Aarons 2015 Annual Report Download - page 19

• reliance on a single bank partner to issue DAMI’s HELPcard® and other credit products. The bank’s regulators could at any time limit or otherwise
modify the bank’s ability to continue its relationship with DAMI and any significant interruption of this relationship would result in DAMI being
unable to acquire new receivables and provide other credit products. It is possible that a regulatory position or action taken with respect to DAMI’s
issuing bank might result in the bank’s inability or unwillingness to originate future credit products on DAMI’s behalf or in partnership with it,
which would adversely affect DAMI’s ability to grow its point-of-sale and direct-to-consumer credit products and other consumer credit offerings
and underlying receivables. In addition, DAMI’s agreement with its issuing bank partner has a scheduled expiration date. If DAMI is unable to
extend or execute a new agreement with its issuing bank upon the expiration of its current agreement, or if its existing agreement was terminated or
otherwise disrupted, there is a risk that DAMI would not be able to enter into an agreement with an alternative bank provider on terms that DAMI
would consider favorable or in a timely manner without disruption of its business; and
• different regulatory risks than those applicable to Aaron’s and Progressive's sales and lease ownership businesses, including risks arising from state
credit laws and the offering of open-end credit and the potential that regulators may target DAMI’s operating model and the interest rates it charges.
These risks could have a material negative effect on Progressive, which could result in a material adverse effect on our entire business.


As a public reporting company subject to the rules and regulations established from time to time by the SEC and the New York Stock Exchange, we are
required to, among other things, establish and periodically evaluate procedures with respect to our disclosure controls and procedures. In addition, as a public
company, we are required to document and test our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 so
that our management can certify, on an annual basis, that our internal control over financial reporting is effective.
Prior to their acquisition by us, our Progressive and DAMI businesses were private companies and were not required to establish disclosure controls and
procedures. In particular, unlike our core business, these businesses have not historically operated under a fully documented and annually tested system for
internal control over financial reporting that is required for public companies by Section 404 of the Sarbanes-Oxley Act.
If we fail to establish and maintain effective internal control over financial reporting and disclosure controls and procedures - particularly in our Progressive
and DAMI businesses - we may not be able to accurately report our financial results, or report them in a timely manner, which could cause a decline in our
stock price and adversely affect our results of operations and financial condition. In addition, if our senior management is unable to conclude that we have
effective internal control over financial reporting, or to certify the effectiveness of such controls, or if our independent registered public accounting firm
cannot render an unqualified opinion on management’s assessment and the effectiveness of our internal control over financial reporting, when required, or if
material weaknesses in our internal controls are identified, we could be subject to increased regulatory scrutiny and a loss of public and investor confidence,
which could also have a material adverse effect on our business and our stock price.


Our business involves the storage and transmission of customers’ personal information, consumer preferences and credit card information, as well as
confidential information about our customers, employees, our suppliers and our Company. We also serve as an information technology provider to our
franchisees including storing and processing information related to their customers on our systems. Our information systems are vulnerable to an increasing
threat of continually evolving cybersecurity risks. Any significant compromise or breach of our data security, whether external or internal, or misuse of
employee or customer data, could significantly damage our reputation, cause the disclosure of confidential customer, associate, supplier or Company
information, and result in significant costs, lost revenues or sales, fines, regulatory enforcement actions and lawsuits. For example, we are currently subject to
settlements with the FTC as well as the State of California and the Commonwealth of Pennsylvania regarding our business practices and compliance with
privacy laws in those states, and data breaches of this nature could result in additional penalties under the terms of those settlements.
18