Risk Factors Dashboard
Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.
View risk factors by ticker
Search filings by term
Risk Factors - TCX
-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing
Our business faces significant risks. Some of the following risks relate principally to our business and the industry and statutory and regulatory environment in which we operate, including those highlighted in this section and summarized below. Other risks relate principally to the securities markets and ownership of our stock. As a result, the following risk factors, as well as other information included or incorporated by reference elsewhere in this Annual Report on Form 10-K, should be considered in evaluating our business and future prospects. The risks described below may not be the only risks we face. Additional risks that we do not yet know of or that we currently think are immaterial may also impair our business operations. If any of the events or circumstances described in the following risk factors actually occur, our business, financial condition or results of operations could suffer, and the trading price of our common stock could decline.
Risk Factor Summary
RISKS RELATED TO OUR BUSINESS AND INDUSTRY
We operate in highly competitive and consolidating industries, which may impact our ability to grow and maintain profitability.
The markets we serve—Internet services (Ting), wireless communications (Tucows Corporate – Mobile Services), BSS/OSS software (Wavelo), and domain registration (Tucows Domains)—are highly competitive and undergoing significant consolidation. Many of our competitors have greater financial, technical, and marketing resources, enabling them to offer lower prices, broader service bundles, and enhanced purchasing power for equipment, content, and infrastructure. As consolidation increases, larger competitors may further strengthen their cost advantages, making it more difficult for us to attract and retain customers. As consolidation in the industry creates even larger competitors, our competitors’ purchasing advantages may increase further, hampering our efforts to attract and retain customers.
To remain competitive, we may need to reduce pricing, increase service offerings, or invest in customer acquisition, which could pressure margins, increase churn, and negatively impact cash flows. Additionally, lower prices could attract less loyal or lower-value customers, further affecting profitability.
In the domain registration industry, regulators are increasingly scrutinizing market consolidation and competitive practices, which could impact our ability to scale through acquisitions, partnerships, or pricing adjustments. Any regulatory action affecting domain pricing, reseller agreements, or distribution channels could constrain growth in our domain business.
Our service offerings may not be successful if we are unable to maintain existing customer relationships or establish new customer relationships.
Maintaining our existing customer relationships and being able to establish new relationships is critical to our success across all our segments, regardless if that customer is an end consumer wanting Gigabit Fiber or Fixed Wireless Internet service to their home, a telecommunication provider, or a leading global domain reseller. Long-term success is dependent upon our sustained ability to generate sufficient revenue from our customers based on their use of our services and ability to respond to churn by retaining existing customers and adding new customers. Long-term success is dependent upon its sustained ability to generate sufficient revenue from its customers based on their use of its services and its ability to respond to churn by retaining existing customers and adding new customers. With significant investments across our segments, be it in the continued build out of our Fiber Network across the United States, our development of our Wavelo or Domains Platforms, our performance and financial results could be negatively impacted if we are unable to realize the return on these investments by failing to attract customers or retain customers to the services we offer.
Regarding Wavelo specifically, EchoStar is our main customer and represents the majority of our revenues until such time that we are able to scale our services to other customers. With the majority of our revenues concentrated with one customer, we are exposed to significant risk if we are unable to maintain this customer relationship or establish new relationships with other MNOs or MVNOs in the future. With all our MSE revenues concentrated with one customer, we are exposed to significant risk if we are unable to maintain this customer relationship or establish new relationships with other MVNOs in the future. Additionally, our revenues are directly tied to the subscriber volumes of EchoStar's MVNO or MNO networks, so our profitability is contingent on the ability of EchoStar to continue to add and retain subscribers onto our platform. Additionally, our revenues as an MSE are directly tied to the subscriber volumes of DISH's MVNO or MNO networks, so our profitability is contingent on the ability of DISH to continue to add subscribers onto our platform. If any of these events occur, our operational performance and financial results may be adversely affected.
Our service offerings may be limited in their ability to grow their respective businesses and customer base unless we can continue to manage our vendor relationships and supply chain to obtain valuable products and service options to offer to our customers.
To stay competitive, we must offer a range of valuable products and services while effectively managing vendor relationships and supply chains. A critical aspect of this is securing domain name registration options through various TLDs and ccTLDs for our Tucows Domains segment. Our business is particularly vulnerable to fee increases imposed by registries like Verisign, which controls .com domains. Verisign, for instance, charges $10.26 per .com registration, with ICANN imposing an additional $0.18 fee. With Verisign’s contract extended until 2030, it is permitted to increase .com domain prices by up to 7% annually in the last four years of its term. In 2024, Verisign exercised this right, raising .com registration costs by 7%, impacting our cost of revenues. Additionally, in our mobile services segment, we rely on MNOs for network capacity, but with a shrinking retail subscriber base concentrated on a single MNO, our ability to negotiate favorable rates is limited. For our Ting Internet segment, we depend on leased fiber capacity, installation equipment, and third-party network access, and any disruptions in supply or cost increases could affect our ability to scale and maintain profitability. Since we have no control over these pricing adjustments and contract terms, they could significantly impact our financial performance and competitiveness across our core businesses.
Changes in Internet infrastructure, adoption, and navigation practices could impact our business.
Our success depends on the continued expansion and stability of the Internet as a global platform for communication and commerce. Any fundamental shift in Internet usage, governance, or navigation could materially impact our business, financial condition, and growth prospects.
● | Ting Internet: The adoption of fiber-optic Internet may be impacted by factors such as consumer reluctance to switch providers, network performance limitations, or the rise of alternative wireless technologies that provide competitive speeds without fixed infrastructure. Any of these could slow fiber adoption, limiting our growth. |
● | Tucows Domains: The domain registration industry relies on the continued use of the domain name system (DNS) for Internet navigation. Emerging technologies, such as alternative traffic routing systems, keyword-based navigation, or government-controlled Internet frameworks, could reduce reliance on domain names. If widely adopted, these changes could diminish demand for domains and impact our revenue. |
● | Global Expansion: We expect future Internet growth to come from international markets, where adoption is currently lower. If Internet usage does not expand as expected, or if governments restrict domain registrations, our growth strategy and revenue potential could be adversely affected. |
Any major shift in Internet infrastructure, governance, or navigation practices could reduce demand for our services and negatively affect our long-term financial performance.
Investments in new businesses and technologies, as well as divestitures, carry inherent risks that may impact our operations and financial performance.
We continually invest in new businesses, services, and technologies and divest non-core assets, but these strategies may not generate the anticipated benefits and could disrupt ongoing operations. If we fail to integrate acquisitions effectively, realize expected synergies, or achieve target returns, our financial condition and ability to meet obligations could be negatively affected.
We may continue to acquire companies, assets, or technologies to expand services, enhance infrastructure, or address competitive pressures. These transactions carry risks, including:
● | Management distraction from core operations, |
● | Integration challenges with acquired businesses, |
● | Significant acquisition costs and potential liabilities, |
● | Loss of key employees, |
● | Unanticipated regulatory changes, and |
● | Failure to generate expected financial returns. |
For example, under the EchoStar Purchase Agreement, we receive a 10-year payment based on transferred subscriber margins. If subscriber churn exceeds expectations or if EchoStar’s pricing strategies or cost structures reduce profitability, our anticipated income stream may fall short, impacting financial results.
Additionally, we may be unable to identify or complete future acquisitions on favorable terms, and market perception of acquisitions could negatively affect our stock price. There is no assurance that our investments will be successful, and failure to realize anticipated benefits could adversely impact our financial condition and operating results.
The Company's success depends on our ability to adapt to technological advancements and evolving industry trends.
The industries in which we operate are characterized by rapid technological change, evolving customer expectations, and increasing competition from emerging technologies. Failure to anticipate and adapt to these changes could impact our ability to attract and retain customers, maintain competitive pricing, and sustain profitability.
● | Ting Internet: Fiber-optic technology currently offers unmatched speed, reliability, and scalability, but future advancements in wireless broadband, 5G, and satellite internet could reduce demand for fiber-based services, particularly in multi-family housing and underserved markets. As we expand our fiber subscribers, we must continuously invest in network performance, scalability, and infrastructure upgrades to remain competitive. Inefficiencies, operational failures, or the inability to accommodate increased traffic demand could erode service quality, damage our reputation, and impact financial performance. |
● | Wavelo: The wireless communications industry is undergoing rapid transformation, including the adoption of AI-driven automation, network optimization, and customer service enhancements. We must continuously evaluate new technologies, platform integrations, and evolving competitive landscapes to maintain market relevance. Competitors with greater financial resources and economies of scale may offer services at lower prices, impacting our revenue growth and margins. |
● | Tucows Domains: The domain registration and internet services industry is evolving with AI-powered tools enabling automated domain search, DNS management, and fraud detection. These innovations may reduce demand for traditional domain registration services or allow competitors to optimize pricing and customer acquisition more efficiently. Additionally, emerging e-commerce platforms and AI-generated website builders could disrupt the traditional domain ecosystem, requiring us to adapt or risk losing market share. |
Our long-term success depends on continuous investment in technology, infrastructure, and service innovation. Failure to adapt to market changes, integrate emerging technologies, or maintain operational scalability could negatively impact our growth, competitive position, and financial performance.
RISKS RELATED TO OUR OPERATIONS AND INFRASTRUCTURE
We rely on third-party network operators, data centers, and service providers, and any disruptions to these systems could negatively impact our business.
Our operations depend on the continuous availability and reliability of network infrastructure, data centers, and cloud service providers. Any system failure, service interruption, or infrastructure damage—whether within our own facilities or those of our third-party partners—could result in service disruptions, loss of revenue, reputational harm, and financial liabilities.
● | Ting Internet relies on our Fiber Network, as well as third-party Partner Network Providers in certain markets. Damage to network facilities, failure to maintain government authorizations, or non-compliance with regulations by these third parties could disrupt our service and result in financial losses. |
● | Wavelo depends on data centers, public cloud providers, and key observability service providers to monitor outages and ensure platform availability. Service interruptions could impact billing and provisioning services for clients, affecting customer retention and revenue. |
● | Tucows Corporate – Mobile Services operates on third-party wireless networks. Failures in their network infrastructure, security breaches, or regulatory non-compliance could lead to subscriber losses, increased costs, or operational challenges. Our Master Services Agreement does not provide indemnification for network outages or disruptions, increasing our exposure to risk. |
● | Tucows Domains depends on IT and communications systems housed in data centers, some of which are in regions with high seismic activity. System failures due to natural disasters, cyberattacks, sabotage, or financial instability of data center operators could cause prolonged service outages, negatively affecting our brands, revenue, and profitability. |
Some of our businesses rely on Network Operators. Failure by a Network Operator to obtain the proper licenses, approvals and or permits from regulatory authorities would cause us to be unable to successfully operate those businesses.
The FCC licenses currently held by our Network Operators and their third-party affiliates to provide wireless services are subject to renewal and revocation. There is no guarantee that their wireless or network licenses will be renewed. The FCC requires all licensee to meet certain requirements, including so-called “build-out” requirements, to retain their licenses. Their failure to comply with certain FCC requirements in a given license area could result in the revocation of their license for that geographic area. This could impact our ability to scale operations, meet customer demand, and achieve projected revenue growth. Additionally, increased regulatory requirements could lead to higher compliance costs and extended buildout timelines.
We are subject to minimum purchase commitments with some partner network providers and mobile network operators.
In certain Ting markets, we operate on third-party-owned internet networks, including municipal and private ("Partner Network Providers"), rather than building our own infrastructure. We pay fees based on minimum purchase commitments, which often increase as network construction expands and new serviceable addresses become available. To maintain profitability in these markets, we must grow our customer base and manage churn to offset these fixed costs.
Additionally, under our Ting Mobile agreement, we have a "take or pay" minimum purchase commitment with our MNO supplier. We are committed to a minimum of $18.5 million in remaining payments through February 16, 2026. Due to the small size of our retained mobile subscriber base, we expect to incur penalties related to underutilization, with $1.3 million accrued as of December 31, 2024. If we fail to grow our mobile customer base or renegotiate these obligations, our cost of revenue may increase, negatively impacting financial results. To date, renegotiation efforts have been largely unsuccessful, with only partial deferrals of penalty escalation. The Company expects to incur penalties throughout the year ending December 31, 2025 ("Fiscal 2025") and thereafter until the contract is complete in early 2026.
We are parties to agreements with other unrelated parties for certain business operations and to license third-party technologies. Any claims against these unrelated parties that we rely upon for business operations and/or licensed technology could result in the need to incur substantial costs to replace technology or services which could delay and increase the cost of product and service developments. Any claims against these unrelated parties to which we rely for business operations and/or licensed technology could result in the need to incur substantial costs to replace the technology or services which could delay and increase the cost of product and service developments.
Across all of our business segments, we have entered into agreements with third parties for licensing of certain technologies, the day-to-day execution of certain services, the development and maintenance of certain systems necessary for the operation of our businesses and for network equipment, handsets, devices and other equipment where appropriate. We expect our dependence on key suppliers to continue as more advanced technologies and services are developed. If we experience difficulties with regard to these arrangements or are unable to negotiate on commercially reasonable terms or at all with future vendors, it could result in additional expense, loss of customers and revenue, interruption of our services or a delay in the roll-out of new technology and services for our customers.
