Item 1A. Risk Factors .

RISK FACTORS

Strategic Business Risk and Competitive Environment

Our 10 largest clients represented 33% and 35%, respectively, of our consolidated revenue for the years ended December 31, 2017 and 2016, and the loss of any of these clients could cause a significant drop in our revenue.

We depend on a limited number of large clients for a significant portion of our consolidated revenue. Our 10 largest clients represented approximately 33% and 35%, respectively, of our consolidated revenue during the years ended December 31, 2017 and 2016, with no single client representing more than 10% of our consolidated revenue during either of these periods. A decrease in revenue from any of our significant clients for any reason, including a decrease in pricing or activity, or a decision either to utilize another service provider or to no longer outsource some or all of the services we provide, could have a material adverse effect on our consolidated revenue.

LoyaltyOne . LoyaltyOne represents 17% and 19%, respectively, of our consolidated revenue for the years ended December 31, 2017 and 2016. Our 10 largest clients in this segment represented approximately 59% and 54%, respectively, of our LoyaltyOne revenue for the years ended December 31, 2017 and 2016. Bank of Montreal represented approximately 21% and 17%, respectively, of this segment’s revenue for the years ended December 31, 2017 and 2016. Sobeys Inc. and its retail affiliates represented approximately 14% and 13%, respectively, of this segment’s revenue for the years ended December 31, 2017 and 2016. Our contract with Bank of Montreal expires in 2020, subject to automatic renewals. Our contract with Sobeys Inc. and its retail affiliates expires in 2024.

Epsilon . Epsilon represents 29% and 30%, respectively, of our consolidated revenue for the years ended December 31, 2017 and 2016. Our 10 largest clients in this segment represented approximately 32% and 30%, respectively, of our Epsilon revenue for the years ended December 31, 2017 and 2016, with no single client representing more than 10% of Epsilon’s revenue during either of these periods.

Card Services . Card Services represents 54% and 51%, respectively, of our consolidated revenue for the years ended December 31, 2017 and 2016. Our 10 largest clients in this segment represented approximately 52% and 59%, respectively, of our Card Services revenue for the years ended December 31, 2017 and 2016. L Brands and its retail affiliates represented approximately 16% of this segment’s revenue for each of the years ended December 31, 2017 and 2016. Ascena Retail Group, Inc. and its retail affiliates represented approximately 13% of this segment’s revenue for the year ended December 31, 2016. Our contract with L Brands and its retail affiliates expires in 2019. Our contracts with Ascena Retail Group, Inc. and its retail affiliates expire in 2019 and 2022.

We expect growth in our Card Services segment to result from new and acquired credit card programs whose credit card receivables performance could result in increased portfolio losses and negatively impact our profitability.

We expect an important source of growth in our credit card operations to come from the acquisition of existing credit card programs and initiating credit card programs with retailers and others who do not currently offer a private label or co-brand credit card. Although we believe our pricing and models for determining credit risk are designed to evaluate the credit risk of existing programs and the credit risk we are willing to assume for acquired and start-up programs, we cannot be assured that the loss experience on acquired and start-up programs will be consistent with our more established programs. The failure to successfully underwrite these credit card programs may result in defaults greater than our expectations and could have a material adverse impact on us and our profitability.

Increases in net charge-offs could have a negative impact on our net income and profitability.

The primary risk associated with unsecured consumer lending is the risk of default or bankruptcy of the borrower, resulting in the borrower’s balance being charged-off as uncollectible. We rely principally on the customer’s creditworthiness for repayment of the loan and therefore have no other recourse for collection. We may not be able to successfully identify and evaluate the creditworthiness of cardholders to minimize delinquencies and losses. An increase in defaults or net charge-offs could result in a reduction in net income. General economic factors, such as the rate of inflation, unemployment levels and interest rates, may result in greater delinquencies that lead to greater credit losses. In addition to being affected by general economic conditions and the success of our collection and recovery efforts, the

stability of our delinquency and net charge-off rates are affected by the credit risk of our credit card and loan receivables and the average age of our various credit card account portfolios. Further, our pricing strategy may not offset the negative impact on profitability caused by increases in delinquencies and losses, thus any material increases in delinquencies and losses beyond our current estimates could have a material adverse impact on us. For 2017, our net charge-off rate was 6.0%, compared to 5.1% and 4.5% for 2016 and 2015, respectively. Delinquency rates were 5.1% of principal credit card and loan receivables at December 31, 2017, compared to 4.8% and 4.2% at December 31, 2016 and 2015, respectively.

If actual redemptions by AIR MILES Reward Program collectors are greater than expected, or if the costs related to redemption of AIR MILES reward miles increase, our profitability could be adversely affected.

A portion of our revenue is based on our estimate of the number of AIR MILES reward miles that will go unused by the collector base. The percentage of AIR MILES reward miles not expected to be redeemed is known as “breakage.”

Breakage is based on management’s estimate after viewing and analyzing various historical trends including vintage analysis, current run rates and other pertinent factors, such as the impact of macroeconomic factors and changes in the program structure, the introduction of new program options and changes to rewards offered. Any significant change in or failure by management to reasonably estimate breakage, or if actual redemptions are greater than our estimates, our profitability could be adversely affected.

Our AIR MILES Reward Program also exposes us to risks arising from potentially increasing reward costs. Our profitability could be adversely affected if costs related to redemption of AIR MILES reward miles increase. A 10% increase in the cost of redemptions would have resulted in a decrease in pre-tax income of $34.2 million for the year ended December 31, 2017.

The loss of our most active AIR MILES Reward Program collectors could adversely affect our growth and profitability.

Our most active AIR MILES Reward Program collectors drive a disproportionately large percentage of our AIR MILES Reward Program revenue. The loss of a significant portion of these collectors, for any reason, could impact our ability to generate significant revenue from sponsors. The continued attractiveness of our loyalty and rewards programs will depend in large part on our ability to remain affiliated with sponsors that are desirable to collectors and to offer rewards that are both attainable and attractive.

Airline or travel industry disruptions, such as an airline insolvency, could negatively affect the AIR MILES Reward Program, our revenues and profitability.

Air travel is one of the appeals of the AIR MILES Reward Program to collectors. As a result of airline insolvencies and restructurings, we may experience service disruptions that prevent us from fulfilling collectors’ flight redemption requests. If one of our existing airline suppliers sharply reduces its fleet capacity and route network, we may not be able to satisfy our collectors’ demands for airline tickets. Tickets from other airlines, if available, could be more expensive than a comparable ticket under our current supply agreements with existing suppliers, and the routes offered by the other airlines may be inadequate, inconvenient or undesirable to the redeeming collectors. As a result, we may experience higher air travel redemption costs, and collector satisfaction with the AIR MILES Reward Program might be adversely affected.

As a result of airline or travel industry disruptions, political instability, terrorist acts or war, some collectors could determine that air travel is too dangerous or burdensome. Consequently, collectors might forego redeeming AIR MILES reward miles for air travel and therefore might not participate in the AIR MILES Reward Program to the extent they previously did, which could adversely affect our revenue from the program.

If we fail to identify suitable acquisition candidates or new business opportunities, or to integrate the businesses we acquire, it could negatively affect our business.

Historically, we have engaged in a significant number of acquisitions, and those acquisitions have contributed to our growth in revenue and profitability. We believe that acquisitions and the identification and pursuit of new business opportunities will be a key component of our continued growth strategy. However, we may not be able to locate and

secure future acquisition candidates or to identify and implement new business opportunities on terms and conditions that are acceptable to us. If we are unable to identify attractive acquisition candidates or successful new business opportunities, our growth could be impaired.

In addition, there are numerous risks associated with acquisitions and the implementation of new businesses, including, but not limited to:

Furthermore, acquisitions that we make may not be successfully integrated into our ongoing operations and we may not achieve expected cost savings or other synergies from an acquisition. If the operations of an acquired or new business do not meet expectations, our profitability may decline and we may seek to restructure the acquired business or impair the value of some or all of the assets of the acquired or new business.

The markets for the services that we offer may contract or fail to expand which could negatively impact our growth and profitability.

Our growth and continued profitability depend on acceptance of the services that we offer. Our clients may not continue to use the loyalty and targeted marketing strategies and programs that we offer. Changes in technology may enable merchants and retail companies to directly process transactions in a cost-efficient manner without the use of our services. Additionally, downturns in the economy or the performance of retailers may result in a decrease in the demand for our marketing strategies. Any decrease in the demand for our services for the reasons discussed above or any other reasons could have a material adverse effect on our growth, revenue and operating results.

Competition in our industries is intense and we expect it to intensify.

The markets for our products and services are highly competitive and we expect competition to intensify in each of those markets. Some of our current competitors have longer operating histories, stronger brand names and greater financial, technical, marketing and other resources than we do. Certain of our segments also compete against in-house staffs of our current clients and others or internally developed products and services by our current clients and others. Our ability to generate significant revenue from clients and partners will depend on our ability to differentiate ourselves through the products and services we provide and the attractiveness of our programs to consumers. We may not be able to continue to compete successfully against our current and potential competitors.

Liquidity, Market and Credit Risk

Interest rate increases on our variable rate debt could materially adversely affect our profitability.

Interest rate risk affects us directly in our borrowing activities. Our interest expense, net was $564.4 million for the year ended December 31, 2017. To manage our risk from market interest rates, we actively monitor the interest rates and the interest sensitive components to minimize the impact that changes in interest rates have on the fair value of assets, net income and cash flow. In 2017, a 1% increase or decrease in interest rates would have resulted in a change to our interest expense of approximately $112 million.

If we are unable to securitize our credit card receivables due to changes in the market, we may not be able to fund new credit card receivables, which would have a negative impact on our operations and profitability.

