ROOT US Equity☆

root-20211231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2021

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d)OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from_____to_____

Commission file number 001-39658

ROOT, INC.

(Exact name of Registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

(866) 980-9431

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definition of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and "emerging growth company" in Rule 12-b-2 of the Exchange Act.

Large accelerated filer ☒ Accelerated filer ☐

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

The aggregate market value of the registrant's Class A common stock, par value $0.0001 per share (the "Class A common stock") held by non-affiliates was approximately $1,204.8 million based upon the June 30, 2021, closing price of $10.82 as reported by the Nasdaq Global Select Market.

There were 154.5 million shares of Class A common stock and 99.5 million shares of Class B common stock outstanding as of February 17, 2022.

DOCUMENTS INCORPORATED BY REFERENCE

Part III of this report incorporates by reference specific portions of the Registrant’s Notice of Annual Meeting and Proxy Statement relating to the Annual Meeting of Stockholders to be held on or about June 7, 2022.

ROOT, INC.

FORM 10-K

As of and For the Year Ended December 31, 2021

TABLE OF CONTENTS

Page

Special Note Regarding Foward-Looking Statements

Risk Factors Summary

Part I.

Item 1. Business 1

Item 1A. Risk Factors 19

Item 1B. Unresolved Staff Comments 56

Item 2. Properties 57

Item 3. Legal Proceedings 58

Item 4. Mine Safety Disclosures 59

Part II.

Item 6. [Reserved] 61

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 84

Item 8. Financial Statements and Supplementary Data 85

Item 9A. Controls and Procedures 130

Item 9B. Other Information 132

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 133

Part III.

Item 10. Directors, Executive Officers and Corporate Governance 134

Item 11. Executive Compensation 135

Item 14. Principal Accountant Fees and Services 138

Part IV.

Item 15. Exhibits and Financial Statement Schedules 139

Signatures

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements about us and our industry that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this Annual Report on Form 10-K are forward-looking statements. In some cases, you can identify forward-looking statements because they contain words such as “anticipate,” “believe,” “contemplate,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “potential,” “predict,” “project,” “should,” “target,” “will” or “would” or the negative of these words or other similar terms or expressions. These forward-looking statements include, but are not limited to, statements concerning the following:

•our ability to retain existing customers and acquire new customers and expand our customer reach;

•our expectations regarding our future financial performance, including total revenue, gross profit/(loss), adjusted gross profit/(loss), direct contribution, gross loss ratio, marketing costs, gross loss adjustment expense, or LAE, ratio, quota share levels and expansion of our renewal premium base;

•the impact of the COVID-19 pandemic on our business and financial performance;

•our goal to be licensed in all states in the United States and the timing of obtaining additional licenses and launching in new states;

•the accuracy and efficiency of our telematics and behavioral data, and our ability to gather and leverage additional data;

•our ability to materially improve retention rates and our ability to realize benefits from retaining customers;

•our ability to underwrite risks accurately and charge profitable rates;

•our ability to maintain our business model and improve our capital and marketing efficiency;

•our ability to drive improved conversion and decrease the cost of customer acquisition;

•our ability to maintain and enhance our brand and reputation;

•our ability to effectively manage the growth of our business;

•our ability to raise additional capital;

•our ability to improve our product offerings, introduce new products and expand into additional insurance lines;

•our ability to cross sell our products and attain greater value from each customer;

•our lack of operating history and ability to attain profitability;

•our ability to compete effectively with existing competitors and new market entrants in our industry;

•future performance of the markets in which we operate;

•our ability to operate a “capital-light” business and obtain and maintain reinsurance contracts;

•our ability to realize economies of scale;

•our ability to build an embedded insurance offering;

•our ability to expand our distribution channels through additional partnership relationships, digital media and referrals;

•our ability to reduce customer acquisition costs and realize other expected benefits related to the partnership with Carvana Group, LLC, or Carvana;

•our ability to drive a significant long-term competitive advantage through our partnership with Carvana;

•our ability to attract, motivate and retain key personnel, or hire personnel, in a competitive labor market and to offer competitive compensation and benefits;

•our ability to deliver a vertically integrated customer experience;

•our ability to develop products that utilize our telematics to drive better customer satisfaction and retention;

•our ability to protect our intellectual property and any costs associated therewith;

•our ability to develop an autonomous claims experience;

•our ability to take rate action early and react to changing environments;

•our ability to meet risk-based capital requirements;

•our ability to realize the benefits anticipated from our Texas county mutual fronting arrangement;

•our ability to expand domestically and internationally;

•our ability to stay in compliance with laws and regulation that currently apply or become applicable to our business;

•our ability to continue to meet Nasdaq listing standards; and

•the growth rates of the markets in which we compete.

You should not rely on forward-looking statements as predictions of future events. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties and other factors described under the header “Risk Factors” and elsewhere in this Annual Report on Form 10-K. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained herein. The results, events and circumstances reflected in the forward-looking statements may not be achieved or occur, and actual results, events or circumstances could differ materially from those described in the forward-looking statements.

The forward-looking statements made in this Annual Report on Form 10-K relate only to events as of the date on which the statements are made and we undertake no obligation to update them to reflect events or circumstances after the date of this Annual Report on Form 10-K or to reflect new information or the occurrence of unanticipated events, except as required by law.

Unless the context otherwise indicates, references in this report to the terms “Root,” “the Company,” “we,” “our” and “us” refer to Root, Inc. and its subsidiaries.

We may announce material business and financial information to our investors using our investor relations website (ir.joinroot.com). We therefore encourage investors and others interested in Root to review the information that we make available on our website, in addition to following our filings with the Securities and Exchange Commission, webcasts, press releases and conference calls.

Risk Factors Summary

Investing in our Class A common stock involves numerous risks and uncertainties, as more fully described below. You should read these risks before you invest in our Class A common stock. In particular, risks associated with our business include, but are not limited to, the following:

•We have a history of net losses and could continue to incur substantial net losses in the future. We may not continue to grow at historical rates or achieve or maintain profitability in the future.

•We may lose our existing customers or fail to acquire new customers, and our future growth and profitability depend in part on our ability to successfully operate in an insurance industry that is highly competitive. If we are unable to maintain the levels of customer service or continue technological innovation and improvements, our prospects for future growth may be materially adversely affected.

•We may require additional capital to support business growth or to satisfy our regulatory capital and surplus requirements, and this capital might not be available on acceptable terms, if at all.

•The COVID-19 pandemic has caused disruption to our operations and may negatively impact our business, key metrics, and results of operations in numerous ways that remain unpredictable.

•We rely on telematics, mobile technology and our digital platform to collect data points that we evaluate in pricing and underwriting our insurance policies, managing claims and customer support, and improving business processes. To the extent regulators prohibit or restrict our collection or use of this data, our business could be harmed.

•We or Carvana may fail to develop an embedded insurance product and/or fail to perform under the parties’ commercial agreement.

•We depend on search engines, social media platforms, digital app stores, content-based online advertising and other online sources to attract consumers to our website and our mobile app both rapidly and cost-effectively. If these third parties change their listings or increase their pricing, if our relationships with them deteriorate or terminate, or if other factors related to these third parties arise which are beyond our control, we may be unable to attract new customers rapidly and cost-effectively, which would adversely affect our business and results of operations.

•Operating system platforms and application stores controlled by third parties, such as Apple and Google, may change their terms of service or policies in a manner that increases our costs or impacts our ability to distribute our mobile app, collect data through it and market our products.

•Our expansion within the United States and any future international expansion strategy will subject us to regulatory approvals, regulatory exposure in new markets and additional costs and risks, and our plans may not be successful.

•Our technology platform may not operate properly or as we expect it to operate.

•Regulators may limit our ability to develop or implement our telematics-based pricing model and/or may eliminate or restrict the confidentiality of our proprietary technology.

•We are subject to full scope financial examinations by state insurance regulatory authorities in each state in which one of our domestic insurance company subsidiaries is domiciled and market conduct examinations by state insurance regulatory authorities in any state in which our domestic insurance company subsidiaries issue insurance policies, which could result in adverse examination findings and necessitate remedial actions.

•Our exposure to loss activity and regulation may be greater in states where we currently have most of our customers: Texas, Georgia and Louisiana.

•We are subject to stringent and changing privacy and data security laws, regulations, and standards related to data privacy and security, increasing the complexity of compliance. Our actual or perceived failure to comply with such obligations could harm our reputation, subject us to significant fines and liability, or adversely affect our business.

•Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business and operating results.

•Our brand may not become as widely known or accepted as incumbents’ brands or the brand may become tarnished.

•We rely on highly skilled and experienced personnel and if we are unable to attract, retain or motivate key personnel or hire qualified personnel, our business may be seriously harmed. In addition, the loss of key senior management personnel could harm our business and future prospects.

•New legislation or legal requirements may affect how we communicate with our customers, which could have a material adverse effect on our business model, financial condition, and results of operations.

•Denial of claims or our failure to accurately and timely pay claims could materially and adversely affect our business, financial condition, results of operations, and prospects.

•Unexpected increases in the frequency or severity of claims may adversely affect our results of operations and financial condition.

•Failure to maintain our risk-based capital at the required levels could adversely affect our ability to maintain regulatory authority to conduct our business.

•We may be unable to prevent, monitor or detect fraudulent activity, including policy acquisitions or payments of claims that are fraudulent in nature.

•We rely on our mobile application to execute our business strategy. Government regulation of the internet and the use of mobile applications in particular is evolving, and unfavorable changes could seriously harm our business.

•Our intellectual property rights are valuable, and any inability to protect them could reduce the value of our products, services and brand.

•Litigation and legal proceedings filed by or against us and our subsidiaries, including shareholder litigation related to the initial public offering, could have a material adverse effect on our business, results of operations and financial condition, and may divert management’s attention and resources away from our business.

•The insurance business, including the market for automobile, renters and homeowners insurance, is historically cyclical in nature, and we may experience periods with excess underwriting capacity and unfavorable premium rates, which could adversely affect our business.

•Reinsurance may be unavailable at current levels and prices, which may limit our ability to underwrite new policies. Furthermore, reinsurance subjects us to counterparty risk and may not be adequate to protect us against losses, which could have a material effect on our results of operations and financial condition.

•Reinsurance subjects us to risks of our reinsurers and may not be adequate to protect us against losses arising from ceded insurance, which could have a material effect on our results of operations and financial condition.

•Failure to meet the continued listing requirements of Nasdaq could result in delisting of our Class A common stock, which in turn would negatively affect the price of our Class A common stock and limit investors’ ability to trade in our common stock.

PART 1.

Item 1. Business

Overview

Root is a technology company revolutionizing personal insurance with a pricing model based upon fairness and a modern customer experience. We operate primarily a direct-to-consumer model in which currently we acquire the majority of our customers through mobile applications.

We have built a company that recognizes each individual is unique and puts customers in control, rewarding them for their actions. For centuries, traditional insurance companies have grouped people into risk pools and long relied on the ‘law of large numbers’ to produce acceptable pricing on an aggregate basis. Fairness at the individual level has been largely ignored. Root is different—we use technology to measure risk based on individual performance, prioritizing fairness to the customer. The way we design and deliver insurance is not a simple tweak to the traditional insurance model—we are fundamentally reinventing insurance through technology, data science and a maniacal focus on the customer. While our opportunity is expansive and our ambition is global, our primary focus is on U.S. auto insurance.

We believe the $260 billion U.S. auto insurance market is ripe for disruption. Traditional methods of pooled risk assessment are not personalized and inherently less precise given individual behavioral data is underutilized or not measured as a component of the insurance risk assessment process. We believe traditional systems and processes have become outdated and are increasingly disconnected from the needs of consumers. Our initial focus on auto insurance was motivated by how well-suited we believe the product to be for fundamental improvement through technology. We believe Root is the innovator to drive this transformation.

Auto insurance is required for the vast majority of drivers in the United States and we believe it is typically the first insurance policy purchased by consumers. As a result, our auto-first strategy establishes the foundation for an expansive lifetime relationship with the opportunity to add other personal insurance lines as customer needs evolve. As part of our strategy, we have also established the technological foundation for an enterprise software offering, diversifying our revenue streams over time.

We believe the Root advantage is derived from our unique ability to efficiently and effectively bind insurance policies quickly, aided by segmenting individual risk based on complex behavioral data and proprietary telematics, a customer experience built for ease of use and a product offering made possible with our full-stack insurance structure. These are all uniquely integrated into a single cloud-based technology platform that captures the entire insurance value chain—from customer acquisition to underwriting to claims and administration to ongoing customer engagement.

As a full-stack insurance carrier, we have the infrastructure to design products and distribute, underwrite, administer and pay claims on all of our policies. Our model, supported by proprietary technology, allows us to be more adaptive across the value chain, provides complete design and feature discretion and we believe frees us to innovate and iterate more quickly than any of our major competitors. We view this flexibility as absolutely critical to introducing new capabilities, reinforcing customer centricity and driving growth. In practice this means we own and control an end-to-end insurance experience and have near complete operating autonomy, subject to regulation, to grow our business.

As with many data-enabled businesses, we benefit from a flywheel powered by data that allows us to improve our model and fuels growth. However, in contrast to many other flywheels where growth-generates-data-generates-growth, we believe our flywheel is more powerful in that increased data generates targeted growth to increase the lifetime value of our customers.

Our model naturally benefits from growing our data flywheel and our portfolio maturing. Renewal premiums, referring to premiums from a customer’s second term and beyond, have lower loss ratios as compared to new premiums in the customer’s first term. As we grow our business, we anticipate, consistent with industry norms, that our portfolio will mature and a greater proportion of our premiums will be from customer renewals. We expect this

1

growing proportion of renewal premiums will bring an increasing mix of lower loss ratio premiums and premiums without associated marketing costs.

We announced in 2021 that we continue to diversify the ways we reach our customers and our product offerings. We are leveraging our technology to develop an embedded experience at the point of car purchase with Carvana. In mid-2021, we saw an elevated consumer interest in vehicle and auto insurance purchases, resulting in a significant increase in customer acquisition and advertising campaigns in digital channels on the part of our competitors, increasing our customer acquisition costs in those channels. Not only do acquisition costs in these channels vary significantly quarter to quarter, we believe an embedded product with distribution partners offers an opportunity for greater marketing efficiency than digital marketing channels alone because they allow us to approach captive audiences in a contextually relevant, data-centric way.

The economic instability caused by the COVID-19 pandemic has led to acute inflationary pressures and supply chain disruptions, which have increased the value of used vehicles and replacement parts in 2021. These cost increases have resulted in greater claims severity while being partially offset by higher salvage and subrogation recoveries on damaged vehicles. As a result of certain factors related to the COVID-19 global pandemic, we continue to file in multiple states to establish rates that more closely follow the evolving loss cost trends. In addition, we are developing underwriting models and products that vary the level of reliance on telematics and the point at which telematics are used in underwriting.

Our Industry

Insurance is one of the oldest and largest markets in the world, touching every corner of the world and protecting many of our most important assets. Global property and casualty, or P&C, insurance premiums amount to $3 trillion annually. Our primary addressable market today is U.S. personal lines insurance. This market exceeded $375 billion in 2020 premiums and has grown at a 3% compound annual growth rate, or CAGR, since 2016.

Over the past century, there have been only a few waves of innovative disruption within insurance. Perhaps the most disruptive was the advent of the internet as a distribution channel in the late 1990s, which redefined the personal auto insurance market. We believe the rise of digital distribution is the primary driver of the $50 billion market share shift that has accrued to direct models over the last 20 years. Further, we believe the next technology-driven structural shift is underway—and this time the shift is not just distribution-related but a holistic change in the way insurance is priced and delivered.

We believe innovation has been slow within the P&C insurance industry, in part, because legacy systems are difficult to build upon and nearly impossible to replace. Also impacting the pace of innovation is institutional friction generated by the cost and perceived risk of a requisite ground-up technology rebuild, disruption of carrier-agent relationships and the business model implications of replacing broad pool-based pricing. Our proprietary technology and business model allow us to avoid these pain points and aggressively pursue the opportunity to be at the forefront of this structural shift.

Our Business Model

Behavioral Data and Proprietary Telematics

We use technology to measure risk based on transparent collection and analysis of individual driving performance, which we believe is the most powerful predictor of accidents and the leading variable in our underwriting model. By collecting and synthesizing massive amounts of rich, sensory behavioral data across thousands of driving variables, including distracted driving, we strive to price auto insurance based more on causality than correlation. This allows us to price our customers’ policies more fairly—and in turn they pay premiums commensurate with their individual risk profile. While the notion of telematics has been around for decades, only recently has mobile technology made the concept adoptable at large scale.

The pooled-risk pricing strategy employed by the majority of incumbents takes a more uniform view of risk absent the capability to segment on an individualized basis. First, incumbents generally do not have the technology and infrastructure to collect and synthesize an integrated set of proprietary telematics and claims data. Second,

2

introducing individualized telematics-based pricing across an existing portfolio constructed without telematics would have enormous profitability implications as lower-risk drivers would be re-rated to a meaningful discount, reducing profits, and high-risk drivers would be surcharged, which could result in reduced retention. As such, we believe we are the only P&C insurance carrier with a scaled proprietary telematics solution designed to price an entire book of business.

The hallmark of our data advantage is our integrated set of actual claims and associated proprietary telematics, which we believe to be one of the largest in the market. We match miles tracked, on an individual basis, with actual claims and identify a set of driving performance factors that cause, or on a relative basis are more likely to cause, accidents. We use an internally developed claims infrastructure to capture comprehensive structured data, contributing to our data advantage when combined with telematics experience and iterated over time. This integrated data set drives a usage-based insurance, or UBI, score. When UBI 3.14, a prior iteration of our current model, was reviewed it was determined to be almost ten times more predictive at estimating future losses than a leading third-party provider, according to a leading independent third-party actuarial and consulting firm. Since then, we have continued to iterate on our UBI models and have released UBI 4.0 in a majority of states, which we believe is more predictive than previous models.

Our model revolves around using integrated data and technology to create a pricing advantage through granular risk segmentation. The data we collect feeds proprietary risk scoring models which assist us in identifying what we believe to be the riskiest drivers on the road, a group we have elected not to quote, thus avoiding a risk segment that is up to two times more likely to get in an accident than our average targeted customer. By removing this high-risk segment, we can price the remaining population more fairly, resulting in a stronger conversion of customers whose behavioral data indicates lower risk than a market-standard demographic rating alone. Our segmentation often allows us to provide better pricing to lower risk customers based on their driving behavior, giving us an advantage in acquiring new customers, as compared to traditional insurance carriers, and allowing us to build a more attractive book of business that contributes even more data to our flywheel.

Customer Experience

We strive to meet customers where they are with a user-friendly interface and convenient, efficient experience. This is the mantra that drives our mobile engagement strategy and underpins both our user experience and our fundamental business model. App installation and initial engagement are designed to be intuitive so that customers can easily identify the coverage they need in everyday language, including offering bundling options which clearly lay out associated cost savings.

Our mobile engagement extends across the customer experience and value chain:

•Engagement. The vast majority of our new customers come through our digital or partnership channels, which are largely mobile. We continue to diversify the ways we reach our customers. We are developing an embedded experience that engages customers at contextually relevant times. In partnership with Carvana, we are deploying an embedded experience at the point of car purchase.

•Profile Creation. The Root app is available for both iOS and Android operating systems making it available to 99% of U.S. smartphone users. By simply scanning a driver’s license, a prospective customer can nearly complete a profile, part of an on-boarding process that is possible to complete in as little as 47 seconds and with no keyboard interaction.

•Underwriting. The test drive is a key component of the underwriting process. A two-to-four week test drive gathers and analyzes data from smartphone sensors measuring braking, consistency, turning, time of day and other performance and contextual data. We are developing underwriting models and products that vary the level of reliance on telematics and the point at which telematics are used in underwriting.

•Coverage Selection. As part of profile setup, our app pre-populates with a customer’s owned automobiles and existing or prior coverage terms, allowing easy and seamless selection of policy terms.

3

•Policy Management. Once bound, customers can perform all policy management functions seamlessly from our app, including profile or coverage adjustments, obtaining proof of insurance or chatting with a bot or human.

•Claims. We make it easy to file a claim and track processing status through to settlement via the app, allowing us to pay out claims rapidly.

Auto insurance is a product most people use every day, reinforcing the importance of our mobile-first engagement strategy for both customer experience and data collection.

Distribution

We distribute largely through the mobile channel, with the majority of our personal insurance customers acquired through either our mobile app or mobile web platform. Mobile is the fastest growing retail channel in the United States, as customers spend less time in front of computers and utilize smart phones for more convenient shopping. We therefore designed a mobile-directed customer acquisition strategy, to ultimately deliver customer acquisition costs below the average cost of doing so, through each of the embedded, direct and agent channels:

•Embedded. We build upon the superior mobile and web customer experiences of distribution partners to reach a captive customer base with an embedded solution. Through our proprietary and fully-integrated application programming interfaces, or APIs, we are able to engage prospective customers when contextually relevant in third-party applications and target high-value customer segments at a higher marketing efficiency than other channels. We expect increased penetration of this channel over time as we seek to grow embedded relationships with other tech-enabled companies like Carvana, offering access to relevant customer bases.

•Digital. Our digital channel is designed to drive volume by efficiently capturing high-intent customers. We accomplish this by meeting our customers within platforms they use extensively such as Facebook and Google or select marketplace platforms where consumers are actively shopping for insurance. We deploy dynamic data science models to optimize targeting and bidding strategies across our digital platforms, aligning customer acquisition cost to expected lifetime value of the potential customer.

•Channel Media. We build consideration and drive intent through household-level targeted digital media channels such as YouTube and Hulu, as well as more traditional media channels such as billboards, regional TV and radio and direct mail. We utilize these media channels to drive awareness when launching new states and to actively target customers in active states.

•Referral. We encourage our existing customers to spread our value proposition. Our referral channel compensates existing customers who refer new customers who subsequently receive a quote. This channel facilitates community-based growth to those who value our fair and transparent approach to insurance. This is our lowest cost acquisition channel and an important aspect of our ongoing distribution strategy.

•Agency. We have been investing in a product to bring the speed and ease of our technology to the independent agency channel. This channel provides access to a larger demographic of customers and we believe it has staying power. We developed an efficient quote and bind process that reduces the time the agent needs to spend with the customer, allowing agencies to be an efficient acquisition channel for us.

Our customer acquisition costs can vary by channel mix, by state, due to seasonality or due to the competitive environment. We believe our main channels allow us to efficiently acquire customers by leveraging our partners’ premier user experiences to approach captive audiences in a contextually relevant, data-centric way. Furthermore, we continue to invest in the technology and data science behind our distribution with A/B tests, dynamic bidding models, and rapid updates and iterations, supporting differentiated cost of customer acquisition over the long term.

Capital Management

As a full-stack insurance company, we operate a “capital-light” business model which utilizes elevated levels of reinsurance. Our capital management strategy has three core objectives: (1) prioritize revenue and targeted customer growth while also maintaining regulatory capital requirements; (2) source efficient capital to support customer

4

acquisition costs; and (3) mitigate impact of large losses or tail events. Together these strategies serve to maximize returns on shareholder capital as we grow.

Reinsurance is a cornerstone of our capital management framework. We have multiple strategic business partnerships with leading global reinsurers who offer us reinsurance solutions on both a proportional (i.e., quota share) and non-proportional (i.e., excess of loss, or XOL, coverage) basis for multi-year periods. We also utilize a wholly-owned, Cayman Islands-based reinsurer, Root Reinsurance Company, Ltd., or Root Re.

Our Growth Strategy

We are focused on the following growth strategies to continue penetrating the $260 billion U.S. auto insurance market and ultimately the $3 trillion global P&C market. In the near term, our primary focus is to execute on the auto opportunity at hand. In the longer-term, we plan to continue to develop additional growth opportunities through the expansion of product offerings, and growing our enterprise solution and entering international markets.

•Execute the Auto Opportunity

◦Better, fairer pricing. We will never stop working to improve our ability to segment risk by increasing the influence of behavioral factors in our underwriting and pricing models. Our primary tool for improvement is to continue applying data science to our powerful flywheel, where each rotation sheds incremental light on the causes of accidents. Over time, we hope that we can replace all correlation-related inputs to our pricing model, such as credit scores, with a fully behavioral pricing model. We would view this as the ultimate achievement in customer transparency and fairness.

◦Enhance marketing efficiency. We will continue to enhance the efficiency of our marketing spend through data science and dynamic targeting, as well as expanding our embedded experience. The embedded experience will allow us to develop integrated auto insurance solutions where we build on the premium mobile and web experiences of contextually relevant partners to access their active customer base.

◦Grow national auto insurance presence. We will continue to focus on domestic growth by diversifying marketing channels, becoming active in more states while improving brand awareness. In November 2020, we acquired Catlin Indemnity Company, a shell insurance company subsequently renamed Root Property & Casualty Insurance Company, or Root Property & Casualty, that expands our ability to sell personal auto insurance in 48 states and the District of Columbia. In instances where a prospective customer solicits a quote in a state where we do not currently underwrite, we retain their contact information, with permission, and re-engage upon state entry.

•Insurance Product Expansion

◦Increase value proposition and business model through cross-sell. We launched our renters product in July of 2019 and our home product partnership in May of 2020. In bundling these products with auto insurance, we unlock the 50% of the market that we believe prefers a bundled offering and was therefore not available to us before. This strategy supports our unit economics by creating additional revenue with no incremental marketing spend. We have also observed that customers with multiple policies retain better than auto-only customers.

