Item 1A. Risk Factors
Our business involves
a high degree of risk. You should carefully consider the risks described below, together with the other information contained in this
Annual Report on Form 10-K, as well as the risks, uncertainties and other information set forth in the reports and other materials filed
or furnished by us with the SEC. We cannot assure you that any of the events discussed in the risk factors below will not occur. These
risks could have a material and adverse impact on our business, prospects, results of operations, financial condition and cash flows.
Risks Related to Our Business and Industry
We have a relatively
short operating history in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the
risk that we will not be successful. We may not be able to generate sufficient revenue to maintain profitability in the future.
We have a relatively short
operating history in a quickly evolving industry that may not develop as we anticipate, if at all. Both our relatively short operating
history and the pace of dramatic change in the cannabis industry, and the complex, multiple and sometimes conflicting regulatory regimes
applicable to it, makes it difficult to assess our future prospects, and you should evaluate our business in light of the risks and difficulties
we may encounter as the industry continues to evolve. While our revenue has grown in recent periods, this growth may not be sustainable
due to a number of factors, including the maturation of our business, increased competition and the eventual decline in the number of
new major geographic markets in which the sale of cannabis is permitted and to which we have not already expanded. We may not be able
to generate sufficient revenue to achieve and sustain profitability.
Additionally, we may incur
increased expenditures which may not result in additional revenue or the growth of our business. If we fail to continue to grow revenue
or to sustain profitability, the market price of our securities could decline, and our business, operating results and financial condition
could be adversely affected.
If we do not successfully
develop and deploy new software, platform features or services to address the needs of our clients, our business, financial condition,
and results of operations could suffer.
Our success has been based
on our ability to design software, platform features and services that address the needs of our clients. We spend substantial amounts
of time and money researching and developing new technologies and enhanced versions of existing platform features, as well as new features,
to meet our clients’ rapidly evolving needs. As consumers and clients demand comprehensive data analysis from platforms such as
us, in conjunction with their point-of-sale providers, our ability to integrate with a client’s POS system and other third party
technology integrations may become increasingly important. If we are unable to arrange or complete new integrations, or improve our existing
integrations, we may lose market share to competitors. There is no assurance that enhancements to our software, platform features or new
services or capabilities will be compelling to our clients or gain market acceptance. If our research and development investments do not
accurately anticipate market demand or if we fail to develop our software, platform features or services in a manner that satisfies client
preferences in a timely and cost-effective manner, we may fail to retain our existing clients or increase demand for our services.
8
The introduction of new products
and services by competitors or the development of entirely new technologies to replace existing service offerings could make our platforms
obsolete or adversely affect our business, financial condition, and results of operations. We may experience difficulties with software
development, design, or marketing that delay or prevent our development, introduction or implementation of new platforms, platform features
or capabilities, or cause errors to arise with our existing software. We have in the past experienced delays in our internally planned
release dates of new features and capabilities, and there can be no assurance that new platforms, platform features, or capabilities will
be released according to schedule. Any delays or other disruptions could result in adverse publicity, loss of revenue or market acceptance,
or claims by consumers or suppliers brought against us, any of which could harm our business. Moreover, the design and development of
new platforms or new platform features and capabilities to our existing platform may require substantial investment, and we have no assurance
that such investments will be successful. If consumers in the market do not widely adopt our new platforms, platform features, and capabilities,
we may not be able to realize a return on our investment and our business, financial condition, and results of operations may be adversely
affected.
If we fail to retain
our existing clients and consumers or to acquire new clients and consumers in a cost-effective manner, our revenue may decrease, and our
business may be harmed.
We compete in a dynamic,
innovative, and fairly new market, which we expect will continue to evolve rapidly. We believe that our success is dependent on our ability
to continue identifying and anticipating the needs of our clients and, in turn, their consumers, and retaining our existing clients and
adding new clients. While we have historically been able to grow and retain our client base, we may grow more slowly than we expect or
than we have grown in the past. Our ability to retain clients depends in part on our ability to create and maintain high levels of client
satisfaction, which we may not always be capable of providing, including for reasons outside of our control. Any decrease in client satisfaction
or other change negatively affecting our ability to retain clients could result in a rapid, concentrated impact to our results going forward.
Therefore, our failure to retain existing clients, even if such losses are offset by an increase in revenue resulting from the acquisition
of new clients, could have an adverse effect on our business and operating results.
If we fail to expand
effectively into new markets, our revenue and business will be adversely affected.
While a key part of our business
strategy is to add clients in our existing geographic markets, we intend to expand our operations into new markets if and as cannabis
continues to be legalized in new markets. Any such expansion places us in competitive markets with which we may be unfamiliar, requires
us to analyze the potential applicability of new and potentially complicated regulations regarding the usage, sale and marketing of cannabis,
and involves various risks, including the need to invest significant time and resources and the possibility that returns on such investments
will not be achieved for several years, if at all. As a result of such expansion, we may incur losses or otherwise fail to enter new markets
successfully. In attempting to establish a presence in new markets, we expect to incur significant expenses and face various other challenges,
such as expanding our compliance efforts to cover those new markets. These efforts may prove more expensive than we currently anticipate,
and we may not succeed in increasing our revenues sufficiently to offset these expenses. Our current and any future expansion plans will
require significant resources and management attention.
We have a significant
working capital deficiency and a history of losses, may need to raise additional funds to meet our obligations and sustain our operations
and may not achieve profitability in the future.
