Item 3. Key Information.

Not applicable.

Not applicable.

Our business faces significant risks. Investors should carefully consider the risks described below, in addition to the other information set forth elsewhere in this Annual Report on Form 20-F (the “Annual Report”), including our consolidated financial statements and the related notes beginning on page F-1. If we were to encounter the risks described, our business, operational performance and financial position could be harmed, potentially with materially adverse consequences. In that event, the quoted prices of our Ordinary Shares and American Depositary Shares could decline.

In summary, these risks are:

3

Risks Related to Our Strategy and Business

Since our inception, we have generated limited revenue and have incurred significant operating losses. We cannot offer any assurances regarding whether or when we will generate sufficient operational cash flow to offset our costs and accelerate the expansion our business, or whether or when we will generate sufficient revenue to achieve or maintain profitability.

Our efforts to execute our strategy successfully may cost more and take longer than we anticipate. We generated revenue of $4.1 million and recorded a net loss of $32.7 million for the year ended December 31, 2022. We generated revenue of $2.8 million and recorded a net loss of $32.6 million for the year ended December 31, 2021.

We are not certain whether or when we will generate sufficient cash flow to fully fund our costs and accelerate the expansion of our business, or whether or when we will generate sufficient revenue to achieve or maintain profitability. Although we have established customer relationships with innovators and early adopters sharing our vision for the potential of fingerprint authentication in smart card applications, our forecasts of when we will generate revenue and cash flow sufficient to meet its funding requirements are based on complex assumptions regarding demand, products, costs, and other considerations that are subject to rapid change. These assumptions involve uncertainties and evolving circumstances, many of which are outside of our influence or control.

Our customers primarily are manufacturers of smart cards, although a critical element of demand for our solutions originates with these manufacturers’ own customers (e.g., the demand for financial payment cards with fingerprint authentication originates with a bank issuer interested in offering such cards). As such, we focus our marketing and sales efforts on smart card manufacturers, as well as their customers and other influential participants in the smart card industry (e.g., payment card networks).

Fingerprint authentication applications in the market segments we target are in the early stages of development. Because of this, we have experienced uncertain and lengthy sales cycles, as potential customers and other influential participants in the smart card industry have required, and likely will continue to require, exposure to, and education about, fingerprint authentication technologies,

4

our solutions, and our value proposition. To address this, we expanded our marketing and sales staff in 2021 and our marketing spending in 2022. We expect our enhanced demand creation efforts will shorten sales cycles, but we cannot offer any assurances regarding the success of these efforts or the amounts and timing of customer orders.

Given recent inflationary pressures, primarily in the semiconductor supply chain, we expect our costs and expenses to increase, which could negatively influence cash flow and profitability, even if we are able to significantly increase our revenue. As a “fabless” developer of semiconductor-based products, our manufacturing costs for the products we currently sell are most influenced by the discounts our vendors offer for sustained, high-volume production orders. We may not achieve the necessary volume of production orders to obtain advantageous pricing for the manufacture of our current products. If we are not able to pass on increased costs to customers by increasing the prices of our products, our profitability could decline, harming our business, operational performance, and financial position.

We believe our advances in fingerprint authentication technologies are an important competitive differentiator. As such, we intend to maintain research and development spending at current levels. While we intend to continue development of new products, with improved performance, greater functionality, and broadened applications, with lower costs, we cannot accurately predict whether or when these new products will be introduced or the level of customer acceptance they will achieve in the market segments we target.

Our operating cost structure is largely fixed, reflecting our business model and strategic focus on development of highly differentiated biometric technologies. Variable costs are associated primarily with production volumes. Accordingly, we anticipate our profitability could improve as revenue increases, as our forecasts for operating expenses are based on our assumed ability to increase revenue without proportional increases in our operating cost structure. However, because of the uncertainties associated with accurately forecasting revenue levels and achieving operational economies of scale, we cannot offer any assurances regarding our ability to, or the timing of when we might, achieve profitability.

We have a going concern risk.

We do not currently have the cash resources to fully meet our operating commitments for the next twelve months. This and the circumstances discussed in the previous risk factor represent a going concern risk.

Among other factors, our history of losses, limited revenue and negative cash flows from operations represent a going concern risk. As a result, our independent registered public accounting firm has included an explanatory paragraph in their opinion for the year ended December 31, 2022 as to the significant doubt about our ability to continue as a going concern. Our financial statements have been prepared in accordance with International Financial Reporting Standards (IFRS) as issued by the International Accounting Standards Board (IASB) and IFRS as endorsed by the European Union, which contemplate that we will continue to operate as a going concern. Historically, we have been able to raise funds through private placements of shares, including private placements of shares that raised $15.1 million before expenses in 2022. We regularly review all strategic options to fund ongoing operations, research and development projects and working capital needs, including a capital raise. While we have been successful in the past in raising funds through private placements of shares, there is no assurance that we will be successful in the future.

We are not certain whether or when we will generate sufficient operational cash flow to offset our costs and accelerate the expansion of our business, nor whether or when we will generate sufficient revenue to achieve or maintain profitability. Because we intend to continue pursuing our strategy of re-investing in our business in order to achieve expected revenue growth, we anticipate that additional capital will be required to fund such revenue growth (e.g., funding of increased working capital requirements). We will require additional funding to support future operating losses and subsequent expected growth. Our forecasts are based on complex assumptions that are subject to rapid change. These assumptions involve uncertainties and evolving circumstances, many of which are outside of our influence or control.

While we previously have been able to raise capital through private placements of our Ordinary Shares, additional financing in any form may not be available on terms favorable to us, if at all. If adequate funds are not available on acceptable terms, we may be unable to maintain or expand our revenue, which could harm our business, operational results, and financial position, and, in turn, the value of an investment in our equity securities could decline. We continuously review all alternatives, financial and strategic, for meeting our future capital requirements. However, because our future funding decisions will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future funding from investors, lenders, or strategic partners.

5

Our fingerprint authentication solutions are targeted at three emerging applications within the smart card market, financial payments, digital authentication/access control, and digital currency storage, all of which are in early stages of development. As such, it is difficult to predict the varying pace at which these applications will develop into defined market segments, how large the market segments could be, and to what extent we will successfully penetrate any such market segment, if at all.

We are a developer of fingerprint authentication solutions and focus on use cases based on smart cards. The specific applications we are targeting with our fingerprint authentication solutions are in the early stages of their development and are characterized by the extended and unpredictable sales cycles associated with new, innovative technologies, a limited number of early adopting customers, immature supply chains, and evolving application requirements and industry-specific standards.

Financial Payments

Currently, our primary focus is on developing the financial payments market segment. We introduced the first flexible touch sensor for ISO ID-1 form factor requirements in 2015 and, later that year, entered into a strategic partnership with Mastercard to develop the biometric payment card opportunity. However, approximately five years passed before we announced significant customer engagements (e.g., IDEMIA France SAS), as:

Because of these and other challenges encountered in developing opportunities in the financial payment market segment, accurately forecasting demand within the market segment has been, and likely will continue to be, difficult, with forecasts based on complex assumptions that have been, and likely will continue to be, subject to rapid change. These assumptions involve uncertainties and evolving circumstances, many of which are outside of our influence or control.

Digital Authentication

We believe high value-add digital authentication applications across the access control market segment represent promising opportunities for our fingerprint authentication solutions. While this market segment shares the characteristics and challenges associated with the financial payments market segment, the competitive landscape for user authentication in access control applications is broader and more complex, with various alternative authentication methods available, delivered in numerous form factors across diverse applications. While we achieved FIDO (Fast Identity Online) Alliance certification for a fingerprint

6

authentication solution in 2016, our penetration of this market segment to date has been limited. We attribute our slower than expected penetration of the access control market segment to:

Digital Currency Storage and Related Applications

We believe the opportunity for us in our third targeted market segment, digital currency storage, also referred to as digital wallets, holds great promise, given the applicability of our fingerprint authentication solutions. However, this market segment is the least developed of the three we are targeting.

Our diverse activities in the emerging digital currency storage market segment include providing fingerprint authentication for two Chinese banks piloting digital wallets for the e-CNY initiative of the People’s Bank of China and collaborating with developers of innovations for emerging crypto-wallet and cybersecurity applications. We have not generated significant revenue within this market segment, as the diverse range of opportunities we have identified are in early stages of development and require disproportionate allocations of our time and resources to establish viable customer- and application-specific solutions. Such engagements have been characterized, to date, by long periods of product prototyping, as well as uncertainties associated with the performance requirements, scope, and timing of potential customer deployments. As such, accurately forecasting demand for digital wallet applications is difficult and based on complex assumptions, notably regarding solution definition and regulatory considerations, that are subject to rapid change. These assumptions involve uncertainties and evolving circumstances, many of which are outside of our influence or control.

The timing of and the rate of demand growth in each market segment we target are difficult to accurately predict, as the drivers of demand differ. Competitive conditions and solution requirements also differ, contributing to difficulty in accurately predicting revenue, profitability, and the timing thereof. Accordingly, we offer no assurances regarding whether or when our revenue growth will accelerate in any of the three targeted segments, nor can we offer assurances regarding whether or when we will reach profitability, if at all, in any such segment.

Our future success is dependent upon our ability to develop, communicate, and deliver a compelling value proposition to customers. If we do not do so, our business, operational results, and financial position could be harmed, and, in turn, the value of an investment in our equity securities could decline.

Our value proposition is based on the highly-differentiated functionality and performance of our fingerprint authentication solutions and our comprehensive approach to offering integrated solutions addressing multiple customer needs. These customer needs may vary among the market segments we target, but generally are associated with the creation of cost-effective competitive advantages for our customers (e.g., highly-differentiated end products).

We believe the primary customer requirement across the market segments we target is a compelling economic rationale for implementing fingerprint authentication in a smart card. We believe the absence of such a rationale, largely the consequence of the historically high costs associated with manufacturing and deploying such smart cards, has inhibited demand to date and, if we cannot further reduce these costs, likely will continue to inhibit demand and, in turn, harm our business, operational performance, and financial position.

