T-Mobile US Inc.: 10-K Risk Factor Changes

We are subject to regulatory oversight by various federal, state, and local agencies, as well as judicial review and actions, on issues related to the wireless industry that include, but are not limited to, roaming, interconnection, spectrum allocation and licensing, facilities siting, pole attachments, intercarrier compensation, Universal Service Fund (“USF”), 911 services, robocalling/robotexting, consumer protection, consumer privacy, and cybersecurity. We are also subject to regulations in connection with other aspects of our business, including device financing and insurance activities. The FCC regulates the licensing, construction, modification, operation, ownership, sale, and interconnection of wireless communications systems, as do some state and local regulatory agencies. In particular, the FCC imposes significant regulation on licensees of wireless spectrum with respect to how radio spectrum is used by licensees, the nature of the services that licensees may offer and how the services may be offered, and the resolution of issues of interference between operators in the same or adjacent spectrum bands. Changes necessary to resolve interference issues or concerns may have a significant impact on our ability to fully utilize our spectrum. Additionally, the FTC and other federal and state agencies have asserted that they have jurisdiction over some consumer protection matters, and the elimination and prevention of anticompetitive business practices with respect to the provision of wireless products and services. We cannot assure that the FCC or any other federal, state, or local agencies will not adopt regulations, change or discontinue existing programs, implement new programs, or take enforcement or other actions that would adversely affect our business, impose new costs, or require changes in current or planned operations, including timing of the shutdown of legacy technologies. For example, in 2015 and 2016, the FCC established net neutrality and privacy regimes that applied to our operations. Both sets of rules potentially subjected some of our initiatives and practices to more burdensome requirements and heightened scrutiny by federal and state regulators, the public, edge providers, and private litigants regarding whether such initiatives or practices are compliant. While the FCC rules were largely rolled back in 2017, the FCC recently initiated a rulemaking proceeding proposing to reinstate the net neutrality rules, to reassert authority in the broadband privacy arena, and to subject broadband offerings to other forms of regulatory oversight. In addition, the current FCC updated transparency obligations to require nutrition-style broadband label disclosures in 2024 that could prompt regulatory inquiries. In addition, some states and other jurisdictions have enacted laws in these areas (including, for example, California and other states’ net neutrality laws, the CCPA and CPRA as discussed below) and others are considering enacting similar laws. It also is uncertain what rules may be promulgated under the current administration (e.g., the FTC has discussed promulgating privacy rules), perpetuating the risk and uncertainty regarding the regulatory environment and compliance around these issues. In addition, states are increasingly focused on the quality of service and support that wireless communications service providers provide to their customers and several states have proposed or enacted new and potentially burdensome regulations in this area. We also face potential investigations by, and inquiries from or actions by state public utility commissions. We also cannot assure that Congress will not amend the Communications Act, from which the FCC obtains its authority, and which serves to limit state authority, or enact other legislation in a manner that could be adverse to our business. Further, government funded programs, such as the Affordable Connectivity Program (ACP) and the Emergency Connectivity Fund (ECF) or Lifeline program, may discontinue due to the exhaustion of funding, which could result in the reduction in low-income customers and the associated revenue. Failure to comply with applicable regulations could have a material adverse effect on our business, financial condition, and operating results. We could be subject to fines, forfeitures, and other penalties (including, in extreme cases, revocation of our spectrum licenses) for failure to comply with the FCC or other governmental regulations, even if any such noncompliance was unintentional. The loss of any licenses, or any related fines or forfeitures, could adversely affect our business, financial condition, and operating results.