•Insurance Product Expansion

◦Invest in enterprise. We have developed a distinct enterprise offering leveraging our existing technology and capabilities. Over the long-term we plan to invest in and grow this product offering to create a distinct and scalable software-as-a-service recurring revenue stream absent risk retention.

◦Pursue International. In the long-term we will look to expand into the international market, both as a consumer-facing insurer in certain markets and through enterprise software in other markets, enabling select insurance companies with mobile telematics data collection and scoring capabilities.

5

We may selectively pursue additional acquisitions and partnerships to accelerate any of our growth and profitability objectives or to improve our competitive positioning within existing and new products.

Investments

Our portfolio of investable assets is primarily held in cash, cash equivalents and available-for-sale fixed maturity securities, including U.S. Treasury securities, corporate debt securities, mortgage back securities and other debt obligations. We manage the portfolio in accordance with investment policies and guidelines approved by our board of directors. We have designed our investment policy and guidelines to provide a balance between current yield, conservation of capital, and liquidity requirements of our operations. We set guidelines that provide for a well-diversified investment portfolio that is compliant with insurance regulations applicable to the states in which we operate. For further information, see Note 3, “Investments,” in the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K.

Competition

The insurance industry in which we operate is highly competitive. Many of our primary competitors have well-established national brands and market similar products. Our competitors include large national insurance companies such as Geico, Progressive and Allstate, as well as up-and-coming companies and new market entrants in the insurtech industry, some of which also utilize telematics and offer forms of usage-based insurance. Several of these established national insurance companies are larger than us and have significant competitive advantages over us, including increased name recognition, higher financial ratings, greater resources, additional access to capital, and more types of insurance coverage to offer, such as health and life, than we currently do. In particular, many of these competitors offer consumers the ability to purchase multiple other types of insurance coverage and “bundle” them together into one policy and, in certain circumstances, include an umbrella liability policy for additional coverage at competitive prices. Moreover, as we expand into new lines of business and offer additional products, we could face intense competition from traditional insurance companies that are already established in such markets.

Competition is based on many factors, including the reputation and experience of the insurer, coverages offered, pricing and other terms and conditions, customer service, size, and financial strength ratings, among other considerations. We believe we compete favorably across many of these factors and have developed a platform and business model based on behavioral data collection and machine learning that we believe will be difficult for incumbent insurance providers to emulate.

Intellectual Property

We believe that our intellectual property rights are valuable and important to our business. We rely on trademarks, patents, copyrights, trade secrets, license agreements, intellectual property assignment agreements, confidentiality procedures, non-disclosure agreements, and employee non-disclosure and invention assignment agreements to establish and protect our proprietary rights. Though we rely in part upon these legal and contractual protections, we believe that factors such as the skills and ingenuity of our employees and the functionality and frequent enhancements to our platform are larger contributors to our success in the marketplace.

As of December 31, 2021, we had two issued patents and two non-provisional patent applications pending examination in the United States. We continually review our development efforts to assess the existence and patentability of new intellectual property.

We have trademark rights in our name, our logo, and other brand indicia, and have trademark registrations for select markets in the United States. We also have registered domain names for websites that we use in our business.

We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. Despite our efforts to protect our intellectual property rights, they may not be respected in the future or may be invalidated, circumvented, or challenged. For additional information, see the sections titled “Risk Factors—Risks Related to Our Business—Our intellectual property rights are valuable, and any inability to protect them could reduce the value of our products, services and brand.”

6

People at Root

As an insurtech, we believe our differentiating factor is our talent. We believe our people, their knowledge, their skills and the ways they work will provide competitive advantages to allow us to innovate, move with speed in the market and bring subject matter expertise to bear in the market for our customers and shareholders.

Our Company is founded on a core set of values: be curious and push boundaries, be courageous and build trust and be focused and deliver impact. The specific words may change with time as we innovate and grow, but we look for employees who share the essence of these values – innovation, courage and bias for action to drive results.

These values form the basis for our People strategy, which is to give employees voice and choice, build leadership capability to ensure our leaders serve as trusted advisors and the source of truth for our employees and create a sense of belonging for all employees at all levels. These three pillars underscore each step on the employee lifecycle from attraction, to hire, to onboard, and through growth and development. We continue to engage with former employees as alumni.

Employees

As of December 31, 2021, we had 1,571 full-time employees. None of our employees are represented by a labor union or covered by collective bargaining agreements. On January 20, 2022, we instituted an organizational realignment, including an involuntary workforce reduction of approximately 330 employees, which represented approximately 20% of our workforce. The majority of the reduction was driven by optimizing certain sales and claims departments, especially claims support staff in first notice of loss. These departments saw a reduced workload that corresponded with the strategic reduction in marketing spend and lower claims volume in the second half of the year. The majority of the affected employees were notified on January 20, 2022, with most job eliminations effective January 2022. All impacted employees were supported with financial and career placement aid. We have not experienced any work stoppages.

Belonging at Root

We are committed to respecting, leveraging, and rewarding the unique views and contributions of all team members by increasing diversity while building and sustaining a culture of inclusivity and belonging—a Root that empowers all employees to be unapologetic about who they are while they connect, create, and innovate. Establishing and maintaining a culture of belonging requires a shift in leadership behaviors and cultural attributes. As we move to a more distributed workforce as a result of our “work where it works best approach” we plan to focus our behaviors on those that are pointed toward driving empathy and trust across our workforce to demonstrate a sense of caring for ourselves, our people and our business. Empathy and trust, along with voice and choice are the cornerstones of our culture of belonging. We are evolving in our approach to a more integrated strategy focused on attracting talent, retaining talent and serving in our communities. Our Board continues to be actively involved in this process, prioritizing representation at all levels in the company and overseeing our belonging efforts at the full board level.

We promote a culture of diversity, equity and inclusion through, for example, Employee Resource Groups, or ERGs. We currently have four ERGs – employees who regularly meet to share like experiences, serve as connectors and support each other as they move forward in their careers and lives more broadly:

•Pride 365: Celebrating everything LGBTQ+ at Root and in our communities;

•Tribe: Cultivating a professional, healthy, and supportive environment while amplifying Black voices at Root;

•Women @ Root: Creating a culture and company that empower women and allies to do their best work; and

•Root Ability and Allies: Resource-sharing, celebrating wins, and cultivating a community of support at Root for our team members with disabilities and their allies.

7

Leadership at Root

We believe we will best meet the needs of our employees by ensuring strong leadership capabilities at all levels in the organization. As our employee needs and motivations change, we are helping our leaders evolve their leadership tool kits to meet these needs and positioning our leaders to be a source of truth and trusted advisors for all of our employees. Our senior management is spending more time helping leaders focus on three aspects of leadership: care for self, care for others and care for the business. We recently launched Root’s Leadership Academy, a program that provides training, leadership toolkits, opportunities to share best practices, mentorship and support to our people managers.

Ethics and Company Values

In addition to applicable laws and regulations, our Code of Conduct, company values and policies provide the grounding for our ethical framework. Employees are encouraged to report any unusual behavior or any non-compliant activities through a variety of vehicles to include our anonymous reporting system. On an annual basis, we provide ethics training to, and require acknowledgement of our Code of Conduct by, every employee. We strive to ensure our new employees know how and what to report and are encouraged through our values to challenge us and be courageous. We have an open door policy that empowers employees to reach out to leaders, our People team, our compliance and/or internal audit teams to ensure that their concerns are heard and addressed.

Hiring and Retaining Talent

We are continually working on building a culture of attraction and retention of key talent. Our recruiting approach has moved from a Columbus-centric approach to a National landscape in order to attract the best talent to innovate and meet the needs of our customers in a multitude of ways. We are continually updating our recruiting approaches to fill candidate pipelines with diverse candidates with diverse skill sets and life experiences.

Our focus on employee engagement continues with employee surveys and feedback opportunities to create action plans to address needs. Employees provide their perspectives on everything from facilities, to communication vehicles, to development approaches, to change management strategies, and on many other subjects.

In addition, we are continually revising our performance development processes to ensure that employees receive timely and actionable feedback and can improve their performance and voice their career aspirations. We are driving to build a more inclusive learning environment where employees can participate in a variety of learning programs offered through our employee assistance program, digital learning platform and our in-person classes.

In addition, we seek to provide competitive pay and benefits through a combination of fixed and variable compensation programs. We have set salary ranges, based on our defined competitive markets, and annual short and long term incentives aligned to each of our positions as we believe are appropriate.

Our executives and senior leadership roles, along with several identified roles throughout the business participate in a long-term equity-based incentive program, which we believe strongly supports a long term view and pay for performance that is aligned with our shareholders.

Our employee benefits platform is reviewed annually to offer benefits competitive with our market and designed to meet the needs of our people and their families. We invest in the emotional and physical wellbeing of our employees and their families through our benefits programs. Our benefit offering covers medical, dental, vision, prescription drug benefits along with a robust employee assistance program, life insurance, short- and long-term disability, paid time off and paid parental leave. Our move to a “work where it works best” culture allows for tremendous employee flexibility for employees to manage their lives in the ways that they want while also meeting their performance objectives at work.

8

Meeting Our Employees Needs While Responding to COVID-19 Demands

During the past two years, we have made some fundamental changes as a result of the COVID-19 pandemic. For the health and safety of our employees, we quickly moved as many people as possible to work from home in the early stages. As the pandemic evolved and we understood more about the evolving needs of our employees, we surveyed employees and moved to an ongoing “work where it works best” working environment. In this scenario, we are allowing employees to tell us where they would like to work – in an office, or outside an office anywhere in the continental United States. This choice allows us to help employees manage their health and the health of their family members, provides them with flexibility to live where they would like, changes our geographic footprint and empowers our leaders to be creative in finding solutions that are mutually beneficial for our employees, customers and shareholders.

Insurance Regulation

We are subject to insurance regulation in the jurisdictions in which we transact insurance through our licensed insurance carriers and producer subsidiaries. Insurance regulatory authorities have broad administrative powers to regulate all aspects of an insurance carrier or producer’s business, including the powers to restrict or revoke licenses to transact business, and to levy fines and monetary penalties against insurers and insurance producers found to be in violation of applicable laws and regulations. Regulations to which our licensed insurance carriers and producer subsidiaries are subject include, but are not limited to:

•prior approval of transactions resulting in a change of “control” (as such term is defined under the Insurance Holding Company System Regulatory Act of Ohio, or the Ohio Holding Company Act, and the Delaware Insurance Holding Company System Registration Act, or the Delaware Holding Company Act, and together with the Ohio Holding Company Act, the Holding Company Acts);

•approval of policy forms and premiums;

•approval of intercompany service agreements;

•statutory and risk-based capital solvency requirements, including the minimum capital and surplus our regulated insurance subsidiaries must maintain;

•establishing minimum reserves that insurance carriers must hold to pay projected insurance claims;

•required participation by our regulated insurance subsidiaries in state guaranty funds;

•restrictions on the type and concentration of our regulated insurance subsidiaries’ investments;

•restrictions on the advertising and marketing of insurance;

•restrictions on the adjustment and settlement of insurance claims;

•restrictions on the use of rebates to induce a policyholder to purchase insurance;

•restrictions on the sale, solicitation and negotiation of insurance;

•restrictions on the sharing of insurance commissions and payment of referral fees;

•prohibitions on the underwriting of insurance on the basis of race, sex, religion and other protected classes;

•restrictions on our ability to use telematics to underwrite and price insurance policies, particularly in California;

•restrictions on the ability of our regulated insurance subsidiaries to pay dividends to us or enter into certain related party transactions without prior regulatory approval;

•rules requiring the maintenance of statutory deposits for the benefit of policyholders;

9

•privacy regulation and data security;

•regulation of corporate governance and risk management;

•periodic examinations of operations, finances, market conduct and claims practices; and

•required periodic financial reporting.

The business of insurance is almost entirely regulated at the state level, and the laws and regulations to which we are subject vary depending on the state. Unless the context otherwise requires, references herein to “state” include any of the 50 states, the District of Columbia and certain U.S. territories. These rules are subject to change as state legislatures and regulatory agencies update their laws and regulations to address real and perceived issues and concerns. These laws and regulations are also subject to interpretation by courts. The National Association of Insurance Commissioners, or NAIC, and the National Council of Insurance Legislators, or NCOIL, are the principal organizations tasked with establishing standards and best practices across the various states, the District of Columbia and five U.S. territories, and from time to time promulgate model rules and regulations that often are the basis for insurance rules and regulations adopted by such jurisdictions. We cannot predict precisely whether or when regulatory actions may be taken that could adversely affect us or the operations of our regulated insurance subsidiaries. Interpretations of regulations by regulators may change and statutes, regulations and interpretations may be applied with retroactive effect, particularly in areas such as accounting or reserve requirements.