Our strategy, reflected in our value proposition, has been focused on reducing these historically high costs. Our TrustedBio module, integrating a low-cost polymer sensor and advanced biometric processing circuitry, has been designed to be cost-competitive with alternative solutions, while delivering superior performance and reliability. We have developed a reference design integrating our TrustedBio module with the SLC38 security controller from Infineon Technologies AG, thereby allowing our manufacturing customers to minimize their own integration costs, while accelerating time-to-market. We have developed an optimized card inlay,

7

consisting of a card antenna and connective circuits, which reduces customer design and procurement costs. We are developing a proprietary card operating system for this reference design, which can be installed on the SLC38 prior to shipment to a card manufacturer, further reducing costs and process steps. We have collaborated with vendors of the capital equipment used for card manufacturing to optimize machine tooling and process management software, thereby increasing card production throughput, while lowering yield losses.

Our objective for solution design is to integrate the active components necessary to produce a smart card incorporating fingerprint authentication, creating a comprehensive, single package, solution design and bill of materials that should significantly reduce development and manufacturing costs for our customers. Our longer-term vision involves the integration of the functions currently performed by separate semiconductor devices into one such device, which, when packaged with our fingerprint sensor, could enable a customer to deliver a smart card with fingerprint authentication at a cost comparable to that associated with a basic, dual-interface smart card. However, we cannot predict whether or when we might complete such lower-cost, higher-functionality solutions or whether such solutions will achieve widespread acceptance.

A significant cost incurred by the end-customers of our manufacturing customers is associated with user enrolment (i.e., the process of imaging and storing a user’s fingerprint, in the form of a template, within the memory of the smart card, thereby enabling its use). We have developed a proprietary enrolment solution that can be delivered directly to users that consists of a disposable, sleeve-like electronic device, with a small battery, allowing for the capture of a user fingerprint and the activation of the smart card for that user. This convenient process allows the user to enroll wherever and whenever he or she might choose, but it adds costs to the deployment of smart cards incorporating fingerprint authentication. To address these costs and to further improve user experience, we are developing software-based enrolment solutions, for which we have protected intellectual property, to allow for enrolment over the user’s mobile phone or, specifically for enrolment of financial payment card users, through a point-of-sale terminal. However, we cannot predict whether or when we might complete such software-based enrolment solutions or whether such solutions will achieve widespread acceptance.

While our efforts have significantly reduced the difference between the costs of manufacturing and deploying smart cards incorporating fingerprint authentication and those associated with manufacturing and deploying less complex smart cards, this cost difference remains an obstacle to widespread adoption. We may not be able to achieve our objectives for additional cost reductions through further component integration and through development of software-based enrolment solutions, as the engineering challenges associated with both are substantial and characterized by uncertainties.

If we are not able to achieve additional cost reductions in support of our value proposition, our fingerprint authentication solutions may not achieve widespread adoption and our opportunities may be constrained, thereby harming our business, operational performance, and financial position.

Card-based fingerprint authentication solutions have not yet achieved, and may never achieve, widespread acceptance by card issuers, card manufacturers, or card users.

Fingerprint authentication integrated into a smart card remains a novel solution for enhancing security. In addition to addressing costs and supporting the economic rationale for customer use of our fingerprint authentication solutions, we must address the other uncertainties and concerns of potential customers and users if our solutions are to achieve widespread acceptance. Although recently escalating concerns about fraud losses, identify theft, data breaches, and other security risks have increased general awareness of the need for improved electronic security systems and data protection procedures, and fingerprint authentication has achieved widespread acceptance among manufacturers and users of smart phones, widespread acceptance of fingerprint authentication in smart cards, if it occurs, likely will depend on a wide range of variables and outcomes, including:

For these reasons, we are uncertain whether or when fingerprint authentication in smart cards will achieve widespread acceptance in any commercial markets or that demand for our solutions will be sufficient to create a market large enough to produce

8

significant revenue or earnings. If widespread acceptance is not achieved, our business, operational performance, and financial position may be harmed, and the value of an investment in our securities may decline.

The extended and unpredictable sales cycles which we have encountered, and may continue to encounter, may involve commitments of engineering support, requiring valuable time and resources. If our customer development activities are not successful, we will not meet our revenue forecasts and will absorb potentially significant customer- or application-specific costs.

As fingerprint authentication in smart cards has not yet been widely adopted in the market segments we target, our engagement with potential customers frequently begins with an extensive education process regarding our products and technologies, which may be followed by an extended period of pre-sale engineering support for customer development of a smart card incorporating our products and technologies. During a customer’s product development process, we face the risk that our solutions will fail to meet the customer’s technical, performance, or cost requirements, or that our product will be replaced by a competitor’s product or an alternative authentication solution based on different technologies. Although we may complete a customer’s product development process successfully, the customer subsequently may delay or terminate its product development efforts due to factors and considerations outside of our influence or control.

Until the advantages and benefits of fingerprint authentication in smart cards are well-known in the market segments we target, supported by compelling use cases and volume deployments of our solutions, we are likely to continue to experience extended and unpredictable sales cycles, resource allocation challenges, and high pre-sale customer engagement costs.

If the estimates and assumptions we have used to calculate the sizes and growth rates of our targeted market segments are inaccurate, our business, operational performance, and financial position may be harmed.

Our forecasts, based on assumptions and estimates, are necessarily subject to a high degree of uncertainty and risk due to a variety of factors, including those described herein. We utilize third-party data sources and analysis, which we generally do not independently verify, in our business planning and the development of our forecasts. Inaccuracies or errors in such third-party information likely could contribute to inaccuracies or errors in our business planning and forecasting. We also collect our own market data and competitive information, from which we develop certain assumptions and estimates used in our business plans and forecasts. If we make errors in developing the assumptions and estimates used in our business plans and forecasts, or the assumptions are inaccurate due to rapidly changing circumstances, our growth rate may be limited, as we may incorrectly allocate resources and capital, potentially harming our business, operating performance, and financial position.

If the size of one or more of our targeted market segments expands as we have estimated, our revenue may not expand at a similar rate, if at all. Growth of our revenue is subject to many risk factors, including those described herein. Accordingly, forward-looking statements regarding expected or forecast demand levels, market segment size, market shares, revenue levels, and growth rates included in this Annual Report or in other disclosures should be considered estimates, characterized by uncertainty and subject to change.

A significant portion of our revenue is associated with a limited number of customers, and the loss of such a customer, or a meaningful decline in revenue associated with such a customer, could harm our business, operating performance, and financial position.

We have historically generated limited total revenue, and most of that revenue has been associated with a limited number of customers. During 2022, 2021, and 2020, one customer accounted for approximately 48%, 85%, and 81% of our revenue, respectively.

While we pursue new customers and business opportunities as we maintain our relationships with our current customers, we have had limited success in diversifying our customer base. Excessive customer concentration, now and in the future, could cause any fluctuations in revenue and profitability to be more severe and could contribute to greater difficulty in resource allocation, inventory planning, and revenue forecasting. The loss of a major customer, an unanticipated decrease in demand for our products from a major customer, or our failure to diversify our customer base could harm our business, operational performance, and financial position.

9

If we are unable to retain our existing customers or attract new customers, our growth will be adversely affected and our business, operating performance, and financial position could be harmed.

The success of our business depends on retaining current customers, while expanding and diversifying our customer base, and relies on our ability to develop, communicate, and deliver a compelling value proposition to our customers. Our ability to attract new customers and retain existing customers depends in large part on our ability to be collaborative, responsive, and flexible in the timely delivery of fingerprint authentication solutions to customers, meeting their current and future needs. As enabling technologies evolve, manufacturing processes and requirements change and demand drivers shift within market segments, we are required to continually improve our existing products and introduce new, innovative products, thereby maintaining our competitive position as a leading developer of highly-differentiated fingerprint authentication solutions. If we fail to anticipate technological advances, fail to develop high-performance, lower-cost products incorporating those advances, and fail to deliver compelling, highly-differentiated solutions meeting customer requirements, our competitive position likely will suffer, harming our business, operational performance, and financial position.

Our hardware and software solutions may contain defects, which will make it more difficult for us to establish and maintain customer relationships.

Although we have completed the development of multiple generations of our fingerprint authentication solutions, they have not yet been deployed in high volumes. Despite extensive testing during development and third-party certifications, our solutions may contain undetected design flaws, coding errors, and material or manufacturing defects that are discovered only after high volume deployment and extensive use. Any such flaw, error, or defect in current or new solutions could cause product release delays, design modifications, customer delays, and product recalls, any of which could be costly and disruptive, with potentially adverse effects on customer relationships and our competitive position and, in turn, harm our business, operational performance, and financial position.

Our strategic alliances and collaborations may not achieve their objectives in a timely manner, if at all, and their failure to do so could inhibit our ability to pursue opportunities in targeted market segments.

An important element of our strategy is collaboration with well-positioned partners, leveraging their expertise and resources. We have entered, and we anticipate that we will continue to enter, into strategic alliances and collaborations. We continually evaluate strategic partnership opportunities designed to enhance or complement our technologies, to provide necessary expertise, components, or supplies, to facilitate and accelerate our access to customers and geographies, and to develop, introduce, and distribute solutions integrating our products and intellectual property with those of the partner. Certain strategic alliances may not achieve their intended objectives, and parties to our strategic alliances may not perform as we expect. The failure of these alliances to achieve their objectives may impede our ability to introduce new products and enter new markets, meeting our growth and performance expectations. Furthermore, our partners may possess, obtain, or retain rights in intellectual property they developed independently or as part of an alliance. In the event of a dispute with a partner, the partner may attempt to withhold or assert rights in intellectual property that we developed or sought access to for the purpose of enhancing or complementing our technologies.

We face intense competition.

We compete with both established companies and early-stage businesses providing identification and authorization solutions, as well as larger providers of broader, more traditional security solutions. Some of our competitors have substantially greater financial, engineering, marketing, customer support and manufacturing resources than us, and may independently develop superior technologies and solutions, which may result in our technologies and solutions becoming less competitive or obsolete.

In some circumstances, competitors may be able to aggressively compete on price in a manner we may not. Current and potential competitors also may have greater name recognition, more extensive market presence, larger installed bases, and long, established relationships with many of their customers and partners.

In the market segments we target, authentication solutions utilizing powered mobile devices (e.g., smart phones) are achieving broadening acceptance and represent a significant competitive threat. We believe the demonstrable vulnerabilities of such alternative solutions, most notably to hacking (i.e., the unauthorized access to and misuse, for fraudulent or criminal purposes, of private information stored on a networked electronic device), afford us a meaningful competitive advantage. However, we may not be able to successfully communicate this and other competitive advantages to those potential customers for which a networked, mobile device, albeit vulnerable to security risks, might be an acceptable alternative solution.