A number of factors affect our ability to fund our receivables in the securitization market, some of which are beyond our control, including:

In addition, on August 27, 2014, the SEC adopted a number of rules that will change the disclosure, reporting and offering process for publicly registered offerings of asset-backed securities, including those offered under our credit card securitization program. The adopted rules finalize rules that were originally proposed on April 7, 2010 and re-proposed on July 26, 2011. A number of rules proposed by the SEC in 2010 and 2011, such as requiring group-level data for the underlying assets in credit card securitizations, were not adopted in the final rulemaking but may be adopted by the SEC in the future with or without further modifications. The adoption of further rules affecting disclosure, reporting and the offering process for publicly registered offerings of asset-backed securities may impact our ability or desire to issue asset-backed securities in the future.

The FDIC, the SEC, the Federal Reserve and certain other federal regulators have adopted regulations, commonly known as Regulation RR, that mandate a minimum five percent risk retention requirement for securitizations that are issued on and after December 24, 2016. Such risk retention requirements may limit our liquidity by restricting the amount of asset-backed securities we are able to issue or affecting the timing of future issuances of asset-backed securities; we intend to satisfy such risk retention requirements by maintaining a seller’s interest calculated in accordance with Regulation RR.

Early amortization events may occur as a result of certain adverse events specified for each asset-backed securitization transaction, including, among others, deteriorating asset performance or material servicing defaults. In addition, certain series of funding notes issued by our securitization trusts are subject to early amortization based on triggers relating to the bankruptcy of one or more retailers. Deteriorating economic conditions and increased competition in the retail industry, among other factors, may lead to an increase in bankruptcies among retailers who have entered into credit card programs with us. The bankruptcy of one or more retailers could lead to a decline in the amount of new receivables and could lead to increased delinquencies and defaults on the associated receivables. Any of these effects of a retailer bankruptcy could result in the commencement of an early amortization for one or more series of such funding securities, particularly if such an event were to occur with respect to a retailer relating to a large percentage of such securitization trust’s assets. The occurrence of an early amortization event may significantly limit our ability to securitize additional receivables.

As a result of Basel III, which refers generally to a set of regulatory reforms adopted in the U.S. and internationally that are meant to address issues that arose in the banking sector during the recent financial crisis, banks are becoming subject to more stringent capital, liquidity and leverage requirements. In response to Basel III, investors of our securitization trusts’ funding securities have sought and obtained amendments to their respective transaction documents permitting them to delay disbursement of funding increases by up to 35 days. Although funding may be requested from other investors who have not delayed their funding, access to financing could be disrupted if all of the investors implement such delays or if the lending capacities of those who did not do so were insufficient to make up the shortfall. In addition, excess spread may be affected if the issuing entity’s borrowing costs increase as a result of Basel III. Such cost increases may result, for example, because the investors are entitled to indemnification for increased costs resulting from such regulatory changes.

The inability to securitize card receivables due to changes in the market, regulatory proposals, the unavailability of credit enhancements, or any other circumstance or event would have a material adverse effect on our operations and profitability.

Our level of indebtedness could materially adversely affect our ability to generate sufficient cash to repay our outstanding debt, our ability to react to changes in our business and our ability to incur additional indebtedness to fund future needs.

We have a high level of indebtedness, which requires a high level of interest and principal payments. Subject to the limits contained in our credit agreement, the indentures governing our senior notes and our other debt instruments, we may be able to incur substantial additional indebtedness from time to time to finance working capital, capital expenditures, investments or acquisitions, or for other purposes. If we do so, the risks related to our level of indebtedness could intensify. Our level of indebtedness increases the possibility that we may be unable to generate cash sufficient to pay, when due, the principal of, interest on or other amounts due in respect of our indebtedness. Our higher level of indebtedness, combined with our other financial obligations and contractual commitments, could:

Future sales of our common stock, or the perception that future sales could occur, may adversely affect our common stock price.

As of February 21, 2018, we had an aggregate of 80,414,831 shares of our common stock authorized but unissued and not reserved for specific purposes. In general, we may issue all of these shares without any action or approval by our stockholders. We have reserved 6,638,165 shares of our common stock for issuance under our employee stock purchase plan and our long-term incentive plans, of which 531,501 shares have been issued and 864,713 shares are issuable upon vesting of restricted stock awards, restricted stock units, and upon exercise of options granted as of February 21, 2018, including options to purchase approximately 11,513 shares exercisable as of February 21, 2018 or that will become exercisable within 60 days after February 21, 2018. We have reserved for issuance 1,500,000 shares of our common stock, 568,045 of which remain issuable, under our 401(k) and Retirement Savings Plan as of December 31, 2017. In addition, we may pursue acquisitions of competitors and related businesses and may issue shares of our common stock in connection with these acquisitions. Sales or issuances of a substantial number of shares of common stock, or the perception that such sales could occur, could adversely affect prevailing market prices of our common stock, and any sale or issuance of our common stock will dilute the ownership interests of existing stockholders.

The market price and trading volume of our common stock may be volatile and our stock price could decline.

The trading price of shares of our common stock has from time to time fluctuated widely and in the future may be subject to similar fluctuations. The trading price of our common stock may be affected by a number of factors, including our operating results, changes in our earnings estimates, additions or departures of key personnel, our financial condition, legislative and regulatory changes, general conditions in the industries in which we operate, general economic conditions, and general conditions in the securities markets. Other risks described in this report could also materially and adversely affect our share price.

