GMO GlobalSign Holdings K.K.

GMO Internet Group, Inc. is the parent company holding 51.97% of the Company's outstanding shares, and a change in its basic policy could affect the Company's business and operating results. In addition, 2 of the Company's 9 officers concurrently serve as officers of GMO Internet Group, Inc., creating certain constraints on governance independence. Of the ¥446,514 million in data center usage fees, the Company paid ¥5,772 million to the GMO Internet Group, and any change in the GMO Internet Group's data center business policy would directly affect the continuity of the Cloud Infrastructure Business.

The Company strictly manages the private keys of its root CA certificates using hardware security modules, but if a private key were to be compromised for any reason, trust in all certificates under the GlobalSign brand would be fundamentally undermined. Since the Electronic Certification Business is founded on brand trust, such a compromise would constitute a critical risk threatening the continuity of the business itself. Part of the certificate authority operations is outsourced to multiple external contractors, and deterioration in the contractors' business condition, contract termination, or decline in technical standards could give rise to similar risks.

The Company's consolidated group handles large volumes of customers' personal information, and if an information system outage or leakage of customer information or personal data were to occur, this could result in loss of trust, damage to corporate image, damages litigation, and other consequences. As countermeasures, the Tokyo head office has obtained ISO/IEC 27001 and ISO/IEC 27017 certification, and GMO GlobalSign, Inc. has obtained ISO 27001, ISO 22301, and ISO/IEC 27017 certification, but these do not guarantee complete prevention. In addition, violation of personal information protection laws and regulations in various countries around the world, including the GDPR, could result in substantial fines.

The electronic certification market is a growth market, but market share is concentrated among the top companies. Since entering the market in 2003, the Company has differentiated itself through low prices and fast issuance speed. If future intensification of competition causes the Company's market share to decline, or if price competition causes selling prices to fall, this could adversely affect the Company's business and operating results. Similar competitive risks exist in the Electronic Seal business (entered in 2015), and the Company may be unable to maintain differentiation based on its strength as a certificate authority holder.

The cloud infrastructure services market has low barriers to entry and features intense competition among numerous industry peers, with stable delivery of high-quality, reasonably priced services serving as the source of the Company's competitiveness. If the Company's competitive advantage were to decline due to further intensification of technology development competition and price competition, this could affect its business and operating results. Competition from major cloud service providers also remains an ongoing threat.

The Company's consolidated group operates businesses in countries around the world, including North America, Europe, Russia, and Asia, and is exposed to risks such as the enactment and revision of laws and regulations in each country, changes to tariff systems, product liability regulations, class action lawsuits, and large damages awards. Geopolitical risks such as political turmoil due to war, terrorism, or conflict, and labor issues or disease arising from differences in culture and customs, could also affect business continuity. In particular, business operations in regions including Russia require continuous monitoring in light of heightened geopolitical tensions.

The Company's consolidated group conducts some transactions denominated in foreign currencies in the course of business, including investments and loans to overseas consolidated subsidiaries, and manages foreign currency holdings for the purpose of hedging foreign exchange risk. However, if exchange rates fluctuate significantly due to changes in the global economic situation or other factors, this could affect the business and operating results of the Company's consolidated group. Given the global structure of its operations, fluctuations in either the yen's appreciation or depreciation could affect earnings.

Both the Electronic Certification & Seal services and the cloud infrastructure services require stable operation 24 hours a day, 365 days a year, and SLAs have been introduced for some services. If a service outage occurs due to disasters, accidents causing disconnection of communication networks, sudden spikes in access, computer virus damage, software defects, or human error, this could result in direct losses such as refunds, loss of trust, and damages litigation. Since the Company does not own its own data centers and relies on external IDC operators, outages on the IDC side also constitute a business risk.

The internet industry is undergoing significant technological progress in both hardware and software, and the Company's consolidated group continuously improves its services through proprietary development and collaboration with alliance partners. However, if existing services become obsolete due to the unexpected spread of new technologies or new services, this could reduce competitiveness relative to competitors and require additional expenditure to respond to new technologies. In particular, advances in encryption technology in the field of electronic certification could affect the very foundation of the business.

The Company's consolidated group has a policy of actively utilizing strategic alliances, including M&A and capital alliances, as a means of business expansion, and conducts detailed due diligence in advance. However, if contingent liabilities or previously unrecognized liabilities that were not identified during prior investigation arise after an acquisition, or if the business plan does not proceed as originally planned due to delays in integration work, departure of key personnel, or failure to achieve expected synergies, this could affect the business and operating results. The establishment of subsidiaries and investments and loans associated with the development of new businesses such as IoT services and electronic contract services also carry similar risks.