing ones which may require material expenditures and harm our financial condition and results of operations. Any actual or perceived failure to comply may result in the inability to process payments, monetary penalties and reputational damages which may require material expenditures and harm our financial condition and results of operations.
The Payment Card Industry Data Security Standard (“PCI DSS”) applies to the processing of cardholder data. PCI DSS consists of a set of policies and procedures intended to enhance the security of cardholder data during card transactions. PCI DSS was implemented by the five largest credit card brands—Visa, Mastercard, Discover, American Express, JCB. Compliance in this regard is important as we do process cardholder data. Where there is actual or perceived non-compliance with PCI DSS, this may result in our inability to process payments, monetary penalties and reputational damage. As part of PCI DSS compliance, we are required to undertake internal and external network vulnerability scans at least quarterly and after any significant change in the network and to carry out a formal risk assessment process at least annually and upon significant changes to the environment that identifies critical assets, threats, and vulnerabilities. Where such scans reveal any lack of compliance, the Company will take appropriate steps to ensure compliance in accordance with the relevant and applicable policies and procedures.
We will rely on licenses and service agreements to use the intellectual property rights of third parties which are incorporated into or used in our products and services. Failure to renew or expand existing licenses or service agreements may require us to modify, limit or discontinue certain product offerings, which could materially affect our business, financial condition, results of operations and prospects.
We rely on products, technologies and intellectual property that we license or that are made available to us through service agreements from third parties, for use in our B2B, B2B2C and B2C offerings. Substantially all of our product offerings and services use intellectual property licensed or made available to us through service agreements from third parties. The future success of our business may depend, in part, on our ability to obtain, retain and/or expand licenses or service agreements for certain technologies. We cannot assure that these third-party licenses and services agreements, or support for the technologies licensed or provided to us thereunder, will continue to be available to us on commercially reasonable terms, if at all. In the event that we cannot renew and/or expand existing licenses or services agreements, we may be required to discontinue or limit our use of the product offerings that include or incorporate the licensed or provided technology.
Some of our license agreements contain minimum guaranteed royalty payments to the third party. Individually and in the aggregate, these minimum guaranteed royalty payments are immaterial to our operations. Our license agreements generally allow for transferability in the event of a strategic transaction but contain some limited termination rights related to the transfer. Certain of our license agreements grant the licensor rights to audit our use of their intellectual property. Disputes with licensors over uses or terms could result in the payment of additional royalties or penalties by us, cancellation or non-renewal of the underlying license or litigation.
The regulatory review process and licensing requirements also may preclude us from using technologies owned or developed by third parties if those parties are unwilling to subject themselves to regulatory review or do not meet regulatory requirements. Some gaming authorities require gaming manufacturers to obtain approval before engaging in certain transactions, such as acquisitions, mergers, reorganizations, financings, stock offerings and share repurchases. Obtaining such approvals can be costly and time consuming, and we cannot assure that such approvals will be granted or that the approval process will not result in delays or disruptions to our strategic objectives.
26
Table of Contents
Risks Related to our Third-Party Vendor Relationships
We rely on third-party providers to validate the identity and location of our users, and if such providers fail to perform adequately or provide accurate information or we do not maintain business relationships with them, our business, financial condition, results of operations and prospects could be adversely affected.
There is no guarantee that the third-party geolocation and identity verification systems that we rely on perform adequately or will be effective. We rely on our geolocation and identity verification systems to ensure we are in compliance with certain laws and regulations, and any service disruption to those systems would prohibit us from operating our Platform and would adversely affect our business. Additionally, incorrect or misleading geolocation and identity verification data with respect to current or potential users received from third-party service providers may result in us inadvertently allowing access to our product offerings to individuals who should not be permitted to access them, or otherwise inadvertently deny access to individuals who should be able to access our product offerings, in each case based on inaccurate identity or geographic location determination. Our third-party geolocation services provider relies on its ability to obtain information necessary to determine geolocation from mobile devices, operating systems and other sources. Changes, disruptions or temporary or permanent failure to access such sources by our third-party services providers may result in their inability to accurately determine the location of our users. Moreover, our inability to maintain our existing contracts with third-party services providers, or to replace them with equivalent third parties, may result in our inability to access geolocation and identity verification data necessary for our day-to-day operations. If any of these risks materializes, we may be subject to disciplinary action, fines, lawsuits, and our business, financial condition, results of operations and prospects could be adversely affected.
We rely on other third-party service and content providers (including online slot and other game providers) and if such third parties do not perform adequately or terminate their relationships with us, our costs may increase and our business, financial condition, results of operations and prospects could be adversely affected.