There is no guarantee that we will pay future dividends or repurchase shares at a level anticipated by stockholders, which could reduce returns to our stockholders. Decisions to declare future dividends on, or repurchase, our common stock will be at the discretion of our Board of Directors based upon a review of relevant considerations.

Since October 2016, our Board of Directors has declared quarterly cash dividend payments on our outstanding common stock. Future declarations of quarterly dividends and the establishment of future record and payment dates are subject to approval by our Board of Directors. Since 2001, our Board of Directors has approved various share repurchase programs, including the share repurchase program approved in 2017 for the repurchase of up to $1 billion of our common stock through July 31, 2018. The Board’s determination to declare dividends on, or repurchase shares of, our common stock will depend upon our profitability and financial condition, contractual restrictions, restrictions imposed by applicable law and other factors that the board deems relevant. Based on an evaluation of these factors, the Board of Directors may determine not to declare future dividends at all, to declare future dividends at a reduced amount, not to repurchase shares or to repurchase shares at reduced levels compared to historical levels, any or all of which could reduce returns to our stockholders.

Our reported financial information will be affected by fluctuations in the exchange rate between the U.S. dollar and certain foreign currencies.

The results of our operations are exposed to foreign exchange rate fluctuations. We are exposed primarily to fluctuations in the exchange rate between the U.S. and Canadian dollars and the exchange rate between the U.S. dollar and the Euro. Upon translation, operating results may differ from our expectations. As we have expanded our international operations, our exposure to exchange rate fluctuations has increased. For the year ended December 31, 2017, foreign currency movements relative to the U.S. dollar positively impacted our revenue by approximately $27 million and positively impacted income before income taxes by approximately $3 million.

Regulatory Environment

Current and proposed regulation and legislation relating to our card services could limit our business activities, product offerings and fees charged and may have a significant impact on our business, results of operations and financial condition.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), among other things, includes a sweeping reform of the regulation and supervision of financial institutions, as well as of the regulation of derivatives and capital market activities.

The full impact of the Dodd-Frank Act is difficult to assess because many provisions require federal agencies to adopt implementing regulations, and some of the final implementing regulations have not yet been issued. In addition, the Dodd-Frank Act mandates multiple studies, which could result in future legislative or regulatory action. In particular, the Government Accountability Office issued its study on whether it is necessary, in order to strengthen the safety and soundness of institutions or the stability of the financial system of the United States, to eliminate the exemptions to the definition of "bank" under the Bank Holding Company Act for certain institutions including limited purpose credit card banks and industrial loan companies. The study did not recommend the elimination of these exemptions. However, if legislation were enacted to eliminate these exemptions without any grandfathering of or accommodations for existing institutions, we could be required to become a bank holding company and cease certain of our activities that are not permissible for bank holding companies or divest our credit card bank subsidiary, Comenity Bank, or our industrial bank subsidiary, Comenity Capital Bank.

The Dodd-Frank Act created the CFPB, a federal consumer protection regulator with authority to make further changes to the federal consumer protection laws and regulations. The CFPB assumed rulemaking authority under the existing federal consumer financial protection laws, and enforces those laws against and examines certain non-depository institutions and insured depository institutions with total assets greater than $10 billion and their affiliates.

As of October 1, 2016, both Comenity Bank and Comenity Capital Bank are under the CFPB’s supervision and the CFPB may, from time to time, conduct reviews of their practices. In addition, the CFPB's broad rulemaking authority is expected to impact their operations, including with respect to deferred interest products. For example, the CFPB's rulemaking authority may allow it to change regulations adopted in the past by other regulators including regulations issued under the Truth in Lending Act or the CARD Act by the Board of Governors of the Federal Reserve System. The CFPB's ability to rescind, modify or interpret past regulatory guidance could increase our compliance costs and litigation exposure. Further, the CFPB has broad authority to prevent "unfair, deceptive or abusive" acts or practices and has taken enforcement action against other credit card issuers and financial services companies. Evolution of these standards could result in changes to pricing, practices, procedures and other activities relating to our credit card accounts in ways that could reduce the associated return. It is unclear what changes would be promulgated by the CFPB and what effect, if any, such changes would have on our credit accounts.

The Dodd-Frank Act authorizes certain state officials to enforce regulations issued by the CFPB and to enforce the Dodd-Frank Act's general prohibition against unfair, deceptive or abusive practices. To the extent that states enact requirements that differ from federal standards or courts adopt interpretations of federal consumer laws that differ from those adopted by the federal banking agencies, we may be required to alter products or services offered in some jurisdictions or cease offering products, which will increase compliance costs and reduce our ability to offer the same products and services to consumers nationwide.

Various federal and state laws and regulations significantly limit the retail credit card services activities in which we are permitted to engage. Such laws and regulations, among other things, limit the fees and other charges that we can impose on consumers, limit or proscribe certain other terms of our products and services, require specified disclosures to consumers, or require that we maintain certain licenses, qualifications and minimum capital levels. In some cases, the precise application of these statutes and regulations is not clear. In addition, numerous legislative and regulatory proposals are advanced each year which, if adopted, could have a material adverse effect on our profitability or further restrict the manner in which we conduct our activities. The CARD Act acts to limit or modify certain credit card practices and requires increased disclosures to consumers. The credit card practices addressed by the rules include, but are not limited to, restrictions on the application of rate increases to existing and new balances, payment allocation, default pricing, imposition of late fees and two-cycle billing. The failure to comply with, or adverse changes in, the laws or regulations to which our business is subject, or adverse changes in their interpretation, could have a material adverse effect on our ability to collect our receivables and generate fees on the receivables, thereby adversely affecting our profitability.

In the normal course of business, from time to time, Comenity Bank and Comenity Capital Bank have been named as defendants in various legal actions, including arbitrations, class actions and other litigation arising in connection with their business activities. While historically the arbitration provision in each bank's customer agreement has generally limited such bank's exposure to consumer class action litigation, there can be no assurance that the banks will be successful in enforcing the arbitration clause in the future. There may also be legislative, administrative or regulatory efforts to directly or indirectly prohibit the use of pre-dispute arbitration clauses.

Comenity Bank and Comenity Capital Bank are also involved, from time to time, in reviews, investigations, and proceedings (both formal and informal) by governmental agencies regarding the bank's business, which could subject the bank to significant fines, penalties, obligations to change its business practices or other requirements. In September 2015, each bank entered into a consent order with the FDIC agreeing to provide restitution to eligible customers, to pay civil money penalties to the FDIC and to make further enhancements to their compliance and other processes related to the marketing, promotion and sale of add-on products.

The effect of the Dodd-Frank Act on our business and operations could be significant, depending upon final implementing regulations, the actions of our competitors, the behavior of other marketplace participants and its interpretation and enforcement by federal or state officials or regulators. In addition, we may be required to invest significant management time and resources to address the various provisions of the Dodd-Frank Act and the numerous regulations that are required to be issued under it. The Dodd-Frank Act and any related legislation or regulations and their interpretation and enforcement may have a material impact on our business, results of operations and financial condition.

Legislation relating to consumer privacy and security may affect our ability to collect data that we use in providing our loyalty and marketing services, which, among other things, could negatively affect our ability to satisfy our clients’ needs.

The evolution of legal standards and regulations around data protection and consumer privacy may affect our business. The enactment of new or amended legislation or industry regulations pertaining to consumer, public or private sector privacy issues could have a material adverse impact on our marketing services, including placing restrictions upon the collection, sharing and use of information that is currently legally available. This, in turn, could materially increase our cost of collecting certain data. These types of legislation or industry regulations could also prohibit us from collecting or disseminating certain types of data, which could adversely affect our ability to meet our clients’ requirements and our profitability and cash flow targets. In addition to the United States, Canadian and European Union regulations discussed below, we have expanded our marketing services through the acquisition of companies formed and operating in foreign jurisdictions that may be subject to additional or more stringent legislation and regulations regarding consumer or private sector privacy.

There are also a number of specific laws and regulations governing the collection and use of certain types of consumer data that are relevant to our various business and services. In the United States, federal and state laws such as the federal Gramm-Leach-Bliley Act and the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003, make it more difficult to collect, share and use information that has previously been legally available and may increase our costs of collecting some data. Regulations under these acts give cardholders the ability to “opt out” of having information generated by their credit card purchases shared with other affiliated and unaffiliated parties or the public. Our ability to gather, share and utilize this data will be adversely affected if a significant percentage of the consumers whose purchasing behavior we track elect to “opt out,” thereby precluding us and our affiliates from using their data.

In the United States, the federal Do-Not-Call Implementation Act makes it more difficult to telephonically communicate with prospective and existing customers. Similar measures were implemented in Canada beginning September 1, 2008. Regulations in both the United States and Canada give consumers the ability to “opt out,” through a national do-not-call registry and state do-not-call registries of having telephone solicitations placed to them by companies that do not have an existing business relationship with the consumer. In addition, regulations require companies to maintain an internal do-not-call list for those who do not want the companies to solicit them through telemarketing. These regulations could limit our ability to provide services and information to our clients. Failure to comply with these regulations could have a negative impact on our reputation and subject us to significant penalties. Further, the Federal Communications Commission has approved interpretations of rules related to the Telephone Consumer Protection Act defining robo-calls broadly, which may affect our ability to contact customers and may increase our litigation exposure.

In the United States, the federal Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 restricts our ability to send commercial electronic mail messages, the primary purpose of which is advertising or promoting a commercial product or service, to our customers and prospective customers. The act requires that a commercial electronic mail message provide the customers with an opportunity to opt-out from receiving future commercial electronic mail messages from the sender. Failure to comply with the terms of this act could have a negative impact on our reputation and subject us to significant penalties.

Further, many state governments are reviewing or proposing the need for greater regulation of the collection, processing, sharing and use of consumer data for various marketing purposes. This may result in new laws or regulations imposing additional compliance requirements.