The execution of our Ting restructuring plans, involves risks that could adversely affect our business operations, financial condition, and growth strategy; including risks related to implementation difficulties, operational disruptions, and financial impacts.
To reflect the ongoing operational prioritizations of the Ting segment and to lower year-over-year operating expenses, we undertook the Ting workforce reductions on February 7, 2024 and October 30, 2024. The 2024 workforce reductions were aimed at streamlining the operations within our Ting segment and reducing capital expenditures. The successful execution of these plans was critical to our efforts to reduce costs, improve efficiency, and align our resources with strategic priorities. However, the implementation of the workforce reductions requires significant management attention and financial resources and is subject to a number of risks that could negatively impact our results of operations, including the following:
- | Implementation difficulties and costs: The process of implementing the Capital Efficiency Plan may encounter unforeseen challenges, including delays and higher-than-anticipated expenses. These difficulties could hinder our ability to achieve the anticipated benefits of the Plan, such as cost savings and improved operational efficiencies. |
- | Operational Disruptions: Changes to our operational structure as part of the Capital Efficiency Plan, such as workforce reductions, may lead to temporary disruptions in our operations. These disruptions could adversely affect our ability to meet customer demands, maintain service quality, and achieve our growth objectives. |
- | Financial Impacts: The Capital Efficiency Plan has resulted in significant costs related to severance, asset write-downs, and other restructuring charges, which were incurred in the current fiscal period. While these expenditures were necessary to implement the plan and are expected to yield long-term financial benefits, they have negatively impacted our profitability in the short term. There is also a risk that the anticipated efficiencies and cost savings may take longer than expected to materialize or may not fully offset the upfront costs. |
- | Employee Morale and Retention: The Capital Efficiency Plan may impact employee morale and lead to challenges in retaining key personnel. Maintaining a motivated workforce is crucial to our ongoing success, and any negative effects on employee morale could adversely impact our business operations and financial performance. |
- | Market and Competitive Pressures: As we restructure our operations, there is a risk that competitors may take advantage of any perceived disruptions or weaknesses, potentially impacting our market position and competitive advantage. |
- | Reputational Harm: The public perception and reputation of our company could be adversely affected by the execution of significant restructuring plans like the Plan. Public, customer, and investor perceptions of our actions, especially in relation to workforce reductions, service changes, or other visible outcomes of the restructuring, could negatively influence our brand and reputation in the market. | |
- | Impede Growth: The restructuring plans are expected to significantly reduce capital expenditures, which will in turn slow, and in some markets pause, the expansion of the Ting Internet footprint. The resulting reduction in capital spend will result in fewer additions to the Company's Owned Infrastructure Serviceable Addresses, which in turn could lead to fewer net additions to Internet Subscribers Under Management and revenue growth. |
RISKS RELATED TO CYBERSECURITY, DATA PRIVACY, AND INTELLECTUAL PROPERTY
We face cybersecurity risks that could disrupt our business, damage our reputation, and result in financial and legal liabilities.
As a provider of internet-based services, we collect, store, and process sensitive customer, employee, and business data across our operations. We rely on centralized data processing, online services, and third-party providers, increasing our exposure to cyber threats, data breaches, and unauthorized access. Any compromise of our network security or IT systems could lead to service disruptions, data loss, reputational harm, regulatory penalties, and financial liability.
Cyberattacks, including malware, phishing, ransomware, deepfake fraud, and AI-driven hacking techniques, continue to increase in sophistication, frequency, and impact. Nation-state actors and organized cybercriminal groups are increasingly targeting technology infrastructure providers, and as a company supporting core internet services, we may be at greater risk. AI-driven threats, such as realistic social engineering attacks and domain abuse, may further expose us to fraudulent activity, regulatory scrutiny, and increased compliance costs.
Additionally, supply chain attacks—particularly those targeting open-source software and third-party dependencies—have become more prevalent, increasing the risk of compromised infrastructure and security vulnerabilities. Despite our investments in security controls, fraud detection tools, and risk mitigation strategies, our defensive measures may not be sufficient to prevent or detect all cyber incidents.
A significant security breach, data loss, or service outage could result in legal claims, increased regulatory oversight, financial penalties, loss of customer trust, and damage to our competitive position, all of which could materially affect our business, financial condition, and results of operations.
Evolving laws and regulations governing intellectual property and internet services may expose us to increased liability and compliance costs.
The legal framework surrounding intellectual property, domain registration, and online content liability continues to evolve, and changes in these laws could increase our legal exposure, regulatory burden, and compliance costs.
As a provider of domain registration and hosting services, we do not monitor the appropriateness of domain names or website content created by our customers, nor are we required to do so under our ICANN accreditation. However, we may be subject to legal claims arising from illegal or infringing activities conducted by third parties using domains registered through our platforms. While we maintain policies to address misuse, we cannot prevent all violations, and enforcement efforts may result in legal disputes, reputational harm, or regulatory penalties.
Several laws currently shield internet service providers and domain registrars from liability, including:
● | The Communications Decency Act (CDA), which limits liability for user-generated content, except in cases of direct participation in unlawful activity. |
● | The Digital Millennium Copyright Act (DMCA), which provides safe harbor protections for hosting third-party content, contingent on compliance with takedown requests. |
● | The Anti-Cybersquatting Consumer Protection Act (ACPA), which governs domain name disputes and limits registrar liability absent bad faith intent to profit. |
These protections, however, are subject to judicial interpretation and legislative changes, both in the U.S. and internationally. Some jurisdictions have introduced stricter content liability laws, data localization mandates, and intellectual property protections that may be difficult or costly to comply with. If courts narrow existing legal protections or governments impose new regulatory obligations on domain registrars, we may be required to modify our business practices, enhance compliance programs, or absorb additional operational costs.
Additionally, domain registrars are increasingly facing tort liability for domain disputes, security breaches, and fraudulent registrations. While we implement safeguards against unauthorized transfers, phishing, and domain hijacking, our defenses may not always be effective, and we may be subject to claims that increase our litigation exposure and financial risk.
We maintain general liability insurance, but coverage may be insufficient, disputed, or unavailable for certain claims. Any significant uninsured losses, regulatory penalties, or litigation costs could adversely impact our financial condition and results of operations.
Data protection regulations may impose legal obligations on us that we cannot meet or that conflict with our ICANN contractual requirements.
