What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-05-01 compared with 2023-11-08 · 25 added, 30 removed, 2 unchanged (96% of the section changed)

1 unchanged sentence

Except as set forth below, there have been no material changes to those factors previously disclosed in our 2023 Annual Report on Form 10-K.

The failure to maintain the integrity of our information and other systems or customer information can result in damage to our reputation, subject us to fines, payment of damages, lawsuits and restrictions on our use of data, and have a material adverse effect on our business, financial condition, and results of operations.

We collect and process information relating to our employees, guests, and others for various business purposes, including marketing and promotional purposes.

The collection and use of personal data are governed by privacy laws and regulations enacted by the various states, the United States and other jurisdictions around the world.

Privacy laws and regulations continue to evolve and on occasion may be inconsistent (or conflict) between jurisdictions.

Various federal, state and foreign legislative or regulatory bodies may enact or adopt new or additional laws and regulations concerning privacy, data retention, data transfer, and data protection.

For example, California has a comprehensive privacy law, known as the California Consumer Privacy Act of 2018 (“CCPA”), which provides some of the strongest privacy requirements in the United States.

The CCPA was amended by the California Privacy Rights Act that went into effect in 2023.

In addition, new privacy requirements went into effect in 2023 in Colorado, Connecticut, Utah, and Virginia.

Outside the United States, the European Union has adopted a data protection regulation known as the General Data Protection Regulation that provides data subjects with significant privacy-related rights and imposes operational and compliance requirements on organizations with significant penalties for non-compliance.

Other jurisdictions including Canada and China have also amended or adopted new privacy laws and/or requirements which often include similar requirements and obligations.

There may be risks and uncertainties associated with these and other privacy laws and regulations including their interpretation and implementation, as well as the potential extraterritorial effect of certain privacy laws and regulations.

Compliance with applicable privacy laws and regulations increases our operating costs and could adversely impact our ability to market our products, properties and services to our guests.

In addition, non-compliance with applicable privacy laws and regulations by us (or in some circumstances non-compliance by third parties engaged by us), including accidental loss, inadvertent disclosure, unapproved dissemination or a breach of security on systems storing our customer data can result in damage to our reputation, subject us to fines, payment of damages, lawsuits or restrictions on our use or transfer of data, and have a material adverse effect on our business, financial condition, and results of operations.

We rely on proprietary and commercially available systems, software, and tools to provide security for processing of customer and employee information, such as payment card and other confidential or proprietary information.

Our data security measures are reviewed and evaluated regularly;

however, they might not protect us against increasingly sophisticated and aggressive threats, like the Cybersecurity Issue that affected us in September 2023.

We also rely extensively on our information and other systems and those of third parties to process transactions, maintain and communicate information, and manage our businesses, including at our properties and on our website and digital platforms.

Disruptions in these systems, through cyber-attacks or otherwise, have in the past and can in the future be expected to impact our ability to service our customers and adversely affect our business, financial condition, and results of operations.

This can occur notwithstanding the data security measures and disaster recovery plans that we have in place.

Further, our systems are not fully redundant and our disaster recovery planning cannot account for all possible scenarios.

There has been an increase in criminal cybersecurity attacks against companies (and third-party service providers) where systems have been breached, businesses disrupted, and customer, employee, and other company information has been compromised or destroyed.

Our systems and data, including those we maintain with our third-party service providers, have been subject to cybersecurity breaches in the past of varying degrees and are expected to be subject to cybersecurity breaches in the future.

Our third-party information system and other service providers face risks relating to cybersecurity similar to ours, and we do not directly control any of such parties’ information security or other operations.

A significant theft, loss or fraudulent use of customer or company data maintained by us or by a third-party service provider could have an adverse effect on our reputation, cause a material disruption to our operations, and result in remediation expenses, regulatory

penalties and litigation by customers and other parties whose information was subject to such attacks, all of which could have a material adverse effect on our business, results of operations and cash flows.

While we maintain cybersecurity insurance to assist in the cost of recovery from a significant cyber event, such coverage may not be sufficient.

A cybersecurity incident also could require that we expend significant additional resources on remediation, restoration, and enhancement of our information technology and other systems.

By way of example, in September 2023, we had a Cybersecurity Issue affecting certain of our systems, in which criminal actors obtained certain personal information of some of our customers.

Among other things, this issue resulted in system shutdowns that created operational disruptions at our domestic properties, adversely affected revenues, and subjected us to litigation.