In Canada, the Personal Information Protection and Electronic Documents Act requires an organization to obtain a consumer’s consent to collect, use or disclose personal information. Under this act, consumer personal information may be used only for the purposes for which it was collected. We allow our customers to voluntarily “opt out” from receiving either one or both promotional and marketing mail or promotional and marketing electronic mail. Heightened consumer awareness of, and concern about, privacy may result in customers “opting out” at higher rates than they have historically. This would mean that a reduced number of customers would receive bonus and promotional offers and therefore those customers may collect fewer AIR MILES reward miles.

Canada’s Anti-Spam Legislation may restrict our ability to send commercial “electronic messages,” defined to include text, sound, voice and image messages to email, or similar accounts, where the primary purpose is advertising or promoting a commercial product or service to our customers and prospective customers. The Act requires, in part, that a sender have consent to send a commercial electronic message, and provide the customers with an opportunity to opt out from receiving future commercial electronic email messages from the sender. Failure to comply with the terms of this Act or any proposed regulations that may be adopted in the future could have a negative impact on our reputation and subject us to significant monetary penalties.

In the European Union, the Directive 95/46/EC of the EU Parliament and of the Council of 24 October 1995 requires member states to implement and enforce a comprehensive data protection law that is based on principles designed to safeguard personal data, defined as any information relating to an identified or identifiable natural person. The Directive frames certain requirements for transfer outside of the European Economic Area and individual rights such as consent requirements. In January 2012, the European Commission proposed the General Data Protection Regulation, or GDPR, a new European Union-wide legal framework to govern data collection, use and sharing and related consumer privacy rights. In December 2015, the EU Parliament and the EU Council reached informal agreement on the text of the GDPR, and in April 2016 both the EU Council and the EU Parliament adopted the GDPR, which will go into effect May 25, 2018. The GDPR will replace the Directive and, because it is a regulation rather than a directive, will directly apply to and bind the 28 EU Member States. Compared to the Directive, GDPR may result in greater compliance obligations, including the implementation of a number of processes and policies around our data collection and use. These and other terms of the GDPR could limit our ability to provide services and information to our customers. In addition, the GDPR includes significant new penalties for non-compliance, with fines up to the higher of €20 million ($24 million as of December 31, 2017) or 4% of total annual worldwide revenue.

Further, the European Union has also released a draft of the proposed reforms to the ePrivacy Directive that governs the use of technologies to collect consumer information. In general, GDPR, and other local privacy laws, could also lead to adaptation of our technologies or practices to satisfy local privacy requirements and standards that may be more stringent than in the U.S. Similarly, it is possible that in the future, U.S. and foreign jurisdictions may adopt legislation or regulations that impair our ability to effectively track consumers’ use of our advertising services, such as the FTC’s proposed “Do-Not-Track” standard or other legislation or regulations similar to EU Directive 2009/136/EC, commonly referred to as the “Cookie Directive,” which directs EU Member States to ensure that accessing information on an internet user’s computer, such as through a cookie, is allowed only if the internet user has given his or her consent.

In addition, in 2016, the EU-US Safe Harbor program (“Safe Harbor”) was held to be invalid. Safe Harbor provided a valid legal basis for transfers of personal data from Europe Union to the United States. While we have other legally recognized mechanisms in place that we believe allow for the transfer of customer and employee data from the European Union to the United States, these mechanisms are also being challenged. Further, some of these mechanisms are set to be updated and changed under GDPR. These changes may include new legal requirements that could have an impact on how we move data from the European Union to entities outside the European Union, including to our affiliates or vendors.

There is also rapid development of new privacy laws and regulations in the Asia Pacific region and elsewhere around the globe, including amendments of existing data protection laws to the scope of such laws and penalties for noncompliance. Failure to comply with these international data protection laws and regulations could have a negative impact on our reputation and subject us to significant penalties.

While 48 U.S. states and the District of Columbia have enacted data breach notification laws, there is no such federal law generally applicable to our businesses. Data breach notification legislation has been proposed widely and exists in specific countries and jurisdictions in which we conduct business. If, when and as enacted, these legislative measures could impose, among other elements, strict requirements on reporting time frames for providing notice, as well as the contents of such notices. 

Legislation relating to consumer protection may affect our ability to provide our loyalty and marketing services, which, among other things, could negatively affect our ability to satisfy our clients’ needs.

The enactment of new or amended legislation or industry regulations pertaining to consumer protection could have a material adverse impact on our loyalty and marketing services. On December 5, 2016, the Ontario, Canada Legislature passed Bill 47, Protecting Rewards Points Act (Consumer Protection Amendment), 2016, amending Ontario’s Consumer Protection Act, 2002 with respect to rewards points. The amendments became effective on December 8, 2016, and additional related regulations were made effective on January 1, 2018. Changes to the Ontario Consumer Protection Act effected by the amendments and related regulations prohibit suppliers from entering into or amending consumer agreements to provide for the expiry of rewards points due to the passage of time alone, while permitting the expiry of rewards points if the underlying consumer agreement is terminated and that agreement provides that reward points expire upon termination. Accordingly, the Ontario Consumer Protection Act, as amended, does not impact LoyaltyOne’s practice of terminating a collector’s account and cancelling their AIR MILES reward miles after two years of inactivity.

