What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-12-03 compared with 2024-12-11 · 36 added, 18 removed, 273 unchanged (17% of the section changed)

16 unchanged sentences

Volatility in and disruption of the capital markets and changes in the economy has and may continue to significantly affect our assets under management and revenues.

The securities markets are inherently volatile and may be affected by factors beyond our control, including global economic conditions, industry trends, interest and inflation rate fluctuations, political factors, the imposition of economic sanctions, trade policies and tariffs, public health crises, natural disasters, geopolitical instability and war, including the invasion by Russia into Ukraine and the conflict between Israel and Hamas, as well as actions taken by other countries in response to such conflicts, and other factors that are difficult to predict.

Because our assets under management is largely concentrated in equity products, our results are particularly susceptible to downturns in the equity markets.

89 unchanged sentences

If we are unable to access sufficient capital on acceptable terms, our business could be adversely impacted.

We may use artificial intelligence technologies in our business and operations, and challenges with effectively managing its use could harm our business and expose us to costly liability.

The use of artificial intelligence technologies by us and others may exacerbate or create new and unpredictable competitive, operational, legal, and regulatory risks to our business.

There is substantial uncertainty about the extent to which artificial intelligence technologies will result in dramatic changes throughout the world, and we may not be able to anticipate, prevent, mitigate, or remediate all of the potential risks, challenges, or impacts of such changes.

These changes could potentially disrupt, among other things, our business model and operational processes.

Some of our competitors may incorporate artificial intelligence into their services or operational processes more quickly or more successfully than us, or more effectively use artificial intelligence to drive internal efficiencies or enhance services.

If we are unable to adequately advance our capabilities in these areas, or do so at a slower pace than others in our industry, we may be at a competitive disadvantage.

We may incorporate the use of artificial intelligence technologies into our services and operational processes.

There are significant risks involved in developing and deploying artificial intelligence technologies, and there can be no assurance that the use of artificial intelligence technologies will enhance our services or be beneficial to our business, including our efficiency or profitability.

Data that artificial intelligence applications utilize are likely to contain a degree of inaccuracy and error, which could result in flawed algorithms.

This could reduce the effectiveness of artificial intelligence technologies and adversely impact us and our operations to the extent we rely on the work product of such technology in our operations.

There is also a risk that artificial intelligence tools or applications may be misused or misappropriated by our employees.

For example, an employee may input confidential information, including material non-public information or personally identifiable information, into artificial intelligence technologies, resulting in such information becoming part of a dataset that is accessible by third-party artificial intelligence applications and users.

Such actions could subject us to legal and regulatory investigations or actions.

Further, we may not be able to control how third-party artificial intelligence technologies that we choose to use are developed or maintained, or how data we input is used or disclosed, even where we have sought contractual protections with respect to these matters.

The misuse or misappropriation of our data could have an adverse impact on our reputation and could subject us to legal and regulatory investigations or actions.

In addition, artificial intelligence technologies are continuously evolving, and we may incur costs to adopt and deploy artificial intelligence technologies that could become obsolete earlier than expected, and there can be no assurance that we will realize the desired or anticipated benefits from artificial intelligence technologies.

There is also uncertainty in the legal and regulatory landscape for artificial intelligence technologies and any laws, regulations, or industry standards adopted in response to the emergence of artificial intelligence technologies may be burdensome, could entail significant costs, and may restrict or impede our ability to successfully deploy artificial intelligence technologies efficiently and effectively.

Failure to establish adequate controls and risk management policies, as well as circumvention of established controls and policies by employees, could harm us by impairing our ability to attract and retain investors in the Hennessy Funds and by subjecting us to significant legal liability, regulatory scrutiny, and reputational harm.

15 unchanged sentences

(ii) the Hennessy Focus Fund (13% of average assets under management);

(iii) the Hennessy Gas Utility Fund (12% of average assets under management);

(iv) the Hennessy Japan Fund (10% of average assets under management);

and (v) the Hennessy Cornerstone Growth Fund (9% of average assets under management).

(iii) Hennessy Cornerstone Growth Fund (12% of average assets under management);

(iv) the Hennessy Gas Utility Fund (11% of average assets under management);

and (v) the Hennessy Japan Fund (9% of average assets under management).

Consequently, our revenues followed a similar pattern of concentration:

1 unchanged sentence

(b) the Hennessy Focus Fund (16% of total revenue);

(d) the Hennessy Cornerstone Growth Fund (9% of total revenue);

and (e) the Hennessy Cornerstone Value Fund (8% of total revenue).

(d) the Hennessy Japan Fund (10% of total revenue);

and (e) the Hennessy Gas Utility Fund (7% of total revenue).

As a result, our operating results are particularly dependent upon the performance of a small number of funds and our ability to maintain and grow assets under management in these funds.

