MALIBU BOATS, INC.

Previous report

With our recent acquisition of Saxdor and our continued operations in Australia, our operations and sales in international markets will require significant management attention, expose us to difficulties presented by international economic, political, legal, and business factors, and may not be successful or produce desired levels of sales and profitability.

Previous report

In March 2026, we acquired Saxdor. Saxdor sells premium adventure dayboats worldwide and has three engineering and manufacturing facilities in Finland and Poland. The acquisition of Saxdor significantly increases our international operations and will require substantial management attention as we integrate Saxdor into our current operations. In addition to our Saxdor acquisition, we continue to sell our products throughout the world and we manufacture some boats in Australia for our Malibu segment.

Previous report

The countries in which we operate, including the U.S., Finland, Poland and Australia, could face economic and geopolitical challenges and may experience significant fluctuations in gross domestic product, interest rates and currency exchange rates, as well as civil disturbances, government instability, nationalization and the imposition of unexpected taxes or other charges by government authorities. This can result in economic and political instability, which could negatively affect our operations in those countries and our ability to sell our boats in those markets.

Previous report

Doing business on a worldwide basis also requires us to comply with the laws and regulations of various foreign jurisdictions. These laws and regulations place restrictions on our operations, trade practices, partners and investment decisions. In particular, our operations are subject to U.S. and foreign anti-corruption and trade control laws and regulations, such as the FCPA, export controls and economic sanctions programs, including those administered by the U.S. Treasury Department’s Office of Foreign Assets Control, or the OFAC. As a result of doing business in foreign countries and with foreign partners, we are exposed to a heightened risk of violating anti-corruption and trade control laws and sanctions regulations.

Previous report

In addition, legal systems in markets in which we operate may have different liability standards, which could make it more difficult for us to enforce our legal rights in such countries. Doing business in countries around the world has and may continue to expose us to heightened risks and negatively impact our earnings and cash flows.

Previous report

Our results after the acquisition of Saxdor may suffer if we do not effectively manage our expanded operations following the acquisition.

Previous report

The size of our business and geographic presence have expanded following our acquisition of Saxdor. Our future success depends, in part, upon our ability to manage this expanded business, which will pose substantial challenges for management, including challenges related to the management and monitoring of additional operations, including in Finland and Poland where Saxdor has three engineering and manufacturing facilities, and associated increased costs and complexity. There can be no assurances we will be successful or that we will realize the benefits from our acquisition of Saxdor.

Previous report

We have incurred and will continue to incur significant transaction expenses and acquisition-related integration costs in connection with the acquisition of Saxdor.

Previous report

We incurred non-recurring, legal and advisory costs in connection with the acquisition of Saxdor and we anticipate that we will incur integration-related charges in connection with the integration of Saxdor. These transaction expenses and integration costs are charged as an expense in the period incurred. The significant transaction costs and integration costs could materially affect our results of operations in the period in which such charges are recorded. Although we believe that the elimination of duplicative costs, as well as the realization of other efficiencies related to the integration of the business, will offset incremental transaction and integration costs over time, this net benefit may not be achieved in the near term, or at all.

Previous report

The Saxdor business may underperform relative to our expectations.

Previous report

We will need to integrate the operations of Saxdor into our business. We may not be able to maintain the levels of revenue, earnings or operating efficiency that we and Saxdor have achieved or might achieve separately. The business and financial performance of Saxdor are subject to certain risks and uncertainties, including the risk of the loss of, or changes to, its relationships with its dealers and suppliers, increased product liability and warranty claims, and negative publicity or other events that could diminish the value of the Saxdor family of brands. We may be unable to achieve the same growth, revenues and profitability that Saxdor achieved in the past.

Previous report

Changes in currency exchange rates can adversely affect our results.

Previous report

A portion of our sales are denominated in a currency other than the U.S. dollar. With our recent acquisition of Saxdor, we anticipate a much larger portion of our sales than in the past will be denominated in a currency other than the U.S. dollar, with most of Saxdor’s sales denominated in the euro. Since our acquisition of Saxdor on March 2, 2026, sales in Europe accounted for approximately 75% of Saxdor’s total revenue. We also continue to sell our other brands worldwide. Consequently, a strong U.S. dollar may adversely affect reported revenues. We maintain a portion of our manufacturing operations in Poland and Australia which partially mitigates the impact of the volatility of the U.S. dollar in those countries. A portion of our selling, general and administrative costs are transacted in the Polish zloty and Australian dollars as a result.

Previous report

We also sell U.S. manufactured products into certain international markets in U.S. dollars, including the sale of products into Canada, Europe and Latin America. Demand for our products in these markets may also be adversely affected by a volatile U.S. dollar. We do not currently use hedging or other derivative instruments to mitigate our foreign currency risks.

Previous report

Risks and requirements related to transacting business in foreign countries may result in increased liabilities including penalties and fines as well as reputational harm.

Previous report

Our activities are subject to various trade and economic sanctions and export control laws and regulations administered by the United States, including the U.S. Department of Commerce’s Export Administration Regulations and the U.S. Department of the Treasury’s Office of Foreign Assets Control economic and trade sanctions programs, and other laws and regulations of a similar nature administered by foreign governmental authorities with relevant jurisdiction, including Australia, Finland, and Poland. We also are subject to various anti-corruption laws and regulations, including the U.S. Foreign Corrupt Practices Act and U.K. Bribery Act. These laws and regulations may impose restrictions on our business, including our ability to export, reexport, or transfer our products or provide our services to certain countries, territories, entities, or individuals, without authorization from the cognizant government authorities. Relevant licensing processes can be time-consuming, and favorable outcomes cannot be guaranteed.

Previous report

These laws and regulations are subject to frequent change, and compliance can be time- and resource-intensive. Although we have training programs in place for our employees, we cannot guarantee that our rules will be followed, nor can we guarantee full compliance with applicable export control and sanctions laws and regulations. Violations of these regimes can result in significant financial penalties, loss of licensing privileges, other administrative penalties, reputational harm, and adverse business impact.

Previous report

Climatic events, including hurricanes, tornadoes, or other disruptions, may adversely impact our operations and financial condition, disrupt the business of our suppliers, and may not be adequately covered by insurance.

Previous report

Climatic events in the areas where we operate have caused, and future climatic events may cause, disruptions and in some cases delays or suspensions in our operations that may adversely impact our business. We rely on the continuous operation of our facilities in Tennessee, Florida, Kansas, California, Poland, Finland and Australia. Any natural or environmental disaster to our facilities due to fire, flood, hurricanes, earthquake, or other severe climatic events could adversely affect our business, financial condition and results of operations. For example, we have plants located in regions of the United States, such as Florida and Kansas, that have been and may be exposed to extreme weather, such as tropical storms, hurricanes, and tornadoes. An increased frequency and/or severity of storms, hurricanes, or tornadoes could impair our ability to operate by severely damaging our facilities and restricting our ability to deliver products to our customers. The occurrence of any disruption at any of our facilities, even for a short period of time, may have an adverse effect on our productivity and profitability, during and after the period of the disruption, including by causing delays in receiving supplies from our vendors and creating logistical challenges for delivery of our product to our dealers and customers. These disruptions may also cause personal injury and loss of life, severe damage to or destruction of property and equipment and environmental damage. Although we maintain property, casualty and business interruption insurance of the types and in the amounts that we believe are customary for the industry, we are not fully insured against all potential natural disasters or other disruptions to our facilities.

Previous report

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, and sensitive third-party data (collectively, sensitive information).

Previous report

Our data processing activities subject us to numerous data privacy and security obligations, such as laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).

Previous report

Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, ( "CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Previous report

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation ("EU GDPR"), the United Kingdom’s GDPR ("UK GDPR") (collectively, "GDPR"), and Australia’s Privacy Act impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Previous report

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto ("DPF

Previous report

Framework") (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the DPF Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

Previous report

Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we share consumer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Previous report

Our employees and personnel use generative artificial intelligence ("AI") technologies and/or automated decision-making technologies to perform their work, and the disclosure and use of personal data in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating AI and/or automated decision-making technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. We also use machine learning and AI technologies, including generative AI, in our products and services. The development and use of AI technologies present various privacy and security risks that may impact our business. AI technologies are subject to privacy and data security laws, as well as increasing regulation and scrutiny. Further, countries and states are applying their data and consumer protection laws to AI technologies, and particularly generative AI and interactive chatbots. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI technologies, such as the EU’s AI Act, the Colorado Artificial Intelligence Act, the Utah Artificial Intelligence Policy Act, and the CCPA regulations on automated decision-making technology. For example, the EU AI Act sets out a risk-based framework, subjecting certain AI technologies to numerous compliance obligations, including transparency, conformity and risk assessment, monitoring and human oversight requirements. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. Certain of our activities subject us to the EU AI Act and depending on how the EU AI Act is implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and services to comply with such obligations. We expect other jurisdictions will adopt similar laws. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous report

In addition to data privacy and security laws, we are, or may be contractually subject to industry standards adopted by industry groups and, we are, or may become subject to such obligations in the future. For example, we are or may be subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses.

Previous report

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials and other statements, regarding data privacy, artificial intelligence, and data security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Previous report

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; and orders to destroy or not use personal data.

Previous report

In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or changes to our business model or operations.

Previous report

If our information technology systems or those of third parties with whom we work or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.

Previous report

In the ordinary course of our business, we and the third parties with whom we work, process sensitive information, including intellectual property; our proprietary business information and that of our dealers, suppliers, and other business partners; and personal information of consumers and employees. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Previous report

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. We have in the past been targeted by such attacks and likely will continue to be targeted in the future. In particular, severe ransomware attacks are becoming more prevalent – particularly for companies like ours that are engaged in critical infrastructure or manufacturing – and can lead to significant interruptions in our operations, ability to provide our products, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Previous report

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

Previous report

We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, commercial transactions, customer interactions, manufacturing, branding, employee tracking, and other functions. We also rely on third parties to provide other products, services, parts, to sell our products or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or that of the third parties with whom we work have not been compromised.

Previous report

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, detect and remediate all such vulnerabilities on a timely basis. Further, we have and may in the future experience delays in deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Previous report

Any of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our products. For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future. Additionally, if we experience a security incident impacting the electronic components embedded into our products, such as the navigation or operating systems, this could prevent or cause customers to stop using our products, deter new customers from using our products, adversely affect the reputation of our business, or cause us to experience other similar harms.

Previous report

We expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences.

Previous report

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business.