SpringBig is an early-stage
company with a history of losses. We incurred net losses of $1.6 million and $10.2 million for the years ended December 31,
2024 and December 31, 2023, respectively. In addition, as of December 31, 2024, we had a working capital deficiency of $1.5 million
and we may need to raise additional funds to meet our obligations and sustain our operations. SpringBig may not achieve or maintain profitability
in the future. We may incur net losses in the future, and such losses may fluctuate significantly from quarter to quarter.
Our efforts to grow our business
may be more costly than we expect, and we may not be able to increase our revenue sufficiently to offset our higher operating expenses.
We may incur significant losses, and we may not achieve or maintain future profitability, due to a number of reasons, including the risks
described in this report, unforeseen expenses, difficulties, complications and delays, and other unknown events. Furthermore, if our future
growth and operating performance fail to meet investor or analyst expectations, or if we have future negative cash flow or losses resulting
from our investment in acquiring customers or expanding our operations, this could make it difficult for you to evaluate our current business
and our future prospects and may have a material adverse effect on our business, financial condition and results of operations.
9
Federal law enforcement
may deem our clients to be in violation of U.S. federal law, and, in particular the CSA. A change in U.S. federal policy on cannabis enforcement
and strict enforcement of federal cannabis laws against our clients would undermine our business model and materially affect our business
and operations.
U.S. federal law, and more
specifically the CSA, proscribes the cultivation, processing, distribution, sale, advertisement and possession of cannabis. As a result,
U.S. federal law enforcement authorities, in their attempt to regulate the illegal or unauthorized production, distribution, promotion,
sale, possession, or use of cannabis, may seek to bring criminal actions against our clients under the CSA. If our clients are found to
be violating U.S. federal law relating to cannabis, they may be subject not only to criminal charges and convictions, but also to forfeiture
of property, significant fines and penalties, disgorgement of profits, administrative sanctions, cessation of business activities, or
civil liabilities arising from proceedings initiated by either the U.S. government or private citizens. Any of these actions or consequences
on our clients could have a material adverse effect on our business, operating results or financial condition, or could force us to cease
operations, and as a result, our investors could lose their entire investment.
Further, to the extent any
law enforcement actions require us to respond to subpoenas, or undergo search warrants, for client records, cannabis businesses could
elect to cease using our products and services. Until the U.S. federal government changes the laws with respect to cannabis, described
below under the caption “Cannabis remains illegal under federal law, and therefore, strict enforcement of federal laws regarding
cannabis would likely result in our inability to execute our business plan,” to apply to all state cannabis programs, U.S. federal
authorities could more strictly enforce current federal prohibitions and restrictions. An increase in federal enforcement against companies
licensed under state cannabis laws could negatively impact the state cannabis industries and, in turn, our business, operating results,
financial condition, brand and reputation.
Some of our clients
currently and in the future may not be in compliance with licensing and related requirements under applicable laws and regulations. Allowing
unlicensed or noncompliant businesses to access our platform and services, or allowing businesses to use our solutions in a noncompliant
manner, may subject us to legal or regulatory enforcement and negative publicity, which could adversely impact our business, operating
results, financial condition, brand and reputation. In addition, allowing businesses that engage in false or deceptive advertising practices
to use our solutions may subject us to negative publicity, which could have similar adverse impacts on us.
While we have instituted
policies and procedures in connection with the verification and periodic screening of the licensing status of our clients operating cannabis
retail businesses (and our contracts with clients generally provide for client representations relating to compliance, termination of
services in the case of client noncompliance, and client indemnification obligations), some of our clients currently and in the future
may not be in compliance with licensing and related requirements under applicable state laws and regulations. There could be legal enforcement
actions against unlicensed or insufficiently licensed entities selling cannabis, which could negatively impact us.
Any legal or regulatory enforcement
against us based on our platform, the content provided by clients, the marketing campaigns created by clients on our platform or noncompliance
by our clients with licensing and other legal requirements, could subject us to various risks, including monetary penalties and/or required
changes to our platform or business model, and would likely cause us to experience negative publicity. Any of these developments could
materially and adversely impact our business, operating results, financial condition, brand, and reputation.
We generally do not,
and cannot, ensure that our clients will conduct their business activities in a manner compliant with the complex, disparate and constantly
evolving regulations and requirements affecting the legal cannabis industry. As a result, federal, state, provincial or local government
authorities may seek to bring criminal, administrative or regulatory enforcement actions against our clients, which could have a material
adverse effect on our business, operating results or financial conditions, or could force us to cease operations.
While our solutions provide
features to support our clients’ compliance with certain regulations and other legal requirements applicable to the cannabis industry,
and we have policies and procedures regarding the verification and periodic screening of the licensing status of our clients, we generally
do not, and cannot, ensure that at all times our clients will conduct their business activities in a manner compliant with such regulations
and requirements, in whole or in part. Their legal noncompliance could result in regulatory and even criminal actions against them, which
could lead to a material adverse impact on our business and operating results or financial condition, and as a result, our investors could
lose their entire investment. For additional information, see the other risk factors in this section, including “Some of our clients
currently and in the future may not be in compliance with licensing and related requirements under applicable laws and regulations. Allowing
unlicensed or noncompliant businesses to access our platform and services, or allowing businesses to use our solutions in a noncompliant
manner, may subject us to legal or regulatory enforcement and negative publicity, which could adversely impact our business, operating
results, financial condition, brand and reputation. In addition, allowing businesses that engage in false or deceptive advertising practices
to use our solutions may subject us to negative publicity, which could have similar adverse impacts on us.”
10
Our business is dependent
on U.S. state laws and regulations and Canadian federal and provincial laws and regulations pertaining to the cannabis industry.