We are subject to regulatory oversight by various federal, state, and local agencies, as well as judicial review and actions, on issues related to the wireless industry that include, but are not limited to, roaming, interconnection, spectrum allocation and licensing, facilities siting, pole attachments, intercarrier compensation, Universal Service Fund, 911 services, consumer protection, consumer privacy, and cybersecurity. We are also subject to regulations in connection with other aspects of our business, including device financing and insurance activities. The FCC regulates the licensing, construction, modification, operation, ownership, sale, and interconnection of wireless communications systems, as do some state and local regulatory agencies. In particular, the FCC imposes significant regulation on licensees of wireless spectrum with respect to how radio spectrum is used by licensees, the nature of the services that licensees may offer and how the services may be offered, and the resolution of issues of interference between operators in the same or adjacent spectrum bands. Changes necessary to resolve interference issues or concerns may have a significant impact on our ability to fully utilize our spectrum. As an example, we recently won spectrum licenses in the so-called “C band” to support our continued rollout of 5G technology and services. There have been concerns raised that use of this spectrum by wireless carriers for 5G deployment could interfere with the altimeters in certain aircraft, and there is an ongoing discussion between the industry, the FCC, and the FAA as to whether and how 5G operations should be limited around airports. Additionally, the FTC and other federal and state agencies have asserted that they have jurisdiction over some consumer protection matters, and the elimination and prevention of anticompetitive business practices with respect to the provision of wireless products and services. We cannot assure that the FCC or any other federal, state, or local agencies will not adopt regulations, implement new programs, or take enforcement or other actions that would adversely affect our business, impose new costs, or require changes in current or planned operations, including timing of the shutdown of legacy technologies. For example, in response to the Pandemic, the California Public Utilities Commission adopted a resolution providing a moratorium on customer disconnects and late fees for certain California customers facing financial hardship. Additionally, in 2015 and 2016, the FCC established net neutrality and privacy regimes that applied to our operations. Both sets of rules potentially subjected some of our initiatives and practices to more burdensome requirements and heightened scrutiny by federal and state regulators, the public, edge providers, 19 19 19 Table of Contents Table of Contents and private litigants regarding whether such initiatives or practices are compliant. While the FCC rules were largely rolled back in December 2017, the current FCC updated transparency obligations to require nutrition-style broadband label disclosures effective potentially in 2023 that could prompt regulatory inquiries, and the FCC could decide to establish new net neutrality requirements. In addition, some states and other jurisdictions have enacted laws in these areas (including, for example, California and other states’ net neutrality laws, the CCPA and CPRA as discussed below) and others are considering enacting similar laws. It also is uncertain what rules may be promulgated under the current administration (e.g., the FTC has discussed promulgating privacy rules), perpetuating the risk and uncertainty regarding the regulatory environment and compliance around these issues. In addition, states are increasingly focused on the quality of service and support that wireless communications service providers provide to their customers and several states have proposed or enacted new and potentially burdensome regulations in this area. We also face potential investigations by, and inquiries from or actions by state public utility commissions. We also cannot assure that Congress will not amend the Communications Act, from which the FCC obtains its authority, and which serves to limit state authority, or enact other legislation in a manner that could be adverse to our business. Failure to comply with applicable regulations could have a material adverse effect on our business, financial condition, and operating results. We could be subject to fines, forfeitures, and other penalties (including, in extreme cases, revocation of our spectrum licenses) for failure to comply with the FCC or other governmental regulations, even if any such noncompliance was unintentional. The loss of any licenses, or any related fines or forfeitures, could adversely affect our business, financial condition, and operating results.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”). Additionally, to offer services to our customers and operate our business, we utilize a number of applications and systems, including those we own and operate as well as others provided by third-party providers, such as cloud services (collectively, “Systems”). We are subject to persistent cyberattacks and threats to our business from a variety of bad actors, many of whom attempt to gain unauthorized access to and compromise Confidential Information and Systems. In some cases, the bad actors exploit bugs, errors, misconfigurations or other vulnerabilities in our Systems to obtain Confidential Information. In other cases, these bad actors may obtain unauthorized access to Confidential Information by exploiting insider access or utilizing log in credentials taken from our customers, employees, or third-party providers through credential harvesting, social engineering or other means. Other bad actors aim to cause serious operational disruptions to our business and Systems through ransomware or distributed denial of services attacks. Cyberattacks against companies like ours have increased in frequency and scope of potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments. 12 12 12 Table of Contents Table of Contents In addition, we routinely rely upon third-party providers whose products and services are used in our business. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information. In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver’s license/identification numbers. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 17 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization that was only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features. Our investigation indicated that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. In addition to the August 2021 cyberattack and the January 2023 cyberattack, we have experienced other unrelated non-material incidents involving unauthorized access to certain Confidential Information and Systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property. Some of these incidents have occurred at third-party providers, including third parties who provide us with various Systems and others who sell our products and services through retail locations or take care of our customers. Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers, including through our cybersecurity programs or policies. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers, including through our cybersecurity programs or policies, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. We also expect that threat actors will continue to gain sophistication including in the use of tools and techniques (such as artificial intelligence) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more challenging for us to identify, investigate and recover from future cyberattacks in a timely and effective manner. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities or unsophisticated security measures, which exposes us to significant cybersecurity, operational, and financial risks. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Our business involves the receipt, storage, and transmission of confidential information about our customers, such as sensitive personal, account and payment card information, confidential information about our employees and suppliers, and other sensitive information about our Company, such as our business plans, transactions, financial information, and intellectual property (collectively, “Confidential Information”). We are subject to persistent cyberattacks and threats to our networks, systems, and supply chain from a variety of bad actors, many of whom attempt to gain access to and compromise Confidential Information by exploiting bugs, errors, misconfigurations or other vulnerabilities in our networks and other systems (including purchased and third-party systems) or by engaging in credential harvesting or social engineering. In some cases, these bad actors may obtain unauthorized access to Confidential Information utilizing credentials taken from our customers, employees, or third parties. Other bad actors aim to cause serious operational disruptions to our business or networks through other means, such as through ransomware or distributed denial of services attacks. Cyberattacks against companies like ours have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance. They are perpetrated by a variety of groups and persons, including state-sponsored parties, malicious actors, employees, contractors, or other unrelated third parties. Some of these persons reside in jurisdictions where law enforcement measures to address such attacks are ineffective or unavailable, and such attacks may even be perpetrated by or at the behest of foreign governments. In addition, we routinely provide certain Confidential Information to third-party providers whose products and services are used in our business operations, including as part of our IT systems, such as cloud services. These third-party providers have experienced in the past, and will continue to experience in the future, cyberattacks that involve attempts to obtain unauthorized access to our Confidential Information and/or to create operational disruptions that could adversely affect our business, and these providers also face other security challenges common to all parties that collect and process information. In August 2021, we disclosed that our systems were subject to a criminal cyberattack that compromised certain data of millions of our current customers, former customers, and prospective customers, including, in some instances, social security numbers, names, addresses, dates of birth and driver’s license/identification numbers. With the assistance of outside cybersecurity experts, we located and closed the unauthorized access to our systems and identified current, former, and prospective customers whose information was impacted and notified them, consistent with state and federal requirements. We have incurred certain cyberattack-related expenses, including costs to remediate the attack, provide additional customer support and enhance 12 12 12 Table of Contents Table of Contents customer protection, and expect to incur additional expense in future periods resulting from the attack. For more information, see “Recent Cyberattacks” in the Overview section of our Management’s Discussion and Analysis of Financial Condition and Results of Operations. As a result of the August 2021 cyberattack, we are subject to numerous claims, lawsuits and regulatory inquiries, the ongoing costs of which may be material, and we may be subject to further regulatory inquiries and private litigation. For more information, see “– Contingencies and Litigation – Litigation and Regulatory Matters” in Note 19 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements. In January 2023, we disclosed that a bad actor was obtaining data through a single Application Programming Interface (“API”) without authorization. Based on our investigation to date, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features. The result from our investigation to date indicates that the bad actor(s) obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set. We believe that the bad actor first retrieved data through the impacted API starting on or around November 25, 2022. We continue to investigate the incident and have notified individuals whose information was impacted consistent with state and federal requirements. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we may incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. In addition to the recent cyberattacks, we have experienced other unrelated immaterial incidents involving unauthorized access to certain Confidential Information. Typically, these incidents have involved attempts to commit fraud by taking control of a customer’s phone line, often by using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers’ private information, including credit card information, financial data, social security numbers or passwords, and to certain of our intellectual property. Our procedures and safeguards to prevent unauthorized access to Confidential Information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations. These preventative actions require the investment of significant resources and management time and attention. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third-party providers. While T-Mobile may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third-party providers, will adequately repel a significant cyberattack or prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of Confidential Information, unauthorized access to our networks or systems or exploits against third-party environments, or that we, or our third-party providers, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. We expect to continue to be the target of cyberattacks, given the nature of our business, and we expect the same with respect to our third-party providers. If we fail to protect Confidential Information or to prevent operational disruptions from future cyberattacks, there may be a material adverse effect on our business, reputation, financial condition, cash flows, and operating results.

Since 2020, a number of states have enacted new, comprehensive privacy laws that create new data privacy rights for residents of those states and new compliance obligations for us and the industry in general, in addition to private rights of action for certain types of data breaches. These include the California Consumer Privacy Act (“CCPA”), recently modified by the California Privacy Rights Act (“CPRA”), similar laws in Colorado, Connecticut, Utah, and Virginia that went into effect in 2023, and similar laws in Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas that will go into effect in the next few years. Pending legislation in several other states would create similar laws elsewhere. All of these new privacy laws and others that we expect to be developed and enacted going forward will impose additional data protection obligations and 19 19 19 Table of Contents Table of Contents potential liability on companies such as ours doing business in those states. Further, privacy laws also limit our ability to collect and use personal information. We have incurred and will continue to incur significant implementation costs to ensure compliance with the CCPA, the CPRA, new privacy laws in other states, and their related regulations, including managing the complexity of laws that vary from state to state. Both federal and state governments are considering additional privacy laws and regulations which, if passed, could further impact our business, strategies, offerings, and initiatives and cause us to incur further costs. Any actual or perceived failure to comply with the CCPA, CPRA, other data privacy laws or regulations, or related contractual or other obligations, or any perceived privacy rights violation, could lead to investigations, claims, and proceedings by governmental entities and private parties, damages for contract breaches, and other significant costs, penalties, and other liabilities, as well as harm to our reputation and market position.

In January 2020, the California Consumer Privacy Act (the “CCPA”) became effective, creating new data privacy rights for California residents and new compliance obligations for us and industry in general, in addition to private rights of action for certain types of data breaches. Moreover, new privacy laws are being developed and/or enacted in many jurisdictions, for example, in Colorado, Utah, Connecticut, Virginia, and in California, where the California Privacy Rights Act (“CPRA”) (which modifies the CCPA) recently became effective. All of these new privacy laws and others that we expect to be developed and enacted going forward will impose additional data protection obligations and potential liability on companies such as ours doing business in those states. We have incurred and will continue to incur significant implementation costs to ensure compliance with the CCPA, the CPRA, new privacy laws in other states, and their related regulations, including managing the complexity of laws that vary from state to state. Both federal and state governments are considering additional privacy laws and regulations which, if passed, could further impact our business, strategies, offerings, and initiatives and cause us to incur further costs. Any actual or perceived failure to comply with the CCPA, CPRA, other data privacy laws or regulations, or related contractual or other obligations, or any perceived privacy rights violation, could lead to investigations, claims, and proceedings by governmental entities and private parties, damages for contract breaches, and other significant costs, penalties, and other liabilities, as well as harm to our reputation and market position.

In connection with the closing of the Prepaid Transaction, we and DISH entered into certain arrangements, including a Master Network Services Agreement (the “MNSA”) and a License Purchase Agreement (as amended, the “DISH License Purchase Agreement”). Pursuant to the MNSA, DISH will receive network services from the Company for a period of seven years. As set forth in the MNSA, the Company provides DISH, among other things, (a) legacy network services for certain Boost Mobile prepaid end users on the Sprint network, (b) T-Mobile network services for certain end users that have been migrated to the T-Mobile network or provisioned on the T-Mobile network by or on behalf of DISH and (c) infrastructure mobile network operator services to assist in the access and integration of the DISH network. Pursuant to the DISH License Purchase Agreement, DISH has agreed to purchase all of Sprint’s 800 MHz spectrum (approximately 13.5 MHz of nationwide spectrum) for a total of $3.6 billion. Pursuant to an amendment to the DISH License Purchase Agreement (the “LPS Amendment”) executed by us and DISH and approved by the Court along with a proposed amendment to the Final Judgment on October 23, 2023, if DISH fails to purchase such spectrum on or prior to April 1, 2024, then DISH’s sole liability will be that the Company can retain a non-refundable extension fee of $100 million. In such instance, absent prior approval from the U.S. Department of Justice, T-Mobile is required to conduct an auction sale of all of Sprint’s 800 MHz spectrum under the terms set forth in the Final Judgment, but would not be required to divest such spectrum for an amount less than $3.6 billion. Failure to successfully manage these ongoing arrangements entered into in connection with the Prepaid Transaction and liabilities arising in connection therewith may result in material unanticipated problems, including diversion of management time and energy, significant expenses and liabilities. There may also be other potential adverse consequences and unforeseen increased expenses or liabilities associated with the Prepaid Transaction, the occurrence of which could materially impact our business, financial condition, liquidity and operating results. In addition, there may be an increase in competition from DISH and other third parties that DISH may enter into commercial agreements with, who are significantly larger and have greater resources and scale advantages as compared to us. Such increased competition may result in our loss of customers and other business relationships. 16 16 16 Table of Contents Table of Contents