Required Licensing

We have two wholly-owned regulated U.S. insurance subsidiaries, Root Insurance Company and Root Property & Casualty Insurance Company, or Root Property & Casualty. Root Insurance Company, an Ohio-domiciled insurer, is admitted in the state of Ohio to transact certain lines of property and casualty insurance, maintains licenses to transact insurance in Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maryland, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, Washington and West Virginia, and has an application pending for license to transact insurance in Massachusetts. Root Property & Casualty is domiciled in Delaware and admitted in all 50 states and the District of Columbia to transact certain lines of property and casualty insurance (including to sell personal auto insurance in 48 states and the District of Columbia). Since Root Insurance Company is our regulated insurance subsidiary with the largest premium volume, Ohio is considered our primary state insurance regulator.

We have a reinsurance captive subsidiary, Root Reinsurance Company, Ltd., or Root Re, domiciled in the Cayman Islands.

Our licensed insurance producer subsidiaries, Root Insurance Agency, LLC, Root Lone Star Insurance Agency, LLC, and Root Scout, LLC, must maintain an insurance producer license in every state in which they sell, solicit or negotiate insurance. Root Insurance Agency, LLC currently holds a resident insurance producer license in Ohio and a non-resident license in the remaining 49 states and the District of Columbia, except for California, Florida, Massachusetts and New York. Root Lone Star Insurance Agency, LLC currently holds a resident managing general agency license in Texas. Root Scout, LLC currently holds a resident insurance producer license in Ohio and a non-resident license in the remaining 49 states and the District of Columbia, except California, Florida, Massachusetts, and New York. Root Scout, LLC is seeking such license in California, Florida, Massachusetts, and New York and expects to have obtained them by the end of the second quarter of 2022.

Insurance regulators have broad authority to restrict or revoke licenses of insurance carriers and producers who are found to be in violation of any applicable laws and regulations.

10

Licensing of Our Employees

Any of our employees who sell, solicit or negotiate insurance must be licensed and appointed insurance producers and must fulfill annual continuing education requirements. In certain states in which we operate, insurance claims adjusters are also required to be licensed and fulfill annual continuing education requirements.

Insurance Holding Company Regulation

As the ultimate controlling person in the “insurance holding company system” under the Holding Company Acts, we are required to file annual enterprise risk reports, corporate governance disclosures and own risk solvency assessments with our domiciliary regulators. Moreover, in Ohio for example, any person divesting control of an insurer must provide 30 days’ notice to the regulator and the insurer.

Under the Holding Company Acts, all inter-affiliate transactions within a holding company system must meet the following conditions: (i) the terms must be fair and reasonable; (ii) charges or fees for services performed must be fair and reasonable; and (iii) expenses incurred and payments received must be allocated to the insurer in conformity with customary insurance accounting practices consistently applied. We generally must disclose any transaction between our regulated insurance subsidiaries and our other affiliates to the supervisory Department of Insurance, or DOI, and obtain prior approval from such DOI before entering into certain material inter-affiliate transactions, including, but not limited to, management agreements, tax allocation agreements, service contracts, cost-sharing arrangements, extraordinary dividends, certain reinsurance transactions and certain loan agreements.

Change of Control

Pursuant to the Holding Company Acts, a person must seek regulatory approval from the superintendent of the supervisory DOI prior to acquiring direct or indirect “control” of a domestic insurer by filing a Form A Statement Regarding the Acquisition of Control of or Merger with a Domestic Insurer. As part of this Form A application, the entity acquiring control (as well as any controlling shareholders of such entity) will need to submit, along with other documents and disclosures, its financial statements, organizational charts and biographical affidavits for any officers, directors and controlling shareholders of each applicable entity. The superintendent of the DOI will grant approval of an application to acquire control of a domestic insurer unless, after a public hearing, the superintendent finds that any of the following apply: (i) after the change of control, the domestic insurer would not be able to satisfy the requirements for the issuance of a license to write the line or lines of insurance for which it is presently licensed; (ii) the effect of the merger or other acquisition of control would be substantially to lessen competition in insurance in the applicable state or tend to create a monopoly; (iii) the financial condition of any acquiring party is such as might jeopardize the financial stability of the domestic insurer, or prejudice the interests of its policyholders; (iv) the plans or proposals that the acquiring party has to liquidate the domestic insurer, sell its assets, or consolidate or merge it with any person, or to make any other material change in its business or corporate structure or management, are unfair and unreasonable to policyholders of the domestic insurer and not in the public interest; (v) the competence, experience and integrity of the persons that would control the operation of the domestic insurer are such that it would not be in the interest of policyholders of the domestic insurer and of the public to permit the merger or other acquisition of control; or (vi) the acquisition is likely to be hazardous or prejudicial to the insurance-buying public.

The Holding Company Acts provide that control over a domestic insurer is presumed to exist if any person, directly or indirectly, owns, controls, holds with the power to vote, or holds proxies representing, ten percent or more of the voting securities of the domestic insurer. A person may rebut this statutory presumption of control by submitting a disclaimer of affiliation with the supervisory DOI, disclosing all material relationships and bases for affiliation between the person and the insurer as well as the basis for disclaiming such affiliation. The state regulators, however, may also find that “control” exists in circumstances in which a person owns or controls less than ten percent of the voting securities of the domestic insurer.

These change of control regulations may dissuade investors from acquiring a controlling stake in our company, including through transactions that some or all of our stockholders might consider to be desirable. Such regulations may also inhibit our ability to acquire an insurance company should we wish to do so in the future. See the section

11

titled “Risk Factors—Risks Related to this Offering and Ownership of Our Class A Common Stock—Applicable insurance laws may make it difficult to effect a change of control.”

ORSA

Pursuant to the Own Risk and Solvency Assessment, or ORSA, an insurance company with gross written and unaffiliated assumed premium of more than $500 million or that is part of an insurance group with gross written and unaffiliated assumed premium of more than $1 billion must maintain a risk management framework to assist the insurer with identifying, assessing, monitoring, managing, and reporting on its material and relevant risks. In addition, the insurer must regularly conduct an own risk and solvency assessment in accordance with NAIC’s ORSA Guidance Manual. Upon the request of the superintendent of the Ohio DOI, and not more than once a year, an insurer must submit an ORSA summary report, or any combination of reports that together contain the information described in the ORSA Guidance Manual, with respect to the insurer and the insurance group of which it is a member. Root Insurance Company became subject to ORSA in 2020 since it had gross written and unaffiliated assumed premium in excess of $500 million for that year and its first assessment was due prior to the end of fiscal year 2021. Root, Inc. filed its first ORSA summary report with the Ohio DOI on December 30, 2021.

Restrictions on Paying Dividends

We are a holding company that transacts a majority of its business through operating subsidiaries. Consequently, our ability to pay dividends to stockholders and meet our debt payment obligations depends on the results of operations of our operating subsidiaries and on the ability of such subsidiaries to provide us with cash, whether in the form of dividends, distributions, loans or otherwise. The payment of any extraordinary dividend by one of our regulated insurance subsidiaries requires the prior approval of the superintendent of the supervisory DOI. “Extraordinary dividend” is defined under the Code as: (i) any dividend or distribution of cash or other property whose fair market value, together with that of other dividends or distributions made within the preceding twelve months, exceeds the greater of (a) ten percent of an insurer’s policyholder surplus as of December 31 of the preceding year, or (b) an insurer’s net income for the twelve-month period ending December 31 of the preceding year or (ii) any dividend or distribution paid by an insurer from a source other than earned surplus. As of December 31, 2021, neither Root Insurance Company nor Root Property & Casualty were permitted to pay any dividends to us without approval of the superintendent of the supervisory DOI. See the section titled “Risk Factors—Risks Related to Our Business— Failure to maintain our risk-based capital at the required levels could adversely affect our ability to maintain regulatory authority to conduct our business.”

In addition, insurance regulators have broad powers to prevent a reduction of statutory surplus to inadequate levels, and there is no assurance that dividends of the maximum amount calculated under any applicable formula would be permitted. The Ohio DOI and the Delaware DOI may in the future adopt statutory provisions more restrictive than those currently in effect.

Reserves

Our domestic insurance subsidiaries are required to hold admitted assets as reserves to cover projected losses under its policies, in accordance with actuarial principles. In accordance with NAIC’s property and casualty statement instructions, they must submit an annual Statement of Actuarial Opinion from a qualified actuary appointed by the company, certifying that its reserves are reasonable.

Risk-Based Capital

Our domestic insurance subsidiaries are required to maintain minimum levels of risk-based capital to support their overall business operations and minimize the risk of insolvency. State insurance regulators use risk-based capital to set capital requirements, based on the size and degree of risk taken by the insurer, taking into account various risk factors including asset risk, credit risk, underwriting risk, and interest rate risk. As the ratio of an insurer’s total adjusted capital and surplus decreases relative to its risk-based capital, the risk-based capital laws provide for increasing levels of regulatory scrutiny and intervention.

12

Both Ohio and Delaware have adopted the model legislation promulgated by the NAIC pertaining to risk-based capital and require annual reporting by insurers domiciled within such states to confirm that the insurer is meeting its risk-based capital requirements. Insurers falling below a risk-based capital threshold may be subject to varying degrees of regulatory action. An insurance company with total adjusted capital that is less than 200% of its authorized control level risk-based capital is at a company action level, which would require the insurance company to file a risk-based capital plan that, among other things, contains proposals of corrective actions the company intends to take that are reasonably expected to result in the elimination of the company action level event. Additional action level events occur when the insurer’s total adjusted capital falls below 150%, 100% and 70% of its authorized control level risk-based capital. When total adjusted capital falls below 70%, a mandatory control event is triggered which results in the supervisory DOI placing the insurance company in receivership and assuming control of the operations of the insurer. Root, Inc. entered into an agreement with the Superintendent of Insurance, State of Ohio, or the Superintendent, guaranteeing that Root Insurance Company will maintain certain capital and surplus requirements or risk-based capital levels, whichever is greater, and such additional surplus as the Superintendent requires. The guarantee remains in effect until such time as the Superintendent may release Root, Inc. in writing. As of December 31, 2021, both Root Insurance Company and Root Property & Casualty’s risk-based capital levels are above any of these regulatory action level thresholds and our guaranteed threshold.

Hazardous Financial Conditions

Our insurance regulatory authorities have the authority to deem our domestic insurance subsidiaries to be in a hazardous financial condition such that the insurer’s continued operation may be hazardous to its policyholders, creditors, or the general public. A finding of a hazardous condition can be based upon a number of factors, including, but not limited to: (i) adverse findings in a financial, market conduct or other examination; (ii) failure to maintain adequate reserves in accordance with presently accepted actuarial standards of practice; (iii) net loss or negative net income in the last twelve month period or any shorter period of time; (iv) failure to meet financial and holding company filing requirements; (v) insolvencies with a company’s reinsurer(s) or within the insurer’s insurance holding company system; (vi) a finding of incompetent or unfit management of the insurer; (vii) a failure to furnish requested information or provide accurate information in relation to a response to an inquiry or filing of a financial statement; and (viii) any other finding determined by the commissioner to be hazardous to the insurer’s policyholders, creditors or general public.

If an insurance regulatory authority finds one of our domestic insurance subsidiaries to be in hazardous condition it has the authority, in lieu of placing the insurer into supervision, rehabilitation or liquidation, to enter into a memorandum of understanding with the insurer or issue an order to require the insurer to remedy the hazard. This would include, but is not limited to, ordering the insurer to: (i) increase its capital and surplus, (ii) suspend payments of dividends, (iii) limit or withdraw from certain investments, (iv) correct corporate governance deficiencies and (v) take any other action necessary to cure the hazardous condition.

Periodic Examinations

Our insurance subsidiaries are subject to on-site visits and financial and/or market conduct examinations by state insurance regulatory authorities. We are subject to financial condition examinations in any state in which one of our insurance company subsidiaries is domiciled. For example, Root Insurance Company is Ohio-domiciled and subject to a financial condition examination by the Ohio DOI at least every five years, during which the Ohio DOI reviews the company’s financials, governance, and operations, including its relationships and transactions with affiliates. Root Insurance Company’s first financial condition examination by the Ohio DOI covered the period of January 1, 2015 through December 31, 2019 and was completed on July 8, 2021. Root Property & Casualty, a Delaware-domiciled insurer, was subject to a similar financial condition examination by the Delaware DOI, which covered the period of January 1, 2016 through December 31, 2020 and was completed on February 2, 2022. The Ohio DOI and Delaware DOI examination reports are available to the public and contained no formal findings. Additionally, no financial statement adjustments were required as a result of the Ohio DOI and the Delaware DOI examinations.