Although the federal CSA
classifies cannabis as a Schedule I controlled substance, many U.S. states have legalized cannabis to varying degrees. In addition, the
enactment of the Cannabis Act legalized the commercial cultivation and processing of cannabis for medical and adult-use purposes in Canada
and created a federal legal framework for controlling the production, distribution, promotion, sale and possession of cannabis. The Cannabis
Act also provides the provinces and territories of Canada with the authority to regulate other aspects of adult-use cannabis, such as
distribution, sale, minimum age requirements (subject to the minimum set forth in the Cannabis Act), places where cannabis can be consumed,
and a range of other matters. The governments of every Canadian province and territory have implemented regulatory regimes for the distribution
and sale of cannabis for recreational purposes. In addition, subsection 23(1) of the Cannabis Act provides that it is prohibited to publish,
broadcast or otherwise disseminate, on behalf of another person, with or without consideration, any promotion that is prohibited by a
number of sections of the Cannabis Act. The Cannabis Act therefore includes provisions that could apply to certain aspects of our business,
both directly to the solutions we provide and indirectly on account of any noncompliance by those who use our offerings. However, as the
Cannabis Act has been recently enacted, there is a lack of available interpretation, application and enforcement of the provisions that
may be relevant to digital platforms such as ours, and as a result, it is difficult to assess our potential exposure under the Cannabis
Act.
Laws and regulations affecting
the cannabis industry in U.S. states and Canada are continually changing. Any change or even the speed of changes could require us to
incur substantial costs associated with compliance or alter our business plan, and could detrimentally affect our operations, revenue,
and profitability. The commercial cannabis industry is still a young industry, and we cannot predict the impact of the compliance regime
to which it may be subject. We will incur ongoing costs and obligations related to regulatory compliance, and such costs may prove to
be material. Failure to comply with regulations may result in additional costs for corrective measures, penalties or restrictions on our
operations. In addition, changes in regulations, more vigorous enforcement thereof, or other unanticipated events could require extensive
changes to our operations or increased compliance costs or give rise to material liabilities, which could have a material adverse effect
on us.
Given the concentration of
our revenue from the sale of access to our platforms and services, any increase in the stringency of any applicable laws, including U.S.
state, or Canadian federal, provincial or territorial, laws and regulations relating to cannabis, or any escalation in the enforcement
of such existing laws and regulations against the current or putative cannabis industry within any jurisdiction, could negatively impact
the profitability or viability of cannabis businesses in such affected jurisdictions, which in turn could materially adversely affect
our business and operating results.
In addition, although we
have not yet been required to obtain any cannabis license as a result of existing cannabis regulations, it is possible that cannabis regulations
may be enacted in the future that will require us to obtain such a cannabis license or otherwise seek to substantially regulate our business.
U.S. and Canadian federal, state, provincial, local and other non-U.S. jurisdictions’ cannabis laws and regulations are broad in
scope and subject to evolving interpretations, which could require us to incur substantial costs associated with compliance or alter our
business plan. Our failure to adequately manage the risk associated with future regulations and adequately manage future compliance requirements
may adversely affect our business, our status as a reporting company and our public listing. Further, any adverse pronouncements from
political leaders or regulators about businesses related to the legal cannabis industry could adversely affect the price of our securities.
Because our business
is dependent, in part, upon continued market acceptance of cannabis by consumers, any negative trends in the market could adversely affect
our business operations.
We are dependent on public
support, continued market acceptance and the proliferation of consumers in the state-level and Canadian legal cannabis markets. While
we believe that the market and opportunities in the space will continue to grow, we cannot predict the future growth rate or size of the
market. Any downturns in, or negative outlooks on, the cannabis industry may adversely affect our business and financial condition.
11
Expansion of our business is dependent on
the continued legalization of cannabis and its sale through regulated cannabis distributed channels.
Expansion of our business
is, in part, dependent upon continued legislative authorization, including by voter initiatives and referenda, of cannabis in various
jurisdictions worldwide, including the legalization of recreational and medical use cannabis. Any number of factors could slow, halt,
or even reverse progress in this area. Progress for the industry, while encouraging, is not assured. While there may be ample public support
for legislative action in a particular jurisdiction, numerous factors could impact the legislative process, including lobbying efforts
by opposing stakeholders as well as legislators’ disagreements about how to legalize cannabis as well as the interpretation, implementation,
and enforcement of applicable laws or regulations. Further, our clients face substantial competition from unlicensed cannabis operators
selling cannabis on the illicit market, as well as the growth of psychoactive hemp products which are proliferating in response to a loophole
in the 2018 Farm Bill, both of which are sold outside the regulated cannabis distribution channels utilized by our client base.
Any one of these factors
could slow or halt the legalization of cannabis, or create substantial competition for the regulated cannabis industry, which would negatively
impact our ability to expand our business. Additionally, the expansion of our business also depends on jurisdictions in which cannabis
is currently legalized not narrowing, limiting or repealing existing laws legalizing and regulating cannabis, or altering the regulatory
landscape in a way that diminishes the viability of cannabis businesses in those jurisdictions.
Our business is highly
dependent upon our brand recognition and reputation, and any erosion or degradation of our brand recognition or reputation would likely
adversely affect our business and operating results.