In connection with the closing of the Prepaid Transaction, we and DISH entered into certain commercial and transition services arrangements, including a Master Network Services Agreement (the “MNSA”) and a license purchase agreement (the “DISH License Purchase Agreement”). Pursuant to the MNSA, DISH will receive network services from the Company for a period of seven years. As set forth in the MNSA, the Company will provide DISH, among other things, (a) legacy network services for certain Boost Mobile prepaid end users on the Sprint network, (b) T-Mobile network services for certain end users that have been migrated to the T-Mobile network or provisioned on the T-Mobile network by or on behalf of DISH and (c) infrastructure mobile network operator services to assist in the access and integration of the DISH network. Pursuant to the DISH License Purchase Agreement, DISH has agreed to purchase all of Sprint’s 800 MHz spectrum (approximately 13.5 MHz of nationwide spectrum) for a total of approximately $3.6 billion in a transaction to be completed, subject to certain additional closing conditions, following an application for FCC approval to be filed three years following the closing of the Merger; provided, however, that if DISH breaches the DISH License Purchase agreement prior to the closing or fails to deliver the purchase price following the satisfaction or waiver of all closing conditions, DISH’s sole liability will be to pay us a fee of approximately $72 million. In such instance, T-Mobile is required, unless otherwise approved under the Consent Decree, to conduct an auction of all of Sprint’s 800 MHz spectrum under the terms set forth in the Consent Decree, but would not be required to divest such spectrum for an amount less than $3.6 billion. The parties are required to file an application for the transfer by April 1, 2023. The covered spectrum sale must occur within the later of three years after the closing of the Prepaid Transaction and five days after receipt of the approval from the FCC of the application. Failure to successfully manage these ongoing commercial and transition services arrangements entered into in connection with the Prepaid Transaction and liabilities arising in connection therewith may result in material unanticipated problems, including diversion of management time and energy, significant expenses and liabilities. There may also be other potential adverse consequences and unforeseen increased expenses, or liabilities associated with the Prepaid Transaction, the occurrence of which could materially impact our business, financial condition, liquidity, and operating results. In addition, there may be an increase in competition from DISH and other third parties that DISH may enter into commercial agreements with, who are significantly larger and with greater resources and scale advantages as compared to us. Such increased competition may result in our loss of customers and other business relationships.

Our future success depends in substantial part on our ability to recruit, hire, motivate, develop, and retain talented personnel for all areas of our organization, including our CEO and members of our senior leadership team. Both external factors, such as fluctuations in economic and industry conditions, changes in U.S. immigration policies, and the competitive landscape, and internal factors, such as employee tolerance for changes in our corporate culture, organizational changes, limited remote working opportunities, and our compensation programs, may impact our ability to effectively manage our workforce. Further, employee compensation and benefit costs may increase due to inflationary pressures, and if our compensation does not keep up with inflation or that of our competitors’, we may see increased employee dissatisfaction and departures or difficulty in recruiting new employees. If key employees depart or we are unable to recruit and integrate new employees successfully, our business could be negatively impacted.

The market for highly skilled workers and leaders is extremely competitive. We believe our future success depends in substantial part on our ability to recruit, hire, motivate, develop, and retain talented personnel for all areas of our organization, including our CEO and the other members of our senior leadership team. Doing so may be difficult due to many factors, including fluctuations in economic and industry conditions, changes to U.S. immigration policy, competitors’ hiring and remote working policies and practices, employee intolerance for the significant changes within, and demands on, our Company and our industry, and the effectiveness of our compensation programs. If key employees depart or we are unable to recruit successfully, our business could be negatively impacted. Further, inflationary cost pressures may increase our costs, including employee compensation, and lead to increased employee attrition to the extent our compensation does not keep up with inflation, particularly if our competitors’ compensation does. In addition, certain members of our senior leadership team, including our CEO have term employment agreements with us. Our inability to extend the terms of these employment agreements or to replace these members of our senior leadership team at the end of their terms with qualified and capable successors could hinder our strategic planning and execution. In addition, the new hybrid work model introduced during the global COVID-19 pandemic (the “Pandemic”) required T-Mobile to change and evolve our company culture. As our culture continues to evolve, we may experience adverse impacts on our ability to attract, retain and motivate key personnel, as existing and prospective employees may experience uncertainty about their future roles with us. If key employees depart, our business could be negatively impacted. We may incur significant costs in identifying, hiring and replacing employees, and we may lose significant expertise and talent. As a result, we may not be able to meet our business plan, and our business, financial condition and operating results may be materially adversely affected.