In 2018, the European Commission adopted the GDPR, which creates obligations around the procurement, processing, publication and sharing of personal data. Potential fines for violations of certain provisions of GDPR reach as high as 4% of a company’s annual total revenue, potentially including the revenue of its international affiliates. The solutions we develop for GDPR-compliance may not be adequate in the views of regulatory authorities or ICANN, which may cause the loss of WHOIS privacy revenue or increase our costs of developing compliant solutions or subject us to litigation, liability, civil penalties, or loss of market share. As the privacy laws and regulations around the world continue to evolve, these changes could adversely affect our business operations in similar ways.
Disputes concerning the ownership or rights to use intellectual property and litigation involving other rights of third parties could be costly and time-consuming to litigate, may distract management from operating the business, and may result in us paying significant damage awards, losing significant rights and our ability to operate all or a portion of our business.
We rely upon copyright, trade secret and trademark law, confidentiality and nondisclosure agreements, invention assignment agreements and work-for-hire agreements to protect our proprietary technology, all of which offer only limited protection. Due to the global nature of our web-based businesses and services, we cannot ensure that our efforts to protect our proprietary information will be adequate to protect against infringement and misappropriation by third parties, particularly in foreign countries where laws or law enforcement practices may not protect proprietary rights as fully as in the U.S. and Canada.
We have licensed, and may in the future license, some of our trademarks and other proprietary rights to others. Third parties may also reproduce or use our intellectual property rights without seeking a license and thus benefit from our technology without paying for it. Third parties could also independently develop technology, processes or other intellectual property that are similar to or superior to those used by us. Actions by licensees, misappropriation of the intellectual property rights or independent development by others of similar or superior technology might diminish the value of our proprietary rights or damage our reputation. The unauthorized reproduction or other misappropriation of our intellectual property rights, including copying the look, feel and functionality of our website could enable third parties to benefit from our technology without us receiving any compensation. The enforcement of our intellectual property rights may depend on our taking legal action against these infringing parties, and we cannot be sure that these actions will be successful.
Defense of claims of infringement of intellectual property or other rights of third parties against us would require the resources of both our time and money. Third parties may assert claims of infringement of patents or other intellectual property rights against us concerning past, current or future technologies. Content obtained from third parties and distributed over the Internet by us may result in liability for defamation, negligence, intellectual property infringement, product or service liability and dissemination of computer viruses or other disruptive problems. We may also be subject to claims from third parties asserting trademark infringement, unfair competition and violation of publicity and privacy rights relating specifically to domains.
As a domain name registrar, we regularly become involved in disputes over registration of domain names. These disputes are typically resolved through the UDRP, ICANN’s administrative process for domain name dispute resolution, or less frequently through litigation under the Anti Cyber Squatting Consumer Protection Act "ACPA", or under general theories of trademark infringement or dilution. These disputes are typically resolved through the UDRP, ICANN’s administrative process for domain name dispute resolution, or less frequently through litigation under the ACPA, or under general theories of trademark infringement or dilution. The UDRP generally does not impose liability on registrars, and the ACPA provides that registrars may not be held liable for registering or maintaining a domain name absent a showing of bad faith intent to profit or reckless disregard of a court order by the registrars. However, we may face liability if we fail to comply in a timely manner with procedural requirements under these rules. In addition, these processes typically require at least limited involvement by us, and therefore increase our cost of doing business. The volume of domain name registration disputes may increase in the future as the overall number of registered domain names increases.
We have substantial goodwill and other intangible assets, therefore to the extent that any intellectual property is deemed impaired we would be required to record a significant charge to earnings in our financial statements during the period in which any impairment of our goodwill or intangible assets is determined. Any impairment charges or changes to the estimated amortization periods could have a material adverse effect on our financial results.
Domain names are valuable assets, and cybersecurity risks could lead to their loss or misattribution of liability to us.
Domain names are valuable and critical assets for businesses, serving as digital storefronts and key components of brand identity, customer engagement, and online commerce. As a domain registrar, we facilitate the registration, renewal, and management of domain names on behalf of customers. However, cyber threats such as phishing, social engineering, credential theft, and unauthorized account access create risks that could result in the loss, transfer, or hijacking of valuable domain names.
In the event that we, our systems, or a customer’s account is compromised due to a cyberattack, the affected party may suffer significant reputational and financial harm. A lost or stolen domain name can lead to business disruption, loss of web traffic, loss of value, intellectual property disputes, and potential legal claims. Even if the security breach originates from a customer’s own systems, we may be blamed for failing to prevent the loss or unauthorized transfer of the domain, leading to liability exposure, regulatory scrutiny, or litigation.
Despite implementing security measures such as multi-factor authentication, domain locking, and account monitoring, no system is immune to attack. Additionally, evolving cyber threats—particularly AI-driven fraud, deepfake impersonation, and credential stuffing—may increase the likelihood of domain-related security breaches. If we are held responsible for a domain name loss, whether through direct fault or perceived negligence, our reputation, financial position, and operations could be materially impacted.
RISKS RELATED TO FINANCIAL AND MACROECONOMIC CONDITIONS
Our indebtedness could adversely affect our ability to raise additional capital to fund our operations, our ability to operate our business, execute our strategy divert our cash flow from operations for debt payments, and prevent us from meeting our debt obligations.
The Company’s wholly owned subsidiary, Ting Fiber, LLC, as well as its wholly owned subsidiaries are financed by the 2023 and 2024 Term Notes (as defined in Note 8 – Notes Payable to the Company’s Consolidated Financial Statements) as well as the Unit Purchase Agreement (“UPA”) with Generate (as defined in Note 13 – Redeemable Preferred Units to the Company’s Consolidated Financial Statements).
On May 4, 2023 (the "Closing Date"), Tucows Inc. through its indirect and wholly owned subsidiaries, including Ting Fiber, LLC, entered into a definitive agreement relating to a securitized financing facility related to (i) $168,357,000 of its 5.95% Secured Fiber Revenue Notes, Series 2023-1, Class A-2, (ii) $23,289,000 of its 7.40% Secured Fiber Revenue Notes, Series 2023-1, Class B and (iii) $46,859,000 initial principal amount of 9.95% Secured Fiber Revenue Notes, Series 2023-1, Class (together, the “2023 Term Notes”). On the Closing Date, Ting Issuer LLC, a Delaware limited liability company (the “Issuer”), a limited purpose, bankruptcy-remote, indirect wholly owned subsidiary of the Company issued the 2023 Term Notes. The net proceeds from the issuance of the 2023 Term Notes were $220.5 million, after deducting a debt discount of $11.2 million and issuing costs of $6.7 million. As of March 13, 2025, our outstanding 2023 Term Notes was $238.5 million.