We believe that our business
is highly dependent on the SpringBig brand identity and our reputation, which is critical to our ability to attract and retain clients
and consumers. We also believe that the importance of our brand recognition and reputation will continue to increase as competition in
the markets in which we operate continues to develop. Our success in this area will depend on a wide range of factors, some of which are
within our control and some of which are not. The factors affecting our brand recognition and reputation that are within our control include
the following:
● the efficacy of our marketing efforts;
● the quality and perceived value of our platforms and services;
● successfully implementing and developing new features and revenue streams;
● our ability to continue to integrate with POS systems;
● our compliance with laws and regulations;
● our ability to provide client support; and
12
In addition, our brand recognition and reputation may be affected by
factors that are outside our control, such as:
● actions of competitors or other third parties;
● consumers’ experiences with retailers or brands using our platform;
● public perception of cannabis and cannabis-related businesses;
● interruptions, delays or attacks on our platforms; and
● litigation or regulatory developments.
Damage to our reputation
and loss of brand equity from one or more of the factors listed above may reduce demand for our platform and have an adverse effect on
our business, operating results and financial condition. Moreover, any attempts to rebuild our reputation and restore the value of our
brand may be costly and time-consuming, and such efforts may not ultimately be successful.
We currently face intense
competition in marketing and advertising services available to our clients, and we expect competition to further intensify as the cannabis
industry continues to evolve.
The cannabis marketing and
software services market is rapidly evolving and is currently characterized by intense competition, due in part to relatively low barriers
to entry. We expect competition to further intensify in the future as cannabis continues to be legalized and regulated, new technologies
are developed and new participants enter the cannabis CRM and marketing solutions market. Competitors for individual components of our
service platforms include businesses both within and outside of the cannabis industry. These include businesses focused on marketing and
customer engagement, commerce and POS solutions, and SaaS or other technology solutions for brands and retailers. In addition, if legal
market for cannabis becomes more accepted and/or the regulatory regime for cannabis evolves, it may eliminate existing barriers preventing
our clients from using traditional marketing and advertising channels. This could result in increased competition in our industry from
both products and solutions offered by internet search engines and advertising networks, like Google, social media platforms, like Instagram
and Facebook, various other newspaper, television, media companies, outdoor billboard advertising, and online merchant platforms, as well
as new participants entering into the cannabis CRM and marketing services market. Such potential competitors may have substantially greater
financial, technical, and other resources than existing market participants. Additionally, as consumers and cannabis industry clients
demand richer data, integrations with other cannabis industry participants such as point-of-sale providers may become increasingly important.
If we are unable to complete such new integrations as quickly as our competitors, or improve our existing integrations based on legacy
systems, we may lose market share to such competitors. Our current and future competitors may also enjoy other competitive advantages,
such as greater name recognition, more varied or more focused offerings, better market acceptance, and larger marketing budgets.
Additionally, as the legalization
of cannabis continues, cannabis cultivators, product manufacturers and distributors could experience consolidation as existing cannabis
businesses seek to obtain greater market share and purchasing power and new entrants seek to establish a significant market presence.
Consolidation of the cannabis markets could reduce the size of our potential client base and give remaining clients greater bargaining
or purchasing power. This may in turn erode the prices for access to our services and platform and result in decreased margins. Further,
heightened competition between cannabis businesses could ultimately have a negative impact on the viability of individual market participants,
which could reduce or eliminate their ability to purchase our services and solutions.
If we are unable to compete
effectively for any of these reasons, we may be unable to maintain our operations or develop our products and solutions, and as a result
our business and operating results may be adversely affected.
13
If we fail to manage
our growth effectively, our brand, business and operating results could be harmed.
We have experienced rapid
organic growth in our operations, which places substantial demands on management and our operational infrastructure. To manage the expected
growth of our operations and personnel, we expect we will be required to improve existing, and implement new systems, procedures and controls
including, among others, financial and operational systems. We will also be required to expand our finance, administrative and operations
staff. We intend to continue making substantial investments in our sales, service and marketing workforce. As we continue to grow, we
must effectively integrate, develop and motivate a significant number of new employees, while maintaining the beneficial aspects of our
existing corporate culture, which we believe fosters innovation, teamwork and a passion for our products and clients. In addition, our
revenue may not grow at the same rate as the expansion of our business. There can be no assurance that our current and planned personnel,
systems, procedures and controls will be adequate to support our future operations or that management will be able to hire, train, retrain,
motivate and manage required personnel. If we are unable to manage our growth effectively, the quality of our platform, efficiency of
our operations, and management of our expenses could suffer, which could negatively impact our brand, business, profitability and operating
results.
The growth of our business
depends on our ability to accurately predict consumer trends, successfully offer new services, improve existing services and expand into
new markets.
Our growth depends, in part,
on our ability to successfully offer new platforms, products and services and improve and reposition our existing platforms and services
to meet the requirements of our clients and their customers. This, in turn, depends on our ability to predict and respond to evolving
consumer trends, demands and preferences. Our strategy is based on certain key trends and the projected growth of our key markets. However,
historical trends may not be indicative of future trends and forecasts or estimated growth rates may not be accurate, in whole or part,
or ever materialize. Further, underlying markets could decline, overall growth rates in our product categories could be slower than anticipated.
The offering of innovative
new platforms, products and services and expansion into new offerings involves considerable costs. Any new platform, product or service
offering may not generate sufficient consumer interest and sales to become profitable or to cover the costs of its development and promotion
and, as a result, may reduce our operating income. In addition, any such unsuccessful effort may adversely affect our brand and reputation.
If we are unable to anticipate, identify, develop or market new offerings, that respond to changes in consumer requirements and preferences,
or if our new offerings fail to gain consumer acceptance, we may be unable to grow our business as anticipated, our sales may decline
and our margins and profitability may decline or not improve. As a result, our business, financial condition, and results of operations
may be materially and adversely affected.