In Quebec, similar legislation pertaining to the expiry of rewards points due to the passage of time alone was passed in 2017, subject to additional related regulations currently being proposed for implementation. Additional changes to consumer protection laws and regulations, or any failure to comply with such changes, could have a negative impact on our reputation, adversely affect our profitability and may increase our litigation exposure.

Technologies have been developed that can block the display of ads we serve for clients, which could limit our product offerings and adversely impact our financial results.

Technologies have been developed, and will likely continue to be developed, that can block the display of ads we serve for our clients, particularly advertising displayed on personal computers. Ad blockers, cookie blocking, and tracking protection lists (TPLs) are being offered by browser agents and device manufacturers to prevent ads from being displayed to consumers. We generate revenue from online advertising, including revenue resulting from the display of ads on personal computers. Revenue generated from the display of ads on personal computers has been impacted by these technologies from time to time. If these technologies continue to proliferate, in particular with respect to mobile platforms, our product offerings may be limited and our future financial results may be harmed.

Our bank subsidiaries are subject to extensive federal and state regulation that may require us to make capital contributions to them, and that may restrict the ability of these subsidiaries to make cash available to us.

Federal and state laws and regulations extensively regulate the operations of Comenity Bank, as well as Comenity Capital Bank. Many of these laws and regulations are intended to maintain the safety and soundness of Comenity Bank and Comenity Capital Bank, and they impose significant restraints on them to which other non-regulated entities are not subject. As a state bank, Comenity Bank is subject to overlapping supervision by the State of Delaware and the FDIC. As a Utah industrial bank, Comenity Capital Bank is subject to overlapping supervision by the FDIC and the State of Utah. Comenity Bank and Comenity Capital Bank must maintain minimum amounts of regulatory capital. If Comenity Bank and Comenity Capital Bank do not meet these capital requirements, their respective regulators have broad discretion to institute a number of corrective actions that could have a direct material effect on our financial statements. Comenity Bank and Comenity Capital Bank, as institutions insured by the FDIC, must maintain certain capital ratios, paid-in capital minimums and adequate allowances for loan loss. If either Comenity Bank or Comenity Capital Bank were to fail to meet any of the capital requirements to which it is subject, we may be required to provide them with additional capital, which could impair our ability to service our indebtedness. To pay any dividend, Comenity Bank and Comenity Capital Bank must each maintain adequate capital above regulatory guidelines. Accordingly, neither Comenity Bank nor Comenity Capital Bank may be able to make any of its cash or other assets available to us, including to service our indebtedness.

If our bank subsidiaries fail to meet certain criteria, we may become subject to regulation under the Bank Holding Company Act, which could force us to cease all of our non-banking activities and lead to a drastic reduction in our revenue and profitability.

If either of our depository institution subsidiaries failed to meet the criteria for the exemption from the definition of “bank” in the Bank Holding Company Act under which it operates (which exemptions are described below), and if we did not divest such depository institution upon such an occurrence, we would become subject to regulation under the Bank Holding Company Act. This would require us to cease certain of our activities that are not permissible for

companies that are subject to regulation under the Bank Holding Company Act. One of our depository institution subsidiaries, Comenity Bank, is a Delaware State FDIC-insured bank and a limited-purpose credit card bank located in Delaware. Comenity Bank will not be a “bank” as defined under the Bank Holding Company Act so long as it remains in compliance with the following requirements:

Our other depository institution subsidiary, Comenity Capital Bank, is a Utah industrial bank that is authorized to do business by the State of Utah and the FDIC. Comenity Capital Bank will not be a “bank” as defined under the Bank Holding Company Act so long as it remains an industrial bank in compliance with the following requirements:

Operational and Other Risk

We rely on third party vendors to provide products and services. Our profitability could be adversely impacted if they fail to fulfill their obligations.

The failure of our suppliers to deliver products and services in sufficient quantities and in a timely manner could adversely affect our business. If our significant vendors were unable to renew our existing contracts, we might not be able to replace the related product or service at the same cost which would negatively impact our profitability.

Failure to safeguard our databases and consumer privacy could affect our reputation among our clients and their customers, and may expose us to legal claims.

Although we have extensive physical and cyber security controls and associated procedures, our data has in the past been and in the future may be subject to unauthorized access. In such instances of unauthorized access, the integrity of our data has in the past been and may in the future be affected. Security and privacy concerns may cause consumers to resist providing the personal data necessary to support our loyalty and marketing programs. Information security risks for large financial institutions have increased with the adoption of new technologies, including those used on mobile devices, to conduct financial and other business transactions, and the increased sophistication and activity level of threat actors. The use of our loyalty, marketing services or credit card programs could decline if any compromise of physical or cyber security occurred. In addition, any unauthorized release of customer information or any public perception that we released consumer information without authorization, could subject us to legal claims from our clients or their customers, consumers or regulatory enforcement actions, which may adversely affect our client relationships.

Loss of data center capacity, interruption due to cyber attacks, loss of network links or inability to utilize proprietary software of third party vendors could affect our ability to timely meet the needs of our clients and their customers.

Our ability, and that of our third-party service providers, to protect our data centers against damage, loss or performance degradation from fire, power loss, network failure, cyber attacks, including ransomware or denial of service attacks, and other disasters is critical. In order to provide many of our services, we must be able to store, retrieve, process and manage large amounts of data as well as periodically expand and upgrade our technology capabilities. Any damage to our data centers, or those of our third-party service providers, any failure of our network links that interrupts our operations or any impairment of our ability to use our software or the proprietary software of third party vendors,

including impairments due to cyber attacks, could adversely affect our ability to meet our clients’ needs and their confidence in utilizing us for future services.

Our failure to protect our intellectual property rights may harm our competitive position, and litigation to protect our intellectual property rights or defend against third party allegations of infringement may be costly.

Third parties may infringe or misappropriate our trademarks or other intellectual property rights, which could have a material adverse effect on our business, financial condition or operating results. The actions we take to protect our trademarks and other proprietary rights may not be adequate. Litigation may be necessary to enforce our intellectual property rights, protect our trade secrets or determine the validity and scope of the proprietary rights of others. We may not be able to prevent infringement of our intellectual property rights or misappropriation of our proprietary information. Any infringement or misappropriation could harm any competitive advantage we currently derive or may derive from our proprietary rights. Third parties may also assert infringement claims against us. Any claims and any resulting litigation could subject us to significant liability for damages. An adverse determination in any litigation of this type could require us to design around a third party’s patent or to license alternative technology from another party. In addition, litigation is time consuming and expensive to defend and could result in the diversion of our time and resources. Any claims from third parties may also result in limitations on our ability to use the intellectual property subject to these claims. Further, our competitors or other third parties may independently design around or develop similar technology, or otherwise duplicate our services or products in a way that would preclude us from asserting our intellectual property rights against them. In addition, our contractual arrangements may not effectively prevent disclosure of our intellectual property or confidential and proprietary information or provide an adequate remedy in the event of an unauthorized disclosure.

Our international operations, acquisitions and personnel may require us to comply with complex United States and international laws and regulations in the various foreign jurisdictions where we do business.

Our operations, acquisitions and employment of personnel outside the United States may require us to comply with numerous complex laws and regulations of the United States government and those of the various international jurisdictions where we do business. These laws and regulations may apply to a company, or individual directors, officers, employees or agents of such company, and may restrict our operations, investment decisions or joint venture activities. Specifically, we may be subject to anti-corruption laws and regulations, including, but not limited to, the United States’ Foreign Corrupt Practices Act, or FCPA; the United Kingdom’s Bribery Act 2010, or UKBA; and Canada’s Corruption of Foreign Public Officials Act, or CFPOA. These anti-corruption laws generally prohibit providing anything of value to foreign officials for the purpose of influencing official decisions, obtaining or retaining business, or obtaining preferential treatment and require us to maintain adequate record-keeping and internal controls to ensure that our books and records accurately reflect transactions. As part of our business, we or our partners may do business with state-owned enterprises, the employees and representatives of which may be considered foreign officials for purposes of the FCPA, UKBA or CFPOA. There can be no assurance that our policies, procedures, training and compliance programs will effectively prevent violation of all United States and international laws and regulations with which we are required to comply, and such a violation may subject us to penalties that could adversely affect our reputation, business, financial condition or results of operations. In addition, some of the international jurisdictions in which we operate may lack a developed legal system, have elevated levels of corruption, maintain strict currency controls, present adverse tax consequences or foreign ownership requirements, require difficult or lengthy regulatory approvals, or lack enforcement for non-compete agreements, among other obstacles.

Anti-takeover provisions in our organizational documents and Delaware law may discourage or prevent a change of control, even if an acquisition would be beneficial to our stockholders, which could affect our stock price adversely and prevent or delay change of control transactions or attempts by our stockholders to replace or remove our current management.

Delaware law, as well as provisions of our certificate of incorporation, bylaws and debt instruments, could discourage unsolicited proposals to acquire us, even though such proposals may be beneficial to our stockholders. These include our Board’s authority to issue shares of preferred stock without further stockholder approval.

In addition, we are subject to the provisions of Section 203 of the Delaware General Corporation Law, which may prohibit certain business combinations with stockholders owning 15% or more of our outstanding voting stock. These and other provisions in our certificate of incorporation, bylaws and Delaware law could make it more difficult for stockholders or potential acquirers to obtain control of our Board of Directors or initiate actions that are opposed by our then-current Board of Directors, including a merger, tender offer or proxy contest involving us. Any delay or prevention of a change of control transaction or changes in our Board of Directors could cause the market price of our common stock to decline or delay or prevent our stockholders from receiving a premium over the market price of our common stock that they might otherwise receive.