If we are unable to enhance our existing technologies or develop new technologies in a timely manner in response to technological and marketplace changes, our ability to compete in our targeted market segments likely will suffer. In addition, if one or more other biometric technologies, such as voice, face, iris, hand geometry, or blood vessel recognition offered by competitors, are widely adopted, the potential opportunities for our fingerprint authentication solutions could be reduced.

10

Our ability to compete successfully depends on a number of competitive factors, which may be outside our influence or control. These competitive factors include the following:

Additional competitors may enter the market segments we have targeted, with fingerprint authentication solutions or solutions based on other technologies or approaches, increasing competition and increasing risks to our business, operational performance, and financial position.

Early-stage markets are susceptible to consolidation of participants and entry into the market by larger, established companies that acquire or form joint ventures with participants. Our position in the market segments we target could be harmed if the competitive landscape were to change due to consolidation or entry by a company with substantial resources through a merger, acquisition, or joint venture with a competitor. Increased competition within any of our targeted market segments could result in price reductions, reduced gross margins, and lost opportunities, potentially harming our business, operational performance, and financial position.

We are exposed to potentially significant supply chain risks, as we currently rely on one semiconductor manufacturer and a limited number of providers of assembly and test services for outsourced production of our products.

We currently rely on Taiwan Semiconductor Manufacturing Company, Limited (“TSMC”), the leading producer of semiconductor wafers, for production of our proprietary application specific integrated circuit (“ASIC”) designs. We also rely on a limited number of providers of assembly and test services, including Amkor Technology, Inc. and Silicon Precision Industries Limited (a unit of ASE Technology Holding Co., Ltd.), both of which are leaders in outsourced semiconductor assembly and test services.

We enjoy collaborative, supportive relationships with these suppliers. While we have experienced lengthened delivery lead times, we have not experienced significant delays in delivery of wafers or completed products. However, broader supply chain uncertainties have contributed to, and likely will continue to contribute to, difficulties in accurately planning capacity utilization, inventory provisioning, and inventory levels.

We also have experienced increased costs and expect further cost increases if supply chain conditions remain for a prolonged period, which we anticipate. Numerous industries dependent on the semiconductor and electronics supply chains have experienced supply shortages and delays, contributing to lower production, higher costs, and reduced efficiencies. We expect, based on the research of industry analysts and information from our suppliers, uncertainties associated with capacity utilization, lead times, delivery schedules, and costs will continue in 2023 and possibly future years. However, we cannot accurately predict when conditions in our supply chains will normalize or what the consequences for our business might be if such normalization does not occur when expected.

The TSMC facility producing our semiconductor wafers is located in China, which exposes us to risks associated with international trade policy, tariffs, and related policy matters, all of which are outside of our influence or control. While TSMC facilities in other countries offer the fabrication processes we require, transition of production of our wafers to such a facility would require significant effort, time, and costs, which could harm our business, operational performance, and financial position.

Because we depend on the contributions of very skilled staff across critical engineering and business disciplines, if these individuals were to leave us, we may not be able to attract and hire replacements with the same skills in a timely fashion, if at all, which could harm our business, operational performance, and financial position.

Our ability to successfully execute our growth strategy depends on our ability to attract, motivate, and retain our personnel. Competition for well-qualified employees across critical disciplines, is intense. Our continued ability to compete effectively depends on our ability to attract new, well-qualified candidates and to retain and motivate existing staff. If we do not succeed in attracting well-qualified candidates or retaining and motivating existing staff, our business, operational performance, and financial position could be adversely affected.

11

We believe our success has depended, and will continues to depend, on the talents and efforts of our executives and our highly skilled staff, including our engineering, sales, and administrative personnel. We believe we provide compensation, in the form of salaries, benefits, and share-based awards, consistent with comparable technology companies of our size, development stage, and industry focus. We also maintain a yearly performance-based, variable compensation plan, in which all full-time employees participate, directly tied to company-wide, departmental, and individual performance goals. However, total variable compensation paid for the last three years has not been a significant portion of cash compensation, representing, in aggregate, approximately 5%, 5%, and 4% of employee salaries paid for the years ended December 31, 2022, 2021, and 2020. Until we achieve certain levels of sustained revenue and profitability, such amounts of variable compensation likely will not be a significant portion of total compensation. As such, our variable compensation plan may not have the intended effects associated with motivating and retaining our employees.

As of December 31, 2022, all of our full-time staff (i.e., employees and permanent individual contractors) held subscription rights for the purchase of our Ordinary Shares. Our executives and other key contributors receive a significant portion of their total annual compensation in the form of subscription rights awards or, from time to time, other forms of share-based compensation. If the quoted price of our Ordinary Shares does not appreciate from the prices per share associated with the subscription rights outstanding, the value, if any, of those subscription rights, if and when exercised, may not be meaningful to holders of those subscription rights. If the quoted price of our Ordinary Shares does not increase, the holder’s perception of the potential value of his or her subscription rights may be insufficient to retain that holder as an employee or contractor. The loss of one or more important contributors, due to the perception that the current or future value of subscription rights awards is not sufficiently compelling to remain with us, could adversely affect our ability to execute our strategy, and we may not be able to find adequate replacements in a timely manner. Accordingly, we can provide no assurances that we will be able to retain the services of our executives or key contributors.

The COVID-19 pandemic could have an adverse impact on our business, operational performance, financial position, as well as the markets and communities in which we operate.

In response to the COVID-19 pandemic, many state, local, and national governments put in place quarantines, executive orders, shelter-in-place orders, and similar government orders and restrictions to control the spread of the virus. At the onset of the pandemic, we implemented a flexible work-from-home policy for employees and restricted travel. We will continue to monitor applicable regulations and the recommendations of public health professionals as we determine which actions are in the best interests of us and our employees.

We expect, based on the research of industry analysts and information from our suppliers, uncertainties associated with capacity utilization, lead times, delivery schedules, and costs will continue in 2023 and possibly future years. We cannot accurately predict when conditions in our supply chains will normalize or what the consequences for our business might be if such normalization does not occur when expected.

While the ultimate duration and impact of the COVID-19 pandemic on the global economy, our targeted market segments, and our business is difficult to assess or predict, the pandemic has resulted in, and may again result in, the disruption of global financial markets, potentially reducing our ability to access capital.

Additionally, the pandemic could negatively impact the performance of our customers, which could cause reduced orders from them or delays in renewing or entering into contracts with us. We believe the pandemic has had an adverse influence on the timing of activities of smart card manufacturers and issuers, including delaying product development and the initiation of trials and pilots involving smart cards incorporating our fingerprint authentication solutions. Such negative impact on the performance of our customers could slow the collection of accounts receivable or expose us to inventory obsolescence, either of which, if significant, could harm our business, operational performance, and financial position.

We will continue to monitor circumstances closely. While the pandemic may have increased end-user awareness of the hygienic benefits of contactless payment solutions, such as those enabled by our fingerprint authentication solutions, therefore possibly increasing demand for such solutions, the full impact of COVID-19 (or a similar health emergency) is difficult to predict, highly uncertain, with assumptions and estimates subject to change.

12

Our business, operational performance, and financial position are subject to a range of exogenous risks. A sustained period of unfavorable conditions in the global economy or in the market segments we target could have an adverse impact on our business, operational performance, financial position. War, terrorism, other acts of violence, or natural or manmade disasters, could have an immediate and sustained impact on business and investor confidence, leading to reduced economic activities, potentially harming our business, operational performance, and financial position.

Because we sell an innovative technology solution for emerging applications in market segments in early stages of development, we are particularly vulnerable to a sustained decline in economic conditions, which likely would be accompanied by a decline in confidence within our targeted market segments. Heightened risk aversion within our targeted market segments could inhibit demand for our solutions, which have yet to achieve wide adoption.

We believe global economic conditions are subject to the following short- and long-term exogenous risks, individually and with combined effect:

These and other risks to economic activity could make it difficult for our customers and other market participants to accurately forecast and plan business activities, leading to lower confidence and the possibility of reduced or delayed on new initiatives, such as the deployment of products incorporating our fingerprint authentication solutions. If economic conditions deteriorate or are characterized by greater uncertainty or volatility, we may not meet our revenue forecasts or our expectations for when profitability will be achieved may be delayed, which could have an adverse impact on our business, operational performance, and financial position.

Additionally, if economic conditions were to deteriorate, valuations in the capital markets likely would decline, independent of our performance or disclosed outlook, potentially resulting in lower quoted market prices for our equity securities. As such, our ability to access additional capital through the capital markets could be diminished or significantly delayed.

Our business is susceptible to risks associated with international operations.

We market our solutions worldwide. Our global marketing and sales personnel are assigned to offices in the United Kingdom, the United States, and China, and focus on demand creation and customer support. We also have sales and marketing personnel residing across Europe, North America, and Asia, addressing opportunities across our three targeted markets in those regions. Employing and managing personnel across disparate international domiciles, with differing employment and tax laws, has been, and likely will continue to be, a source of organizational complexities and costs that have been, and likely will continue to be, disproportionally high for a company of our size and stage of development.

Our reliance on international marketing and sales activities subjects us to the risks of conducting business internationally, including risks associated with political and economic instability, including trade restrictions, sanctions, and import/export regulations, currency controls and exchange rate fluctuations, changes in tariff and duty rates, and travel and trade restrictions related to health emergencies (e.g., the COVID-19 pandemic). Such instabilities or uncertainties associated with these risks may negatively impact the performance of our customers in one or more regions of the world, which could cause reduced orders from them or delays in renewing or entering into contracts with us, negatively affecting our business, operational performance, and financial position. Such negative impact on the performance of our customers in one or more regions of the world could slow the collection of accounts receivable from such customers or expose us to inventory obsolescence due to delayed or cancelled orders, either of which, if significant, could harm our business, operational performance, and financial position.

13

Our international activities may expose us to a number of other risks including, but not limited to:

These and other risks associated international activities could contribute to reduced demand from, or disruptions of our relationships with, international customers operating in any of our three targeted markets, with a potentially adverse influence on our business, operational performance, and financial position.

If currency exchange rates fluctuate substantially in the future, our financial results, which are presented in U.S. Dollars, could be adversely influenced by potentially large gains or losses experienced in the translation of amounts denominated in foreign currencies.

Our terms and conditions of sale provide for pricing our products and invoicing our customers in U.S. Dollars, and our suppliers of outsourced product manufacturing and assembly and test services invoice us in U.S. Dollars. However, we incur expenses for employee compensation, property leases, and other operating expenses in the local currencies of the countries in which we operate. To date, we have not engaged in any currency hedging strategies, and any such strategies, such as forward contracts, currency options, and foreign exchange swaps, we may implement to mitigate this risk may not eliminate, or may increase, our exposure to foreign exchange fluctuations.

Product errors or defects could expose us to costs and liabilities, harm our reputation, and reduce our ability to compete effectively.

Semiconductor-based products such as those we develop and sell may contain errors or defects, especially when first introduced, when new versions are released, or when first integrated with other technologies, either by us or our customers. Product errors, including those resulting from third-party suppliers, could affect the performance or interoperability of our products, could delay the development or release of enhanced or new products and solutions, with potentially adverse consequences for our reputation, market acceptance of our products and solutions, and our ability to compete. Any errors or delays in releasing enhanced or new products and solutions could cause us to lose customers, subject us to liability for damages, and divert our resources from other tasks, any one of which could materially and adversely affect our business, operational performance, and financial position. Although we have insurance to cover product liability claims, the amount of coverage may not be sufficient.

14

If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to: regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.

In the ordinary course of our business, we may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) proprietary, confidential, and sensitive data, including personal data, intellectual property, and trade secrets (collectively, sensitive information). We may rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties.

Cyberattacks, malicious internet-based activity, and online and offline fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect. These threats come from a variety of sources, including traditional computer “hackers,” threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats.

Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products and services) or the third-party information technology systems that support us and our services.

Remote work has become more common and has increased risks to our information systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

Any of the previously identified or similar threats could cause a security incident or other interruption. A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our products or services. The failure of our information security infrastructure, procedures, and controls to protect us from an expanding variety of cybersecurity threats could have a material adverse effect on our business, operational performance, financial position, and damage to our reputation as a provider of solutions for information security.

We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

To date, we have not experienced a security incident or similar event. Although we have implemented information security infrastructure, procedures, and controls designed to protect against these threats, there can be no assurance that these measures will be effective. Our systems remain vulnerable to an expanding variety of cybersecurity threats, including data theft, financial fraud, ransomware and similar third-party criminal activity, and computer viruses or similar operationally disruptive problems, given the pace at which such threats evolve. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and

15

remediate all vulneratbilities because the threats and techniques used to explot the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulneratbilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products or services, deter new customers from using our products or services, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.

We may pursue strategic transactions, including acquisitions of other businesses operating in our current market or operating in a new market, and integration of any such acquired assets or operations into our company may be disruptive or not meet expectations, thereby harming our business, operating performance, and financial position.

We may pursue strategic transactions in the future. Risks associated with mergers, acquisitions, investments, asset purchases, joint ventures, and related strategic transactions include:

These and other risks may prevent us from realizing the expected strategic and financial benefits from completion of the strategic transaction, and, if the full economic value of the strategic transaction is not realized, we may be required to incur an impairment charge to reduce the carrying value of any goodwill or intangible assets recorded at the time of the strategic transaction.

If we fail to properly evaluate and successfully execute any strategic transaction, our business, operational performance, and financial position may be harmed.

16

Because the value of an investment in our equity securities is subject to a range of risks, including those described herein, if investors were to experience significant losses in the value of their investments in our equity securities, we may face litigation alleging that we have violated securities laws.

Companies that have experienced declines in the quoted prices of their shares, leading to investor losses, have been the subject of securities class action litigation, principally associated with allegations of material misstatements or omissions in disclosures required under SEC rules. Any such lawsuit to which we are a party, with or without merit, may result in an unfavorable judgment, or we and our insurance carriers may decide to settle litigation on unfavorable terms. Any such negative outcome could result in substantial damages or fines, damage to our reputation, or require modification of our business practices, all of which could harm our business, operational performance, and financial position. Defending litigation is costly and time-consuming and could

divert management’s attention and our resources. Furthermore, negative public announcements associated with the litigation could have a negative effect on the quoted prices of our ADSs or Ordinary Shares.

We have received grants and subsidies in the past that we may not receive in the future.

We have received various grants and subsidies to fund our research and development programs from various funding organizations. Furthermore, the Company continues to engage in efforts to secure further grants and subsidies for the next development steps of its product candidates. There is no assurance that granting bodies and agencies will continue to provide grants or that our programs will continue to qualify for grants.

Risks Related to Intellectual Property

Any failure to protect our proprietary technology and intellectual property rights could substantially reduce our ability to compete effectively, thereby harming our business, operational performance, and financial position.

We protect our proprietary technology and confidential information through the use of patents, trade secrets, trademarks, confidentiality agreements, and other contractual instruments and provisions.

Our intellectual property rights cover individual inventions and complete systems ranging from fingerprint measurement principles, fingerprint processing and matching algorithms, image sensor designs, integrated circuit designs, card-not-present solutions, dynamic registration enrolment solutions, and integrated system solutions. We have filed applications to protect our intellectual property rights in many countries, including Norway, South Korea, the United Kingdom, the United States, and those of the European Union. As of December 31, 2022, we have been granted 175 patents and have 62 pending patent applications.

The wordmark ‘IDEX’ and the IDEX logo are registered trademarks of IDEX Biometrics ASA and are owned by our company. There can be no assurance we will obtain protective registrations of our trademarks in key markets. Failure to obtain registrations could compromise our ability to fully protect our trademarks and brands and could increase the risk of challenge from third parties to our use of our trademarks and brands.

Effective intellectual property protection may be unavailable or limited in some foreign countries in which we operate. For example, the validity, enforceability, and scope of protection of intellectual property in China, where we operate, are still evolving and do not protect our intellectual property rights to the same extent as the laws in the other countries in which we operate.

We rely upon written agreements with our customers, suppliers, manufacturers, and other recipients of our technologies and products, in which our intellectual property is used, setting forth requirements for the treatment of confidential information, including our intellectual property. However, such agreements may not be adequate to protect our intellectual property and other proprietary information. Our customers, suppliers, manufacturers, and other recipients of our technologies and products may seek to use our intellectual property or proprietary information in violation of the terms of such written agreements.

Unauthorized parties may attempt to copy or otherwise use elements of intellectual property or proprietary information. Other parties, including our competitors, may independently develop technologies and products that are similar to or replicate features and functions of our technologies and products, potentially infringing on our intellectual property rights. If our efforts to protect and enforce our intellectual property rights are ineffective, we may engender increased competition in the market segments we target or in other markets in which fingerprint authentication applications are appropriate.

We may pursue and, from time to time, defend litigation to enforce our intellectual property rights, to protect our trade secrets, and to determine the validity and scope of the proprietary rights of others. Such litigation, whether successful or unsuccessful, could result in substantial costs and diversion of resources, which could have a material adverse effect on our business, operating performance, and financial position.

17

Any claims by third parties alleging we have infringed on their intellectual property rights could result in substantial costs and diversion of resources, which could have a material adverse effect on our business, operating performance, and financial position.

Our success depends, in part, on our ability to develop and commercialize our solutions and services without infringing, misappropriating or otherwise violating the intellectual property rights of third parties. However, we may not be aware that our solutions or services are infringing, misappropriating, or otherwise violating third-party intellectual property rights and such third parties may bring claims alleging such infringement, misappropriation, or violation. For example, there may be issued patents of which we are not aware, held by third parties that, if found to be valid and enforceable, could be alleged to be infringed by our current or future technologies or products. There also may be pending patent applications of which we are not aware that may result in issued patents, which could be alleged to be infringed by our current or future technologies or products. Because patent applications can take years to issue and are often afforded confidentiality for some period of time there may currently be pending applications, unknown to us, that later result in issued patents that could cover our current or future technologies or products. A claim may also be made relating to technology that we acquire or license from others. We are not aware of any claims of infringement. However, any such claims, with or without merit, could result in significant litigation costs and diversion of resources, including the attention of management, and could require us to enter into licensing agreements. There can be no assurance such licenses could be obtained on commercially reasonable terms in a timely manner, if at all, or that the terms of any offered licenses would be acceptable to us.

We also may be required to pay substantial penalties and damages to third parties, potentially including treble damages if we are found to have willfully infringed patents or copyrights. We may also be required to indemnify customers or our licensees for penalties and damages they suffer, if the products they purchase from us, or the technology they may license from us, are found to violate third-party intellectual property rights. We cannot predict the outcome of lawsuits and cannot ensure that the results of any such actions will not have an adverse effect on our business, operational performance, or financial position or results of operations. An adverse determination in a judicial or administrative proceeding, or a failure to obtain necessary licenses to use such third-party intellectual property could prevent us from manufacturing, using, or selling certain of our products, and there is no certainty we will be able to develop or acquire other non-infringing intellectual property to allow us to continue to offer such products without infringement.

In addition, we may license from third-parties certain technologies used in our products. These third-party licenses may be granted with restrictions, and there can be no assurances that such third-party technologies will be available to us on commercially acceptable terms. If we are unable to license technologies for our products from third-parties on commercially acceptable terms, or if any third-party initiates litigation against us for alleged infringement of their intellectual property rights, we may not be able to sell certain of our products and we could incur significant costs in defending against litigation or attempting to develop or acquire alternate non-infringing products, which would have an adverse effect on our business, operating performance, and financial position.

Our patents may not provide us with competitive advantages.

Our success is dependent, in part, upon protecting our intellectual property rights. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws, and contractual restrictions to establish and protect our intellectual property rights in our products and services. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and services that compete with ours.

We hold numerous patents in the United States and in other countries, covering multiple elements of our highly-differentiated technologies and products. There can be no assurance we will continue to develop proprietary technologies and products that are patentable, that any issued patent will provide us with any competitive advantages or will not be challenged by third-parties, or that patents of others will not limit our ability to effectively compete. Although we have patented the intellectual property that we believe provides us with competitive advantages, our competitors offer products for fingerprint authentication applications, employing different technologies and processes.