If we are unable to
recruit, train, retain and motivate key personnel, we may not achieve our business objectives.
Our future success depends
on our ability to recruit, train, retain and motivate key personnel. Competition for qualified personnel in the technology industry is
intense. Additionally, we face challenges in attracting, retaining and motivating highly qualified personnel due to our relationship to
the cannabis industry, which is rapidly evolving and has varying levels of social acceptance. Any failure to attract, train, retain and
motivate qualified personnel could materially harm our operating results and growth prospects.
If our current marketing
model is not effective in attracting new clients, we may need to employ higher-cost sales and marketing methods to attract and retain
clients, which could adversely affect our profitability.
We use our sales team to
build relationships with our client base. Our sales team builds and maintains relationships with clients primarily through phone, email
and other virtual contact, which is typically designed to allow us to cost-effectively service a large number of clients. We may need
to employ more resource-intensive sales methods, such as increasing sales teams, to continue to attract and retain clients, particularly
as we increase the number of our clients and our client base employs more sophisticated marketing operations, strategies and processes.
We have experienced increased
spending in connection with growing our sales, service and marketing operation and we expect to incur higher sales and marketing expenses,
which could adversely affect our business and operating results.
14
We may be unable to
scale and adapt our existing technology and network infrastructure in a timely or effective manner to ensure that our platform is accessible,
which would harm our reputation, business and operating results.
It is critical to our success
that clients and consumers within our geographic markets be able to access our platform at all times. We may experience service disruptions,
outages or other performance problems due to a variety of factors, including infrastructure changes, human or software errors, capacity
constraints, and distributed denial of service, or “DdoS,” fraud or security attacks. In some instances, we may not be able
to identify the cause or causes of these performance problems within an acceptable period of time. It may become increasingly difficult
to maintain and improve the availability of our platform, especially during peak usage times and as our products become more complex or
dependent on integration with third parties, or as usage or traffic increases. If our platform is unavailable when our clients (or their
consumers) attempt to access it or it does not load as quickly as they expect, they may seek other solutions and may seek to cancel and
not renew subscriptions for our services. We expect to continue to make significant investments to maintain and improve the availability
of our platform and to enable rapid releases of new features and products. To the extent that we do not effectively address capacity constraints,
respond adequately to service disruptions, upgrade our systems as needed or continually develop our technology and network architecture
to accommodate actual and anticipated changes in technology, our business and operating results would be harmed.
We expect to continue making
significant investments in the functionality, performance, reliability, design, security and scalability of our platform. We may experience
difficulties with the development of our platform that could delay or prevent the implementation of new solutions and enhancements. Software
development involves a significant amount of time and resources for our product development team, and we may not be able to continue making
those investments in the future.
To the extent we are not
able to continue successfully improving and enhancing our platform, our business could be adversely affected.
Real or perceived errors,
failures, or bugs in our platform could adversely affect our operating results and growth prospects.
We update our platform on
a frequent basis. Despite efforts to test our updates, errors, failures or bugs may not be found in our platform until after it is deployed
to our clients. We have discovered and expect we will continue to discover errors, failures and bugs in our platform and anticipate that
certain of these errors, failures and bugs will only be discovered and remediated after deployment to clients. Real or perceived errors,
failures or bugs in our platform could result in negative publicity, security incidents, such as data breaches, government inquiries,
loss of or delay in market acceptance of our platform, loss of competitive position, or claims by clients for losses sustained by them.
In such an event, we may be required, or may choose, for client relations or other reasons, to expend additional resources in order to
help correct the problem.
We implement bug fixes and
upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes
and upgrades in a timely manner, any history of inaccuracies in the data we collect for our clients, or unauthorized access or damage
to, or the loss, acquisition, or inadvertent release or exposure of confidential or other sensitive data could cause our reputation to
be harmed and result in claims against us, and cannabis businesses may elect not to purchase our products or, in the case of existing
clients, renew their agreements with us or we may incur increased insurance costs. The costs associated with any material defects or errors
in our software or other performance problems may be substantial and could harm our operating results and growth prospects.
A distributed denial
of service attack, ransomware attack, security breach or unauthorized data access could impair or incapacitate our information technology
systems and delay or interrupt service to our clients and consumers, harm our reputation, or subject us to significant liability.
We may become subject to
DdoS attacks, a technique used by hackers to take an internet service offline by overloading its servers. In addition, ransomware attacks
against businesses of all sizes are becoming increasingly common. Further, we may face increased cybersecurity risks due to our reliance
on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals
to exploit vulnerabilities. Our platform may be subject to DdoS, ransomware or other cybersecurity attacks in the future and we cannot
guarantee that applicable recovery systems, security protocols, network protection mechanisms and other procedures are or will be adequate
to prevent network and service interruption, system failure or data loss. Moreover, our platform could be breached if vulnerabilities
in our platform are exploited by unauthorized third parties or others. Techniques used to obtain unauthorized access change frequently,
and the size of DdoS attacks and the number and types of ransomware attacks are increasing. As a result, we may be unable to implement
adequate preventative measures or stop such attacks while they are occurring. A DdoS attack, ransomware attack or security breach could
delay or interrupt service to our clients and consumers and may deter the utilization of our platform.
15
We also use information technology
and security systems to maintain the physical security of our facilities and to protect our proprietary and confidential information,
including that of our clients, consumers, and employees. Accidental or willful security breaches or other unauthorized access to our facilities
or information systems, or viruses, loggers, malware, ransomware, or other malfeasant code in our data or software, could compromise this
information or render our systems and data unusable. Additionally, we rely on third-party “cloud-based” providers and we are
therefore dependent on the security systems of these providers. Any security breaches or other unauthorized access to our service providers’
facilities or systems, or viruses, loggers, malware, ransomware or other malfeasant code in their data or software, could expose us to
information loss, and misappropriation of confidential information, and other security breaches. In addition, our employees, contractors,
or other third parties with whom we do business may attempt to circumvent security measures in order to misappropriate personal information,
confidential information or other data, or may inadvertently release or compromise such data. Because the techniques used to obtain unauthorized
access to or sabotage security systems, or to obtain unauthorized access to data we or our contractors maintain, change frequently and
are often not recognized until after an attack, we and our service providers may be unable to anticipate the techniques or implement adequate
preventative measures.
Any actual or perceived DdoS
attack, ransomware attack, security breach or other unauthorized access could damage our reputation and brand, result in decreased utilization
of our platform, expose us to fines and penalties, government investigations, and a risk of litigation and possible liability, require
us to expend significant capital and other resources to alleviate any resulting problems and otherwise to remediate the incident, and
require us to expend increased cybersecurity protection costs. We expect to incur significant costs in an effort to detect and prevent
security breaches and other security-related incidents. Numerous state, federal and foreign laws and regulations require companies to
notify individuals and/or regulatory authorities of data security breaches involving certain types of personal data. Any disclosures of
security breaches, pursuant to these laws or regulations or otherwise, could lead to regulatory investigations and enforcement and negative
publicity, and may cause our clients and consumers to lose confidence in the effectiveness of our data security measures.
Additionally, our discovery
of any security breach or other security-related incident, or our provision of any related notice, may be delayed or be perceived to have
been delayed. Any of these impacts or circumstances arising from an actual or perceived attack, breach or other unauthorized access could
materially and adversely affect our business, financial condition, reputation and relationships with clients and consumers.
Furthermore, while our errors
and omissions insurance policies include liability coverage for certain of these matters, if we experienced a significant security incident,
we could be subject to claims or damages that exceed our insurance coverage. We also cannot be certain that our insurance coverage will
be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically
reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more
large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium
increases or the imposition of large deductible or co-insurance requirements, could have a material and adverse effect on our business,
including our financial condition, operating results, and reputation.
We rely upon cloud-based
technologies provided by third parties, and technology systems and electronic networks supplied and managed by third parties, to operate
our business, and interruptions or performance problems with these systems, technologies and networks may adversely affect our business
and operating results.
We rely on technologies and
services provided by third parties in order to host our cloud-based infrastructure that operates our business. If any of these services
becomes unavailable or otherwise is unable to serve our requirements due to extended outages, interruptions, or facility closure, or because
it is no longer available on commercially reasonable terms, our expenses could increase, our ability to manage finances could be interrupted
and our operations otherwise could be disrupted or otherwise impacted until appropriate substitute services, if available, are identified,
obtained, and implemented.
We do not control, or in
some cases have limited control over, the operation of the data center facilities and infrastructure we use, and they are vulnerable to
damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, cyberattack, terrorism and similar other
events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, to adverse events caused
by operator error, and to interruptions, data loss or corruption, and other performance problems due to various factors, including introductions
of new capabilities, technology errors, infrastructure changes, DdoS attacks, or other security-related incidents. Changes in law or regulations
applicable to data centers in various jurisdictions could also cause a disruption in service. Despite precautions taken at these facilities,
the occurrence of a natural disaster, an act of terrorism or other act of malfeasance, a decision to close the facilities without adequate
notice or other unanticipated problems at these facilities could result in lengthy interruptions in our platform operations and the loss,
corruption of, unauthorized access to or acquisition of client or consumer data.
16
Our platform also depends
on our ability to communicate through the public internet and electronic networks that are owned and operated by third parties. In addition,
in order to provide our solutions on-demand and promptly, our computer equipment and network servers must be functional 24 hours per day,
which requires access to telecommunications facilities managed by third parties and the availability of electricity, which we do not control.
A severe disruption of one or more of these networks or facilities, including as a result of utility or third-party system interruptions,
could impair our ability to process information and provide our solutions to our clients and consumers.
Any unavailability of, or
failure to meet our requirements by, third-party data centers or other third-party technologies or services, or any disruption of the
internet, utilities or the third-party networks or facilities that we rely upon, could impede our ability to make our platform accessible,
harm our reputation, result in reduced traffic from consumers, cause us to issue refunds or credits to our clients, and subject us to
potential liabilities. Any of these circumstances could adversely affect our business, reputation and operating results.
The impact of global,
regional or local economic and market conditions may adversely affect our business, operating results and financial condition.
Our performance is subject
to global economic conditions and economic conditions in one or more of our key markets, which impact spending by our clients and consumers.
A majority of our clients’ access to capital, liquidity and other financial resources is constrained due to the regulatory restrictions
applicable to cannabis businesses. As a result, these clients may be disproportionately affected by economic downturns. Clients may choose
to allocate their spending to items other than our platform, especially during economic downturns.
Economic conditions may also
adversely impact retail sales of cannabis. Declining retail sales of cannabis could result in our clients going out of business or deciding,
to stop using our platform to conserve financial resources or move to different marketing solutions. Negative economic conditions may
also affect third parties with whom we have entered into relationships and upon whom we depend in order to grow our business.
Furthermore, economic downturns
could also lead to limitations on our ability to obtain debt or equity financing on favorable terms or at all, reduced liquidity, decreases
in the market price of SpringBig’s securities, decreases in the fair market value of our financial or other assets, and write-downs
of and increased credit and collectability risk on our trade receivables, any of which could have a material adverse effect on our business,
operating results or financial condition.
Negative economic conditions
may be created or exacerbated by catastrophic events or health crises, including, among others, re-occurrence of the COVID-19 pandemic
or similar wide-spread public health crises.
Catastrophic events
may disrupt our business and impair our ability to provide our platform to clients and consumers, resulting in costs for remediation,
client and consumer dissatisfaction, and other business or financial losses.
Our operations depend, in
part, on our ability to protect our operations against damage or interruption from natural disasters, power or telecommunications failures,
criminal acts and similar events. Despite precautions taken at our facilities, the occurrence of a natural disaster, an act of terrorism,
vandalism or sabotage, spikes in usage volume or other unanticipated problems could result in lengthy interruptions in the availability
of our platform. Even with current and planned disaster recovery arrangements, our business could be harmed. Also, in the event of damage
or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. These factors in turn could
further reduce revenue, subject us to liability and lead to decreased usage of our platform and decrease sales of our marketing services,
any of which could harm our business.
17
Fluctuations in our
quarterly and annual operating results may adversely affect our business and prospects.
You should consider our business
and prospects in light of the risks and difficulties we encounter in the uncertain and rapidly evolving market for our solutions. Because
the cannabis CRM, marketing services and technology markets are new and evolving, predicting their future growth rate and size is difficult.
This reduces our ability to accurately evaluate our future prospects and forecast quarterly or annual performance. In addition to the
other risk factors discussed in this section, factors that may contribute to the variability of our quarterly and annual results include:
● our ability to attract new clients and retain existing clients;
● the effects of increased competition on our business;
● the impact of global, regional or economic conditions;
● our ability to protect our intellectual property;
● our ability to maintain and effectively manage an adequate rate of growth;
● our ability to maintain and increase traffic to our platform;
● changes in governmental or other regulation affecting our business;
● the attraction and retention of qualified personnel;
● the effectiveness of our internal controls.
We may improve our
products and solutions in ways that forego short-term gains.
We seek to provide the best
experience for the clients who use our platform. Some of our changes may have the effect of reducing our short-term revenue or profitability
if we believe that the benefits will ultimately improve our business and financial performance over the long term. Any short-term reductions
in revenue or profitability could be greater than planned or the changes mentioned above may not produce the long-term benefits that we
expect, in which case our business and operating results could be adversely affected.
We currently have clients
across the United States and Canada using our platform. We anticipate growing our business, in part, by continuing to expand our foreign
operations. As we continue our expansion, we may enter new foreign markets where we have limited or no experience marketing and deploying
our platform. If we fail to launch or manage our foreign operations successfully, our business may suffer.
We are subject to industry standards, governmental
laws, regulations and other legal obligations, particularly related to privacy, data protection and information security, and any actual
or perceived failure to comply with such obligations could harm our business.
We are subject to regulation
by various federal, state, provincial, local and foreign governmental authorities, including those responsible for monitoring and enforcing
employment and labor laws, anti-bribery laws, lobbying and election laws, securities laws and tax laws. These laws and regulations are
subject to change over time and thus we must continue to monitor and dedicate resources to ensure continued compliance.
18
In addition, our business
is subject to regulation by various federal, state, provincial and foreign governmental agencies responsible for monitoring and enforcing
privacy and data protection laws and regulations. Numerous foreign, federal and state laws and regulations govern collection, dissemination,
use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state
laws requiring disclosure of breaches); federal and state consumer protection and employment laws; the Health Insurance Portability and
Accountability Act of 1996, or HIPAA; and European and other foreign data protection laws.
We receive, store, process,
and use personal information and other user content. The regulatory framework for privacy issues worldwide, including in the United States,
is rapidly evolving and is likely to remain uncertain for the foreseeable future, as many new laws and regulations regarding the collection,
use and disclosure of personally identifiable information, or PII, and other data have been adopted or are under consideration and existing
laws and regulations may be subject to new and changing interpretations. In the United States, the Federal Trade Commission and many state
attorneys general are applying federal and state consumer protection laws to impose standards for the online collection, use and dissemination
of data. The California Consumer Privacy Act of 2018, or CCPA imposes significant additional requirements with respect to the collection
of personal information from California residents. The CCPA, among other things, creates new data privacy obligations for covered companies
and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The
CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated
with a data breach. It remains unclear what, if any, modifications will be made to this legislation or how it will be interpreted. Additionally,
a new privacy law, the California Privacy Rights Act, or CPRA, significantly modified the CCPA, which has resulted in further uncertainty
and requiring us to incur additional costs and expenses. The CPRA created a new California state agency charged with enforcing state privacy
laws, and there is uncertainty about potential enforcement actions that the new agency may take in the future. The effects of the CCPA
and the CPRA remain far-reaching, and depending on final regulatory guidance and related developments, may require us to modify our data
processing practices and policies and to incur substantial costs and expenses in an effort to comply.
We are also currently subject
to a variety of, and may in the future become subject to additional U.S. federal, state and local laws and regulations on advertising
that are continuously evolving and developing, including the Telephone Consumer Protection Act, or the TCPA, the Telemarketing Sales Rule,
the Controlling the Assault of Non-Solicited Pornography and Marketing Act, or the CAN-SPAM Act, and, at the state level, the CCPA (as
described above), the Virginia Consumer Data Protection Act of 2021, or VCDPA, and the Colorado Privacy Act, or CPA. Many states are discussing
potentially adopting similar comprehensive privacy legislation and we expect many of these will be implemented over the course of the
next few years. These laws and regulations directly impact our business and require ongoing compliance, monitoring and internal and external
audits as they continue to evolve, and may result in ever-increasing public and regulatory scrutiny and escalating levels of enforcement
and sanctions. Subsequent changes to data protection and privacy laws and regulations could also impact how we process personal information
and, therefore, limit the effectiveness of our product offerings or our ability to operate or expand our business, including limiting
strategic relationships that may involve the sharing of personal information.