For more information, see “Cybersecurity Issue” in Part I, Item 2 - “Management’s Discussion and Analysis of Financial Condition and Results of Operations” as well as “Cybersecurity litigation” in Part I, Item 1, Note 9 to the accompanying consolidated financial statements.

Our substantial indebtedness and significant financial commitments, including our rent payments and guarantees we provide of the indebtedness of the landlords of Bellagio, Mandalay Bay.

and MGM Grand Las Vegas could adversely affect our operations and financial results and impact our ability to satisfy our obligations .

As of March 31, 2024, we had approximately $6.3 billion of principal amount of indebtedness outstanding on a consolidated basis, including $3.0 billion of outstanding indebtedness of MGM China.

Any increase in the interest rates applicable to our existing or future borrowings would increase the cost of our indebtedness and reduce the cash flow available to fund our other liquidity needs.

We do not guarantee MGM China’s obligations under its debt agreements and, to the extent MGM China was to cease to produce cash flow sufficient to service its indebtedness, our ability to make additional investments into MGM China is limited by the covenants in our existing senior credit facility.

In addition, our substantial indebtedness and significant financial commitments could have important negative consequences on us, including:

• increasing our exposure to general adverse economic and industry conditions;

• limiting our flexibility to plan for, or react to, changes in our business and industry;

• limiting our ability to borrow additional funds for working capital requirements, capital expenditures, debt service requirements, execution of our business strategy (including returning value to our shareholders) or other general operating requirements;

• making it more difficult for us to make payments on our indebtedness;

• placing us at a competitive disadvantage compared to less-leveraged competitors.

We currently also provide shortfall guarantees of the $3.01 billion and $3.0 billion principal amount of indebtedness (and any interest accrued and unpaid thereon) of the landlords of Bellagio and Mandalay Bay and MGM Grand Las Vegas, respectively.

The terms of each guarantee provide that, after the lenders have exhausted certain remedies to collect on the obligations under the underlying indebtedness, we would then be responsible for any shortfall between the value of the collateral and the debt obligation, which amount may be material, and we may not have sufficient cash on hand to fund any such obligation to the extent it is triggered in the future.

We also provide for guarantees (i) in the amount of 12.65 billion yen (approximately $84 million as of March 31, 2024) for 50% of Osaka IR KK’s obligations to Osaka under various agreements related to the venture’s development of an integrated resort in Osaka, Japan and (ii) of an uncapped amount to provide funding to Osaka IR KK, if necessary, for the completion of the construction and full opening of the integrated resort.

The guarantees expire when the obligations relating to the full opening of the integrated resort are fulfilled.

If we do not have sufficient cash on hand to satisfy any obligations with respect to any of these guarantees or our other financial commitments, we may need to raise capital, including incurring additional indebtedness, in order to satisfy our obligation.

There can be no assurance that any financing will be available to us, or, if available, will be on terms that are satisfactory to us.

Under the terms of MGM Grand Paradise’s concession, MGM Grand Paradise is required to implement certain investments in gaming and non-gaming projects, for which the non-gaming commitment is subject to increase if market-wide Macau annual gross gaming revenue reaches a specified level.

There can be no assurance, however, that MGM Grand Paradise will have sufficient cash on hand to fund these obligations, including any increased investment amounts to the extent they are triggered in the future, or that it would be able to obtain financing to fund these obligations on satisfactory terms or at all.

If MGM Grand Paradise is unable to satisfy its investment commitments, its concession contract may be subject to termination by the Macau government.

Moreover, our businesses are capital intensive.

For our owned, leased and managed properties to remain attractive and competitive, we must periodically invest significant capital to keep the properties well-maintained, modernized and refurbished.

The leases for our operating properties have fixed rental payments (with annual escalators) and also require us to apply a percentage of net revenues generated at the leased properties to capital expenditures at those properties.

Such investments require an ongoing supply of cash and, to the extent that we cannot fund expenditures from cash generated by operations, funds must be borrowed or otherwise obtained.

Similarly, development projects, including any potential future development of an integrated resort in Japan, strategic initiatives, including positioning BetMGM as a leader in online sports betting and iGaming, investments in the growth of our international digital gaming business, and acquisitions could require significant capital commitments, the incurrence of additional debt, guarantees of third-party debt or the incurrence of contingent liabilities, any or all of which could have an adverse effect on our business, financial condition, results of operations, and cash flows.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors