HERBALIFE LTD.

Current report

None.

Previous report

Our actual or perceived failure to comply with privacy, artificial intelligence (AI) and data protection laws, rules, and regulations could materially harm our business, financial condition, and operating results.

Previous report

Our business requires the collection, transmission, and retention of large volumes of confidential and proprietary information, including personal information of our Members, customers, leads, vendors, and employees in various information technology systems that we maintain and in those maintained by third parties with which we interact. For example, we introduced the beta version of our Pro2col platform, which will increase the amount of information collected, transmitted and retained. Anyone who is able to circumvent our security measures or those of our third-party service providers could misappropriate such confidential or proprietary information, including that of third parties such as our Members, cause interruption in our operations, damage our information technology infrastructure, damage our reputation, or otherwise damage our business. We may need to expend significant resources to protect against security breaches or to address problems caused by such breaches, and the potential risk of security breaches may increase as we introduce new technology systems and services. Any actual security breaches could result in legal and financial exposure, including litigation and other potential liability, reduced Member usage of our systems or digital platforms and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, and operating results and our reputation as a brand, business partner, and employer. In addition, employee error or malfeasance or other errors in the storage, use, or transmission of any such information could result in disclosure to third parties. If this should occur, we could incur significant expenses addressing such problems. Since we collect and store Member, customer, and vendor information, including credit card, banking, and consumer health information, and data that may be considered biometric data under certain laws, these risks are heightened. In addition, our role as a credit card merchant may also put us at a greater risk of being targeted by hackers and requires us to comply with certain regulatory requirements. See also the risk factor titled“We depend on the integrity and reliability of our information technology infrastructure, and any related interruptions or inadequacies may have a material adverse effect on our business, financial condition, and operating results.”

Previous report

In addition, the use and handling of certain types of information, including personal, health and financial information, is regulated by evolving and increasingly demanding laws, rules, and regulations, such as the Vietnam Personal Data Protection Decree, the India Digital Personal Data Protection Act, the European Union General Data Protection Regulation, the Brazil Law on General Data Protection, the California Consumer Privacy Act, or the CCPA, as amended by the California Privacy Rights Act, the European Union Payment Services Directive 2, which requires stronger customer authentication for online transactions in that region, the China Personal Information Protection Law, and state consumer health privacy laws, such as Washington’s My Health My Data Act. These laws impose continuing, and at times new, responsibilities on our operations, including, among other things, the collection, deletion, disclosure, and maintenance of personal, health and financial information of our Members and their customers and could present technological challenges and negatively impact our sales. Compliance with these laws, rules, and regulations and potential and actual conflicts amongst them in the various jurisdictions in which we operate have resulted in greater compliance burden and risk and increased costs for us. Furthermore, as we expand our use of AI, we face additional regulatory risks due to the evolving legal landscape relating to AI, with various jurisdictions, including Europe and certain U.S. states, proposing or enacting AI-related laws. For example, certain of our software applications have the ability to utilize AI and we expect our usage of AI to increase with the rollout of our Pro2col platform and the adoption of certain cloud-based software applications, which could increase this risk. As such, it remains uncertain how AI laws and regulations will impact our business, or the associated cost or risks related to compliance therewith or with respect to embedding compliance mechanisms appropriately and effectively into our operations. If we fail to comply with these privacy, data security, and AI laws, rules, and regulations, we could be subject to significant litigation, monetary damages, and regulatory enforcement actions or fines in one or more jurisdictions, which could have a material adverse effect on our operating results.

Previous report

(c) On February 9, 2021, our board of directors authorized a three-year $1.5 billion share repurchase program which had approximately $985.5 million of remaining authorized capacity prior to the share repurchase program expiring on February 9, 2024. This share repurchase program allowed us, which included an indirect wholly-owned subsidiary of Herbalife Ltd., to repurchase our common shares at such times and prices as determined by management, as market conditions warranted, and to the extent Herbalife Ltd.’s distributable reserves were available under Cayman Islands law. The 2024 Credit Facility permits us to repurchase our common shares as long as no default or event of default exists and other conditions, such as specified consolidated leverage ratios, are met. We did not repurchase any of our common shares during the three months ended September 30, 2025.