Many foreign countries and
governmental bodies, including Canada and other relevant jurisdictions where we conduct or may, in the future, conduct business, have
laws and regulations concerning the collection and use of PII and other data obtained from their residents or by businesses operating
within their jurisdiction. These laws and regulations often are more restrictive than those in the United States Laws and regulations
in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of data that identifies or may be used to
identify or locate an individual, such as names, email addresses and, in some jurisdictions, internet protocol addresses and other types
of data. In Canada, the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, governs the collection, use and
disclosure of PII in many provinces in Canada, and though it is silent with respect to territorial reach, the Federal Court of Canada
has found that PIPEDA will apply to businesses established in other jurisdictions if there is a “real and substantial connection”
between the organization’s activities and Canada. Provincial privacy commissioners take a similar approach to the interpretation
and application of provincial private-sector privacy laws equivalent to PIPEDA. Further, Canada has robust anti-spam legislation. Organizations
sending commercial electronic messages to individuals must either have express consent from the individual in the prescribed form or the
situation must qualify as an instance of implied consent or other authorization set out in Canada’s Anti-Spam Legislation, or CASL.
The penalties for non-compliance under CASL are significant and the regulator, the Canadian Radio- Television and Telecommunications Commission,
is active with respect to enforcement.
19
Although we are working to
comply with those federal, state, provincial and foreign laws and regulations, industry standards, governmental standards, contractual
obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified,
interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements
or legal obligations, our practices or the features of our applications or platform. Any failure or perceived failure by us or our contractors
to comply with federal, state, provincial or foreign laws or regulations, industry standards, contractual obligations or other legal obligations,
or any actual or suspected security incident, whether or not resulting in loss of, unauthorized access to, or acquisition, alteration,
destruction, release or transfer of PII or other data, may result in governmental enforcement actions and prosecutions, private litigation,
fines and penalties or adverse publicity and could cause employees, clients and consumers to lose trust in us, which could have an adverse
effect on our reputation and business. Any inability or perceived inability (even if unfounded) on our part to adequately address privacy,
data protection, and information security concerns, or comply with applicable laws, regulations, policies, industry standards, governmental
standards, contractual obligations, or other legal obligations, could result in additional cost and liability to us, damage our reputation,
inhibit sales, restrict our ability to utilize collected personal information, and adversely affect our business.
We also expect that there
will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security
in the United States, Canada and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards
may have on our business. Future laws, regulations, standards and other obligations, or amendments or changes in the interpretation of
existing laws, regulations, standards and other obligations, could impair our or our clients’ ability to collect, use, disclose
or otherwise process information relating to employees or consumers, which could decrease demand for our applications, increase our costs
and impair our ability to maintain and grow our client and consumer bases and increase revenue. Such laws and regulations may require
us to implement privacy and security policies, permit users to access, correct and delete personal information stored or maintained by
such companies, inform individuals of security breaches that affect their personal information, and, in some cases, obtain individuals’
consent to use PII or other data for certain purposes. In addition, a foreign government could require that any data collected in a country
not be transferred or disseminated outside of that country, or impose restrictions or conditions upon such dissemination, and we may face
difficulty in complying with any such requirements for certain geographic regions. Indeed, many privacy laws, such as those in force in
Canada, already impose these requirements. If we fail to comply with federal, state, provincial and foreign data privacy laws and regulations,
our ability to successfully operate our business and pursue our business goals could be harmed. Furthermore, due to our acceptance of
credit cards, we are subject to the Payment Card Industry Data Security Standard (also known as the “PCI-DSS”), which is designed
to protect the information of credit card users.
In the event our determinations
are challenged and found to have been incorrect, we may be subject to unfavorable publicity or claims by one or more state attorneys general,
federal regulators, or private plaintiffs, any of which could damage our reputation, inhibit sales and adversely affect our business.
Governmental regulation
of the internet continues to develop, and unfavorable changes could substantially harm our business and operating results.
We are subject to general
business regulations and laws as well as federal, state, provincial and foreign laws specifically governing the internet. Existing and
future laws and regulations, narrowing of any existing legal safe harbors, or previous or future court decisions may impede the growth
of the internet or online products and solutions, and increase the cost of providing online products and solutions. These laws may govern,
among other issues, taxation, tariffs, user privacy, data protection, pricing, content, copyrights, distribution, electronic contracts
and other communications, consumer protection, broadband residential internet access and the characteristics and quality of offerings.
It is not clear how existing laws governing issues such as property ownership, sales, use and other taxes, libel and personal privacy
apply to the internet or online services. There is also a risk that these laws may be interpreted and applied in conflicting ways across
jurisdictions, and in a manner that is not consistent with our current practices. Unfavorable resolution of these issues may limit our
business activities, expose us to potential legal claims or cause us to spend significant resources on ensuring compliance, any of which
could harm our business and operating results.
20
We may need to raise
additional capital, which may not be available on favorable terms, if at all, causing dilution to our stockholders, restricting our operations
or adversely affecting our ability to operate our business.
SpringBig may require additional
financing to fund its operations or growth. The failure to secure additional financing could have a material adverse effect on the continued