On August 20, 2024, Tucows Inc., through its indirect and wholly owned subsidiaries, including Ting Fiber, LLC, entered into a definitive agreement relating to a securitized financing facility related to a privately placed securitization transaction. On August 20, 2024, Ting Issuer LLC, the Issuer, a limited purpose, bankruptcy-remote, indirect wholly owned subsidiary of the Company, issued the 2024 Term Notes. The net proceeds from the issuance of the 2024 Term Notes were $61.0 million, after deducting issuance costs of $2.0 million. As of March 13, 2025, our outstanding 2024 Term Notes was $63 million.
The 2023 Term Notes and 2024 Term Notes are secured by certain of the Ting Issuer LLC's, revenue-generating assets, consisting principally of fiber-network related agreements, fiber-network assets and customer contracts (collectively, the “Securitized Assets”) that are owned by certain other limited-purpose, bankruptcy-remote, wholly owned indirect subsidiaries of the Company that act as the Guarantors (collectively with the Issuer, the “Obligor”) under the Base Indenture, dated as of May 4, 2023 (the “Base Indenture”). The 2023 Term Notes and 2024 Term Notes are subject to a series of covenants, restrictions and other investor protections including (i) that the Issuer maintains specified reserve accounts to be used to make required payments in respect of the 2023 Term Notes and 2024 Term Notes, (ii) provisions relating to optional and mandatory prepayments and the related payment of specified amounts, (iii) certain indemnification payments, (iv) the guarantors comply with standard bankruptcy-remoteness covenants, including not guaranteeing or being liable for other affiliates debts or liabilities, and (v) covenants relating to recordkeeping, access to information, and similar matters. Our ability to remain in compliance with our operating restrictions, generate cash flow from operations to maintain reserve account, make principal, interest payments on our debt will depend on our future performance, which will be affected by a range of economic, competitive and business factors and changes in government monetary or fiscal policy. Failure to maintain compliance with operating restrictions of our credit facility could result in a default and could have a material adverse effect on our business and results of operation.
On September 22, 2023, the Company and its wholly owned subsidiaries, Tucows.com Co., Ting Inc., Tucows (Delaware) Inc., Wavelo, Inc. and Tucows (Emerald), LLC (each, a “Borrower” and together, the “Borrowers,” collectively with the Company, “Tucows”) and certain other subsidiaries of the Company, as guarantors, entered into a Credit Agreement (the “2023 Credit Agreement”) with Bank of Montreal, as administrative agent (“BMO” or the “Agent”), and the lenders party thereto, to, among other things, provide the Borrowers with a revolving credit facility in an aggregate amount not to exceed $240 million (the “2023 Credit Facility”). The Borrowers may request an increase to the 2023 Credit Facility through new commitments of up to $60 million if the Total Funded Debt to Adjusted EBITDA Ratio (as defined in the 2023 Credit Agreement) is less than 3.75:1.00. The 2023 Credit Facility expires on September 22, 2026, which is the third anniversary of the effective date of the 2023 Credit Facility. The 2023 Credit Facility contains customary representations and warranties, affirmative and negative covenants, and events of default. The 2023 Credit Agreement requires that the Company comply with certain customary non-financial covenants and restrictions. In addition, the Company has agreed to comply with the following financial covenants: (1) a leverage ratio by maintaining at all times a Total Funded Debt to Adjusted EBITDA Ratio of not more than (i) 4.50:1:00 at any time from and after the Closing Date to and including December 30, 2023; (ii) 4.25:1:00 from December 31, 2023 to and including March 30, 2024; (iii) 4.00:1.00 from March 31, 2024 to and including June 29, 2024; and (iv) 3.75:1.00 thereafter; and (2) an interest coverage ratio by maintaining as of the end of each rolling four financial quarter period, an Interest Coverage Ratio (as defined in the 2023 Credit Agreement) of not less than 3.00:1.00. Tucows businesses excluding Ting are financed by the Company’s 2023 Credit Facility. As of March 13, 2025, our outstanding debt under the 2023 Credit Facility was $195.4 million with remaining committed funds of $44.6 million. Absent sufficient cash flows from operations, Tucows businesses excluding Ting may need to engage in equity or debt financings to secure additional funds to meet our operating and capital needs. Absent sufficient cash flows from operations, we may need to engage in equity or debt financings to secure additional funds to meet our operating and capital needs. The covenants and restrictions on the 2023 Credit Facility may prevent the Tucows businesses excluding Ting from accessing the remaining committed funds if additional financing is required.
In any situation where the Company is seeking such debt or equity financing, it may not be able to secure additional debt or equity financing on favorable terms, or at all, at the time when funding is needed. The Company does not currently have an effective “universal” shelf registration statement on Form S-3 on file with the SEC, which might delay the Company's ability to complete an equity financing. In addition, even though we may have sufficient cash flow, we may still elect to sell additional equity or debt securities or obtain credit facilities for other reasons. If we raise additional funds through further issuances of equity or convertible debt securities, our existing shareholders could suffer significant dilution in their percentage ownership of our company, and any new equity securities we issue could have rights, preferences and privileges senior to those of holders of our common stock. In addition, if we decide to raise funds through debt or convertible debt financings, we may be unable to meet our interest or principal payments. Our inability to generate sufficient cash flow from operations or obtain additional capital or alternative financing on acceptable terms could have a material adverse effect on our business, financial condition and results of operations.
Our debt agreements impose significant operating and financial restrictions on us and our subsidiaries, which may prevent us from capitalizing on business opportunities across the Company. Breaching these agreements could have a materially adverse impact on the Company.
The agreements governing our current 2023 Credit Facility impose significant operating and financial restrictions on Tucows businesses excluding Ting. These restrictions, subject in certain cases to customary baskets, exceptions, and incurrence-based ratio tests, may limit our subsidiaries' ability to engage in some transactions, including the following: incurring additional indebtedness and issuing stock; paying dividends, share repurchases or making other restricted payments or investments; selling assets, properties, or licenses that we have or in the future may procure, creating liens on assets; engaging in mergers, acquisitions, business combinations, or other transactions. These restrictions, subject in certain cases to customary baskets, exceptions, and incurrence-based ratio tests, may limit our or our subsidiaries' ability to engage in some transactions, including the following: incurring additional indebtedness and issuing stock; paying dividends, share repurchases or making other restricted payments or investments; selling assets, properties, or licenses that we have or in the future may procure; creating liens on assets; engaging in mergers, acquisitions, business combinations, or other transactions.
The trailing twelve month debt to Adjusted EBITDA ratio was 3.26:1.00 as of December 31, 2024 for the Tucows businesses excluding Ting. Our covenants under the Company’s 2023 Credit Facility required us to maintain a debt to Adjusted EBITDA ratio of not more than 3.75:1.00. Our ability to remain in compliance with our operating restrictions, generate cash flow from operations to make principal, interest payments on our debt will depend on our future performance, which will be affected by a range of economic, competitive and business factors as well as changes in government monetary or fiscal policy. Failure to maintain compliance with the operating restrictions of the 2023 Credit Facility could result in default and could have a material adverse effect on our business.
With respect to the UPA, Ting Fiber, LLC is obligated to redeem Generate's equity interests for an amount equal to the outstanding capital balance plus the unsatisfied preferred return (and pay a make-whole premium if the redemption of the preferred units occurs within the four years following the closing of the transaction (the "Transaction Close"), upon certain conditions, including a material breach of any Tucows' credit agreement that is not cured, the failure to pay the preferred return in two consecutive quarters following the second anniversary of the Transaction Close, and the six year anniversary of the Transaction Close. These restrictions could limit our ability to react to changes in our operating environment or the economy. Triggering the make-whole provision could have a material adverse effect on our business.
With respect to the 2023 and 2024 Term Notes are secured by certain of the Company’s revenue-generating assets, consisting principally the Securitized Assets that are owned by the Obligor under the Base Indenture. The 2023 and 2024 Term Notes are subject to a series of covenants, restrictions and other investor protections including (i) that the Issuer maintains specified reserve accounts to be used to make required payments in respect of the 2023 and 2024 Term Notes, (ii) provisions relating to optional and mandatory prepayments and the related payment of specified amounts, (iii) certain indemnification payments, (iv) the guarantors comply with standard bankruptcy-remoteness covenants, including not guaranteeing or being liable for other affiliates debts or liabilities, and (v) covenants relating to recordkeeping, access to information, and similar matters. Our ability to remain in compliance with our operating restrictions, generate cash flow from operations to maintain reserve account, make principal, interest payments on our debt will depend on our future performance, which will be affected by a range of economic, competitive and business factors as well as changes in government monetary or fiscal policy. Failure to maintain compliance with the operating restrictions of our credit facility could result in default and could have a material adverse effect on our business.
Any future indebtedness that we incur may contain similar or more restrictive covenants. Any failure to comply with the restrictions of our debt agreements may result in an event of default under these agreements, which in turn may result in defaults or acceleration of obligations under these agreements and other agreements, giving our lenders the right to terminate any commitments they had made to provide us with further funds and to require us to repay all amounts then outstanding. Any of these events would have a material adverse effect on our business, financial condition, and operating results.
On August 8, 2022, Ting Fiber, LLC entered into the UPA with Generate under which Ting Fiber, LLC has committed to issue and sell $60 million of Series A Preferred Units at the Initial Funding, subject to customary closing conditions, and an additional aggregate of $140 million Series A Preferred Units if the Milestones are achieved over a three year period from the date of the Transaction Close. As of March 13, 2025, our outstanding preferred units purchased under the UPA was $91.5 million, with a further capital commitment of $108.5 million available to Ting LLC through Milestone Fundings.
The international nature of our businesses and operations expose us to additional risks that could harm our business, operating results, and growth strategy; including risks related to taxation and foreign currencies fluctuations.
As a Company with multinational operations. Expansion into international markets is a continued element of our growth strategy. Introducing and marketing our services internationally, developing direct and indirect international sales and support channels and managing foreign personnel and operations all require significant management attention and financial resources. We face a number of risks associated with expanding our businesses internationally that could negatively impact our results of operations, including the following:
- | Foreign currency fluctuations and exchange rates: Our operating results are accordingly subject to fluctuations in foreign currency exchange rates, which could adversely affect our future operating results. We attempt to mitigate a portion of these risks through foreign currency hedging, based on our judgment of the appropriate trade-offs among risk, opportunity and expense. We generally use hedging programs to partially hedge our exposure to foreign currency exchange rate fluctuations for Canadian dollars, the currency in which we incur the majority of operating expenses. Although we regularly review our hedging program and make adjustments as necessary based on the judgment factors discussed above, our hedging activities may not offset more than a portion of the adverse financial impact resulting from unfavorable movement in foreign currency exchange rates, which could adversely affect our financial condition or results of operations. | |
- | Potentially adverse tax consequences or an inability to realize tax benefits: Significant judgment is required in determining our provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. While we believe our tax positions are consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be overturned by jurisdictional tax authorities, which may have a significant impact on our provision for income taxes. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the law are issued or applied, including the Tax Cuts and Job Act of 2017. In addition, governmental tax authorities are increasingly scrutinizing the tax positions of companies. If the U.S. or other foreign tax authorities change applicable tax laws, our overall taxes could increase, and our business, financial condition or results of operations may be adversely impacted. |
- | Sufficiently qualified labor pools in various international markets. | |
- | We may not succeed in our efforts to continue to expand our international presence as a result of the factors described above or other factors that may have an adverse impact on our overall financial condition and results of operations. |
Ting incurred a net loss of $121.7 million and $119 million for the year ended December 31, 2024 and the year ended December 31, 2023, respectively. At December 31, 2024, Ting had $61.7 million in cash and cash equivalents, restricted cash and restricted cash equivalents, $1.2 million in accounts receivable, $1.2 million in accounts payable and $15.8 million in accrued liabilities. At December 31, 2024, Ting's long term liabilities included $287.6 million payable on the 2023 and 2024 Term Notes as well as $122.1 million on the Redeemable Preferred Units. Ting incurred an operating cash flow deficit of $49.9 million and $50.4 million for the year ended December 31, 2024 and the year ended December 31, 2023, respectively. Ting has scheduled interest payments of $39.9 million in the twelve months following December 31, 2024.
Should Ting fail to pay the Unsatisfied Preferred Return associated with the Series A Preferred Units for two consecutive quarters, Generate has the option to either (i) require Ting to redeem the Series A Preferred Units at the Redemption Price; or (ii) compel the sale of certain assets of Ting and/or its subsidiaries to Generate with a value equal to the Redemption Price. The Redemption Price is an amount equal to the outstanding Unreturned Series A Capital Balance plus the Unsatisfied Preferred Return (and pay a Make-Whole Premium if the redemption of the preferred units occurs within the four years following the Transaction Close). The Make-Whole Premium is an amount calculated immediately prior to redemption equal to:(i) (A) the Unreturned Series A Capital Balance and Unsatisfied Preferred Return outstanding immediately prior to such redemption plus (B) the cumulative and compounded Preferred Return that would have accrued (at the Preferred Rate as in effect immediately prior to such redemption) on such Unreturned Series A Capital Balance through and including the six-year anniversary of the Effective Date had such Series A Preferred Units not been redeemed, and thereafter applying to such sum a discount rate on a quarterly compounded basis equal to the Applicable Treasury Rate plus 50 basis points, less (ii) the Unreturned Series A Capital Balance and Unsatisfied Preferred Return outstanding immediately prior to such redemption.
RISKS RELATED TO REGULATORY AND LEGAL COMPLIANCE
Changes in government regulations may increase compliance costs and impact our business operations.
Our business is subject to evolving federal, state, and international regulations, which may increase operational costs, restrict market access, or impact future growth.
The FCC grants wireless licenses that are subject to renewal and revocation. If our Network Operator’s license is not renewed or if compliance requirements change, it could disrupt our service offerings. Additionally, various state regulations on billing practices, privacy, and consumer protection could increase compliance costs and make it more difficult to implement national sales and marketing programs
Our Tucows Domains segment operates in a regulatory environment that is increasingly complex and subject to change. Governments worldwide may impose new laws affecting online resellers, content liability, privacy, consumer protection, and cross-border commerce. Changes in tax regulations, content policies, or data security requirements could result in higher compliance costs, increased liability, or restrictions on our ability to provide services
The adoption of new regulations, reinterpretation of existing laws, or removal of legal protections for internet services could hinder market growth, increase costs, or disrupt our operations, potentially impacting our financial condition and results of operations.
We may be subject to unforeseen liabilities or unenforceable customer agreements, which could negatively impact our financial results.
Our Domain Services business operates globally under standard customer agreements that outline the terms of our services and include provisions intended to limit our liability. These agreements are typically executed electronically or deemed accepted through continued use of our services. While this approach aligns with industry practices, courts in certain jurisdictions could challenge the validity or enforceability of these agreements, potentially exposing us to increased legal liability and compliance costs.
Although we maintain general liability insurance, coverage may be insufficient or disputed, and claims may exceed policy limits. Additionally, while we seek indemnifications from technology and content providers, we cannot guarantee their accuracy or adequacy. If we are required to pay claims that are uninsured, underinsured, or not covered by indemnification, our financial condition and operating results could be materially affected.
We are exposed to risks related to online payment fraud, chargebacks, and evolving payment technologies.
Across all our business segments, we are exposed to risks associated with credit card transactions, chargebacks, and online payment fraud, regardless of whether services operate on a postpaid or prepaid basis. A significant portion of our revenue comes from online credit card transactions, where we assume liability for fraudulent and disputed charges under industry rules. Any damage to or failure of our network facilities could result in interruptions in our service, which could reduce our revenues and profits, and damage our brands. If chargeback rates exceed established thresholds, we may face higher processing fees, penalties, or restrictions from payment networks, which could impact our ability to accept credit card payments.
Additionally, in our postpaid businesses, including Tucows Corporate – Mobile Services, Ting and Wavelo, our ability to manage credit risk while acquiring profitable customers is critical. These segments have relatively short operating histories, and we may be unable to accurately predict customer defaults, fraud risks, or collection challenges. Factors such as regulatory changes, competitive pricing strategies, or consumer behavior shifts may further impact our ability to mitigate credit risk and maintain profitability.
If fraud rates rise or credit losses exceed expectations, we may need to implement costly fraud prevention measures, enhance credit risk models, or absorb financial losses, all of which could negatively impact our margins, operational efficiency, and overall financial performance.
Unanticipated changes in effective tax rates or adverse outcomes resulting from examination of our income or other tax returns could adversely affect our operating results and financial condition.
We are subject to income and other taxes in a number of jurisdictions and our tax structure is subject to review by both domestic and foreign tax authorities. We must make significant assumptions, judgments and estimates to determine our current provision for income taxes, deferred tax assets and liabilities and any valuation allowance that may be recorded against our deferred tax assets. Although we believe that our estimates are reasonable, the ultimate determination of our tax liability is always subject to review by the applicable tax authorities. Any adverse outcome of such a review could have a negative effect on our operating results and financial condition in the period or periods for which such determination is made. Our current and deferred tax liabilities could be adversely affected by:
We could be subject to changes in tax rates, the adoption of new U.S. or international tax legislation, or exposure to additional tax liabilities. This could discourage the registration or renewal of domain names.
Due to the global nature of the Internet, it is possible that, although our services and the Internet transactions related to them typically originate in the United States, Canada, Denmark and Germany, governments of other states or foreign countries might attempt to regulate our transactions or levy sales, income or other taxes relating to our activities. Tax authorities at the international, federal, state and local levels are currently reviewing the appropriate treatment of companies engaged in Internet commerce. New or revised international, federal, state or local tax regulations may subject us or our customers to additional sales, income and other taxes. We cannot predict the effect of current attempts to impose sales, income or other taxes on commerce over the Internet on Tucows or on our customers. New or revised taxes and, in particular, sales taxes, would likely increase the cost of doing business online and decrease the attractiveness of advertising and selling goods and services over the Internet. New taxes could also create significant increases in internal costs necessary to capture data, and collect and remit taxes. Any of these events could have an adverse effect on our business and operating results.
Changes in ICANN policies, fees, and oversight may impact our domain registration business.
ICANN oversees the domain name registration system and imposes fees on domain registrar. They operate as a private sector, not-for-profit entity but faces ongoing public, governmental, and industry scrutiny regarding its governance, policies, and decision-making processes. Regulatory bodies, including the U.S. Congress and international authorities, periodically evaluate ICANN’s role, policies, and fee structures, which could lead to structural changes, increased regulation, or shifts in oversight. These changes may introduce uncertainty and potential instability in the domain registration market.
We face several risks related to ICANN’s oversight and evolving policies, including:
● | Fee increases which could raise our costs or deter domain registrations. |
● | Changes to the Registrar Accreditation Agreement that could be disadvantageous or, in extreme cases, prevent us from operating as a registrar. |
● | Conflicts between ICANN policies and national laws, leading to compliance challenges or operational restrictions in certain jurisdictions. |
● | Legal or regulatory actions against ICANN, which could impact its authority and introduce uncertainty into the domain name system. |
● | International regulatory bodies, such as the ITU or the EU, gaining greater influence over domain governance, potentially leading to new taxation, privacy, or competition regulations. |
If any of these events occur, they could disrupt the stability of the domain registration market, increase our compliance costs, or reduce our ability to operate efficiently, negatively affecting our wholesale and retail domain businesses.
RISKS RELATED TO CAPITAL MARKETS AND STOCK VOLATILITY
Our share price may be volatile, and investors may be unable to sell shares at a favorable price.
The market price of our common stock has fluctuated and may continue to experience significant volatility, regardless of our financial performance. Investors may be unable to resell their shares at a desired price due to market conditions, reduced trading volume, or negative sentiment toward our stock.
Several factors may contribute to this volatility, including:
● | Actual or anticipated variations in our quarterly financial results; |
● | Service disruptions or outages that impact customer trust and operational performance; |
● | Seasonal fluctuations in demand for our services and those of our customers; |
● | Announcements of new technologies or competitive services in our industry; |
● | Market perceptions of our business strategy, growth initiatives, and execution; |
● | Stock performance of companies in our sector, particularly those considered comparable to us; |
● | Analyst ratings, short-seller activity, or media coverage of our company; |
● | Macroeconomic trends affecting the technology and internet sectors. |
The stock market, particularly for internet, technology, and telecom companies, has experienced periods of significant volatility. Broader market trends, economic conditions, or shifts in investor sentiment toward our industry may further impact our stock price, trading volume, and overall market valuation.
We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance long-term shareholder value.
On February 13, 2025, our Board of Directors approved a stock repurchase program authorizing the Company to buy back up to $40 million of its common stock in the open market. The program commenced on February 14, 2025, and is expected to terminate on February 13, 2026.
While the Company has previously repurchased shares under similar programs, we are under no obligation to repurchase shares under this program, nor are we obligated to complete purchases up to the full authorized amount. The timing, quantity, and pricing of repurchases will depend on market conditions, available liquidity, and other strategic considerations, and the program may be modified, suspended, or discontinued at any time at the discretion of our Board.
Stock repurchase programs can impact our share price and market volatility, but there is no assurance that the repurchase program will enhance the long-term value of our stock or generate returns for shareholders.
RISKS RELATED TO ENVIRONMENTAL, SOCIAL, GOVERNANCE (ESG) FACTORS
Energy consumption from data centers and internet infrastructure may result in higher costs and increased regulatory scrutiny.
Our operations rely on data centers, cloud computing resources, and domain registration infrastructure, all of which require significant energy consumption. As governments introduce carbon reduction policies and energy efficiency mandates, we may face higher electricity costs, increased environmental compliance requirements, and potential pressure from investors to adopt more sustainable energy practices. If we are unable to reduce our carbon footprint or comply with future environmental regulations, we could face reputational risks and higher operational costs.
Investor and regulatory expectations for ESG (Environmental, Social, and Governance) transparency may require additional disclosures and compliance efforts.
Institutional investors, regulatory agencies, and industry stakeholders are increasingly focused on ESG performance and corporate sustainability disclosures. We may be required to implement new reporting frameworks, publish ESG-related data, or enhance corporate governance structures to meet investor expectations and regulatory requirements in the U.S., the U.K., Canada, and Europe. In addition, stakeholder expectations are not uniform, and both opponents and proponents of various ESG-related matters have increasingly resulted in a range of activism to advocate for their positions, including Anti-ESG positions. We could also be criticized by ESG detractors for the scope or nature of our ESG policies and practices. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could impact our access to capital markets, investor sentiment, and corporate reputation.
Our business and financial performance could be adversely impacted by climate change, environmental disruptions, and other unforeseen disasters or crises.
Our business operations, financial condition, and results of operations could be negatively affected, directly or indirectly, by extreme weather events, environmental disasters, public health crises, and other large-scale disruptions. These events are inherently unpredictable and may impact us directly, by causing physical damage to infrastructure, disrupting service delivery, or increasing operational costs, or indirectly, by affecting customer demand, supply chain stability, or broader economic conditions.
As climate-related risks continue to evolve, our fiber network infrastructure, data centers, and operational facilities may be exposed to hurricanes, wildfires, floods, and other extreme weather events. Damage to physical assets may disrupt network services, increase maintenance and repair costs, and contribute to customer churn, which could impact revenue. Additionally, the cost of insurance, regulatory compliance, and infrastructure hardening may increase over time, potentially affecting our capital expenditure planning and overall profitability.
Our ability to mitigate the impact of such events depends on the effectiveness of our business continuity planning, network resilience strategies, and disaster recovery measures. However, unanticipated disruptions or insufficient preparedness by local, national, or international emergency responders, supply chain partners, or other key stakeholders could exacerbate the financial and operational consequences of such events.
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
Risk Management and Strategy
Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.
We maintain and continue to expand our investment in the development of our information security management system (“ISMS”). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST”) Cybersecurity Framework (“CSF”) and the International Organization for Standardization (“ISO”) 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company’s information system infrastructure as well as the data in the Company’s care, custody and control. The Company engages parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.
Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.
Cybersecurity incidents are responded to in accordance with the Company’s established Cybersecurity Incident Response Plan (“IRP”). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is to the senior leadership, including the CEO and senior leadership. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third-party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third-party Digital Forensics and Incident Response (“DFIR”) service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.
Board Governance and Management
Recently Filed
Ticker * | File Date |
---|---|
FETH | an hour ago |
UBCP | an hour ago |
NXL | an hour ago |
FCCO | an hour ago |
FRBP | an hour ago |
CDIX | an hour ago |
PBT | 2 hours ago |
MRC | 2 hours ago |
FSEN | 2 hours ago |
AIRS | 2 hours ago |
DTI | 3 hours ago |
FUSB | 3 hours ago |
GNE | 3 hours ago |
SFDL | 4 hours ago |
CSBB | 4 hours ago |
WEYS | 4 hours ago |
NHHS | 4 hours ago |
ANKM | 4 hours ago |
SBT | 5 hours ago |
CBAN | 5 hours ago |
NECB | 5 hours ago |
CFBK | 5 hours ago |
ACNB | 5 hours ago |
MNSB | 7 hours ago |
NWFL | 7 hours ago |
ALRS | 7 hours ago |
LWAY | 7 hours ago |
ASTH | 8 hours ago |
MHH | 8 hours ago |
GNTY | 9 hours ago |
HLLY | 9 hours ago |
BTBT | 10 hours ago |
RMBL | 19 hours ago |
JYNT | 20 hours ago |
HBIO | 21 hours ago |
TPTA | 21 hours ago |
TFSA | 21 hours ago |
RGEN | 21 hours ago |
PRPL | 22 hours ago |
BLND | 23 hours ago |
PHLT | 23 hours ago |
ATYR | 23 hours ago |
STRO | 23 hours ago |
CVKD | 23 hours ago |
ATLC | 23 hours ago |
TCX | 23 hours ago |
RCMT | 23 hours ago |
AAWH | 23 hours ago |
BRLT | 23 hours ago |
FDBC | 23 hours ago |