We are also subject to market conduct examinations in any state in which one of our insurance subsidiaries issues policies. Market conduct examinations examine an insurer’s conduct toward policyholders, including

13

complaint handling, marketing, claims, policyholder notice, rate and form filing, and customer service. These examinations can result in fines and other monetary penalties, as well as other regulatory orders requiring remedial, injunctive, or other corrective action. Root Insurance Company is currently undergoing market conduct examinations conducted by the Virginia Bureau of Insurance and the Texas Department of Insurance. The Texas examination is expected to conclude near the end of the first quarter of 2022 and the Virginia examination is expected to conclude near the end of the second quarter of 2022. In addition, Root Re, our Cayman Islands subsidiary, is subject to inspections by the Cayman Islands Monetary Authority, or CIMA, on an ad-hoc basis and likely within a five-year period. To date no inspection has occurred.

Statutory Accounting Principles

A licensed insurance carrier’s financial statements must be completed in accordance with statutory accounting principles, or SAP. SAP was developed by U.S. insurance regulators as a method of accounting used to monitor and regulate the solvency of insurance companies. In developing SAP, insurance regulators were primarily concerned with evaluating an insurer’s ability to pay all its current and future obligations to customers. As a result, statutory accounting focuses on conservatively valuing the assets and liabilities of insurers, generally in accordance with standards specified by the insurer’s domiciliary jurisdiction.

Uniform statutory accounting practices are established by the NAIC and generally adopted by regulators in the various U.S. jurisdictions. These accounting principles and related regulations differ somewhat from generally accepted accounting principles in the United States, or GAAP, which are designed to measure a business on a going-concern basis. GAAP gives consideration to matching of revenue and expenses and, as a result, certain expenses are capitalized when incurred and then amortized over the life of the associated policies. Other assets such as goodwill are accounted for under GAAP financial statements but not SAP. As a result, the values for assets, liabilities, and equity reflected in financial statements prepared in accordance with GAAP may be different from those reflected in financial statements prepared under SAP.

Credit for Reinsurance

Root Insurance Company is currently party to a number of reinsurance agreements under which it has ceded a portion of the risk it is insuring to various reinsurers. State insurance laws permit U.S. insurance companies, as ceding insurers, to take financial statement credit for reinsurance that is ceded, so long as the assuming reinsurer satisfies the state’s credit for reinsurance laws. Once an insurance carrier has received credit for reinsurance it does not need to hold separate admitted assets as reserves to cover claims on the risks that it has ceded to the reinsurer. There are several different ways in which the credit for reinsurance laws may be satisfied by an assuming reinsurer, including being licensed in the state, being accredited in the state, or maintaining certain types of qualifying collateral. We ensure that all of Root Insurance Company’s reinsurers qualify for credit for reinsurance so that Root Insurance Company is able to take full financial statement credit for its reinsurance.

Rate Regulation

Most states require personal property and casualty insurers to file rating plans, policy or coverage forms, and other information with the state’s regulatory authority. In certain cases, such rating plans, policy forms, or both must be approved prior to use.

We currently have products on file and approved in the following states: Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Georgia, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maryland, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, West Virginia, and Wisconsin.

The speed with which an insurer can change rates in response to competition or increasing costs depends, in part, on whether the rating laws are (i) prior approval, (ii) file-and-use or (iii) use-and-file laws. In states having prior approval laws, the regulator must approve a rate before the insurer may use it. In states having file-and-use laws, the insurer does not have to wait for the regulator’s approval to use a rate, but the rate must be filed with the regulatory authority prior to being used. A use-and-file law requires an insurer to file rates within a certain period of

14

time after the insurer begins using them. Under all three types of rating laws, the regulator has the authority to disapprove a rate filing.

An insurer’s ability to adjust its rates in response to competition or to changing costs depends on an insurer’s ability to demonstrate to the regulator that its rates or proposed rating plan meet the requirements of the rating laws. In those states that significantly restrict an insurer’s discretion in selecting the business that it wants to underwrite, an insurer can manage its risk of loss by charging a rate that reflects the cost and expense of providing the insurance. In those states that significantly restrict an insurer’s ability to charge a rate that reflects the cost and expense of providing the insurance, the insurer can manage its risk of loss by being more selective in the type of business it underwrites. When a state significantly restricts both underwriting and pricing, it becomes more difficult for an insurer to maintain its profitability.

From time to time, the personal lines insurance industry comes under pressure from state regulators, legislators, and special-interest groups to reduce, freeze, or set rates at levels that do not correspond with our analysis of underlying costs and expenses. In particular, auto insurers have come under increasing pressure and in some states have been required to refund a portion of their premium to their policyholders due to decreasing auto claims arising from the COVID-19 pandemic. Whether this pressure continues to exist depends on the persistence of COVID-19 generally. State regulators may interpret existing law or rely on future legislation or regulations to impose new restrictions that adversely affect profitability or growth. We cannot predict with precision the impact on our business of possible future legislative and regulatory measures regarding insurance rates.

In addition, insurers are restricted in their ability to use telematics-based data to set premium rates in California. Proposition 103, which was passed by referendum in 1988, limits the factors that insurers can use to set auto insurance rates to, in decreasing order of importance: (i) the insured’s driving safety record; (ii) the number of miles he or she drives annually; (iii) the number of years of driving experience the insured has had; and (iv) those other factors that the Commissioner of the California Department of Insurance, or CA DOI, may adopt by regulation and that have a substantial relationship to the risk of loss. Under current California regulation, the use of telematics-based data beyond miles driven, including when, where or how the car is driven, is prohibited. We are currently in discussions with the CA DOI to revise its regulations to allow us to use telematics to a greater extent to underwrite and price insurance policies, although we cannot predict the outcome of these discussions, and there can be no assurance that the CA DOI will revise its regulations accordingly, if at all.

Insolvency Funds and Associations, Guarantee Funds, Assigned Risk Plans, Mandatory Pools, and Insurance Facilities

Most states require admitted property and casualty insurance companies to become members of insolvency funds or associations, which they fund through an annual assessment. In addition, certain states have enacted laws that require an insurer conducting business in that state to participate in assigned risk plans, reinsurance facilities and joint underwriting associations. These funds cover payments of claims of state policyholders whose admitted insurance carriers have become insolvent. The annual assessments required in any one year will vary from state to state and are subject to various maximum assessments per line of insurance.

Investment Regulation

Root Insurance Company is subject to Ohio’s rules and regulations governing the investment of its assets. Similarly, Root Property & Casualty is subject to Delaware’s rules and regulations governing invested assets. These laws generally require that an insurance company invest in a diverse portfolio and limit their investments in certain asset categories. Failure to comply with these laws and regulations would cause non-conforming investments to be treated as non-admitted assets for purposes of measuring statutory surplus and, in certain circumstances, we would be required to dispose of those investments.

Trade Practices

Insurance producers are subject to regulation on how they may sell, solicit or negotiate insurance and conduct their business, with state laws prohibiting certain unfair trade practices. Such practices include, but are not limited to, false advertising, making false statements to regulators, unfair discrimination and rebating premium to

15

policyholders above certain de minimis amounts. We set business conduct policies and provide training to make our employee-agents and other customer service personnel aware of these prohibitions and require them to conduct their activities in compliance with these statutes.

Unfair Claims Practices

Insurance companies, third-party administrators and individual claims adjusters are generally prohibited by state statutes from engaging in unfair claims practices. Unfair claims practices include, but are not limited to, misrepresenting pertinent facts or insurance policy provisions, failing to acknowledge and act reasonably promptly upon communications with respect to claims arising under insurance policies, failing to adopt reasonable standards for the investigation and settlement of a claim and attempting to settle a claim for less than the amount to which a reasonable person would have believed such person was entitled. We set business conduct policies to make claims adjusters aware of these prohibitions and to require them to conduct their activities in compliance with these statutes.

Commission Sharing

Insurance producers cannot share insurance commissions with any person for selling, soliciting or negotiating insurance unless such person holds an insurance producer license in the lines of insurance that are being transacted. Under the insurance laws of most states, there is a limited exception to this prohibition on commission sharing for the payment of referral fees to unlicensed persons, provided that the fee is a flat fee that is not contingent on the purchase of insurance and the referral does not involve the discussion of the terms or conditions of the policy.

Data Privacy

The use of non-public personal information in the insurance industry is subject to regulation under the privacy provisions of the Gramm-Leach Bliley Act and the NAIC Insurance Information and Privacy Act, as adopted and implemented by the various state legislatures and insurance regulators, including through the California Financial Information Privacy Act. Pursuant to these laws and regulations, among other things, an insurance carrier or producer must disclose its privacy policies to all of its applicants and policyholders and must also provide either an opt-in or opt-out, depending on the state, to the sharing of non-public personal information with unaffiliated third parties. Under these rules and regulations, insurance companies and producers must also establish a program of administrative, technical, and physical safeguards designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of customer information, and protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to the customers.

We are also subject to the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020, and the California Privacy Rights Act, or CPRA, which will become effective January 1, 2023. The CCPA and CPRA give California residents the right to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed disclosures about how their personal information is used and shared. The CCPA and CPRA exempt certain information that is collected, processed, sold or disclosed pursuant to the California Financial Information Privacy Act, the Gramm-Leach-Bliley Act or the federal Driver’s Privacy Protection Act, which also apply to us. However, the definition of “personal information” in the CCPA is broad and encompasses other information that we process beyond the scope of this exemption.

16

Cybersecurity

Additionally, in response to the growing threat of cyber-attacks in the insurance industry, certain jurisdictions have begun to consider and adopt new cybersecurity regulations. On October 24, 2017, the NAIC adopted the Insurance Data Security Model Law, intended to serve as model legislation for states to enact in order to govern cybersecurity and data protection practices of insurers, insurance agents, and other licensed entities registered under state insurance laws. A number of states have adopted versions of the Insurance Data Security Model Law, each with a different effective date. Root takes steps to comply with financial industry cybersecurity regulations and believes it complies in all material respects with their requirements but the patchwork nature of the laws in this area currently can make it more costly and difficult to ensure compliance. Our board of directors oversees cybersecurity risk management and delegates oversight of our information security program to our executive officers and chief information security officer, who is responsible for the day-to-day management of our information security program and provides updates to the audit committee of our board of directors at each of its meetings. Our incident response team, headed by our general counsel, reports material information security incidents to our executive officers, who in turn report them to our board of directors.

Federal Regulation

The regulation of insurance companies is principally a matter of state law, and the federal government does not directly regulate the transaction of insurance. However, federal regulation and initiatives do have an impact on the insurance industry. In particular, the Federal Insurance Office, or FIO, was established within the U.S. Department of the Treasury by the Dodd-Frank Act in July 2010 to monitor and coordinate the regulation of the insurance industry across the United States.

Although the FIO has limited direct regulatory authority over insurance companies or other insurance industry participants, it does represent the United States on prudential aspects of international insurance matters, including at the International Association of Insurance Supervisors, or IAIS. In addition, the FIO serves as an advisory member of the Financial Stability Oversight Council, or FSOC, assists the Secretary of the U.S. Department of the Treasury with administration of the Terrorism Risk Insurance Program, monitors trends in the insurance industry and advises the secretary of the U.S. Department of the Treasury on important national and international insurance matters. The FIO has the ability to make a recommendation to the FSOC to designate an insurer as “systemically significant,” subjecting the insurer to regulation by the Federal Reserve as a bank holding company, which could lead to higher capital requirements.

In addition, a number of federal laws affect and apply to the insurance industry, including various privacy laws, false advertising laws, anti-money laundering laws, the Fair Credit Reporting Act, or FCRA, and the economic and trade sanctions implemented by the Office of Foreign Assets Control, or OFAC. OFAC has imposed civil penalties on persons, including insurance and reinsurance companies, arising from violations of its economic sanctions program.

Available Information

General information about Root, Inc., including our Corporate Governance Guidelines and our Code of Business and Ethics, can be found at ir.joinroot.com under the “Governance” tab by selecting “Documents & Charters.” We will post on our website any amendments to, or waivers from, our Code of Business and Ethics requiring disclosure under applicable rules within four business days of the amendment or waiver. Charters for the Audit, Risk and Finance Committee, Compensation Committee, and Nominating and Governance Committee are also available at this location. Root, Inc. uses its website, ir.joinroot.com, as a channel for routine distribution of important information, including news releases and other investor communications. Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments and exhibits to those reports, are available free of charge through our website as soon as reasonably practicable after the reports are filed with or furnished to the SEC. These documents are also available in hard copy, free of charge, by contacting our Investor Relations office. Additionally, the SEC maintains a website (www.sec.gov) that contains the reports, proxy statements and information statements, and other information regarding issuers that file or furnish electronically with the SEC. In addition, our website allows investors and other interested persons to sign up to

17

automatically receive email alerts when we post news releases and financial information on our website. Information contained on our website is not incorporated into this Annual Report on Form 10-K or other securities filings.

18

Item 1A. Risk Factors

The following are certain risk factors that could affect our business, financial position and results of operations. Although the risks are organized by headings and each risk is described separately, many of the risks are interrelated. The risks that we have highlighted in the following section of this report are not the only ones that we face. Our business involves various risks and uncertainties as well as those associated with the general business and insurance industry environments.

Investing in our Class A common stock involves a high degree of risk. You should carefully consider the following risks, together with all of the other information contained in this Annual Report on Form 10-K, before deciding to invest in our Class A common stock. Our business, financial condition, results of operations or prospects could be materially and adversely affected by any of these risks or uncertainties, as well as by risks or uncertainties not currently known to us, or that we do not currently believe are material. In that case, the trading price of our Class A common stock could decline, and you may lose all or part of your investment.

Risks Related to Our Business

We have a history of net losses and could continue to incur substantial net losses in the future. We may not continue to grow at historical rates or achieve or maintain profitability in the future.

We have incurred net losses on an annual basis since our incorporation in 2015, and we may incur significant net losses in the future. We incurred net losses of $521.1 million, $363.0 million and $282.4 million for the years ended December 31, 2021, 2020 and 2019, respectively. We had an accumulated loss of $1,270.1 million and $748.0 million as of December 31, 2021 and December 31, 2020, respectively.

The principal driver of our losses to date is our loss ratios associated with accidents by our customers. As a newer and high growth-focused full-stack insurance company, we have a higher proportion of new customers and/or customers who are inclined to more regularly shop for insurance relative to longer-tenured insurance companies. This higher proportion of new and shopper customers typically generates proportionately greater losses, thus impacting our loss ratio. Like with other more-tenured insurance companies, over time we expect a greater proportion of all customers will be renewal customers. Establishing adequate premium rates is necessary, together with investment income, if any, to generate sufficient revenue to offset losses, loss adjustments expenses, or LAE, and other costs. If we do not accurately assess the risks that we underwrite, the premiums that we charge may not be adequate to cover our losses and expenses, which would adversely affect our results of operations and our profitability.

We expect accumulated net loss to continue to increase as we continue to make investments in the development and expansion of our business. Expenses contributing to a net loss may occur in the areas of building embedded products, telematics, digital marketing, brand advertising, consumer-facing technologies, core insurance operations services and lines of insurance not presently offered by Root. We may encounter unforeseen or unpredictable factors, including unforeseen operating expenses, complications or delays, which may result in increased costs, and it is difficult to predict the size and growth rate of our market, demand for our services and success of current or potential future competitors. Our investments to grow our business may not result in increased or sufficient revenue or growth for several years or at all. Additionally, we will continue to incur significant expenses in connection with the repayment of the outstanding principal and accrued interest on our term loan, and as a public company, we will also incur significant legal, accounting and other expenses that we did not incur as a private company.

Our limited operating history may make it difficult to evaluate our current business and our future prospects. While our revenue has grown in recent periods, our historic growth rate may not be sustainable. With changes to our focus areas of growth, our historic growth rates should not be considered indicative of future performance, and we may not realize sufficient revenue to achieve or maintain profitability. Revenue growth rates may slow in future periods due to a number of reasons. We may chose to preserve capital, change our focus areas of growth, or encounter unforeseen or unpredictable factors, which may result in increased operating expenses, complications or delays slowing demand for our service, increasing competition, a decrease in the growth of our overall market, and our failure to capitalize on growth opportunities or the maturation of our business. If we fail to manage our losses or

19

to grow our revenue sufficiently to keep pace with our investments and other expenses, our business will be seriously harmed and we may not achieve or maintain profitability in future periods.

We may lose existing customers or fail to acquire new customers, and our future growth and profitability depend in part on our ability to successfully operate in an insurance industry that is highly competitive. If we are unable to maintain the levels of customer service or continue technological innovation and improvements, our prospects for future growth may be materially adversely affected.

Our ability to attract and retain customers depends, in part, on our ability to successfully expand geographically, grow our business in the markets we currently serve, expand into new lines of business and offer additional products beyond automobile, renters and homeowners insurance. Expanding into new geographic markets takes time, may place us in unfamiliar competitive environments, requires us to navigate and comply with extensive regulations and may occur more slowly than we expect or than it has occurred in the past. While our loss performance has generally improved over time, loss performance is influenced by a number of factors, including inflation, and as more customers renew their policies and remain policyholders for longer, a future loss of customers could lead to higher loss ratios or loss ratios that cease to decline, which would adversely impact our profitability. If we lose customers, our value will diminish. In addition, we may fail to accurately predict risk segmentation of new customers or potential customers, which could also reduce our profitability.

Further, the insurance industry in which we operate is highly competitive. Many of our primary competitors have well-established national brands and market similar products. Our competitors include large national insurance companies, as well as up-and-coming companies and new market entrants in the insurtech industry, some of which also utilize telematics and offer forms of usage-based insurance. Several of these established national insurance companies are larger than us and have significant competitive advantages over us, including better name recognition, higher financial ratings, greater resources, additional access to capital, and more types of insurance coverage to offer, such as health and life. In particular, many of our competitors offer consumers the ability to purchase multiple types of insurance coverage and “bundle” them together into one policy and, in certain circumstances, include an umbrella liability policy for additional coverage at competitive prices. As we expand into new lines of business and offer additional products, we could face intense competition from traditional insurance companies that are already established in such markets.

Our business model and technology are still nascent compared to the established business models of the well-established incumbents in the insurance market. Our success in the automobile insurance market depends on our deep understanding of this industry. To penetrate new vertical markets, we will need to develop a deep understanding of those new markets and the associated business challenges faced by participants in them. Developing this level of understanding may require substantial investments of time and resources, and we may not be successful. In addition to the need for substantial resources, insurance regulation could limit our ability to introduce new product offerings. New insurance products could take an extended amount of time to be approved by regulatory authorities or may not be approved at all. If we fail to penetrate new vertical markets successfully, our revenue may grow at a slower rate than we anticipate, and our business, results of operations and financial condition could be materially adversely affected.

We have invested in growth strategies by utilizing unique customer value propositions, differentiated product offerings and distinctive advertising campaigns. If we are unsuccessful through these strategies in generating new business, retaining a sufficient number of customers or retaining or acquiring key relationships, our ability to maintain or increase premiums written or the ability to sell our products could be adversely impacted. Because of the competitive nature of the insurance industry, there can be no assurance that we will continue to compete effectively within our industry, or that competitive pressures will not have a material effect on our business, results of operations or financial condition. If we fail to remain competitive on customer experience, pricing, and insurance coverage options, our ability to grow our business may also be adversely affected.

There are many other factors that could negatively affect our ability to maintain or grow our customer base, including if:

20

•we fail to offer new and competitive products, or fail to obtain regulatory approvals necessary for expansion into new markets or in relation to our products (such as underwriting and rating requirements);

•we fail to develop an effective embedded insurance platform;

•we fail to effectively use search engines, social media platforms, digital app stores, content-based online advertising, and other online sources for generating traffic to our website and our mobile app;

•our digital platform experiences disruptions; technical or other problems frustrate the customer experience, particularly if those problems prevent us from generating quotes or paying claims in a fast and reliable manner; we fail to provide effective updates to our existing products or to keep pace with technological improvements in our industry; or customers have difficulty installing, updating or otherwise accessing our app or website on mobile devices or web browsers as a result of actions by us or third parties;

•we suffer reputational harm to our brand including from negative publicity, whether accurate or inaccurate;

•customers are unable or unwilling to adopt or embrace new technology or the perception emerges that purchasing insurance products online is not as effective as purchasing those products through traditional offline methods; or

•we are unable to address customer concerns regarding the content, privacy, and security of our digital platform.

Our inability to overcome these challenges could impair our ability to attract new customers and retain existing customers and could have a material adverse effect on our business, operating results and financial condition.

We may require additional capital to support business growth or to satisfy our regulatory capital and surplus requirements, and this capital might not be available on acceptable terms, if at all.

We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features and products or enhance our existing products and services, satisfy our regulatory capital and surplus requirements, cover losses, improve our operating infrastructure or acquire complementary businesses and technologies. Many factors will affect our capital needs as well as their amount and timing, including our growth and profitability, regulatory requirements, market disruptions and other developments. If our present capital and surplus is insufficient to meet our current or future operating requirements, including regulatory capital and surplus requirements, or to cover losses, we may need to raise additional funds through financings or curtail our growth. We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans and operating performance, as well as the condition of the capital markets at the time we seek financing. We cannot be certain that additional financing will be available to us on favorable terms, or at all.

If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of Class A common stock. Further, if the trading price of our Class A common stock remains depressed or declines further, the potential magnitude of this dilution will increase. As an insurance company, we are subject to extensive laws and regulations in every jurisdiction in which we conduct business, and any such issuances of equity or convertible debt securities to secure additional funds may be impeded by regulatory approvals or requirements imposed by such regulatory authorities if such issuances are deemed to result in a person acquiring “control” of our company under applicable insurance laws and regulations. Such regulatory requirements may require potential investors to disclose their organizational structure and detailed financial statements as well as require managing partners, directors and/or senior officers to submit biographical affidavits which may deter investment in our company.

Further, we are restricted by covenants in our credit agreements. These covenants restrict, among other things, our ability to incur additional debt without lender consent or grant liens over our assets, which may limit our ability to obtain additional funds.

21

The COVID-19 pandemic has caused disruption to our operations and may negatively impact our business, key metrics, and results of operations in numerous ways that remain unpredictable.

Our business has been and may continue to be impacted by the effects of the outbreak of the novel strain of coronavirus, or COVID-19, which was declared a global pandemic in March 2020. This pandemic and related measures taken to contain the spread of COVID-19, such as government-mandated business closures, orders to “shelter in place,” or SIPs, and travel and transportation restrictions, have negatively affected the U.S. and global economies, disrupted global supply chains, and led to unemployment. In 2020, our business was favorably impacted by the SIPs as our customers drove less and we had a resulting material decline in loss coverages, which returned to pre-COVID-19 levels in 2021. Our business has also been impacted by certain state regulations related to COVID-19 relief efforts, including restrictions on the ability to cancel policies for non-payment, requirements to defer insurance premium payments for up to 60 days and restrictions on increasing policy premiums. We continue to assess and update our business continuity plans in the context of this pandemic, including taking steps in an effort to help keep our employees healthy and safe. The spread of COVID-19 has caused us to modify our business practices (including employee travel, employee work locations in certain cases, and cancellation of physical participation in meetings, events, and conferences), and we expect to take further actions as may be required or recommended by government authorities or as we determine are in the best interests of our employees and customers. Furthermore, the COVID-19 pandemic and governmental responses thereto have impacted and may further impact the broader economies of affected countries, including creating or exacerbating supply chain disruptions and inflation and negatively impacting economic growth, the proper functioning of financial and capital markets, foreign currency exchange rates, and interest rates. It is possible that the pandemic and governmental responses thereto will cause increased inflation, an economic slowdown of potentially extended duration, as well as a global recession. The COVID-19 pandemic and governmental responses thereto have resulted, and could further result in, an increase in costs associated with claims under our policies, including the cost to repair or replace vehicles, as well as an increase in the number of customers experiencing difficulty paying premiums, any of which could have a material adverse effect on our business and results of operations. Furthermore, due to the COVID-19 pandemic’s negative impact on driving, regulators in many states either mandated or requested that auto insurance companies refund a portion of their premium to their policyholders to reflect the insurer’s decrease in projected loss exposure due to the virus, and could do so again in the future. In all of the states in which we operate, state insurance regulators have either encouraged, strongly suggested or mandated insurers to provide COVID-19-related consumer relief. Regulators in 13 states in which we operate placed a mandatory moratorium on non-pay cancellations, providing consumers grace periods ranging from 30 days to 120 days in duration during which premium did not need to be paid in a timely fashion. These moratoriums were part of the increase of premium write offs to 2.5% during the year ended December 31, 2021. These mandates and similar regulations or requests could negatively impact our ability to charge or increase premiums to adequately cover our losses and could result in continued increased premium write offs.

Though we continue to monitor the COVID-19 pandemic closely, due to the speed with which it continues to develop, including as a result of new variants, the global breadth of its spread, the range of governmental and community reactions thereto and any delays in wide distribution, or public acceptance, of vaccines (including boosters), there is considerable uncertainty around its duration and ultimate impact. Even after the COVID-19 pandemic subsides, the U.S. economy and other major global economies may experience severe economic aftereffects, such as increased inflation and/or a recession, and we anticipate our business and operations could be materially adversely affected by either in the United States. The impact of the pandemic may also exacerbate the other risks described in these Risk Factors, and additional impacts may arise that we are not currently aware of, any of which could have a material effect on us. In addition, if there is a future resurgence of COVID-19 or the emergence of another pandemic, these negative impacts on our business may be further exacerbated. As a result, the full extent of the impact of the pandemic on our overall financial and operating results, whether in the near or long term, cannot be reasonably estimated at this time.

We rely on telematics, mobile technology and our digital platform to collect data points that we evaluate in pricing and underwriting our insurance policies, managing claims and customer support, and improving business processes. To the extent regulators prohibit or restrict our collection or use of this data, our business could be harmed.

22

We use telematics, mobile technology and our digital platform to collect data points that we evaluate in pricing and underwriting certain of our insurance policies, managing claims and customer support, and improving business processes. Our business model is dependent on our ability to collect driving behavior data and utilize telematics. If legislation were to restrict our ability to collect driving behavior data, it could impair our capacity to underwrite insurance cost effectively, negatively impacting our revenue and earnings. In addition, if federal, state or international regulators were to determine that the type of data we collect, the process we use for collecting this data or how we use it unfairly discriminates against a protected class of people, regulators could move to prohibit or restrict our collection or use of this data.

Due to Proposition 103 in California, we are currently limited in our ability to use telematics data beyond miles-driven to underwrite insurance, including data on how the car is driven. This has significantly hindered our ability to offer cost-competitive insurance policies in California and could impede our ability to offer insurance policies in other states if they were to pass similar laws or regulations.

Although there is currently limited federal and state legislation outside of California restricting our ability to collect driving behavior data, private organizations are implementing principles and guidelines to protect driver privacy. The Alliance of Automobile Manufacturers and Global Automakers established their Consumer Privacy Protection Principles to provide member automobile manufacturers with a framework with which to consider privacy and build privacy into their products and services while the National Automobile Dealers Association has partnered with the Future of Privacy Forum to produce consumer education guidelines that explain the kinds of information that may be collected by consumers’ cars, the guidelines that governs how it is collected and used, and the options consumers may have to protect their vehicle data. The Global Alliance for Vehicle Data Access is another organization that was formed to advocate for driver ownership of all vehicle data, particularly for insurance underwriting purposes. If federal or state legislators pass laws limiting our ability to collect driver data, particularly through driver’s smartphones, such legislation could have a material adverse effect on our business, financial condition or results of operations.

Some regulators have expressed interest in the use of external data sources, algorithms and/or predictive models in insurance underwriting or rating. Specifically, regulators have raised questions about the potential for unfair discrimination and lack of transparency associated with the use of external consumer data. A determination by federal or state regulators that the data points we collect and the process we use for collecting data unfairly discriminates against a protected class of people could subject us to fines and other sanctions, including, but not limited to, disciplinary action, revocation and suspension of licenses, regulatory fines and other sanctions, and withdrawal of product forms. Any such event could, in turn, materially and adversely affect our business, financial condition, results of operations and prospects. Although we have implemented policies and procedures into our business operations that we feel are appropriately calibrated to our machine learning and automation-driven operations, these policies and procedures may prove inadequate to manage our use of this nascent technology, resulting in a greater likelihood of inadvertent legal or compliance failures.

In addition, the National Association of Insurance Commissioners, or NAIC, announced on July 23, 2020 the formation of a new Race and Insurance Special Committee, or the Special Committee. The Special Committee is tasked with analyzing the level of diversity, equity and inclusion within the insurance sector, identifying current practices in the insurance industry that disadvantage minorities and making recommendations to increase diversity, equity and inclusion within the insurance sector and address practices that disadvantage minorities. The Special Committee may look into strengthening unfair discrimination laws, such as prohibiting the use of credit scores in the underwriting of auto insurance. Any new unfair discrimination legislation that would prohibit us from using data that we currently use or plan to use in the future to underwrite insurance could negatively impact our business.

Regulators may also require us to disclose the external data we use, algorithms and/or predictive models prior to approving our underwriting models and rates. Such disclosures could put our intellectual property at risk.

Additionally, existing laws, such as the California Consumer Privacy Act, or the CCPA, future laws, and evolving attitudes about privacy protection may impair our ability to collect, use, and maintain data points of sufficient type or quantity to develop and train our algorithms. If such laws or regulations were enacted federally or

23

in a large number of states in which we operate, it could impact the integrity and quality of our pricing and underwriting processes.

We or Carvana may fail to develop an embedded insurance product and/or fail to perform under the parties’ commercial agreement.

We entered into a commercial agreement with Carvana on October 1, 2021, in which the parties agreed to develop an integrated automobile insurance solution for Carvana’s online car buying platform, and we will pay commissions to Carvana for insurance policies purchased by Carvana customers. The commercial agreement includes exclusivity rights to offer automobile insurance on Carvana’s platform, and we will partner exclusively with Carvana for an enterprise total loss replacement vehicle solution. If we or Carvana are unable to satisfy the obligations under the commercial agreement, or if we are unable to develop an embedded insurance product, that could have a material and adverse effect on our business, financial condition and results of operations.

We depend on search engines, social media platforms, digital app stores, content-based online advertising and other online sources to attract consumers to our website and our mobile app both rapidly and cost-effectively. If these third parties change their listings or increase their pricing, if our relationships with them deteriorate or terminate, or if other factors related to these third parties arise which are beyond our control, we may be unable to attract new customers rapidly and cost-effectively, which would adversely affect our business and results of operations.

Our success depends on our ability to attract consumers to our website and convert them into customers in a rapid and cost-effective manner through our mobile app. We depend in large part on search engines, social media platforms, digital app stores, content-based online advertising and other online sources for traffic to our website and our mobile app, which are material sources for new consumers.

With respect to search engines, we are included in search results as a result of both paid search listings, where we purchase specific search terms that result in the inclusion of our advertisement, and free search listings, which depend on algorithms used by search engines. For paid search listings, if one or more of the search engines or other online sources on which we rely modifies or terminates its relationship with us, our expenses could rise if we have to pay a higher price for such listings or if the alternatives we find are more expensive, or we could lose consumers and traffic to our website, any of which could have a material adverse effect on our business, results of operations and financial condition. For free search listings, if search engines on which we rely for algorithmic listings modify their algorithms, our websites may appear less prominently or not at all in search results, which could result in reduced traffic to our websites, and fewer new customers.

Our ability to maintain or increase the number of consumers who purchase our products after being directed to our website or our mobile app from other digital platforms depends on many factors that are not within our control. Search engines, social media platforms and other online sources often revise their algorithms and introduce new advertising products. If one or more of the search engines or other online sources on which we rely for traffic to our website and our mobile app were to modify its general methodology for how it displays our advertisements or keyword search results, resulting in fewer consumers clicking through to our website and our mobile app, our business and operating results are likely to suffer. In addition, if our online display advertisements are no longer effective or are not able to reach certain consumers due to consumers’ use of ad-blocking software, our business and operating results could suffer.

Additionally, changes in regulations could limit the ability of search engines and social media platforms, including but not limited to Google and Facebook, to collect data from users and engage in targeted advertising, making them less effective in disseminating our advertisements to our target customers. For example, the proposed Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data, or DASHBOARD, Act would mandate annual disclosure to the Securities and Exchange Commission, or the SEC, of the type and “aggregate value” of user data used by harvesting companies, such as Facebook, Google and Amazon, including how revenue is generated by user data and what measures are taken to protect the data. If the costs of advertising on search engines and social media platforms increase, we may incur additional marketing expenses or be required to allocate a larger portion of our marketing spend to other channels and our business and operating results could be

24

adversely affected. Similarly, changes to regulations applicable to the insurance brokerage and distribution business may limit our ability to rely on key distribution platforms, such as the Root API, if the third-party distribution platforms are unable to continue to distribute our insurance products without an insurance producer license pursuant to applicable insurance laws and regulations.

From time to time (including in 2021), competition for limited and/or high-value advertising space from our competitors or other companies can result in increases in the costs we incur in our marketing efforts. These increases to our customer acquisition costs depend on a number of factors outside of our control and can negatively affect our business and operating results.

The marketing of our insurance products depends on our ability to cultivate and maintain cost-effective and otherwise satisfactory relationships with digital app stores, in particular, those operated by Google and Apple. As we grow, we may struggle to maintain cost-effective marketing strategies, and our customer acquisition costs could rise substantially. Furthermore, because many of our customers access our insurance products through a mobile app, we depend on the Apple App Store and the Google Play Store to distribute our mobile app.

Operating system platforms and application stores controlled by third parties, such as Apple and Google, may change their terms of service or policies in a manner that increases our costs or impacts our ability to distribute our mobile app, collect data through it and market our products.

We are subject to the terms of service and policies governing the operating system platforms on which our mobile app runs and the application stores through which we distribute our mobile app, such as those operated by Apple and Google. These terms of service and policies govern the distribution, operation and promotion of applications on such platforms and stores. These platforms and stores have broad discretion to change and interpret their terms of service and policies in a manner that may adversely affect our business. For example, an operating system platform or application store may increase its access fees, restrict the collection of data through mobile apps that run on those platforms, restrict how that data is used and shared, and limit how mobile app publishers advertise online.

Additionally, limitations on our ability to collect, use or share telematics and other data derived from customer activities on smartphones, as well as new technologies that block our ability to collect, use or share such data, could significantly diminish the value of our platform and have an adverse effect on our ability to generate revenue.

Limitations or blockages on our ability to collect, use or share data derived from use of our mobile app may also restrict our ability to analyze such data to facilitate our product improvement, research and development and advertising activities. For example, in June 2020, Apple announced plans to require applications using its mobile operating systems to obtain an end-user’s permission to track them or access their device’s advertising identifier for advertising and advertising measurement purposes, as well as other restrictions that could adversely affect our business.

If we were to violate, or be perceived to have violated, the terms of service or policies of an operating system platform or application store, the provider may limit or block our access to it. It is possible that an operating system platform or application store might limit, eliminate or otherwise interfere with the distribution of our mobile app, the features we provide and the manner in which we market our mobile app, or give preferential treatment on their platforms or stores to a competitor. To the extent either of these occur, our business, results of operations and financial condition could be adversely affected.

Furthermore, one of the factors we use to evaluate our customer satisfaction and market position is our Apple App Store ratings. This rating, however, may not be a reliable indicator of our customer satisfaction relative to other companies who are rated on the Apple App Store since, to date, we have received a fraction of the number of reviews of some of the companies we benchmark against, and thus our number of positive reviews may not be as meaningful.

Our expansion within the United States and any future international expansion strategy will subject us to additional regulatory approvals and costs and risks, and our plans may not be successful.

25

Our success depends in significant part on our ability to expand into additional markets in the United States and abroad. We currently hold Certificates of Authority in 50 states and the District of Columbia and operate in 32 of those states. We plan to have a presence in all 50 states and the District of Columbia, but cannot guarantee that we will be able to provide nationwide coverage on that timeline or at all. We have applied for licenses in 11 states that have not been approved or were withdrawn. Root Insurance Company has one pending certificate of authority application with the Massachusetts Division of Insurance and has not had a license application denied by any insurance regulators. Generally, regulators in states in which our applications were withdrawn preferred that we seek approval at such time that we could demonstrate an underwriting profit and/or willingness to commit to a risk-based capital position greater than what had been required by the Ohio Department of Insurance, or the Ohio DOI.

In addition to growing our domestic business, we may also seek to expand outside of the United States. International expansion may increase our risks in complying with various laws and standards, including with respect to anti-corruption, anti-bribery, anti-money laundering, export controls, and trade and economic sanctions. If we are successful in our efforts to expand abroad, operating outside of the United States may require significant management attention to oversee operations over a broad geographic area with varying cultural norms and customs, in addition to placing strain on our finance, analytics, compliance, legal, engineering, and operations teams.

As we seek to expand in the United States and abroad, we may incur significant operating expenses, including expenses in connection with securing applicable regulatory approvals, marketing, hiring additional personnel, engaging third-party service providers and other research and development costs. If we invest substantial time and resources to expand our operations while our revenues from those additional operations do not exceed the expense of establishing and maintaining them, or if we are unable to manage these risks effectively, our business, results of operations and financial condition could be adversely affected.

Moreover, our expansion may not be successful for a variety of reasons, including because of:

•one or more states could revoke our license to operate, or implement additional regulatory hurdles that could preclude or inhibit our ability to obtain or maintain our license in such state;

•failures in identifying and entering into joint ventures with strategic partners, both domestically and internationally, or entering into joint ventures that do not produce the desired results;

•challenges in, and the cost of, complying with various laws and regulatory standards, including with respect to the insurance business and insurance distribution, capital and outsourcing requirements, data privacy, tax and local regulatory restrictions;

•difficulty in recruiting and retaining licensed, talented and capable employees;

•competition from local incumbents that already own market share, better understand the local market, may market and operate more effectively and may enjoy greater local affinity or awareness;

•differing demand dynamics, which may make our product offerings less successful;

•currency exchange restrictions or costs and exchange rate fluctuations;

•our lack of experience in operating our business internationally;

•operating in jurisdictions that do not protect intellectual property rights to the same extent as the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate; and

•limitations on the repatriation and investment of funds as well as foreign currency exchange restrictions.

If we fail to grow our geographic footprint or geographic growth occurs at a slower rate than expected, our business, results of operations and financial condition could be materially and adversely affected.

26

Our technology platform may not operate properly or as we expect it to operate.

We utilize our technology platform to gather customer data in order to determine whether or not to write and how to price our insurance products. Similarly, we use our technology platform to process many of our claims. Our technology platform is expensive and complex, its continuous development, maintenance and operation may encounter unforeseen difficulties including material performance problems or undetected defects or errors. We may encounter technical obstacles, and it is possible that we may discover additional problems that prevent our technology from operating properly. If our platform does not function reliably, we may incorrectly select our customers, price insurance products for our customers or incorrectly pay or deny claims made by our customers. These errors could cause us to select an uneconomic mix of customers, encounter customer dissatisfaction, which could lead customers to cancel or fail to renew their insurance policies with us or make it less likely that prospective customers obtain new insurance policies, underprice policies or overpay claims, or incorrectly deny policyholder claims and become subject to liability. Additionally, technology platform errors may lead to unintentional bias and discrimination in the underwriting process, which could subject us to legal or regulatory liability and harm our brand and reputation. Any of these eventualities could result in a material adverse effect on our business, results of operations and financial condition.

While we believe our telematics-based pricing model to be more fair to consumers, it may yield results that customers find unfair. For instance, we may quote certain drivers higher premiums than our competitors, if our model determines that the driver is higher risk even though their higher-risk driving has not resulted in a claim. Such perception of unfairness could negatively impact our brand and reputation.

Regulators may limit our ability to develop or implement our telematics-based pricing model and/or may eliminate or restrict the confidentiality of our proprietary technology.

Our future success depends on our ability to continue to develop and implement our telematics-based pricing model, and to maintain the confidentiality of our proprietary technology. Changes to existing regulations, their interpretation or implementation, or new regulations could impede our use of this technology or require that we disclose our proprietary technology to our competitors, which could negatively impact our competitive position and result in a material adverse effect on our business, results of operations, and financial condition. For example, California voters recently approved the California Privacy Rights and Enforcement Act, or the CPRA, which will become effective January 1, 2023, and which affords California residents significantly more control over their personal information, including the right to information about the logic of certain algorithmic decisions about them and the right to opt-out of such decisions, imposes heightened compliance obligations on covered businesses and establishes a new enforcement agency dedicated to consumer privacy. The CPRA mandates issuance of regulations which could require disclosure of our proprietary technology, limit the effectiveness of our products and reduce demand for them.

We are subject to full scope financial examinations by state insurance regulatory authoritiesin each state in which one of our domestic insurance company subsidiaries is domiciled, which could result in adverse examination findings and necessitate remedial actions.

State insurance regulators perform examinations of insurance companies under their jurisdiction to assess compliance with applicable laws and regulations, financial condition and the conduct of regulated activities at least every five years. Root Insurance Company is Ohio-domiciled and has completed, its first five-year financial examination with the Ohio DOI, which includes a review of the company’s financials, governance, and operations, including its relationships and transactions with affiliates, and a specific examination of our pricing and underwriting methodologies and our regulatory capital. Similarly, Root Property & Casualty is a Delaware-domiciled insurer and completed a similar financial examination by the Delaware DOI. If, as a result of examinations, our regulators determine that our financial condition, capital resources or other aspects of any of our operations are not satisfactory, or that we have violated applicable laws or regulations, such regulator may subject us to fines or other penalties and/or require us to take one or more remedial actions or otherwise subject us to regulatory scrutiny, such as pursuant to an enforcement action or, in the case of regulatory capital, require us to maintain additional capital. The results of the examinations are a matter of public record, and our reputation may also be harmed by such penalties.

27

We are subject to market conduct examinations by state insurance regulatory authorities in any state in which our domestic insurance subsidiaries issue insurance policies, which could result in adverse examination findings and necessitate remedial actions.

Our domestic insurance subsidiaries are also subject to other investigations or inquiries, including market conduct examinations, in any state in which they issue policies. These examinations can result in fines and other monetary penalties, as well as other regulatory orders requiring remedial, injunctive, or other corrective action. For example, Root Insurance Company is currently subject to a market conduct examination by the Virginia State Corporation Commission’s Bureau of Insurance and the Texas Department of Insurance. Any regulatory or enforcement action or any regulatory order imposing remedial, injunctive, or other corrective action against us resulting from this examination could have a material adverse effect on our business, reputation, financial condition or results of operations.

Our exposure to loss activity and regulation may be greater in states where we currently have most of our customers: Texas, Georgia and Louisiana.

Approximately 36.9% of our gross written premium for the year ended December 31, 2021 originated from customers in Texas, Georgia and Louisiana. As a result of this concentration, if a significant catastrophe event or series of catastrophe events occur, and cause material losses in Texas, Georgia or Louisiana, our business, financial condition and results of operation could be materially adversely affected. Further, as compared to our competitors who operate on a wider geographic scale, any adverse changes in the regulatory environment affecting property and casualty insurance in Texas, Georgia or Louisiana may expose us to more significant risks.

We are subject to stringent and changing privacy and data security laws, regulations, and standards related to data privacy and security, increasing the complexity of compliance. Our actual or perceived failure to comply with such obligations could harm our reputation, subject us to significant fines and liability, or adversely affect our business.

In the United States, insurance companies are subject to the privacy provisions of the federal Gramm-Leach-Bliley Act and the NAIC Insurance Information and Privacy Protection Model Act, as adopted and implemented by certain state legislatures and insurance regulators. The regulations implementing these laws require insurance companies to disclose their privacy practices to consumers, allow them to opt-in or opt-out, depending on the state, of the sharing of certain personal information with unaffiliated third parties, and maintain certain security controls to protect their information. Violators of these laws face regulatory enforcement action, substantial civil penalties, injunctions, and in some states, private lawsuits for damages. Insurance companies are also subject to state-specific privacy laws governing the use of particular data. For instance, the Illinois Biometric Information Privacy Act regulates the use and storage of biometric data such as fingerprints in the insurance industry and requires the informed written consent from policyholders if the insurance company intends to collect or disclose their personal biometric identifiers.

Privacy and data security regulation in the United States is rapidly evolving. For example, existing laws, such as the CCPA, which became effective January 1, 2020, future laws, and evolving attitudes about privacy protection may impair our ability to collect, use, and maintain data points of sufficient type or quantity to develop and train our algorithms. The CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches, which is expected to increase the volume and success of class action data breach litigation. In addition to increasing our compliance costs and potential liability, the CCPA’s restrictions on “sales” of personal information may restrict our use of cookies and similar technologies for advertising purposes. The CCPA excludes information covered by Gramm-Leach-Bliley Act, the Driver’s Privacy Protection Act or the California Financial Information Privacy Act from the CCPA’s scope, but the CCPA’s definition of “personal information” is broad and may encompass other information that we maintain.

The requirements of the CCPA will expand substantially in January 2023 as a result of California voters approving the CPRA, in November 2020. The CPRA will give California residents the ability to: limit use of precise

28

geolocation information and other categories of information classified as “sensitive”; add e-mail addresses and passwords to the list of personal information that, if lost or breached, would entitle affected individuals to bring private lawsuits; and establish the California Privacy Protection Agency to implement and enforce the new law, as well as impose administrative fines. The effects of the CCPA, the CPRA, and other similar state or federal laws, are potentially significant and may require us to modify our data processing practices and policies, incur substantial compliance costs and subject us to increased potential liability.

Some observers have noted that the CCPA and the CPRA could mark the beginning of a trend toward more stringent privacy legislation in the United States. There is also discussion in Congress of new comprehensive federal data protection and privacy laws to which we likely would be subject to if enacted. Until an overarching federal privacy law is passed, however, it is anticipated that individual states will continue to adopt or amend state laws and regulations governing data privacy and cybersecurity, which could increase the cost and complexity of our compliance efforts and could impact the integrity and quality of our pricing and underwriting processes.

Additionally, in response to the growing threat of cyberattacks in the insurance industry, certain jurisdictions have begun to impose new cybersecurity laws and regulations. On October 24, 2017, the NAIC adopted its Insurance Data Security Model Law, intended to serve as model legislation for states to enact in order to govern cybersecurity and data protection practices of insurers, insurance agents, and other licensed entities registered under state insurance laws. A number of states have adopted versions of the Insurance Data Security Model Law, each with a different effective date, and other states may adopt versions of the Insurance Data Security Model Law in the future. Also in 2017, the New York State Department of Financial Services adopted regulations providing minimum standards for insurance companies’ cybersecurity programs, requiring an annual certification confirming compliance. In May 2018, South Carolina passed a cybersecurity bill requiring, among other things, any insurance entity operating in the state to establish and implement a cybersecurity program protecting their business and their customers from a data breach, to investigate data breaches and to notify regulators of a cybersecurity event. Some jurisdictions, such as Connecticut, Massachusetts, Nevada and California have enacted more generalized data security laws that apply to certain data that we process. Although we take steps to comply with financial industry cybersecurity regulations and other data security laws and believe we are materially compliant with their requirements, our failure to comply with new or existing cybersecurity regulations could result in material regulatory actions and other penalties. In addition, efforts to comply with new or existing cybersecurity regulations could impose significant costs on our business, which could materially and adversely affect our business, financial condition or results of operations.

If we expand into Europe, we may also face privacy, data security, and data protection risks in connection with requirements of the General Data Protection Regulation (E.U.) 2016/679, or GDPR, and other data protection regulations. Among other stringent requirements, the GDPR restricts transfers of data outside of the European Union. to third countries deemed to lack adequate privacy protections (such as the United States), unless an appropriate safeguard specified by the GDPR is implemented. A July 16, 2020 decision of the Court of Justice of the European Union invalidated a key mechanism for lawful data transfer to the United States and had called into question the viability of its primary alternative. While this ambiguity has largely been resolved, the ability of companies to lawfully transfer personal data from the European Union to the United States at the very least requires updated transfer mechanisms and great attention to detail. Other countries have enacted or are considering enacting similar cross-border data transfer rules or data localization requirements. These developments could limit our ability to deliver our products in the European Union and other foreign markets. In addition, any failure or perceived failure to comply with these rules may result in regulatory fines or penalties including orders that require us to change the way we process data.

Additionally, we are subject to the terms of our privacy policies, privacy-related disclosures, and contractual and other privacy-related obligations to our customers and other third parties. Any failure or perceived failure by us or third parties we work with to comply with these policies, disclosures, and obligations to customers or other third parties, or privacy or data security laws may result in governmental or regulatory investigations, enforcement actions, regulatory fines, criminal compliance orders, litigation or public statements against us by consumer advocacy groups or others, and could cause customers to lose trust in us, all of which could be costly and have an adverse effect on our business.

29

Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business and operating results.

Our continued success depends on our systems, applications, and software continuing to operate and to meet the changing needs of our customers and users. We rely on our technology and engineering staff and vendors to successfully implement changes to and maintain our systems and services in an efficient and secure manner. Like all information systems and technology, our website and mobile app may contain or develop material errors, failures, vulnerabilities or bugs, particularly when new features or capabilities are released, and are subject to fraud, computer viruses or malicious code, break-ins, phishing impersonation attacks, attempts to overload our servers with denial-of-service or other attacks, ransomware and similar incidents or disruptions from unauthorized use of our computer systems, as well as unintentional incidents causing data leakage, any of which could lead to interruptions, delays or website or mobile app shutdowns.

From time to time, third parties may misappropriate our data through website scraping, bots or other means and aggregate this data on their websites with data from other companies. In addition, copycat websites or mobile apps may misappropriate data and attempt to imitate our brand or the functionality of our website or our mobile app. If we become aware of such websites or mobile apps, we intend to employ technological or legal measures in an attempt to halt their operations. However, we may be unable to detect all such websites or mobile apps in a timely manner and, even if we could, technological and legal measures may be insufficient to halt their operations. Regardless of whether we can successfully enforce our rights against the operators of these websites or mobile apps, any measures that we may take could require us to expend significant financial or other resources, which could harm our business, results of operations or financial condition. In addition, to the extent that such activity creates confusion among consumers or advertisers, our brand and business could be harmed.

Many of our services are provided through the Internet which increases our exposure to potential cybersecurity attacks. We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents.

In December 2021 a vulnerability was discovered in Apache Software Foundation’s Log4j—internet software broadly used in a variety of consumer and enterprise services, websites, applications and operational technology products—that allowed malicious attackers to execute code remotely on any exposed computer, which enabled them to then steal data, install malware or take control of the device. Although we have no external facing systems utilizing this software, certain of our contractors and vendors use this software. To date, we have not identified any malicious activity as it relates to us but our investigation is ongoing and we continue to work to both identify the effect on our contractors and vendors and help them minimize the vulnerability’s impact.

Future threats could cause harm to our business and our reputation and challenge our ability to provide reliable service, as well as negatively impact our results of operations materially. Our insurance coverage may not be adequate to cover all the costs related to cybersecurity attacks or disruptions resulting from such events.