Additionally, the process of obtaining patent protection is expensive and time consuming, and we may not be able to file and prosecute all necessary or desirable patent applications, or we may not be able to do so at a reasonable cost or in a timely manner. The United States Patent and Trademark Office (the USPTO) and various foreign governmental patent agencies also require compliance with procedural, documentary, fee payment, and other similar provisions during the patent application process and after a patent has issued. There are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. Even if issued, these patents may not adequately protect our intellectual property, as the legal standards relating to the infringement, validity, enforceability, and scope of protection of patent and other intellectual property rights are complex and often uncertain. Any patents, trademarks, or other intellectual property rights that we have or may obtain may be challenged or circumvented by others or invalidated or held unenforceable through administrative

18

processes, including re-examination, inter partes review, interference and derivation proceedings and equivalent proceedings in foreign jurisdictions (e.g., opposition proceedings) or litigation.

In order to protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time consuming, and distracting to management, and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. An adverse determination of any litigation proceedings could put our intellectual property at risk of being invalidated or interpreted narrowly and could put our related patents, patent applications and trademark filings at risk of being invalidated, not issuing or being cancelled. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential or sensitive information could be compromised by disclosure in the event of litigation. In addition, during the course of litigation there could be public announcements of the results of hearings, motions or other interim proceedings or developments. If securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our existing products, impair the functionality of our products, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or harm our reputation or brand. In addition, we may be required to license additional technology from third-parties to develop and market new products, and we may not be able to license that technology on commercially reasonable terms or at all. Our inability to license this technology could harm our ability to compete.

Risks Related to Government Laws and Regulations

Our business is subject to a complex variety of laws and regulations around the world. Any changes in government regulations relating to our business or other unfavorable developments may adversely affect our business, operational performance, and financial position.

We are incorporated in and registered under the laws of Norway, with staffed subsidiaries in Norway, the United Kingdom, the United States, and China. We also have personnel in various other countries in which we operate. As a result of this organizational structure and the scope of our operations, we are subject to a complex variety of laws and regulations across different countries. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting. If we establish operations in, or have customers domiciled in, other countries, we likely will become subject to the laws and regulations of those countries. It is difficult to accurately predict how existing laws and regulations may be applied to our business, or what new laws and regulations may come into effect.

We are subject to various laws and regulations regarding how we conduct our business. Such laws and regulations include, but are not limited to, labor, advertising and marketing, real estate, taxation, user privacy, data collection and protection, intellectual property, anti-corruption, anti-money laundering, tariffs and customs regulations, export controls, economic sanctions, foreign exchange controls, antitrust and competition, electronic contracts, telecommunications, sales procedures, credit card processing procedures, and consumer protections. We cannot guarantee we have been or will be fully compliant in every country in which we operate, as existing laws and regulations governing issues such as intellectual property, privacy, taxation, and consumer protection, among others, are complex and subject to constant change. The adoption or modification of laws or regulations relating to our technologies and products, and the use thereof, could limit or otherwise adversely affect the manner in which we currently conduct our business. Further, compliance with laws, regulations, and other requirements imposed upon our business may be onerous and expensive, and such compliance may be inconsistent from jurisdiction to jurisdiction, further increasing costs and risk of noncompliance.

Noncompliance with applicable laws, regulations, or requirements could subject us to investigations, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions, or other consequences. Our response to any legal action or a government enforcement action or sanction likely would result in a significant diversion of management attention, an unproductive redirection of resources, and an increase in costs. If our response is ineffective, our business, operational performance, and financial position could be materially adversely affected.

We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies, and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.

In the ordinary course of business, we process personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, and biometric identification information,

19

although we do not copy or store any such data or sensitive information. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations relating to data privacy and security.

Many governments have adopted or are considering adopting laws and regulations regarding the processing of personal data, including biometric information, and notification procedures in the event of a breach of data security or other unintentional disclosure of such information. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. Further, individuals may initiate litigation related to processing of their personal data. We also target customers in Asia and have an office in China, and, as such, may be subject to new and emerging data privacy regimes in Asia, including China’s PIPL, Japan’s Act on the Protection of Personal Information, and Singapore’s Personal Data Protection Act.

We, our card manufacturer customers, and their issuing customers are subject to evolving laws and regulations limiting the circumstances under which certain personal data can be obtained, transferred, received, and processed between countries or jurisdictions. Many jurisdictions in which we operate have established data security and legal frameworks specifically applicable to the collection and storage of biometric information.

European countries and the European Union (the “EU”) have been early and active in the development of such frameworks, but the terms and provisions of such frameworks are not uniform and are subject to change. As such, we are exposed to increased costs associated with compliance, as well as increased risks caused by evolving regulatory requirements and uncertainties.

Complying with the GDPR and the ePrivacy Regulation, when enacted, may cause us to incur additional costs or require us to modify our strategy, business practices, and solutions, as many of our current and targeted customers are domiciled in the EU. Norway, the domicile of our company, is not an EU member state, although it is associated with the EU through its membership in the European Economic Area (“EEA”). Through Norway’s adoption of the Personal Data Act in 2018, the GDPR was incorporated into Norway’s EEA agreement, thus binding Norway to the terms of the GDPR in the same manner as an EU Member State.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal data. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. In addition, the California Privacy Rights Act of 2020 (“CPRA”), effective January 1, 2023, expands the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new California Privacy Protection Agency to implement and enforce the law, which could increase the risk of enforcement. Other states, such as Colorado, Connecticut, Virginia and Utah have passed comprehensive privacy laws and similar data privacy and security laws have been proposed and are being considered at the federal, state, and local levels in recent years, which could further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Additionally, there are U.S. state laws and regulations governing the collection and use of biometric information, such as fingerprints. For example, the Illinois Biometric Information Privacy Act regulates the collection, use, safeguarding, and storage of “biometric identifiers” and “biometric information” by private entities and provides a private right of action for persons who are aggrieved by violations of the law, which have resulted in a number of class action lawsuits. These regulations could have a significant impact on our business.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may become applicable to us. We publish privacy policies, marketing materials and other statements regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our fingerprint authentication solutions. If so, in addition to the possibility of fines, lawsuits, and other claims, we could

20

be required to change our business activities and practices or to modify our products and solutions, which could have an adverse effect on our business, operational performance, and financial position.

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Additionally, certain countries outside Europe (e.g., China) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal data across borders, any of which could increase the cost and complexity of doing business.

If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense.

Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others.

If we, or the third parties on which we rely, fail or are perceived to have failed to adequately address privacy concerns or comply with applicable privacy or data protection laws, regulations and policies, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-related claims); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial position, including but not limited to: loss of customers; interruptions in our business operations; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or revision or restructuring of our operations.

21

We are a multinational organization faced with increasingly complex tax issues in many jurisdictions, in which we could be obligated to pay additional taxes.

Given our international operating structure, with our parent company domiciled in Norway and subsidiaries domiciled in the United Kingdom, the United States, and China, we can be subject to taxation on sales, profits, and assets, as well as payments of social security obligations, in several worldwide jurisdictions. Tax laws are complex, difficult to interpret accurately, and subject to change. Accordingly, the amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax laws and regulations, including increased tax rates or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our business, operating performance, and financial position. Moreover, we generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. Additionally, tax authorities in the jurisdictions in which we operated could review our prior and future tax returns and impose additional tax, interest, and penalties.

As of December 31, 2022, the Company has a tax loss carryforward balance in Norway of 252.6 million, representing a potential deferred tax asset, if recognized and calculated at the current corporate tax rate of 22.0%, of $55.6 million. The Company has a tax loss carryforward balance in the United Kingdom of $3.4 million, representing a potential deferred tax asset, if recognized and calculated at the current corporate tax rate of 19.0%, of $0.6 million. The Company does not have any tax loss carryforward balance or deferred tax liability in China. In the USA, the Company has research and development credits amounting to $1.4 million, which may be applied to offset part of taxable income in future years. There are no restrictions as to the length of time tax losses may be carried forward in Norway and the United Kingdom. Tax rules may change and we cannot guarantee we will generate sufficient taxable profit in future periods that would allow us to recognize the value of the deferred tax asset on our Consolidated Statement of Financial Position. Nor can we guarantee that we ultimately will realize a tax benefit in any country in which he have tax loss carryforwards.

Forecasting our estimated annual effective tax rate for financial accounting purposes is complex and subject to uncertainty, and there may be material differences between our forecasted and actual tax rates.

Forecasts of our income tax position and effective tax rate for financial accounting purposes are complex and subject to uncertainty because our income tax position for each year combines the effects of a mix of profits earned and losses incurred by us in various tax jurisdictions with a broad range of income tax rates, as well as changes in the valuation of deferred tax assets and liabilities, the impact of various accounting rules and changes to these rules and tax laws, the results of examinations by various tax authorities, and the impact of any acquisition, business combination, or other reorganization or financing transaction.

To forecast our global tax rate, we estimate our pre-tax profits and losses by jurisdiction and forecast our tax expense or benefit by jurisdiction. If the actual mix of profits and losses, our ability to use tax credits, or effective tax rates by jurisdiction are different than those estimated, our actual tax rate could be materially different than forecasted, which could have a material impact on our business, operational performance, and financial position.

The countries in which we operate may have broad authority to issue regulations and interpretative guidance that may significantly impact how we apply tax laws and influence the presentation of our financial statements for the period issued. As additional regulatory guidance is issued by the applicable taxing authorities, as accounting treatment is clarified, as we perform additional analysis on the application of tax laws, we refine estimates used in our tax calculations. As such, assumptions and estimated for current tax calculations for the most recent period completed may differ from assumptions and estimated used for prior tax calculations, causing reported tax expense or benefits to differ from period to period. These differences could be material to the tax expense or benefit reported and to comparisons of effective tax rates for the periods.

We are subject to anti-corruption, anti-bribery, anti-money laundering, and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business, operational performance, and financial position.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, (“FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the United Kingdom Bribery Act 2010, and other anti-corruption laws in countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector. We use third-party law firms, accountants, and other representatives for regulatory compliance, sales, and other purposes in different countries. We can be held liable for the corrupt or other illegal activities of our employees, contractors, and other agents, regardless of whether we explicitly authorized such activities. In addition, although we have implemented policies and procedures to ensure compliance with anti-corruption laws, there can be no assurance all of our employees, contractors, or agents will comply with these laws at all times.

Noncompliance with these laws could subject us to whistleblower complaints, investigations, government enforcement actions, prosecution, litigation settlements, disgorgement of profits, fines, damages, other civil and criminal penalties or injunctions,

22

suspension or prohibition from contracting with certain parties, the loss of export privileges, reputational harm, adverse media coverage, and other consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, operational performance, and financial position could be materially harmed. Our response to any event or action likely would result in a significant diversion of management’s attention and resources and a significant increase in legal costs and other professional fees. Enforcement actions and sanctions could further harm our business, operational performance, and financial position.

As an issuer of securities, we also are subject to the accounting and internal controls provisions of the FCPA. These provisions require us to maintain accurate books and records and a system of internal controls sufficient to detect and prevent corrupt conduct. Failure to abide by these provisions could have an adverse effect on our business, operational performance, and financial position.

We must comply with U.S. government laws and regulations governing exports and imports, and we and certain employees are subject to criminal and civil liabilities for violation of those controls.

Our sales are subject to laws and regulations governing exports and imports, including the U.S. Export Administration Regulations, U.S. Customs regulations, and the economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls. Exports of our technologies and products must be made in compliance with these laws and regulations. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil or criminal penalties, including fines and loss of export or import privileges for us and fines or imprisonment for certain employees.

In addition, changes in our products or solutions or changes in applicable export or import laws and regulations may create delays in the introduction and sale of such products and solutions in certain international markets, prevent our customers from deploying our products and solutions or, in some cases, prevent the export or import of our products and solutions to certain countries or customers. Any change in export or import laws and regulations, shift in the enforcement or scope of existing laws and regulations, or change in the countries, governments, persons, or technologies targeted by such laws and regulations could result in a substantial reduction of revenue, with potentially adverse effects on our business, operational performance, and financial position.

Risks Related to Our Governance and Investor Protections

Concentration of ownership of our Ordinary Shares (including Ordinary Shares represented by ADSs) among our executives, members of our Board of Directors, and our principal shareholders may prevent new investors from influencing important corporate decisions and matters submitted to shareholders for approval.

Certain executives, members of Board of Directors (“Board,” as a whole, and each member a “Director”), and beneficial owners of 5% or more of our Ordinary Shares, in aggregate beneficially owned approximately 21% of our issued and outstanding Ordinary Shares, as of March 31, 2023. (For a list of our Directors and Executive Officers, see "Item 6. Section A. Directors and senior management.") As a result, depending on the level of attendance at general meetings of our shareholders, these persons, acting together, would be able to significantly influence all matters requiring shareholder approval, including the election, re-election, and removal of Directors, any merger, scheme of arrangement, or sale of all or substantially all of our assets, other significant corporate transactions, and amendments to our Articles of Association. Accordingly, this concentration of ownership may harm the market price of our Ordinary Shares or ADSs by enabling the persons, acting as a group, to:

23

Under SEC rules, we qualify as a foreign private issuer and, as a result, we are exempt from certain governance requirements, for as long as we maintain such qualification. Because of such reduced requirements, investors may find our equity securities less attractive.

Because we qualify as a foreign private issuer under the Exchange Act, we are exempt from certain provisions of the Exchange Act applicable to domestic (i.e., domiciled in the United States) public companies, including the sections of the Exchange Act regulating: (i) the solicitation of proxies, consents, or authorizations in respect of a security registered under the Exchange Act; (ii) insider reporting requirements regarding insider share ownership and trading activities; (iii) liabilities for insiders who profit from trades made in a short period of time (i.e., “short-swing trading”); and (iv) the required filings with the SEC of quarterly reports on Form 10-Q containing unaudited financial and other specified information, or current reports on Form 8-K upon the occurrence of specified significant events. In addition, foreign private issuers are not required to file their Annual Report on Form 20-F until 120 days after the end of each fiscal year, while domestic issuers must comply with shorter periods. Foreign private issuers also are exempt from Regulation Fair Disclosure, which sets forth rules for issuer disclosures of material information.

As a result of these exemptions, investors in our ADSs or Ordinary Shares may not have protections and safeguards afforded to investors holding the equity securities of companies that are not considered foreign private issuers. As such, investors may find our equity securities less attractive.

As a foreign private issuer domiciled in Norway, under Nasdaq rules we are permitted to adopt certain Norwegian corporate governance practices that differ significantly from corporate governance standards applicable to a domestic issuer. These practices may afford less protection to holders of our equity securities than they would enjoy if we complied fully with Nasdaq listing standards.

As a foreign private issuer listed on Nasdaq, we are subject to corporate governance listing standards. However, Nasdaq rules permit a foreign private issuer to follow the corporate governance practices of its home country in lieu of certain Nasdaq corporate governance listing standards. Corporate governance practices in Norway, which is our home country, may differ significantly from Nasdaq corporate governance listing standards.

Notably, Norwegian independence requirements for our Board are less stringent than the Nasdaq requirements applicable to domestic issuers. In Norway, we are required to comply with the Oslo Børs Issuer Rules, published by Oslo Børs ASA, which operates the stock exchange on which our Ordinary Shares are listed. These rules require at least two of the shareholder-elected members of our Board to be independent of material business relationships with us and any of our significant shareholders. Also, our Board may not include members of our executive management. Subject to these home country requirements, our Board may have members who are not considered independent, and holders of our equity securities may not be afforded the same protections otherwise required under Nasdaq corporate governance listing standards applicable to domestic issuers. See “Item 6. Section C. Board Practices—Corporate Governance” for the exemptions to the Nasdaq corporate governance rules applicable to foreign private issuers.

At some point in the future, we may no longer be considered a foreign private issuer, and we would be required to comply with the Exchange Act’s domestic reporting requirements and the corporate governance listing standards applicable to domestic issuers, likely causing us to incur possibly significant legal, accounting, and other costs related to achieving and maintaining compliance.

As a foreign private issuer, we are not required to comply with certain periodic disclosure and current reporting requirements of the Exchange Act applicable to domestic issuers. Although we do not anticipate losing foreign private issuer status for the foreseeable future, if we were to lose such status, we would be required to comply with all of the periodic disclosure and current reporting requirements of the Exchange Act applicable to U.S. domestic issuers, beginning with the next fiscal year after loss of such status.

In order to maintain our status as a foreign private issuer, either:

(ii) more than 50% of our assets must be located outside the United States, and

(iii) our business must be administered principally outside the United States.

If we lose our status as a foreign private issuer, we would be required to comply with the Exchange Act reporting and other requirements applicable to U.S. domestic issuers, which are more detailed and extensive than the requirements for foreign private issuers. We also will be required to make changes in our corporate governance practices in accordance with applicable SEC and Nasdaq rules.

24

If we lose our status as a foreign private issuer, the compliance and regulatory filing costs and commitments of management time we would likely incur under SEC and Nasdaq requirements could be higher than those we currently incur as a foreign private issuer, potentially increasing our uncertainty regarding whether or when we will achieve profitability.

Because we are an “emerging growth company” and utilize exemptions to certain SEC disclosure requirements, our ADSs and Ordinary Shares may be less attractive to investors.

We are an emerging growth company (“EGC”) as defined in the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”). For as long as we continue to meet the definition of an emerging growth company, we may utilize exemptions from various SEC reporting requirements applicable to other public companies, including exemption from compliance with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act of 2002. We may take advantage of these exemptions until we no longer qualify as an EGC.

We will maintain our EGC status until the earliest of:

We cannot determine whether investors consider our Ordinary Shares or ADSs less attractive because of our utilization of EGC exemptions, but if they do, we could have reduced demand for our equity securities, resulting in less active trading, reduced liquidity, and greater volatility in quoted prices.

Risks Related to Our ADSs and Ordinary Shares

An active trading market for our ADSs may not develop or be sustained, and investors in our ADSs may not be able to resell those ADSs at or above the price paid for them, if at all. If such a market is sustained, we cannot predict its effect on the trading price of our Ordinary Shares on the Oslo Børs.

Our Ordinary Shares have been traded on Oslo Børs since 2010, and we listed our ADSs on Nasdaq on March 1, 2021. Each ADS represents 75 Ordinary Shares. The average daily trading volume for our Ordinary Shares in 2022 was 4,942,583 shares (253 trading days). In contrast, the average daily trading volume for our ADSs for the same period was 1,539 ADSs (251 trading days), representing 115,392 Ordinary Shares.

There can be no assurance an active trading market for the ADSs will develop or be sustained, and the lack of active trading could limit investor interest in our ADSs. If active trading of our ADSs were to develop on Nasdaq, we cannot predict how such trading would influence the quoted prices for our ADSs, nor can we predict the extent to which trading volumes and quoted prices for ADSs, on Nasdaq, and trading volumes and quoted prices for our Ordinary Shares, on the Oslo Børs, may or may not be correlated.

If equity research analysts do not publish research or reports, or express unfavorable opinions about us, our business, or our targeted market segments, the quoted prices of our equity securities could decline. A sustained decline likely will have a negative influence on our ability to access additional capital on favorable terms, if at all.

The quoted prices and trading volumes of our equity securities are influenced by the research and reports, published by equity research analysts, setting forth opinions about our company, our estimated financial performance, estimated future prices for our equity securities, and many other matters such analysts consider important.

We do not have any control over the analysts, or the content and opinions included in their reports. The quoted price of our equity securities could decline if one or more analysts expresses unfavorable opinions or lowers a previously published estimate of future prices of our equity securities. If one or more analysts ends coverage of us or fails to publish reports on us on a regular basis, demand for our equity securities could decrease, which in turn could cause the trading price or trading volume of our equity securities to decline.

25

Because the quoted prices of our ADSs and Ordinary Shares may be volatile, an investor in our equity securities could incur a rapid and substantial loss.

The quoted prices of our ADSs and our Ordinary Shares may be volatile, with sudden changes to quoted prices and trading volumes, due to numerous factors, some of which are outside of our influence or control. Limited liquidity for investors holding our ADSs is a significant source of price volatility, given a relatively small trading float (i.e., the total number of ADSs held by investors).

In addition to other risk factors discussed herein, such sources of volatility include investor reactions to:

We caution investors to thoughtfully consider the sources and context of information encountered regarding or describing us, particularly if that information is found on social media, Internet investment forums, and other unreliable outlets. While we communicate regularly with investors, securities analysts, the investment press, and trade publications, employ a dedicated investor relations professional supporting the investor communications efforts of our executives, and maintain an active investor relations program coordinated by a third-party professional services firm, we cannot offer assurances regarding our ability, through our communications and investor outreach, to offset the negative influence of rumors, speculative statements, and other unreliable information, which may be associated with those engaged in speculative trading activities.

We cannot accurately predict whether or when the nature of these and other factors may cause the quoted prices or trading volumes of our ADSs or Ordinary Shares to fluctuate substantially, regardless of our actual operating performance, which may limit or prevent investors from selling their ADSs or Ordinary Shares at or above the price paid for such securities and may otherwise negatively affect the liquidity of those securities.

Because we do not anticipate paying any cash dividends on our Ordinary Shares (including Ordinary Shares underlying ADSs), capital appreciation, if any, will be an investor’s sole source of return, and an investor may not receive a return on an investment in our equity securities.

An investment in ADSs should not be made to provide dividend income to the investor. Under current Norwegian law, a public limited liability company may only distribute dividends to the extent it will have net assets covering the company’s share capital and other restricted equity after the dividend distribution has been made. We have never declared or paid a dividend on our Ordinary Shares, and we intend to retain our future net earnings, if any, to fund the expansion of our business. As a result, capital appreciation, if any, will be an investor’s sole source of return for the foreseeable future.

Fluctuations in the exchange rate between the U.S. Dollar and the Norwegian Krone may increase the risk of holding ADSs and Ordinary Shares.

The price of our Ordinary Shares is quoted on the Oslo Børs in Norwegian Krone, while the price of our ADSs is quoted on Nasdaq in U.S. Dollars. Fluctuations in the exchange rate between the U.S. Dollar and the Norwegian Krone may result in differences between the value of our ADSs (each of which represents 75 Ordinary Shares) and the value of our Ordinary Shares, which may result in high trading volumes, as investors seek to exploit such differences.

26

As a result of fluctuations in the exchange rate between the U.S. Dollar and the Norwegian Krone, the U.S. Dollar equivalent of the proceeds a holder of ADSs would receive upon the sale on the Oslo Børs, for Norwegian Krone, of Ordinary Shares withdrawn from the Depositary may fluctuate. Similarly, the U.S. Dollar equivalent of any cash dividends paid by us in Norwegian Krone to holders of Ordinary Shares or Ordinary Shares represented by ADSs held, could also fluctuate.

Raising additional capital likely will dilute the ownership interests of holders of our equity securities. Also, depending on the nature and source of additional capital raised, we may relinquish certain rights to our intellectual property, future revenue streams, or other sources of value.

We are not certain whether or when we will generate sufficient cash flow to offset our costs and accelerate the expansion of our business, nor whether or when we will generate sufficient revenue to achieve or maintain profitability. Because we intend to continue pursuing our strategy in order to achieve expected rapid revenue growth, we anticipate additional capital likely will be required to fund such revenue growth (e.g., funding of increased working capital requirements). However, if we do not meet our current performance forecast, we will require additional funding to support future operating losses.

If we raise capital through issuance of equity securities or convertible debt securities, such issuance will result in dilution of the ownership interests of then-current holders of our equity securities. Also, new investors could gain rights, preferences, and privileges senior to those of then-current holders of our equity securities.

Debt financing and preferred equity financing, if available, could result in fixed payment obligations, and we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity ratios or other financial ratios, or restrict our ability to pay dividends or make acquisitions.

If we raise additional funds through strategic partnerships or alliances, or through marketing, distribution, or licensing arrangements with third parties, we may be required to relinquish valuable rights to our intellectual property, future revenue streams, and development activities, or to grant licenses on terms that may not be favorable to us. In addition, we could also be required to seek funds through arrangements with partners or others at an earlier stage than otherwise would be desirable. If we raise funds through government research grants, as we have, we may be subject to certain requirements limiting our discretionary use of the funds provided or require us to share information from our research and development.

If we are unable to raise additional funds through equity or debt financings when needed, we may be required to delay, limit, reduce, or terminate our product development or future sales and marketing efforts or grant rights to a third-party to develop and market products or software solutions that we would otherwise prefer to develop and market ourselves. Raising additional funds through any of these or other means could adversely affect the rights of the holders of our equity securities and may cause the quoted price of our equity securities to decline.

The rights of holders of our equity securities may differ from the rights typically offered to shareholders of a corporation domiciled in the United States.

We are incorporated under Norwegian law. The rights of holders of Ordinary Shares and, therefore, certain rights of holders of our ADSs, are governed by Norwegian law, including the provisions of the Companies Act and our Articles of Association. These rights differ in certain respects from the rights of shareholders in a corporation domiciled in the United States.

The following summarizes certain important differences in shareholder rights between Norway and the United States:

27

For additional information on these and other aspects of Norwegian corporate law and our Articles of Association, see Exhibit 2.4 (Description of Share Capital and Articles of Association) filed herewith.

As a result of the differences between Norwegian corporate law and our Articles of Association, on the one hand, and United States federal and state laws, on the other hand, in certain instances, an investor could receive less protection as a holder of our equity securities than would be available as a shareholder of a company domiciled in the United States and chartered under the corporate laws of a particular state.

Holders of ADSs have fewer rights than holders of our Ordinary Shares and, to exercise their voting rights, must withdraw underlying Ordinary Shares from the Depositary and temporarily register ownership of those withdrawn Ordinary Shares with the appropriate Norwegian authority.

A single ADS represents a claim on 75 Ordinary Shares held on deposit by the Depositary. Holders of ADSs (and the beneficial owners thereof) do not have the same rights as holders of Ordinary Shares and may only exercise their voting rights with respect to the underlying Ordinary Shares in accordance with the provisions of our deposit agreement with the Depositary and the holders of ADSs (the “Deposit Agreement”). An ADS holder is not able to call for a meeting of shareholders.

The following is an incomplete summary of the procedure to be followed if an ADS holder seeks to exercise his or her voting rights. As this procedure is complex and time-consuming, an ADS holder may encounter difficulties and delays in exercising his or her voting rights, and such delays could result in an ADS holder being unable to do so.

An ADS holder cannot vote underlying Ordinary Shares held by the Depositary at a meeting of shareholders, unless those underlying Ordinary Shares are temporarily registered with the Norwegian Central Securities Depository and with the Norwegian Foreign Registrar in the name of the holder (or the beneficial owner, if the holder is not the beneficial owner). Under the Deposit Agreement, ADS holders may instruct the Depositary how to vote that number of deposited Ordinary Shares underlying their ADS holdings. In order to carry out such instruction, in accordance with current Norwegian law, the Depositary will temporarily re-register the underlying Ordinary Shares in the name of the ADS holder (or beneficial owner), vote those Ordinary Shares as proxy for the holder (or beneficial owner) as instructed, and then cause the Ordinary Shares to be re-registered in the Depositary’s name (or the name of its custodial nominee) immediately after the meeting of shareholders. In giving voting instructions to the Depositary as provided in the Deposit Agreement, ADS holders may be required to agree to the temporary restriction of transfer of their ADSs until after the meeting of shareholders and the disclosure of the identity of the ADS holder.

When a meeting of shareholders is convened, an ADS holder may not receive sufficient notice beforehand to allow the holder to instruct the Depositary to take the actions required in the time available. We will make all commercially reasonable efforts to cause the Depositary to extend voting rights to ADS holders, as described, in a timely manner, but we cannot assure ADS holders they will receive voting materials in time to instruct the Depositary to vote. It is possible that persons who hold their ADSs through securities brokers or other third-parties will not have the opportunity to exercise a right to vote. Furthermore, the Depositary will not be liable for any failure to carry out any instructions to vote, for the manner in which any vote is cast, or for the effect of any such vote. As a result, an ADS holder may not be able to exercise his or her right to vote and may lack recourse if his or her ADSs are not voted as requested.

Investors should review the Deposit Agreement, specifically Section 4.7. Voting of Deposited Shares, which sets forth this procedure in detail. The Deposit Agreement is presented as Exhibit 2.2 to this Annual Report and is archived on the SEC website.

28

The Depositary is entitled to charge ADS holders for various administrative services, including annual service fees. Holders of our Ordinary Shares are not subject to many of these charges.

The Depositary is entitled to charge ADS holders for various administrative services, including for the issuance of ADSs upon deposit of Ordinary Shares, cancellation of ADSs, distributions of cash dividends or other cash distributions, distributions of ADSs pursuant to share dividends, distributions of securities other than ADSs, and annual service fees.

In the case of ADSs held through The Depository Trust Company (“DTC”), the fees will be charged by the DTC participant (e.g., a securities broker) to the account of the applicable beneficial owner in accordance with the procedures and practices of the DTC participant as in effect at the time.

ADS holders may not receive distributions we may make to holders of Ordinary Shares underlying the ADSs held, if the Depositary determines it is illegal or impractical to make such distributions to holders of ADSs.

Although we do not have any present plans to declare or pay any dividends to holders of Ordinary Shares, in the event we do so, the Depositary has agreed to pay to ADS holders the dividends it (or its custodian) receives on Ordinary Shares, after deducting its fees and expenses. An ADS holder will receive such dividends, in proportion to the number of Ordinary Shares underlying the ADSs held, after conversion of the dividend’s value in Norwegian Krone to U.S. Dollars.

The provisions of the Deposit Agreement associated with distributions of cash, securities, subscription rights, and other property are complex and afford the Depositary discretion in decision making, particularly regarding the determination that a distribution is unlawful or impractical. We have no obligation to register with the SEC any ADSs, Ordinary Shares, rights, or other securities received through such distributions. The Depositary may determine a distribution made to the holders of Ordinary Shares may be unlawful or impractical if made to ADS holders, and we have no obligation to take any other action to permit such distribution to ADS holders. As such, an ADS holder is exposed to the risk he or she may not receive distributions we make on our Ordinary Shares, or any value from such distributions, if it is unlawful or impractical to make them available to an ADS holder. These restrictions may have an adverse effect on the value of ADSs.

Holders of the ADSs may not be able to exercise the pre-emptive subscription rights related to underlying Ordinary Shares and, accordingly, may suffer dilution of their equity ownership in the event of future issuances of equity securities.

Under the Companies Act, holders of Ordinary Shares benefit from a pre-emptive subscription right on the issuance of Ordinary Shares, for cash consideration only (and not in the event of issuance of Ordinary Shares against non-cash contributions or debt conversion). Such pre-emptive subscription rights, in the event of issuance of Ordinary Shares for cash proceeds, as in a private placement, may be waived by a resolution of the holders of Ordinary Shares at a general meeting of shareholders representing a majority of two-thirds of the votes cast at such general meeting.

At the extraordinary general meeting of shareholders on December 9, 2022, shareholders agreed to waive their pre-emptive subscription rights with respect to the authorization of our Board to increase capital through issuance of up to 116,632,658 Ordinary Shares. This authorization has not been used by the date of this Annual Report.

Pursuant to the Deposit Agreement, we have no obligation to register with the SEC any subscription rights received through a distribution made to holders of Ordinary Shares. The Depositary may determine such a distribution may be unlawful or impractical if made to ADS holders, and we have no obligation to take any other action to permit such distribution to ADS holders. However, a distribution of pre-emptive subscription rights to holders of Ordinary Shares underlying ADSs may be addressed in a manner of our choice, to the extent permitted by law and subject to the determination of the Depositary that the proposed process is practical. For example, we may instruct the Depositary, to the extent permitted by law, to grant ADS holders rights to instruct the Depositary to purchase the number of Ordinary Shares proportional to the ADSs held (i.e., the number of Ordinary Shares subject to the pre-emptive subscription rights distributed to the Ordinary Shares underlying the ADSs held) and deliver those Ordinary Shares or the proportional number of ADSs to the holder. Alternatively, we may instruct the Depositary, to the extent permitted by law, to (i) deliver the pre-emptive subscription rights to ADS holders, or (ii) to the extent practical, sell such pre-emptive subscription rights and distribute the net proceeds thereof to ADS holders. If any such pre-emptive rights are not so exercised, delivered, or otherwise disposed of, the Depositary is required to permit the rights to lapse unexercised.

29

If we are a deemed a passive foreign investment company, there could be adverse federal income tax consequences for ADS holders that are subject to taxation in the United States.

Under the Internal Revenue Code of 1986, as amended (“IRC”), we will be a passive foreign investment company(“PFIC”), for any taxable year in which (i) 75% or more of our gross income consists of passive income, or (2) 50% or more of the of the gross value our assets (determined on the basis of a weighted quarterly average) consists of assets that produce, or are held for the production of, passive income (including cash). For purposes of these tests, passive income includes dividends, interest, gains from the sale or exchange of investment property, and certain rents and royalties. In addition, for purposes of the above calculations, a foreign domiciled corporation that directly or indirectly owns at least 25%, by value, of the shares of another corporation is treated as if it held its proportionate share of that corporation’s assets and received, directly from that corporation, a proportionate share of its income.

If we are deemed a PFIC for any taxable year during which a “U.S. Holder” (as defined herein in “Item 10. Section E. Taxation”) holds our ADSs, the U.S. Holder may be subject to adverse tax consequences, regardless of whether we continue to qualify as a PFIC, including ineligibility for any preferred tax rates on capital gains or on actual or deemed dividends, interest charges on certain taxes treated as deferred, and additional reporting requirements.

Based on our analysis of our income, assets, activities, and market capitalization, we do not believe we met the tests to be deemed a PFIC for our taxable year ended December 31, 2022. However, no assurances regarding our PFIC status can be provided for any past, current, or future taxable years, as the determination of whether we are a PFIC is a fact-intensive determination, made on an annual basis, and the applicable IRC provisions are subject to varying interpretation. In particular, the characterization of our assets as active or passive may depend in part on our current and intended future business plans, which are subject to change. In addition, for our current and future taxable years, the total value of our assets for PFIC testing purposes may be determined in part by reference to the market price of our Ordinary Shares or ADSs from time to time, which may fluctuate considerably. Under the income test, our status as a PFIC depends on the composition of our income, which will depend on the transactions we enter into in the future, our corporate structure, and other considerations. The composition of our income and assets is also influenced by how, and at what pace, we spend the cash we raise through issuance of securities or borrowing. Even if we determine that we are not a PFIC for a taxable year, there can be no assurance that the Internal Revenue Service (“IRS”), will agree with our conclusion and that the IRS would not successfully challenge our position. Accordingly, our U.S. counsel expresses no opinion with respect to our PFIC status for any prior, current, or future taxable year.

For further discussion of the PFIC rules and the adverse federal income tax consequences in the event we are deemed a PFIC, see the section herein under “Item 10. Section E. Taxation.”

Changes and uncertainties in the tax system in the countries in which we have operations could have an adverse effect our business, operational performance, and financial position, potentially reducing the net returns available to holders of our equity securities.

We conduct business globally and file income tax returns in multiple jurisdictions. Our consolidated effective income tax rate could be materially adversely affected by several factors, including: changing tax laws, regulations and treaties, or the interpretation thereof; tax policy initiatives and reforms under consideration (such as those related to the Organisation for Economic Co-Operation and Development’s (“OECD”), Base Erosion and Profit Shifting Project, the European Commission’s state aid investigations and other initiatives); the practices of tax authorities in jurisdictions in which we operate; the resolution of issues arising from tax audits or examinations and any related interest or penalties. Such changes may include (but are not limited to) the taxation of operating income, investment income, dividends received or (in the specific context of withholding tax) dividends paid.

Tax authorities may disagree with our positions and conclusions regarding certain tax positions, or may apply existing rules in an unforeseen manner, resulting in unanticipated costs, taxes, penalties, or the non-realization of expected benefits.

A tax authority may disagree with tax positions we have taken, which could result in increased tax liabilities. For example, a tax authority could challenge our allocation of income by tax jurisdiction and the amounts paid between our affiliated companies, pursuant to our intercompany arrangements and transfer pricing policies, including amounts paid with respect to our intellectual property development. Similarly, a tax authority could assert that we are subject to tax in a jurisdiction where we believe we have not established a taxable connection, often referred to as a ‘‘permanent establishment’’ under international tax treaties, and such an assertion, if successful, could increase our expected tax liability in one or more jurisdictions.

A tax authority may take the position that material income tax liabilities, interest, and penalties are payable by us, which may occur due to complex and changing tax laws and regulations may be contradictory, as new laws and regulations have not been subject to extensive review or interpretation. We may negotiate tax obligations with tax inspectors of a particular jurisdiction, which may be costly, time-consuming, and subject to an unpredictable outcome.

30

Provisions of the Norwegian Securities Trading Act may delay or discourage a takeover attempt, including attempts that may be beneficial to holders of our ADSs.

We are subject to the Norwegian Securities Trading Act (the “STA”), as it applies to an offer made by a third-party to acquire the equity securities of a Norwegian public company with securities trading on a regulated Norwegian exchange. The STA provides a framework within which takeovers of certain companies organized in Norway are regulated and conducted. The provisions of the STA may materially differ from the provisions of other such frameworks (e.g., the takeover provisions of the Delaware General Corporate Law).

The following is a limited summary of important rules of the STA:

Civil liabilities judgements made in United States courts may not be enforceable against us.

We are incorporated under Norwegian law. Certain Directors and executive officers are not residents of the United States, and all or a substantial portion of our assets and the assets of such persons are located outside the United States. As a result, it may not be possible for investors to effect service of process in the United States upon us or such persons or to enforce judgments obtained in courts in the United States against them or us, including judgments predicated upon the civil liability provisions of the federal securities laws.

31

The United States and Norway currently do not have a treaty providing for recognition and enforcement of judgments (other than arbitration awards) in civil and commercial matters. Consequently, a final judgment for payment given by a court in the United States, whether or not predicated solely upon the securities laws of the United States, may not automatically be recognized or enforceable in Norway. In addition, uncertainty exists as to whether the courts in Norway would entertain original actions brought in Norway against us, our Board , or Executive Officers predicated upon the securities laws of any state in the United States.

Any final and conclusive monetary judgment for a definite sum obtained against us in the United States would not be automatically recognized by Norwegian courts, unless: (i) the relevant parties have agreed to such court’s jurisdiction in writing and for a specific legal action or for legal actions that arise out of a particular legal relationship; and (ii) the judgment is not in conflict with Norwegian public policy rules (ordre public) or internationally mandatory provisions. Instead, new proceedings would need to be initiated before the competent court in Norway. However, a judgment obtained in the United States may still have strong evidentiary weight in the Norwegian proceedings, depending on the circumstances and the assessment of the court. If the conditions for recognition of a judgement against us in the United States are satisfied, or a Norwegian court rules for the sum payable under such judgment, the judgement or the Norwegian ruling (as the case may be) will be enforceable by methods generally available for this purpose. These methods generally permit the Norwegian court discretion to prescribe the manner of enforcement. In addition, it may not be possible to obtain a Norwegian ruling or to enforce that ruling if the party subject to the ruling is or becomes subject to any insolvency or similar proceedings, or in other circumstances.

As a result, United States investors may not be able to enforce any judgments against us or certain Directors and our Executive Officers obtained in courts of the United States in civil and commercial matters, including judgments under the federal securities laws.

Holders of ADSs may not be entitled to a jury trial with respect to claims arising under the Deposit Agreement, which could result in less favorable results to a plaintiff in any such action.

The Deposit Agreement provides that ADS holders irrevocably waive the right to a trial by jury in any legal proceeding arising out of or relating to the Deposit Agreement. We are not aware of a specific federal decision addressing the enforceability of a jury trial waiver in the context of federal securities laws, and we have been advised by counsel that jury trial waivers are generally enforceable in the United States. Moreover, insofar as the Deposit Agreement is governed by the laws of the State of New York, such laws recognize the validity of jury trial waivers in appropriate circumstances. In determining whether to enforce a jury trial waiver provision, New York courts and federal courts likely will consider whether the visibility of the jury trial waiver provision within the agreement in question is sufficiently prominent, such that a party has knowingly waived any right to trial by jury. We believe that this is the case with respect to the Deposit Agreement.

Because an ADS holder may not be entitled to a jury trial with respect to his or her claims arising under the Deposit Agreement against us or the Depositary, lawsuits against us or the Depositary may be discouraged or limited. If a lawsuit is brought against us or the Depositary under the Deposit Agreement, the proceedings may be heard only by a judge or justice of the applicable trial court, which would be conducted according to different civil procedures than a jury trial and may result in different outcomes than a jury trial, including results that could be less favorable to the plaintiff(s) in any such action, depending on, among other things, the nature of the claims, the judge or justice hearing such claims, and the venue of the hearing.

32