38 unchanged sentences

Moreover, in order to retain key personnel, we may be required to increase compensation to such individuals, resulting in additional expense.

We utilize a unitary fee structure for the Hennessy Stance ESG ETF, and we bear the risk that the Fund ’ s operating expenses may increase and lead to a reduction in our revenues from the fund.

The Hennessy Stance ESG ETF pays us a unitary fee under its investment advisory agreement with us.

We utilize a unitary fee structure for the Hennessy Sustainable ETF, and we bear the risk that the Fund ’ s operating expenses may increase and lead to a reduction in our revenues from the fund.

The Hennessy Sustainable ETF pays us a unitary fee under its investment advisory agreement with us.

Under a unitary fee structure, we bear all operating expenses incurred in connection with providing services to the fund.

22 unchanged sentences

Generally, if a sub‑advisor experiences a change of control but we do not, we could continue acting as an advisor to the applicable Hennessy Fund, but the shareholders of such Hennessy Fund would have to approve a new sub‑advisory agreement for the sub‑advisor.

However, for the Hennessy Stance ESG ETF, we have the authority to appoint and replace unaffiliated sub‑advisors and to enter into and make material amendments to the related sub‑advisory agreements without shareholder approval.

This is because we sought and received an exemptive order from the SEC in 2023 to operate under a manager of managers structure and subsequently obtained shareholder approval to implement such structure for the Hennessy Stance ESG ETF.

However, for the Hennessy Sustainable ETF, we have the authority to appoint and replace unaffiliated sub‑advisors and to enter into and make material amendments to the related sub‑advisory agreements without shareholder approval.

Under the manager of managers structure, we have ultimate responsibility, subject to oversight of and approval by the Hennessy Funds’ Board of Trustees, for overseeing the Hennessy Funds’ unaffiliated sub-advisors and recommending their hiring, termination, or replacement.

1 unchanged sentence

Any interruption or termination of our sub‑advisory relationships, whether due to a change of control or any other circumstance, could affect our ability to market our sub‑advised funds and result in a reduction in assets under management, which would adversely affect our revenues.

We depend on information technology, and any failures of or damage to, attack on or unauthorized access to our information technology systems or facilities, or those of third parties with which we do business, including as a result of cyber attacks, could result in significant limits on our ability to conduct our operations and activities, costs, and reputational damage.

We rely on information technology and infrastructure.

Any failures of, damage to, attack on or unauthorized access to our systems or facilities, or those of third parties with whom we conduct business, including as a result of cyber ‑ attacks, could significantly limit our ability to conduct our operations effectively, increase our costs, and cause reputational damage.

We use software and related technologies throughout our business and also utilize third-party vendors who use software and related technologies to provide services to us and the Hennessy Funds.

9 unchanged sentences

While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, certain errors or actions could be repeated or compounded before they are discovered and remediated, and communication to the public, regulators, shareholders, and investors in the Hennessy Funds may be inaccurate, any or all of which could further increase the costs and consequences of an information security incident.

If any of these events were to occur, we could suffer a financial loss, a disruption of our business, liability to the Hennessy Funds and their investors, regulatory intervention, or reputational damage, any of which could have a material adverse effect on our business, results of operations, and financial condition.

We also may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures.

If material information security incidents occur in the future, we could experience financial losses, business disruptions, liability to the Hennessy Funds and their investors, regulatory intervention, or reputational damage, any of which could be material and could materially adversely affect our business, results of operations, and financial condition.

We also may be required to expend significant additional resources to strengthen our protective measures or to investigate and remediate vulnerabilities or other exposures.

In addition, our cybersecurity insurance may not cover all losses and damages from such events and our ability to maintain or obtain sufficient insurance coverage in the future may be limited.

Finally, cybersecurity and data privacy are high priorities for many regulators, and many jurisdictions have enacted laws and regulations in these areas.

Enactment of privacy laws or regulations have, and may continue to, result in additional costs of compliance or litigation.

In addition, while we strive to comply with the relevant laws and regulations, any failure to comply could result in regulatory investigations and penalties as well as negative publicity, which could materially adversely affect our business, results of operations, and financial condition.

Finally, cybersecurity and data privacy are priorities for many regulators worldwide, and many jurisdictions have enacted laws and regulations in these areas.

Compliance with evolving privacy laws and cybersecurity regulations has resulted, and may continue to result, in additional costs of compliance or potential litigation exposure.

While we strive to comply with applicable laws and regulations, any failure to do so could result in regulatory investigations, penalties, or negative publicity, any of which could materially adversely affect our business, results of operations, and financial condition.

We may be required to forego all or a portion of our fees under our investment advisory agreements with the Hennessy Funds.

55 unchanged sentences

We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third‑party information technology vendor), the use of a third‑party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular penetration testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan.

We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third‑party information technology vendor), the use of a third‑party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan.

We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors