cyan AG

Annual Report • Apr 27, 2022

cyan AG Annual Report 2021

Key Figures

Earnings Figures		2021	2020
Revenue	in EUR million	8.5	21.3
Total earningsa	in EUR million	10.8	25.4
EBITDA	in EUR million	-12.3	-5.1
EBITDA-marginb	in %	-145%	-24%
EBIT	in EUR million	-18.1	-11.0
EBIT-marginb	in %	-213%	-52%
Net income/loss	in EUR million	-13.9	-9.3
Earnings per share (undiluted)	in EUR	-1.30	-0.95

^a Consists of sales revenues EUR 8.5 million plus other operating income EUR 3.0 million, income from reversals of impairment losses EUR 0.1 million and changes in inventories EUR - 0.8 Mio.

^b Calculated as EBITDA or EBIT divided by revenues.

Segment Figures		2021	2020
Revenue BSS/OSS	in EUR million	5.2	18.2
EBITDA BSS/OSS	in EUR million	-2.4	8.4
Revenue Cybersecurity	in EUR million	3.3	3.1
EBITDA Cybersecurity	in EUR million	-7.4	-11.3

Cash Flow Figures		2021	2020
Operating cash flow	in EUR million	-9.5	-8.7
Investment cash flow	in EUR million	-0.1	-0.8
Financing cash flow	in EUR million	16.5	1.8

Balance Sheet Figures		31/12/2021	31/12/2020
Total assets	in EUR million	95.7	96.3
Equity	in EUR million	72.8	72.7
Net debt incl. IFRS 16c	in EUR million	4.2	7.3

^c Consists of leasing liabilities EUR 5.0 million and financial liabilities EUR 5.2 million, convertible notes EUR 2.5 million less cash and cash equivalents EUR 8.5 million.

Key Operating Figures		31/12/2021	31/12/2020
Number of staff	FTE	131	156

Contents

Contents

Letter from the Executive Board	5
Report by the Supervisory Board	9
cyan-Share	13
Share Price Analyst Coverage Shareholder Structure Key Share Data Investor Relations-Activities Corporate Actions Financial Calendar	13 14 14 15 15 15 16
Combined Management Report	18
Principles of the Group Economic Report Economic Developments at cyan AG Subsequent Events after the Balance Sheet Date Opportunity and Risk Report Forecast Report Takeover Disclosures	18 27 37 40 41 48 49
Consolidated Financial Statements	54
Statement of Comprehensive Income Consolidated Statement of Financial Position Consolidated Statement of Cash Flows Consolidated Statement of Changes in Equity	54 55 57 58
Notes to the Consolidated Financial Statements	60
Information About the Company Accounting Principles Segment Reporting Note to the Statement of Comprehensive Income Notes to the Statement of Financial Position Notes to the Consolidated Cash Flow Statement Financial Instruments and Risk Management Other Explanations	60 60 76 79 84 97 99 105
Assurance by the Legal Representatives	110
Bestätigung des unabhängigen Abschlussprüfers	112
Further Information	117
Disclaimer Imprint	117 118

Letter from the Executive Board

Letter from the Executive Board

Dear shareholders,

The past financial year 2021 was a landmark year for cyan. A year in which we initiated a transformation, but also a year in which the goals we set were not achieved and the support of you as shareholders was put to an extraordinary test. In the life cycle of a company, at some point there comes a phase in which disruptive changes have to be made in order to move forward. cyan has in recent years, in this respect, picked up a great pace in the development of its products and in the expansion of markets. At the same time, cybersecurity for mobile devices is still a relatively young market with little experience. The pace and decisions in this growth market have not always run in parallel for cyan, so we have had to realign ourselves as a company because of the lagging results. With the basis of a market-leading product and the possibilities for use in different markets, the scalability and momentum for cybersecurity are unbroken and above average.

In 2021, we wanted to clearly change direction with cyan from one-time project revenues primarily from the BSS/OSS segment to recurring revenues from our market-leading cybersecurity solution. However, even though we had handed over our products to our telecom partners as planned, the speed and the results of the market launch then fell short of expectations in some cases. Last year, we drew the consequences from this in that we will provide our partners with ongoing advice and long-term support both in the standardization of products and the sequence of introduction of the various types of products and - this is the biggest difference from the competition - in the monetization of cybersecurity. The success of proactive support can already be seen in the faster time to market and thus monetization at Orange in Slovakia and our new partner dtac in Thailand.

Nevertheless, we had to recognize in August 2021 that we will not be able to maintain our ambitious targets for the year. In order to make a real new start and secure the future of the company, it became necessary to reposition the company, including a recapitalization and significant cost savings.

In the second half of the year, two cash capital increases were successfully placed with shareholders, and with institutional and other investors. In total, we were able to raise EUR 12 million in liquid equity capital for cyan. In addition, we were able to agree a debtequity swap with investors in the first quarter of 2022, which, among other items, redeemed outstanding convertible notes. The receivables against cyan AG arising from this title were contributed by means of a capital increase against contributions in kind and settled with new shares, thus preventing an immediate outflow of funds from the cash capital increases.

Another important element of the repositioning was a significant adjustment of the cost structure. This meant that we had to part with some employees, but at the same time we used this to structure some areas of cyan more professionally for the future. In addition, overhead costs that were not essential for core operations were greatly reduced. We were able to implement large parts of the measures in 2021 and complete them by January 2022. The first positive, cost-reducing effects of the intervening measures were already apparent in 2021, but will then help us to embark on a sustainable growth course in 2022. Despite all the rigorous implementation, great care has been taken to ensure that the necessary capacities for professional customer service continue to be available.

In the course of realigning the company, we also took another close look at the market position and orientation of both business units. In particular for the BSS/OSS segment, which in the past had a lower share of recurring revenues compared to the cybersecurity business, all strategic options up to a complete sale were open. After a very intensive and thorough evaluation, taking into account the development of the business area in recent months, we decided to keep the segment within the Group due to the many new partnerships and contracts as well as the qualitatively good pipeline and backlog. Although the past year was characterized by the realignment of the company described above, we were also able to achieve important milestones at a customer level. For the BSS/OSS segment, 2021 was, in fact, the most successful year in terms of the number of new customers: MTEL in two additional countries, educom, Lov and Liwa, a contract extension with our long-standing customer Skitto, and other deals make us optimistic for the future and document the excellent market position of our digital platform solutions. In the future, the BSS/OSS segment will once again have its own identity and will be managed separately as an independent business unit under the renowned i-new brand in order to exploit its full potential. We anticipate that i-new will make a significant contribution to the strategy and enable us to position ourselves as a more comprehensive provider and enabler of safe connectivity.

In the cybersecurity segment, the official launch with Orange in France in April 2021 represented a long-awaited milestone for our company and an important reference for other telecom partners. The second country in the Orange Group, Slovakia, started marketing our cybersecurity solution in the first quarter of 2022, where the cybersecurity service is not only offered as an add-on package, but also represents a component of the new tariffs for the first time.

With dtac (Telenor Group) in Thailand, we have already very successfully launched sales to end customers since March 2022, and with Claro Chile - a company of the América Móvil Group - another Tier-1 customer will be integrated in 2022. With four new customers and the expansion with existing customers of the Magenta Group (T-Mobile) in Austria and Poland, we are considerably better positioned in cyan's history than ever before.

As a result of the new partnerships, the quality and number of potential new customers in both segments, Cybersecurity and BSS/OSS, has increased as well as the interest in the cyan Group in the relevant markets.

There is still much to do to ensure that cyan establishes itself as a Safe Connectivity Partner in the market in the long term. In 2022, we will also focus on an appropriate brand presence, enter into new global partnerships, develop our own product landscape, which will not only differentiate us, but also position us more broadly and occupy niches in which we can profitably leverage our strengths.

Dear Shareholders, the challenges of the past year have been felt strongly in the past months. We would like to express our sincere thanks for the trust you have placed in us. We would also like to thank the Supervisory Board for its support, valuable cooperation and confidence in our plan, which we have implemented and which will form the basis for the new direction in 2022.

Last but not least, we would like to thank our employees and partners for their tireless, loyal and always constructive cooperation and support during this difficult phase. Despite the many unexpected events that have accompanied us in recent years and the suffering caused by the war in Ukraine, the effects of which on the overall economic and political conditions are not yet foreseeable, we are convinced that the company, with its team, technology and partners, is well positioned to pursue a long-term and sustainable growth path in the future.

The Executive Board of cyan AG

Munich, April 2022

Frank von Seth CEO

Markus Cserna CTO

Report of the Supervisory Board

Report of the Supervisory Board

Dear Shareholders,

The past financial year 2021 was characterized by planned and unplanned changes. In the Supervisory Board, meetings continued to be held online or hybrid, initially due to the contact restrictions and then due to the board's international composition. The restrictions and the forecast adjustment required the highest level of professionalism among all those affected in the Group, employees, Executive Board, and Supervisory Board. In the following report, the Supervisory Board provides information on the performance of its duties and the key points of its activities in the financial year 2021.

The Supervisory Board of cyan AG fully performed the duties incumbent upon it under the law and the Articles of Association in the financial year 2021, despite ongoing pandemic restrictions. It addressed the situation and development of the company regularly and in detail. The Supervisory Board consulted regularly with the Executive Board of the Company and carefully monitored its activities. The Executive Board informed the Supervisory Board regularly, promptly and comprehensively in written and verbal form about all aspects of planning, business development, the situation of the company including the risk situation, governance and compliance that were of importance to the company, and about current matters in each case.

Meetings and resolutions

A total of six Supervisory Board meetings were held, on January 25, 2021, April 27, 2021, August 12, 2021, August 19, 2021, August 25, 2021, and September 15, 2021.

Each member of the Supervisory Board attended at least half of all Supervisory Board meetings. Mr. Traina was unable to attend one meeting. Due to the extensive security measures in the wake of the COVID-19 pandemic and the geographical differences of the members, the meetings were held virtually via video conferencing. Where necessary, the Supervisory Board also adopted its resolutions by written circular. Between meetings, the Executive Board informed the Supervisory Board in written reports about projects and plans of particular importance to the Company.

The development of revenue, earnings, and customers, as well as the Company's financial situation, were the subject of regular discussions at the Supervisory Board meetings. No conflicts of interest arose among the members of the Supervisory Board in connection with their activities as members of the Supervisory Board. The Supervisory Board approved the resolutions proposed by the Executive Board after thorough examination in each case.

Until the Annual General Meeting on June 23, 2021, the Supervisory Board consisted of three members. By resolution of the Annual General Meeting, the number of members was increased to five. No committees were formed in the financial year 2021.

In a telephone conference between the Supervisory Board and the Executive Board on January 13, 2021, financing options were discussed, in particular the issue of convertible notes under the Convertible Notes Funding Program, whereupon approval for the Convertible Notes Funding Program was granted by circular resolution on January 14.

At the first constitutive meeting of the Supervisory Board in the financial year 2021, on January 25, 2021, Mr. Schütz was elected Chairman and Mr. Schütze Deputy Chairman. At this meeting, the Supervisory Board also focused on the budget and liquidity planning for the current financial year, which was explained in detail by the Executive Board. In addition, the members of the Executive Board answered miscellaneous questions from the members of the Supervisory Board.

At the balance sheet meeting on April 27, 2021, the Executive Board presented the final consolidated financial statements according to IFRS and the annual financial statements of cyan AG according to HGB. The auditor of HLB Dr. Stückmann und Partner mbB attended the comprehensive discussion of the financial statement documents and reported on the audit, the focal points of the audit, and the results of the audit. The adoption of the annual financial statements of cyan AG in accordance with the German Commercial Code (HGB) and the consolidated financial statements in accordance with IFRS followed the discussion by the Supervisory Board. Furthermore, the possible effects of the ongoing COVID-19 pandemic were discussed with the Executive Board and an updated business plan and liquidity planning were reviewed at the meeting.

On May 12, 2021, a resolution was passed by telephone to amend the Articles of Association with regard to the converted notes from the Convertible Notes Funding Program.

The Supervisory Board meeting on August 12, 2021 addressed the amendments to the business plan and liquidity planning. Measures to reduce risk and safeguard liquidity were consulted with the Executive Board. Further, sales partnerships to strengthen the business were discussed.

On August 19, 2021, the Supervisory Board reviewed the forecast adjustment resulting from the ad-hoc announcement on August 15, 2021. The Executive Board explained the results of the mid-year forecast and measures that are now being taken to stabilize the business in terms of costs and liquidity.

The meeting on August 25, 2021 was dedicated to the resolution of the capital increase. It was resolved to increase the capital by EUR 8 million in gross issue proceeds at an issue price of EUR 3.22 with subscription rights.

On September 13, 2021, the personnel changes in the Executive Board were resolved by circular resolution. Thus, the resignation as of December 31, 2021 of Michael Sieghart was accepted and the contract was terminated by mutual agreement. Subsequently, Martin Wachter was appointed to the Executive Board as his successor as of December 1, 2021, and a corresponding service agreement was concluded.

On September 15, 2021, the result of the capital increase placed and the impact on the liquidity situation were discussed. Furthermore, the Supervisory Board and Executive Board extensively covered the restructuring and cost-saving measures.

In the form of a circular resolution, the liquidation of Group companies in Brazil and Argentina and the distribution of business among the new Executive Board members was agreed on November 4, 2021.

On November 9, 2021, a resolution was passed by circular resolution to extend the Executive Board contract with Markus Cserna until the end of 2024.

On November 15, 2021, a resolution on the capital increase was passed by means of a telephone conference call.

On November 18, 2021, the establishment of an Advisory Board was approved by circular resolution.

In a resolution passed by telephone on December 15, 2021, the personnel matter of Martin Wachter was discussed and, as a result of the discussion and debate, the rescission of Martin Wachter's appointment was resolved.

The subsequent meetings and resolutions took place at the beginning of the new year.

Appointments to the Executive Board and the Supervisory Board

Changes occurred for both the Executive Board and the Supervisory Board of cyan AG in the financial year 2021. As of January 1, 2021, Mr. von Seth succeeded Mr. Arnoth on the Executive Board. Also as of the beginning of the year, Mr. Schütz joined the Supervisory Board by court appointment in place of Mr. Rofalski, who departed, and took over as Chairman of the Supervisory Board. With the expansion of the Supervisory Board to five seats, Alexandra Reich and Trevor Traina were also elected to the Supervisory Board by the Annual General Meeting. Mr. Schütz resigned from the Supervisory Board on December 28, 2021, effective December 31, 2021, in consultation with the other Supervisory Board members.

We thank Alexander Schütz and Michael Sieghart for their cooperation.

Annual and consolidated financial statements

The auditors elected at the Annual General Meeting on July 23, 2021 and appointed by the Supervisory Board, HLB Dr. Stückmann und Partner mbB, München Wirtschaftsprüfungsgesellschaft, audited the annual financial statements and the consolidated financial statements and combined management report of the Company for the financial year 2021 and issued an unqualified audit opinion. The auditor issued a declaration of independence to the Supervisory Board.

In their audit report, the auditors outlined the auditing principles. No objections were raised by the auditors.

The annual financial statements and management report as well as the auditors' report on the individual and consolidated financial statement were made available to all members of the Supervisory Board in good time. The financial statement documents were discussed in detail at the Supervisory Board's balance sheet meeting on April 26, 2022. The Supervisory Board examined in detail the single-entity and consolidated financial statements and the combined management report.

No objections were raised following completion of this review. The Supervisory Board concurred with the results of the audit and approved the annual and consolidated financial statements prepared by the Executive Board for the financial year 2021. The annual financial statements were thus adopted. The Supervisory Board concurred with the combined management report and the assessment of the further development of the Company.

Thanks

The Supervisory Board expresses its thanks and appreciation to the Executive Board and all employees for their high level of commitment and performance under challenging conditions in the reporting year 2021.

Munich, April 2022

For the Supervisory Board

Stefan Schütze Chairman of the Supervisory Board

cyan-Share

cyan-Share

Share Price

cyan share price development 01/01/2021-31/12/2021(rebased)^a

^a XETRA closing price indexed to 100

cyan AG has been listed in the Scale segment (Open Market) of the Frankfurt Stock Exchange since March 2018. As a result of the far-reaching recovery of the economy, the capital markets were also able to recover; the leading indices reached and exceeded their pre-crisis levels. The Scale All Share Index, which covers the performance of all companies listed in the Scale segment (including cyan), rose by 29.5 % in the reporting period; the DAX (Performance Index) by 14.4 %. The cyan share opened on January 4, 2021 (first trading day Xetra) at EUR 13.19 and closed on December 30, 2021 (last trading day Xetra) at EUR 2.64. For the calendar year 2021, this results in a negative performance of 80.0 % for the cyan share. On January 19 and 20, 2021, the highest intraday price (Xetra) of the year was reached at EUR 14.20. The lowest daily low was recorded on November 30 at EUR 2.55. The market capitalization of cyan AG as of December 30, 2021, based on the closing price of EUR 2.64 and the 13,385,884 bearer shares outstanding at that time, was EUR 35.3 million.

	2021	2020
Share capital at the end of the perioda	13,385,884	9,774,538
Market capitalization at the end of the period (EUR million)	35.3	125.1
Period high (Intraday)	14.20	24.50
Period low (Intraday)	2.55	6.12
Opening price at the beginning of the period (first trading day Xetra)	13.19	20.71
Closing price at the end of the period (last trading day Xetra)	2.64	12.80
Performance (Change in %)	-80,0	-38.2

^a Three capital increases were carried out from conditional and authorized capital.

Analyst Coverage

As of December 31, 2021, cyan shares were covered by a total of two research houses. One institute issued a buy recommendation for the cyan share and the other did not publish a recommendation. Stifel Europe ended its coverage as of August 23, 2021. Berenberg is not planning any further research updates for the time being during the restructuring.

	Date	Target price (EUR)	Reccomen dation
Edison Research	14/10/2021	-	-
Kepler Cheuvreux	16/11/2021	EUR 6.40	Buy

Shareholder Structure

The shareholder structure as of June 30, 2021, based on the votes registered at the virtual Annual General Meeting of cyan AG in June 2021 (record date June 2, 2021), is as follows: Tansanit Stiftung 10.1%, Gerd Alexander Schütz 9.6 %, alex schütz familienstiftung 9.4%, Peter Arnoth 3.5%, Apeiron Investment Group Ltd. 2.8 %, Inifinitum Ltd. 1.0%. The Executive Board of cyan AG held 4.6% of the shares. The other shareholders and the free float totaled 59.0%.¹

Shareholder structure at the AGM 2021

¹ Due to the listing in the Scale segment (open market), the reporting obligations of shareholders are limited to the thresholds of the German Stock Corporation Act (AktG). Disclosures below these thresholds are generally made on a voluntary basis, with the exception of executives.

Key Share Data

WKN	A2E4SV
ISIN	DE000A2E4SV8
Stock symbol	CYR
Trading segment	Open Market (Scale)
Sector	Software
Exchange	XETRA and Frankfurt
Type of shares	Bearer shares
First trading day	28/03/2018
First issue price in EUR	23.00
Shares outstanding as of 31/12/2021	13,385,884

Investor Relations-Activities

The ongoing global COVID-19 pandemic, continued to impact IR activities. International conferences and roadshows were exclusively held digitally by the organizers, with all the advantages and disadvantages. Nevertheless, Investor Relations and Executive Board members were present at eight analyst and capital market conferences to present the strategy and cyan in virtual presentations and meetings. On June 23, 2021, the Annual General Meeting was held in virtual format in Munich. On the occasion of the forecast adjustment and capital increase, a webcast with subsequent Q&A was conducted on September 13, 2021.

In addition to quarterly financial reporting, investors and the public were informed about current developments in the Group by means of numerous news and ad hoc announcements. In total, 56 capital market publications and news items were published in this reporting year. In addition, numerous investor calls and e-mail inquiries were answered. ir.cyansecurity.com

Corporate Actions

At the beginning of the financial year 2021, convertible notes with a total value of EUR 4.2 million were issued and partially converted into a total of 152,207 shares. Accordingly, the capital was increased from 9,774,538 shares by 152,207 shares from conditional capital (Conditional Capital 2019/I) to 9,926,745 shares by resolution of May 12, 2021, announced on July 17, 2021.

For financing purposes, the Executive Board and Supervisory Board of cyan AG resolved a cash capital increase with subscription rights on August 25, 2021. The capital increase was fully subscribed ahead of schedule through the exercise of subscription rights and subscriptions in the private placement, by September 15, 2021. Consequently, the nominal capital of the Company increased by EUR 2,481,686.00 from EUR 9,926,745.00 to EUR 12,408,431.00 by partially utilizing the Authorized Capital.

On November 15, 2021, the Executive Board resolved, with the consent of the Supervisory Board, to make partial use of the existing authorized capital and to increase the Company's nominal capital of EUR 12,408,431.00 by up to EUR 977,453.00 to up to EUR 13,385,884.00 by issuing up to 977,453 new no-par value bearer shares in exchange for cash contributions, excluding subscription rights.

In February 2022, cyan AG entered into an agreement with a loan creditor of the Company, according to which their receivables will be contributed to the Company by way of a capital increase against contributions in kind in return for the granting of 1,503,816 shares. Accordingly, the nominal capital was increased by EUR 1,503,816.00 from EUR 13,385,884.00 to EUR 14,889,700.00.

Further details on corporate actions are explained in the management report.

Financial Calendar

In the current year, cyan AG will also regularly inform the capital market about its business performance and will be represented at several analyst and investor conferences internationally.

Event Date		Location
Goldman Sachs European Small & Mid Cap Symposium	03-06/05/2022	London
Equityforum Spring Conference	23-25/05/2022	Frankfurt
Quarterly Statement Q1 2022	31/05/2022	-
Annual General Meeting	22/06/2022	Munich/virtual
Equityforum Fall Conference	05-06/09/2022	Frankfurt
Interim Report H1 2022	28/09/2022
Investor Access Paris	06-07/10/2022	Paris
Quarterly Statement Q3 2022	11/2022	-
Deutsche Börse Equity Forum	28-30/11/2022	Frankfurt

Current dates, upcoming events and news for 2021 are continuously updated on the website.

ir.cyansecurity.com/en/news-events

Combined Management Report

Combined Management Report

Principles of the Group

Business Model

The cyan Group (XETR: CYR; hereinafter "cyan") is a provider of intelligent IT security solutions and telecommunication services with more than 15 years of experience in the IT industry. The main business of the company involves cybersecurity solutions for the end customers of mobile and fixed-line internet providers (MNO, ISP), financial service providers, mobile virtual network operators (MVNO) as well as the convergent BSS/OSS platform (Business Support System and Operations Support System) as a mobile virtual network enabler (MVNE). The security solutions from cyan are integrated in the infrastructure of the business partner, who then offers these in a B2B2C model to its own end users under its own brand. With the BSS/OSS business, services such as connection to the network operator, billing, provisioning, and similar services relating to the operational aspects of running an MVNO are offered.

Today, the Group has a large number of international customers through which cyan products are sold to millions of end users. cyan is able to offer products and services along the entire value chain, from the platform, data optimization, to cybersecurity. In addition, cyan runs its own research and development center with the aim of identifying trends in the industry at an early stage and developing optimal product solutions.

Group Structure

cyan AG, headquartered in Munich (Germany) acts as the holding company within the cyan Group. The majority of operational services are provided by the subsidiary I-New Unified Mobile Solutions GmbH ("i-new"; formerly I-New Unified Mobile Solutions AG) and its subsidiary cyan Security Group GmbH, both headquartered in Vienna (Austria).

Companies were merged and new companies were established in the first half of the previous year. As of the reporting date, cyan was represented in eleven countries by its own local subsidiaries. In addition, sales and service hubs are operated worldwide. Further information on the scope of consolidation as of the respective reporting dates is provided in the Notes to the Consolidated Financial Statements.

Group structure as of December 31, 2021 (Consolidation)

Segments of the Group

The business activities of the Group are divided into two segments that are used to manage the Group and form the basis for segment reporting: Cybersecurity and BSS/OSS. This structure is modeled on the type of solutions provided. Over the last few years, cyan has developed five product groups, that are offered to its customers individually and also as combined 'seamless' solutions – in Cybersecurity these are OnNet Security, OnDevice Security, Child Protection, Clean Pipe DNS, and BSS/OSS it is the MVNO Platform (BSS/OSS).

The Executive Board decided in favor of this form of segmentation because it best reflects the opportunity and threat structure of the company. The distinctive nature of customer groups and the technical solutions and products used provide clear differentiation between the segments.

Cybersecurity

The Cybersecurity Segment comprises all services provided by cyan that are based on the use of technology developed by cyan for protection against threats from the Internet. In this segment, cyan delivers its services and products such as OnNet Security, OnDevice Security, Child Protection, or Clean Pipe DNS. The security solutions from cyan are integrated either directly in the infrastructure of the customers, or deployed in the cloud of the business partners, who then offer the products in their own names ('white labeled') to their end users as a value-added service ("B2B2C"). Contracts in the cybersecurity segment usually feature a revenue share or software license model that generates recurring revenues.

The cybersecurity segment consists mainly of the Group member cyan Security Group GmbH and its subsidiaries. The Cybersecurity Segment consists primarily of the subgroup with cyan Security Group GmbH and has a global focus. Direct customers supplied with cybersecurity solutions from cyan are located in Europe, Asia and South America.

OnNet Security

OnNet Security is cyan's fully network-integrated cybersecurity solution, it is, for example, successfully implemented at Magenta Telekom (T-Mobile Austria GmbH), T-Mobile Poland and Orange. The DNS-based filter is integrated directly in the network infrastructure of the corresponding MNO so that the MNO can generate revenues with its end customers through additional packages and at the same time strengthen its own brand with cyan's white-label approach. For each active end user, cyan receives a monthly license fee for the provision of the cybersecurity solution, or derives a direct percentage of the relevant sales revenue.

OnDevice Security

cyan's OnDevice Security (Endpoint Protection) forms an additional security layer that is installed directly on the end customer's device. The end users protect their smartphone via an app - this can be offered as a standalone app or integrated into an existing app using an SDK. In addition to the cybersecurity filter, this also includes additional features such as identity and website checks or virus scanners. They are connected to the cyan filter system, which is implemented in the partner's infrastructure, locally or via cloud. The app is a standalone solution and is often sold to customers as a premium extension to the OnNet Security solution based on the same model.

Child Protection

By using the Child Protection solution, parents are given the tool they need to provide their children with optimum protection against the dangers on the Internet and to manage activity online. In a central menu, individual profiles can be set up for each child. The app provides age-dependent default settings that are easy for parents to adapt to individual needs. This solution is sold primarily to telecommunications companies as a white label solution, which then offer it to their customers as an additional service (B2B2C).

Clean Pipe DNS

With Clean Pipe DNS, non-relevant and prohibited data packages are filtered out of the data flow, leading to significant cost savings for the MVNOs and can be required for the fulfillment of compliance stipulations. In particular, cyan technology can block malicious sited and what is known as background trackers and advertising that loads in the background. This improves the surfing experience of the customer and reduces the volume of data consumed. Through the reduction in data achieved using the Clean Pipe DNS solution, MNOs are confronted with a lower number of network peak loads which means that network operators can postpone the need for investment in the network.

BSS/OSS

The BSS/OSS segment consists of the services offered as MVNE through provision of a dedicated MVNO platform. cyan is providing a modular product, the MVNO platform, as a one-stop shop for MVNOs and digital communication service providers. This involves offering MVNOs the entire range of products needed to operate a virtual mobile operator.

The spectrum of functionality provided by cyan ranges from connection to the MNO network, the core network, service delivery, (online) charging, billing, rating and policy control through to customer and product management with tools for customer experience, customer management, PoS support, loyalty campaigns and more. The platform supports common mobile standards, including 5G. On the convergent MVNO platform, all digital services and features are managed in a cloud-based service hub by the customer or as a managed service.

The software is sold as a B2B white label solution to MNOs for their B-brand and MVNE platforms and to MVNOs. The software is distributed as a B2B white label solution to MNOs for their B-brand and MVNE platforms and to MVNOs. The software can be installed on-premises at customers' datacenters directly, alternatively customers can purchase the services via one of the cyan BSS/OSS Service Hubs. In the BSS/OSS segment, licenses are typically sold on a monthly basis or in packages, and separate maintenance, support and implementation services are charged where applicable.

This segment originally resulted from the business of I-New Unified Mobile Solutions GmbH and its subsidiaries (excluding cyan Security Group GmbH), which cyan acquired in 2018. The geographic focus in this segment is primarily South America. Most recently, the customer base in Asia and Europe has been expanded.

Organizational Structure

The strategic management of the Group takes place at the headquarters of the Group holding company in Munich (Germany). cyan AG is listed in the Scale segment (open market) of the Frankfurt Stock Exchange in Frankfurt am Main (Germany). The stock corporation under German law has a dual management structure consisting of an Executive Board and a Supervisory Board. The Supervisory Board appoints, advises and monitors the Executive Board. The Supervisory Board was expanded by two seats to five members by resolutions of the 2021 Annual General Meeting. No committees were formed in the Supervisory Board. More information on the activities of the Supervisory Board can be found in the Report of the Supervisory Board.

Until the end of 2021, the Executive Board consisted of three members and at the time of preparing this report, it consisted of two members and is responsible for the strategic and operational management of the Group. The Chief Executive Officer (CEO) is responsible for Sales, Marketing, Partner Management, Finance/Controlling and Human Resources. He is also responsible for regional management in Latin America. The Chief Technology Officer (CTO) is responsible for Product and Engineering (Research, Development, Project Management and Support) and Operations.

At the beginning of the financial year 2021, changes were made in the organization of cyan AG. As of January 1, 2021, Frank von Seth was appointed to succeed Peter Arnoth as Executive Board member and CEO of the Group. Furthermore, in January Alexander Schütz succeeded Volker Rofalski on the Supervisory Board by court appointment, who stepped down on December 31, 2020. Mr. Schütz was elected Chairman of the Supervisory Board at the first Supervisory Board meeting; Stefan Schütze became Deputy Chairman of the Supervisory Board.

At the Annual General Meeting, Alexander Schütz was confirmed by the shareholders by means of a supplementary election. In addition, the Supervisory Board was expanded to five members. Alexandra Reich and Trevor Traina were elected by the Annual General Meeting to fill the two additional seats. Alexandra Reich has over 20 years of management experience in the telecommunications sector. She is currently a member of the board of directors of the Dutch company Delta Fiber and a member of the board of directors of the Spanish company Cellnex Telecom. Trevor Traina is an entrepreneur from the Silicon Valley and was most recently the U.S. Ambassador to Austria.

In September 2021, Michael Sieghart, CFO of the cyan Group for many years, announced his decision to step down at the end of the year. Martin Wachter was appointed as his successor at short notice. In December, Martin Wachter's appointment was rescinded and the Executive Board was reduced to two seats. The allocation of responsibilities was divided between the existing Executive Board members Frank von Seth and Markus Cserna. Meanwhile, Markus Cserna's contract was extended until the end of 2024.

Further, there was a change on the Supervisory Board at the turn of the year 2021/2022. Alexander Schütz stepped down from the board as of December 31, 2021. The Supervisory Board nominated Adrian Shatku, who was appointed to the Supervisory Board by court order effective January 7, 2022, to fill the vacancy. Adrian Shatku is the founder of UNIFI Communications, Inc. and a company of UNIFI Capital, Inc. based in New York. He serves as CEO of WIS Telecom SPA and WIS Telecom SA (formerly M-Link Orascom and Wind International Services). He has over 20 years of experience in the telecommunications industry. Following the departure of Alexander Schütz, who was Chairman of the Supervisory Board until December 31, 2021, Stefan Schütze was elected Chairman and Lucas Prunbauer Deputy Chairman of the Supervisory Board.

Objectives and Strategy

With its two segments, cyan has been synonymous with safe connectivity for over 15 years. The BSS/OSS platform serves as a cost-efficient service provider and system developer for digital telecommunication providers and as MVNE enables innovative services on all levels, voice, text and data. cyan Threat Intelligence - cyan's intelligent cybersecurity technology - ensures that devices and people are protected from digital threats and dangers in their daily use of the Internet. The goal for the future is to continue to lead the way in safe connectivity and Internet usage - regardless of how and where people access Internet content.

In August of the reporting year, a significant reduction in the targeted revenue figures had to be announced. In the course of this, both the general business strategy and the longer-term goals were reviewed and extensively evaluated. The Executive Board immediately decided on a comprehensive restructuring concept to enable the Group to return to sustainable growth as quickly as possible. This realignment should achieve a reduction in planned costs of around 30 % for 2022. As a result, major investments in new markets and products were not pursued as a priority for the time being. Instead, the standardization of products and projects was driven forward in order to reduce costs and the time required for implementation. The cost reduction program affected all areas of the company and could largely be implemented before the end of 2021. Significant savings were made in services procured, personnel and other expenses, with great care being taken to ensure that professional customer support continues to be provided and can even be increased.

Additionally, the positioning of the BSS/OSS segment within the Group was evaluated. Since it has not yet been possible to realize revenue synergies with the Cybersecurity segment as hoped, all options as far as a sale of the BSS/OSS segment were examined. For this, costs and their specific allocation in the Group companies were reconsidered on the one hand, and potential growth areas were explored on the other. Since 2018, the former i-new and its BSS/OSS segment have been successfully integrated and operationally stabilized. Today, the segment serves around 35 direct customers and millions of active end customers around the world. In addition, 2021 was an exceptionally successful year with numerous new customer wins and promising leads for the following years. Following the extensive evaluation, the Executive Board has now decided to keep the BSS/OSS segment within the Group. In the future, the business unit will be managed much more independently so that the acknowledged "i-new" brand can be used more prominently in the sales process.

The completion of the Group's realignment has created a much stronger foundation for implementing the medium- and long-term strategy of increasing recurring revenues. The focus will remain on cybersecurity, where monetization will be accelerated by means of a partnership-based B2P2C model and operational excellence measures. This partnership-based approach envisages supporting partners much more actively, even after contracts have been signed. Greater standardization of the solutions offered is also expected to significantly reduce implementation time. As a result, faster onboarding of end customers will allow revenues to be generated earlier, while fine-tuning technology and marketing. This partnership approach also increases the understanding of the customer's individual situation and consequently promises a higher penetration rate in the partner's end customer base more quickly. This concept is already well accepted by our partners and represents an additional service that sets cyan apart from competitors in the field.

In the long term, larger investments in new markets and products in both segments are also possible. Potential growth options are being reviewed in an ongoing process. These include geographical expansion as well as more substantial product extensions. Based on the fundamental idea of "One Technology - Many Opportunities", cyan could offer solutions for other target groups, industries and regions in the cybersecurity segment in addition to the telecom industry. Expanding the business base in this way and addressing new markets could reduce dependence on individual sectors in the long term and significantly increase the potential for cyan. Details on market developments and opportunities are explained in the management report on sector-specific developments and in the opportunities report.

Management System

The management system's aim is the targeted execution and monitoring of the corporate strategy. The system is implemented through regular strategic discussions and planning talks within the Executive Board and with the staff responsible for the respective area. Value drivers are at the heart of Group management. These have a direct influence on the medium and long-term growth strategy of the Group. The aim is to detect deviations from strategy and planning based on defined key indicators in good time, to enable appropriate measures to be initiated. The Executive Board reports to the Supervisory Board on a regular basis on matters of strategy, planning and related measures.

The central key indicators for management of the Group were, in the most recent financial year and in the year prior to that, revenue, and EBITDA (significant financial performance indicators), as reported in the consolidated financial statements. As part of the realignment of the strategy, the performance indicators have been adjusted slightly and were supplemented by the share and growth of recurring revenues as significant performance indicators for the ongoing business. Recurring revenues reflect the sustainability and stability of cyan's business model. As a growth company, attention is additionally paid to (operational) cashflow and further to that to the net liquidity of individual subsidiaries as well as the financial performance indicators, non-financial indicators for management, in particular the number of employees, the addressable market and the development of the sales pipeline are part of the operational management system.

For both segments, Cybersecurity and BSS/OSS, as in the previous financial year, the same key indicators for management as at overall Group level are used. These indicators are also applied to internal reporting.

Research and development

Research and development plays a major role in safeguarding the competitiveness and lasting success of the Group. In particular, the cybersecurity sector is one strongly characterized by innovations. A close exchange is maintained with research institutions working on various Internet security topics, such as threat detection with new approaches, the use of artificial intelligence (AI), and the analysis of Internet traffic using machine learning (ML).

In the past financial year, the multi-year research project "WeProtectYou," which built on the "MITA - Mobile Internet Traffic Analyser" project and addressed topics of digitization such as IoT devices, smart home solutions and cryptocurrency fakes, was completed. For example, progress was made in automatic detection and protection for telecom and infrastructure providers' endpoints against phishing and against malware that is not only text-based but also uses picture-in-picture detection. Regarding IoT and Smart Home, methods to identify sudden anomalies or network attacks were investigated. Another research focus was on cryptocurrencies and how to best protect users from fraud and phishing/fake attacks.

At the beginning of the financial year 2022, a new research project "DynAISec - Adaptive AI/ML for Dynamic Cybersecurity Systems" was started, which is to decisively advance AI4Sec. The project aims to improve adaptive and incremental learning of AI/ML models so that they can keep up with novel cyber-attacks and network traffic. Goals include development of AI4Sec models with adaptive capabilities for improved cybersecurity performance (higher detection rates with reduced false alarms); algorithms for automatic generation of synthetic cybersecurity data for adaptive re-training with guarantees on the correctness of the synthetic data; Software libraries that provide explanations of model behavior prototypes, with specific application areas of in-network security (malware propagation, IoT-targeted attacks, DDoS attacks), web browsing end-user security (phishing, fake site detection, privacy leaks, employee data exposure), and in-device security of mobile devices (malware detection on smartphones).

Furthermore, cyan engages in research topics in the areas of IoT/CPS security (cyberphysical systems), security of decentralized systems and distributed ledger technologies as well as security in machine learning within the COMET program.

Significant R&D accomplishments have been achieved in connection with products, some of which have been granted patent protection. Threat Detection was expanded to include brand impersonation, an automated solution for detecting websites that attempt to impersonate a specific brand. For this purpose, millions of web pages were scanned, and more than three billion web pages have already been checked on the basis of their certificates via the Certificate Transparency Stream. These and other new threat intelligence findings can now be deployed in less than half an hour due to a core engine upgrade to the core threat intelligence systems.

To strengthen OnDevice solutions on mobile devices, development of DNS-over-VPN was also completed to enable a converged solution between iOS-based (Apple) and Android-based (Google) devices. The SDK required for this was improved, simplifying and accelerating customer deployments. A first customer installation with high customer acceptance confirms this adopted strategy. Furthermore, process automations contributed to the acceleration of rollouts, which shortened implementation and testing times.

The financial year 2021 was, further, characterized by many customer projects in Cybersecurity and BSS/OSS. In the BSS/OSS segment, a number of further enhancements were implemented as part of customer projects. MTEL's expansion into Germany and Switzerland necessitated new integrations with the corresponding MNOs on the multi-MNO-capable BSS/OSS platform. Furthermore, the first 5G MVNO in Austria started operations with the cyan MVNE platform in early 2022. In addition, work was done on supporting other core systems such as Magma Core and on eSIM support in order to expand the application areas of the BSS/OSS solution.

In the Cybersecurity segment, the products went to market at Orange France at the beginning of the year. In parallel, the roll-out in Slovakia progressed and the solution was then launched at the beginning of 2022. Another important project in the Cybersecurity segment was the implementation at dtac, which since March 2022 is being marketed via the dtac app in Thailand. The cyan OnDevice Security is directly integrated into the app at dtac via cyan's SDK, using a fully cloud-based approach leveraging Amazon Web Services (AWS) for high scalability and consistent operation. In this context, cloud capabilities have been further extended, enabling cyan to cover the range from on-premises to public cloud.

As a result, the investments in innovation are also reflected in the development expenses which amounted to EUR 4.6 million which represents an increase of 24% over the previous year (2020: EUR 3.7 million). The development ratio (development expenses as a percentage of Group revenue) increased due to the increase in research activities coupled with slightly lower revenue to 54.1 % (2020: 17.4%). If the requirements for capitalization of development costs pursuant to IAS 38 are met, they are recognized in the balance sheet under intangible assets. No development costs were capitalized in the 2021 financial year. Scheduled amortization in the reporting period amounted to EUR 54 thousand (2020: EUR 54 thousand). As a result, the development costs in assets declined slightly from EUR 891 thousand on December 31, 2020 to EUR 837 thousand on December 31, 2021. Research and development expenses were mainly incurred for the above-mentioned innovations. cyan received subsidies in the form of research grants and subsidized loans for services rendered within the scope of research projects. Further notes to the recognition of intangible assets and development costs can be found in the Notes to the Consolidated Financial Statements.

in EUR thousand	2021	2020
R&D expenses	4,593	3,704
Capitalized development costs	0	0

Personnel Development

For cyan as a company in the knowledge-intensive IT and software sector, highly qualified employees represent one of the most important factors for sustainable corporate success. Great attention is paid to the selection of the right employees and their further development. The aim is to retain these employees in the long term. Attention is placed on promoting the diversity of employees in terms of gender, origin, age and other individual characteristics at all levels.

The first half of the year initially saw a continuation of (partial) lockdowns due to the pandemic in large parts of the world, as was also the case at cyan. As a measure to ensure the safety of employees, home office recommendations applied in all areas to the greatest possible extent. At the beginning of the financial year, the new strategy started to be implemented by making specific adjustments to areas and teams in sales, customer support and engineering/development. As a result of the changes, certain positions were not re-staffed. As part of the restructuring in the second half of the year, all areas were re-evaluated, realigned and corresponding personnel changes were made.

As of December 31, 2021, cyan employed 133 people, or 131 FTEs, including 18 freelancers. As a result of the Performance Improvement Program, the number of employees decreased by 39 FTEs from 170 as of June 30, 2021 to 131 FTEs at year-end 2021. Yearover-year, the number of employees decreased by 25 FTEs from 156 FTEs to 131 FTEs. Additional employees have been hired selectively since the beginning of 2022. A significant proportion of the workforce continues to be employed in operations, development, product management, and research and development. A quarter of the workforce was employed outside the European Union. Women account for one-sixth of the workforce globally and are to be further expanded.

in FTE as of 31/12/2021	Total	EU	Rest of world
Personnel incl. Freelancers	131	97	33
Thereof in operations, development, research	123	93	30

Economic Report

Economic Environment

While 2020 was characterized by a considerable shock, the economic activity returned to normal, despite measures to contain the pandemic still in place. At the global level, there was a clear recovery dynamic – in Europe, a slight contraction on a real GDP basis was still recorded in the first quarter. The easing of pandemic control measures in the second and especially the third quarter caused people to return to stores, restaurants and travel, resulting in a rebound in consumer spending. In addition, positive employment prospects and continued government intervention are supporting spending. The ongoing recovery in domestic and global demand is boosting business optimism, which is encouraging investment.² In the fourth quarter, private consumption contracted as a result of rising infection rates and renewed pandemic uncertainty, combined with a price-related decline in real disposable income. Economic activity in the European Union returned to pre-pandemic levels by the end of 2021.³

The monthly composite employment indicator of the Purchasing Managers' Index (PMI), which includes both industry and services, stood at 54.5 in February 2022, largely unchanged from January and above the threshold of 50 indicating employment growth. This result was calculated despite a worsening of the pandemic in the first weeks of 2022 and reported difficulties in filling vacancies. Business investment increased strongly in the fourth quarter of 2021 as there were signs that supply constraints were easing and demand for capital goods remained strong. Overall, real GDP is expected by European Central Bank experts to grow by an average of 3.7 % in 2022, 2.8% in 2023 and 1.6% in 2024, while inflation is expected to average 5.1 % in 2022, 2.1% in 2023 and 1.9% in 2024.⁴

Globally, GDP growth is estimated at 5.5 % in 2021, following a significant contraction in 2020. The latest forecasts for 2022 and 2023 point to flattening growth to 4.1 % and 3.2%, respectively, driven by a waning of the catch-up effect, lower supportive macroeconomic policies and rising prices.⁵ Nevertheless, unanswered questions regarding the further handling of the pandemic and the uncertain situation resulting from the conflict in Ukraine, as well as the related impact from sanctions and disruption of economies and supply chains, continue to be major sources of uncertainty for global economic development. ⁶

Growth in the East Asia and Pacific region is expected to remain slightly below expectations at 7.1% according to latest estimates, and forecasts for subsequent years have also been revised downward slightly to 5.1 % and 5.2%, respectively, as tourism has not yet fully recovered in many countries. In Latin America and the Caribbean, however, the economy performed above expectations in 2021, growing by an estimated 6.7 %. More moderate growth of 2.6% and 2.7% is expected for 2022 and 2023, respectively. In the Middle East and North Africa region, the economy also developed stronger than originally forecast due to increased oil demand and prices. Nevertheless, future GDP growth also remains below pre-crisis levels. In addition to uncertainties regarding pandemic

² ECB (2021), Economic Bulletin, Issue 5 / 2021.

³ ECB (2022), Eurosystem staff macroeconomic projections for the euro area – March 2022.

⁴ ECB (2022), Economic Bulletin, Issue 2 / 2022.

⁵ World Bank (2022), Global Economic Prospects – January 2022.

⁶ ECB (2022), Eurosystem staff macroeconomic projections for the euro area – March 2022.

developments, climate change, social unrest and inflation, particularly in developing countries, pose a risk to forecasts in all regions. ⁷

Sector-Specific Business Environment

Telecommunications Sector

In the telecommunications sector, the pandemic had a negative impact in 2020, but a significant recovery is expected for 2021 and subsequent years. This is also associated with increased investment in infrastructure, which in Europe and North America will initially focus heavily on 5G. Considerable growth is expected especially in the mobile-first regions such as Asia and Latin America.⁸

By 2025, according to the GSM Alliance, there will be an additional 400 million new mobile subscribers, most of them from Asia-Pacific and sub-Saharan Africa, bringing the total number of subscribers to 5.7 billion (70 % of the world's population). In 2021, mobile technologies and services already contributed \$4.5 trillion in economic value added, or 5% of global GDP. This figure is expected to rise by more than \$400 billion to nearly \$5 trillion by 2025, as countries increasingly benefit from the improvements in productivity and efficiency that come from increased use of mobile services. 5G represents another accelerating factor in this regard, additionally driving developments in services and industry, particularly IoT.⁹

Furthermore, the adoption of 5G, especially at lower prices, influenced upgrade purchases to address future-proof needs. As a result, according to Gartner, smartphone sales increased significantly across all five leading vendors in 2021 and by 6 % on average globally, following a 12.5% decline in 2020. The decline in smartphone sales in the previous year due to COVID-19 and the catch-up effect in the first half of 2021 contributed to the growth of the market. However, in the second half of 2021, smartphone sales were affected by component shortages and supply chain issues.¹⁰

This results in the GSM Alliance estimating that the number of smartphone connections will increase by more than one billion to 7.4 billion in the coming years, bringing penetration from 75% to 84%. On the one hand, this is due to network expansion, which over the past decade has helped narrow the mobile broadband coverage gap from one-third of the world's population to just 6%. However, although the industry continues to invest in innovative solutions and partnerships to extend connectivity to underserved areas, in 2021 there was still a mobile internet service usage gap of 41 % of the world's population, which is increasingly being closed; at the same time, driven by smartphone penetration and faster data connections that also utilize FWA (fixed wireless access) to replace wired connections, mobile data volumes are expected to multiply globally by 2027.¹¹

⁷ World Bank (2022), Global Economic Prospects – January 2022.

⁸ GSMA (2021), The Mobile Economy 2021.

⁹ GSMA (2022), The Mobile Economy 2022.

¹⁰ Gartner (2022), Market Share: PCs, Ultramobiles and Mobile Phones, All Countries, 4Q21 Update.

¹¹ Ericsson (2021), Ericsson Mobility Report – November 2021; GSMA (2022), The Mobile Economy 2022.

Closely linked to the technological advancement of networks, such as through 5G-SA with Ultra-Reliable Low-Latency Communications (URLLC) but also Cat-M/LTE-M or Narrowband/Cat-NB (narrowband communication), is also the development of devices and use cases, especially in machine-to-machine communication and IoT. This is accompanied by the pervasiveness of Internet-connected computing in daily life and business from manufacturing to healthcare, so-called Massive and Critical IoT. As early as 2027, the number of broadband IoT connections, i.e. IoT based on 4G and 5G, is expected to exceed those based on 2G and 3G.¹²

Cybersecurity

The increased penetration of smartphones and Internet-enabled devices has opened up additional attack vectors and thus increased the cyber risk. At the same time, cybercriminals have been able to become considerably more professional in recent years and expand their cybercrime-as-a-service offering. The result has been numerous cyberattacks that have been publicized in the media, forcing entire companies to come to a standstill. This is also reflected in the Allianz Risk Barometer, where cyber risk has consistently ranked among the top three risks over the past five years and is again the number one topic among risk experts in 2022. Overall, recorded cyber-related claims increased from nearly 500 in 2018 to more than 1,100 in 2020, with the number of ransomware claims increasing by 50% in 2020 compared to the previous year, and the number of claims received in the first half of 2021 being the same as in all of 2019.¹³

Therefore, so-called "cyber hygiene" and "cyber resilience" are playing an increasingly important role in the context of growing risk and represent a particular challenge for small businesses. According to the Hiscox Cyber Readiness Report 2021, the risk for companies with fewer than 50 employees is significantly higher than for larger companies. Small and midsize businesses have, on average, lower budgets and expertise due to lack of staff, with roughly the same number of cyber incidents and a lower detection rate. At the same time, smaller companies were among those that suffered the greatest losses relative to company size. For micro-businesses with fewer than ten employees, the average cost of all attacks was more than \$8,000, with the long tail in the 95th percentile and above suffering losses of \$308,000. One in six companies attacked this year said the impact was severe enough to significantly threaten the company's solvency or viability, regardless of reputational damage to customers, suppliers and consumers. ¹⁴

MVNO & BSS/OSS

MVNOs are operators who lease bandwidth and wireless frequencies from mobile network operators (MNOs) and sell these on to consumers. This exchange benefits MNOs as well as consumers. The operating costs of MNOs in relation to billing, customer service, and marketing are reduced. Also, the customer base of the MNOs is extended indirectly to include niche customers by offering targeted, segment-oriented differentiation in products and prices to customers who fall outside the core customer base of traditional MNOs.

Over the last few years, MVNOs have experienced strong growth and have transformed themselves from operators, who only provide customers with basic services such as voice calls to comprehensive providers who can deliver a wide and diverse range of value-added and premium services. These extended services, such as roaming packages, data plans, media and entertainment content as well as cybersecurity, on the one

¹² Ericsson (2021), Ericsson Mobility Report – November 2021.

¹³ Allianz Global Corporate & Specialty (2022), Allianz Risk Barometer: Identifying The Major Business Risks For 2022.

¹⁴ Hiscox (2021), Hiscox Cyber Readiness Report 2021.

hand help to retain customers and, on the other, also contribute to increased average revenues derived from each user (ARPU). The MVNO model is therefore an advantage for customers, MVNOs, and MNOs and is becoming an increasingly dynamic force on the global telecommunications market. Consequently, in 2021, the number of active MVNOs is still continuing to rise globally. This development is sustainably underpinned by market supervision and regulatory authorities in the consolidating network operator market. According to GSMA Intelligence records, on average more than 50 new MVNOs were launched each year in recent years.¹⁵

Positioning of the Group

The general global economic developments also have a positive indirect effect on the market situation in the relevant markets for cyan. Irrespective of this, cyan operates in a strong growth market, particularly in the Cybersecurity segment, whose long-term development has only been affected to a minor extent by the crisis. Nevertheless, technological framework conditions in particular, as well as underlying structural developments in the relevant markets, may continue to influence cyan's business performance in the years to come. The competitive situation in the less mature cybersecurity industry is different from that in the established and price-sensitive market for MVNO technology and services due to the high margins and disruptive technologies. Therefore, the market situation changed only slightly for cyan in the past years.

The technology of cybersecurity for mobile devices offered through the network-integrated approach is still relatively young, so competition in this new growth market is still just starting to emerge. Classic endpoint solutions are continuously getting replaced by contemporary alternatives that are better suited to meet current challenges such as heterogeneity of terminal devices ranging from high-end smartphone to low power IoT-device, and the performance and agility required for deployment. Most recently, cyan has been in competition mainly with providers of cloud-based solutions, traditional DNS providers security products as well as with deep packet inspection (DPI). The former, cloud providers, have the significant disadvantage that their traffic has to be directed partially or entirely via third-party data centers. This can lead to significant overhead and latencies but also presents problems in relation to data protection. Traditional DNS providers have the advantage of a partially existing customer base, but their products are often 'addons' and are not the primary focus of attention. Also, scaling in the fixed and mobile network with regard to 5G is often difficult or even impossible due to the old architectures involved. The latter, solutions based on deep packet inspection, are reaching their limits due to the required computing power combined with low latency as the data throughput surges, triggered among others by the expansion of 5G networks and the increasing proportion of encrypted data packets. Furthermore, the modern Scale-to-the-Customer approach on communications networks, where service delivery should, wherever possible, occur in the geographic vicinity of the customer, is hard to reconcile with DPI approaches and the required roll-out of infrastructure. cyan offers telecom companies a state-of-theart addition to the product portfolio with highly scalable solutions that meet the needs of end customers, consumers and enterprises, for easy-to-use and trustworthy cybersecurity.

¹⁵ GMSA Intelligence (2022), MVNO List (Accessed March 2022).

Competition in the BSS/OSS and MVNO service market is much more pronounced because, in contrast to modern cybersecurity solutions, this market has already been in existence for decades, and is also characterized by higher levels of price-based competition. The BSS/OSS market is dominated by a small number of big players, although their solutions are directed at the comprehensive needs of Tier- 1 telecommunications companies and are correspondingly expensive and elaborate, both in terms of project implementation and of everyday operation. In many cases, these systems and services are not suitable for the requirements of a dynamic and cost-sensitive MVNO. In this respect, right from the outset, cyan has established itself in the market with a completely digital and therefore quickly deployable, cost-effective convergent platform. cyan, therefore, is in competition with smaller agile providers here, which as a rule cannot cover a broad product spectrum like cyan's BSS/OSS platform.

Course of Business

The past financial year was by no means an easy one for cyan, with revenues not showing the planned growth as anticipated. On the one hand, this was due to the prioritization of contracts with recurring revenues, which will contribute to growth in the long term. Therefore, large license agreements were strategically avoided in the interest of qualitative sustainability of business performance. Secondly, the fact that sales premises were still closed due to the global COVID-19 pandemic had a negative impact on the sales success of cyan's telecom and MVNO partners. In addition, there were certain delays in the implementation of our solutions at customer sites, which also contributed to the significantly lower revenues and could not have been foreseen at the beginning of the year. In August, the Executive Board therefore had to announce a reduction of expected revenues and profits - the revenue forecast was lowered to 10-14 million and now expected a clearly negative EBITDA. This was followed by an extensive repositioning program ("Performance Improvement Program"), which was aimed specifically at substantially reducing the fixed cost base, recapitalizing the company and evaluating all strategic options with regard to the individual business segments.

In order to secure sufficient liquidity for cyan in this transformation year, the Executive Board, with the approval of the Supervisory Board, had initially decided on a "Convertible Notes Funding Program" (CNFP) in January 2021, which authorized the issuance of convertible notes with a total volume of up to EUR 8.4 million. From the program, a total of four tranches in the total amount of EUR 4.2 million were issued in the first half of 2021 and partially converted into a total of 152,207 shares. The program was terminated in 2022 and the remaining outstanding convertible notes in the amount of EUR 2.5 million were contributed to the Company in 2022 in a capital increase against contribution in kind. Further details are provided in the Subsequent events and in the Notes.

The Executive Board, with the approval of the Supervisory Board, resolved a cash capital increase with subscription rights (subscription ratio 4 to 1) for existing shareholders on August 25, 2021. The offer period was set at September 2 to September 15 and the issue price per new share was set at EUR 3.22. The shares not subscribed for by the shareholders were issued at a price of EUR 1.00. Shares not subscribed by shareholders were then offered to interested investors in a private placement. The capital increase was fully subscribed before the end of the subscription period and the private placement was significantly oversubscribed. As a result, the nominal capital of the Company was increased by EUR 2,481,686.00 from EUR 9,926,745.00 to EUR 12,408,431.00, making partial use of the authorized capital. The new shares carry full dividend rights from January 1, 2021. The capital increase generated gross issue proceeds of EUR 7,991,028.92.

On November 15, 2021, the Executive Board, with the approval of the Supervisory Board, resolved to make partial use of the existing authorized capital and to increase the Company's nominal capital in the amount of EUR 12,408,431.00 by up to EUR 977,453.00 to up to EUR 13,385,884.00 by issuing up to 977,453 new no-par value bearer shares against cash contributions, excluding subscription rights. The placement price was EUR 4.15 per share. The new shares carry full dividend rights from January 1, 2021 and were offered exclusively to institutional investors in a private placement. cyan AG received gross issue proceeds of EUR 4,045,429.95 from the full placement of 977,453 new shares. In total, therefore, the two capital increases in 2021 raised gross issue proceeds of EUR 12 million.

Due to the high cost structure of the Company compared to the lower expected sales level, comprehensive cost reduction measures were implemented. This also resulted in cyan having to part with some employees and thus strategically streamlining areas and teams or reallocating resources. In addition, overhead costs that were not essential to core operations were sharply reduced. The main changes have already been implemented in the financial year 2021 and the first effects, such as the reduced headcount, are already reflected in the key figures for 2021. In addition, further measures are being taken, such as the standardization of processes and solutions to accelerate implementation, which will enable not only cost reductions but also earlier revenue generation in the medium term. As a further key element of the Performance Improvement Program, the positioning of the BSS/OSS segment was also evaluated with the conclusion that it should be repositioned within the Group. Further details are explained in the section on targets and strategy.

Cybersecurity Segment

One of the most significant milestones in the first half of the year was the launch of the cybersecurity solution at Orange France on April 8. Following a successful test phase and the acquisition of several hundred thousand existing Child Protection customers, the value-added services "Cyberfiltre" and "Cyberfiltre Avancé" entered marketing in the Orange Pro B2B segment. Despite initially closed stores in the launch regions, the market launch was successful, with additional regions gradually having been added continuously. Various sales strategies – including the consideration of a launch in the B2C segment – are being tested. Intensified marketing measures showed significant growth in the user base, particularly at the end of the second and fourth quarters. A solid conversion rate from active trial subscriptions to paying customers after the free trial period can be observed. The low churn rates among paying subscribers are particularly encouraging. Initial revenues were recognized in the second half of the year and additional contributions to the top line are expected from 2022 onwards.

Furthermore, the rollout of cyan products in other national Orange Group companies progressed in 2021. In Slovakia, the first phase was completely handed over to the partner over the summer and support was started with regard to the launch, which took place in the first quarter of 2022. The cybersecurity solution from cyan is offered as the Orangebranded service "Online ochrana" as a tariff-integrated component of the "Go Safe" tariffs and as a stand-alone add-on package for business customers and consumers for mobile and fixed connections. Due to the tariff-integrated option, high adoption figures have been recorded following the launch. Meanwhile, preparations for the second phase have already begun.

In addition to the highlights with Orange, further partnerships and contracts were also concluded. Another important milestone in the financial year 2021 was the successful technical implementation of cyan's solution at dtac (Total Access Communication Public Company Limited). The company belongs to the Telenor Group and is the second-largest mobile communications provider in Thailand with around 19 million customers. At dtac, the first step is to use cyans OnDevice Security, which in this case was implemented entirely as a cloud solution in the AWS cloud.

Claro Chile, a subsidiary of América Móvil Group, which is one of the largest Tier- 1 telecommunications providers, is another major international partner that will offer cyan cybersecurity solutions. In the future, Claro Chile's customers will be able to obtain security solutions from cyan in both the B2B and B2C sector. The entire spectrum, OnNet Security, OnDevice Security and Child Protection will be offered.

On the existing customer side, the expansion of cyan technology to fixed-network customers of Magenta (T-Mobile Austria) in Austria was an important project, which was finalized in May. As a convergent provider, Magenta can thus provide cyan cybersecurity solutions to both fixed-network and mobile customers. This enables Magenta to bundle mobile and fixed-network products, which are marketed under the common brand more intensively. As a result, cyan was able to win an additional end-customer segment and, thus expand the addressable market by 700,000 end-customers. The partnership with MobiFone in Vietnam has so far been less successful, with very slow commercialization after the launch.

BSS/OSS Segment

In the BSS/OSS segment, cyan was able to make important progress with customers and acquire new customers in the financial year 2021. In addition, a significant pipeline has been established. In terms of the number of new customer wins, it was one of the most successful financial years in the company's history, although this is not yet reflected in revenue. At the beginning of the year, the extension of the partnership with Grameenphone, one of the leading telecommunications providers in Bangladesh, for a further five years was announced. Its telecom B-brand Skitto is expected to reach a customer base in the double-digit millions over the next few years.

After years of successful cooperation with MTEL, a subsidiary of Telekom Srbija, in the Austrian market, a partnership was agreed for joint expansion into the larger markets of Germany and Switzerland. This will lead to a significant increase in the number of end customers. The project, which includes not only the connection of two new MNOs to the cyan platform but also an upgrade of the hardware, was launched in the first quarter and progressed significantly in the financial year.

In Austria, cyan acquired educom as a new customer, which needed a new platform to increase its independence from host operators as part of its realignment from reseller to virtual 5G mobile operator. On cyan's BSS/OSS platform, educom will be able to evolve rapidly to meet the demand of its digital customers across its product portfolio, delivering personalized experiences while providing deeper integration with the group's other businesses, edustore and edudeals, to further drive customer engagement.

In Latin America, several new contracts were signed with customers for the BSS/OSS solution in 2021.As for Europe, fast onboarding on the respective platforms was one of the focus points especially in the second half of financial year 2021. Lov Telecomunicaciones is the first in a series of MVNOs that launched or will launch in 2022. Lov, is a social enterprise that uses mobile services as a tool to transform people's lives through prepaid services in Colombia. The company gives a new meaning to mobile telephony and donates 50% of its operating revenues to social causes.

Earnings, Asset and Financial Position

Earnings Position

Revenue

Group revenues totaled EUR 8.5 million in 2021 (2020: EUR 21.3 million). The revenues of the previous year included revenues from the old business with Virgin Mobile in the first half of the year as well as the capex contract for 83 million end user licenses in the BSS/OSS segment recognized in accordance with IFRS 15. In the last quarter, revenues again increased slightly compared to the previous quarters and amounted to EUR 2.5 million. However, revenue in total remained below initial expectations. The share of recurring revenues, including in particular revenues from subscriptions and recurring service and maintenance fees, amounted to 64 %. The key figure Annual Recurring Revenue (ARR), calculated from recurring revenues including pro rata revenues from license agreements, stood at EUR 9.6 million as of December 31, 2021, adjusted for exchange rate effects.

cyan generated 14% (2020: 68%) of group revenues in the Americas region, 17 % (2020: 16%) in the APAC region, and 69% (2020: 17%) in the EMEA region. The changes are mainly due to one-off revenues in the previous year in the BSS/OSS segment in Mexico and in Bangladesh.

In addition to revenues, the Group generated other operating income of EUR 3.0 million (2020: EUR 1.1 million), income from reversals of impairment losses of EUR 0.1 million (2020: EUR 1.0 million) and recognized changes in inventories of EUR -0.8 million (2020: EUR 2.0 million). Other operating income mainly includes exchange rate differences in the amount of EUR 2.0 million (2020: EUR 0.2 million) and income from research grants for research activities at EUR 1.0 million (2020: EUR 0.8 million). Further details are provided in the section on research and development. Due to the launch of the cybersecurity solution at Orange in France, the previously recognized costs will be amortized, resulting in negative changes in inventories since the second quarter of 2021. Accordingly, total revenues for the financial year 2021 amounted to EUR 10.8 million (2020: EUR 25.4 million) and are in line with the reduced forecast.

EBITDA

EBITDA was EUR -12.3m in financial year 2021 (2020: EUR -5.1m), in line with the adjusted forecast of August 2021. In the last quarter, reduced costs and slightly higher revenues resulted in an improvement compared to previous periods. Overall, operating expenses decreased by 24% in financial year 2021 to a total of EUR 23.1 million (2020: EUR 30.4 million), with prior-period costs being impacted by the occurrence of contractually agreed preconditions for a waiver of receivables from Virgin Mobile in the amount of EUR 1.3 million; the earn-out of EUR 1.0 million as a result of the achievement of certain EBITDA thresholds for 2020 agreed upon when cyan AG acquired I-New Unified Mobile Solutions AG (now: I-New Unified Mobile Solutions GmbH); and the value adjustment of the receivable owed by an insolvent German customer in the amount of EUR 4.8 million.

The cost of materials and services procured rose to EUR 5.4 million in the past financial year (2020: EUR 4.3 million), with a significant increase in the cost of purchased services due to the strong order backlog. Personnel expenses remained essentially stable at EUR 11.4 million in 2021 (2020: EUR 11.1 million) with an average of 150 employees (2020: 149). On a quarterly perspective, personnel expenses were reduced to EUR 2.8 million in the fourth quarter of 2021 (2020: EUR 3.1 million). Value adjustments and other operating expenses amounted to EUR 6.3 million (2020: EUR 15.1 million). Apart from the absence of major one-off effects, foreign currency effects had a significantly lower impact on other operating expenses of EUR -0.4 million in the financial year 2021 than in the previous year (2020: EUR 2.2 million).

Segments

The BSS/OSS segment accounted for 61 % of revenues at EUR 5.2 million (2020: EUR 18.2 million). In the BSS/OSS segment, a multi-year license agreement was concluded with Virgin Mobile in the financial year 2020, most of the revenues of which were already recognized in 2020. A similar license agreement was concluded in the fourth quarter of 2019 with ACN/Flash Mobile, the revenues from which were already recognized in 2019. Both contracts therefore contributed only marginally to revenue in the financial year 2021. In addition, one-off revenues were generated in 2020 from the contract extension including platform upgrade with Grameenphone for the Skitto brand. On a quarterly basis, revenues increased due to projects with existing customers and new contracts. Total earnings added up to EUR 7.3 million (2020: EUR 19.7 million) and segment EBITDA was EUR -2.4 million (2020: EUR 8.4 million).

At EUR 3.3 million (2020: EUR 3.1 million), the Cybersecurity segment generated around 39% of group revenues. New business was able to compensate for the decline resulting from the planned end of support for the products of the original B2B business of the former cyan Networks Software GmbH. Compared to the previous quarters of the financial year, revenues in the segment increased. Total earnings decreased from EUR 5.7 million to EUR 3.5 million in 2021 due to the amortization of contract costs. Segment EBITDA for 2021, however, improved from EUR -11.3 million to EUR -7.4 million compared to the previous year.

EBIT and Net Income

The loss from operating activities (EBIT) for the financial year amounted to EUR 18.1 million (2020: EUR 11.0 million). Depreciation and amortization expense decreased slightly again this year from EUR 6.0 million to EUR 5.7 million, of which EUR 4.6 million was incurred for intangible assets and EUR 1.1 million for depreciation of property, plant and equipment. Depreciation is mainly scheduled and includes depreciation expenses in accordance with IFRS 16.

In the past year, a positive financial result of EUR 0.6 million (2020: EUR 0.6 million) was recorded, which resulted primarily from interest income from contract assets. Accordingly, earnings before taxes (EBT) amounted to EUR 17.5 million (2020: EUR -10.5 million). The net loss for the year amounted to EUR -13.9 million (2020: EUR -9.3 million) due to deferred tax income. Accordingly, undiluted earnings per share were EUR -1.30 (2020: EUR -0.95).

Asset Position and Capital Structure

Total assets amounted to EUR 95.7 million as of December 31, 2021 (2020: EUR 96.3 million). Non-current assets decreased from EUR 85.4 million to EUR 78.0 million due to scheduled depreciation/amortization and the reduction of long-term contract assets, whereas current assets increased from EUR 10.9 million to EUR 17.8 million, mainly as a result of increased inventories and cash capital increases in the fourth quarter.

Equity totaled EUR 72.8 million at the end of the year (2020: EUR 72.7 million), which corresponds to an equity ratio of 76 % (2020: 75%). Total liabilities decreased slightly to EUR 23.0 million from EUR 23.6 million. Non-current liabilities decreased by EUR 2.0 million from EUR 14.4 million to EUR 12.4 million compared to the previous year, which was mainly related to deferred tax liabilities. Furthermore, a research loan was received and a credit line was utilized. Current liabilities increased from EUR 9.2 million to EUR 10.6 million. Trade payables decreased by approximately EUR 1.2 million and convertible notes were added, which were recorded at EUR 2.5 million at year-end.

Net debt thus totaled EUR 4.2 million as of December 31, 2021 (2020: EUR 7.3 million), including IFRS 16 liabilities in the amount of EUR 5.0 million. Cash and cash equivalents amounted to EUR 8.5 million (December 31, 2020: EUR 2.5 million) and thus increased significantly as a result of the cash capital increases carried out. Leasing liabilities (IFRS 16) decreased from EUR 6.2 million to EUR 5.0 million. Further borrowed funds from existing credit lines and research loans were drawn down in the financial year 2021, resulting in an increase in financial liabilities.

Financial Position

Cash flow from operating activities amounted to EUR -9.5 million in financial year 2021 (2020: EUR 8.7 million). The license agreements with Virgin Mobile and ACN/Flash Mobile did not contribute to revenue but to cash flow in the reporting period. cyan's business is not particularly investment-intensive in either segment. Cash flow from investing activities therefore totaled EUR -0.1 million (2020: EUR -0.8 million).

The cash inflow from financing activities increased to EUR 16.5 million in the financial year (2020: EUR 1.8 million). Inflows were generated by raising debt capital, issuing convertible notes and equity through cash capital increases. The financing cash flow includes payments in connection with IFRS 16 Leasing. In total, there was a cash inflow of EUR 6.9 million in the financial year (2020: cash outflow of EUR 7.7 million).

Economic Developments at cyan AG

In contrast to the consolidated financial statements, the annual accounts of cyan AG are not prepared in accordance with the International Financial Reporting Standards (IFRS) as applicable in the European Union, but in accordance with the rules defined in the German Commercial Code [Handelsgesetzbuch (HGB)]. In addition, the regulations of the German Stock Corporation Act [Aktiengesetz (AktG)] were observed.

Course of Business and Economic Environment

Within the Group, cyan AG acts as a holding company. cyan AG is a company headquartered in Munich. It is registered in the Commercial Register [Handelsregister] at the Munich District Court [Amtsgericht München] under HRB 232764. Strategic management of the corporation is based at the head office of the company in Munich. The majority of operational services are provided by the subsidiary I-New Unified Mobile Solutions GmbH and its subsidiaries, in particular cyan Security Group GmbH.

The key performance indicator for cyan AG in both the financial year and the previous year was the annual result. In addition, in the form of regular reports, the Executive Board monitors the cost structure of cyan AG as well as the operational performance of its affiliated companies (based on the indicators listed in the consolidated financial statements). Also, the most important balance sheet indicators, such as equity, outside capital and net debt, are observed at reporting dates.

Earnings, Asset and Financial Position of cyan AG

As a holding company, cyan AG does not generate any sales revenues itself. The development of results is determined, on the one hand, by the expenses incurred for legal and consulting services, administrative activities, and Executive Board compensation, and, on the other hand, by interest income from the financing of the operating activities of the subsidiaries and income from holdings. cyan AG handles all cash management and financing within the cyan Group on behalf of all of its subsidiaries. To service its debt properly and to finance integration and growth, cyan AG is dependent upon the inflow of funds from its operational subsidiaries or from other financing resources.

Earnings Position

in EUR thousand	2021	2020
Other operating income / Gross result	15	1342
Personnel expenses	-885	-342
Depreciation	-3	-3
Other operating expenses	-1,726	-1,333
Interest income	1,397	1,386
Interest expense	-17	-6
Taxes on income and earnings	6	-13
Net profit/-loss for the year	-1,213	1,032
Profit/loss carried forward	1,032	0
Declared profit	-181	1,032

Gross profit (other operating income) in the past financial year 2021 amounted to EUR 15 thousand, compared to EUR 1,342 thousand in the same period of the previous year. The difference results from cyan AG's waiving of part of a recoverable receivable from a subsidiary, which resulted in other operating income of EUR 970 thousand in the previous year. In addition to salaries in the amount of EUR 625 thousand, personnel expenses (2021: EUR 885 thousand, 2020: EUR 342 thousand) included social security expenses in the amount of EUR 260 thousand. Other operating expenses amounted to EUR 1,726 thousand (2020: EUR 1,333 thousand).

The financial result in the period under review amounted to EUR 1,380 thousand (2020: EUR 1,380 thousand) and consists of financial income of EUR 1,397 thousand (2020: EUR 1,386 thousand) and financial expenses of EUR 17 thousand (2020: EUR 6 thousand). Negative taxes on income and earnings amounted to EUR 6 thousand (2020: tax expenses EUR 13 thousand).

In the financial year 2021, the annual result, which is the most relevant key performance indicator at cyan AG level, was EUR -1,213 thousand (2019: EUR 1,032 thousand). The declared profit therefore amounts to EUR -181 thousand (2020: EUR 1,032 thousand). The annual result forecast originally issued for 2021 at the level of the previous year was thus not met. In August, the forecasts in the Group were adjusted due to the business development.

in EUR thousand	31/12/2021	31/12/2020
Intangible assets	13	15
Tangible assets	0	0
Financial assets	69,956	49,340
Non-current assets	69,969	49,356
Receivables and other assets	18,311	27,093
Cash on hand, bank balances and checks	3,038	243
Current assets	21,349	27,335
Prepaid expenses	69	39
Assets	91,387	76,730

Asset and Financial Position

in EUR thousand	31/12/2021	31/12/2020
Subscribed capital	13,386	9,775
Capital reserve	73,634	63,448
Declared profit	-181	1032
Equity	86,839	74,255
Provisions	667	320
Liabilities	3,881	2,155
Liabilities	4,548	2,475
Equity and liabilities	91,387	76,730

cyan AG had total assets of EUR 91,387 thousand as of December 31, 2021, in contrast to EUR 76,730 thousand at the end of the previous year. Equity amounted to EUR 86,839 thousand (2020: EUR 74,255 thousand).

As of December 31, 2021, cyan AG had a significant investment in the form of I-New Unified Mobile Solutions GmbH, which is carried as an investment in the balance sheet in the amount of EUR 69,956 thousand (2020: EUR 49,340 thousand). The increase results from contributions and a value-retaining waiver of receivables owed by the subsidiary.

Opportunities and Risks

The business performance of cyan AG is closely linked to the performance of its subsidiaries and is therefore indirectly subject to the same opportunities and risks as the Group. The opportunities and risks are described in the report's section on the Group's Opportunities and Risks.

Forecast

In view of the current economic and industry forecasts, which are characterized by significant global risks, and the existing sales pipeline of the subsidiaries, the Executive Board is cautious but optimistic about the new financial year. For cyan AG, the annual result for the financial year 2022 is expected to be at the level of the previous year.

Subsequent Events after the Balance Sheet Date

Operational Progress

At the beginning of the financial year 2022, further progress was made with customers in both business segments. On the Cybersecurity segment side, the solution with Orange in Slovakia was launched in February. "Online ochrana" (Online Protection) represents part of the new "Go Safe" tariffs and is also available as an add-on package. In March, the cybersecurity solution went online with dtac in Thailand. dtac Safe is part of the popular dtac app and can be activated there in just a few steps. The SDK is directly integrated into the app. The fully cloud-based approach uses Amazon Web Services (AWS) for high scalability and consistent operations.

In the BSS/OSS segment, several MVNOs were able to launch on cyan's platforms. At the beginning of the year, the Austrian telecommunications company educom completed its migration to cyan's platform. educom offers mobile and Internet tariffs tailored to students, pupils, trainees and employees of educational institutions. As part of educom's realignment from reseller to 5G mobile virtual network operator, educom selected cyan's Seamless BSS/OSS & MVNE platform to transform itself into an independent and 5Genabled Mobile Virtual Network Operator (MVNO). In March and April, MVNOs Lov and Liwa followed suit in Colombia. LOV is a social enterprise that uses mobile services as a tool to transform people's lives through prepaid services in Colombia. The company donates a portion of its operating income to social causes. LIWA is a multi-service company and part of the T-Valley Group, providing telecommunications, renewable energy and IoT reaching into underserved areas. The launch added mobile telephony to the product portfolio. Further projects could progress significantly in the first months of 2022.

Convertible Notes Funding Program

In the first half of 2021, at the end of April and in the following months, the share price fell below 115% of the minimum price of EUR 10.472 set in the Convertible Notes Funding Program. cyan was therefore unable to obtain any further convertible notes from the program. At the same time, the cash capital increases in the fourth quarter generated additional liquid funds. The Executive Board therefore decided to terminate the program in the first quarter of 2022, to redeem the convertible notes together with an investor in a capital increase against contributions in kind and to swap the liabilities in exchange for new shares without causing significant capital outflow.

Capital increase against contributions in kind

In February 2022, cyan AG concluded an agreement with a creditor of the Company, according to which the creditor's loan claim in the amount of EUR 3,940 thousand will be contributed to the Company in the course of a capital increase against contributions in kind in exchange for 1,503,816 shares. The loan amount includes the outstanding convertible notes from the Convertible Notes Funding Program, which was terminated at the beginning of 2022. Accordingly, the nominal capital was increased by EUR 1,503,816.00 from EUR 13,385,884.00 to EUR 14,889,700.00 by issuing 1,503,816 shares at an issue price of EUR 2.62 against contribution in kind with entry in the Commercial Register in April. The shareholders' subscription rights were excluded.

Opportunity and Risk Report

Opportunity and Risk Management System

Entrepreneurial activity serves to increase the value of the company by making use of identified opportunities. As a group operating internationally, cyan is exposed to various external and internal developments and events. The opportunity and risk management system used, serves to optimize the relationship between risk and opportunity in the interests of sustained business success. In order to ensure this, suitable instruments are in place by the Executive Board which continually develops them further as needed.

The risk management of cyan concentrates on the early detection of risks with the aim of identifying all risks and opportunities that could or could not endanger the existence of the company, in order to derive appropriate strategic measures in good time. Risk management is conducted for the Group and for cyan AG in the same way, on a parallel basis. The internal control system (ICS) and the Information Security Management System constitute integral components of the risk management system used throughout the Group.

Group Risk Management

The Group-wide risk management system serves to identify relevant risks, their mitigation (e.g. training, insurance) and the resulting opportunities, so that these can be identified and harnessed within the Company and the Executive Board. The overarching risk principle is to safeguard the company's continued existence - no decision or action may give rise to a risk that could jeopardize the company's existence. Market developments in particular are monitored as part of the risk management process in order to derive appropriate decisions for the strategic management of the company in good time. The Executive Board regularly discusses new risks that have arisen and acts accordingly. cyan's risk management system is continuously developed and optimized.

The Supervisory Board is informed by the Executive Board in regular meetings about the economic development in the form of consolidated presentations, consisting of segment reporting, earnings development with budgetary and previous year figures, forecasts, consolidated financial statements, personnel and order development as well as selected other key financial figures. Likewise, the Supervisory Board is informed about risks.

Taking into account the potential damage and the probability of occurrence, individual risks are assessed in similar risk groups. The risks are assessed with proposed countermeasures and the effects of opportunities and risks are offset against each other. Residual risks are reassessed, and additional measures are taken.

Internal Control System (ICS)

cyan has established an internal control system designed to ensure the correctness of processes relating to accounting. Key elements of the ICS are the institutionalized foureyes principle, the separation of functions, and the monitoring and review of the effectiveness and efficiency of operating activities. Other important topics include the reliability of financial reporting and compliance with the legal requirements relevant to the company.

The scope and design of cyan's accounting-related ICS are at the discretion and responsibility of the Executive Board. The objective of the ICS with regard to the accounting process is to ensure, through the implementation of controls, reasonable assurance that, despite the identified risks, consolidated and separate financial statements can be prepared in compliance with the regulations. The ICS is designed to ensure that the annual financial statements are prepared in accordance with the relevant local regulations of the German Commercial Code and the German Stock Corporation Act, and that the consolidated financial statements are prepared in accordance with International Financial Reporting Standards (IFRS) as adopted by the European Union.

The organization of the accounting-related ICS has a uniform and centrally prescribed reporting structure based on local legal requirements in line with the Group's principles. The subsidiaries report periodically in accordance with IFRS as part of Group reporting. Newly established or acquired companies are integrated into this reporting process as quickly as possible. Internal controls of the subsidiaries' accounting are carried out, which in addition to the four-eyes principle include in particular IT-supported and random checks and plausibility tests.

Information Security Management System

cyan, as a European company, places high value on information and data security and therefore uses certified risk management systems in accordance with the internationally recognized ISO 27001 standard. The standard provides for a systematic examination of information security risks in the organization, taking into account threats, vulnerabilities and their impact. Based on this, a coherent and comprehensive set of information security controls and other forms of risk management procedures, such as risk avoidance or risk transfer, must be designed and implemented to address those risks. To do this, overarching management processes exist to ensure that information security controls continue to meet the organization's information security requirements. The ISO standard specifies, and an independent audit by auditors from TÜV Rheinland Cert GmbH certifies, the correct establishment, implementation, maintenance and continuous improvement of the documented information security management system.

The certification process, which involves a two-stage audit, has been successfully completed in the fourth quarter.

Risks

All risks at cyan are grouped into five categories; in an additional sixth category, COVIDspecific risks are grouped together. These categories are based on the internal structure of the risk assessment, as is also the case in discussions with the Executive Board and the responsible divisional managers.

Operational Risks

While 2020 and the winter of 2021 in particular were dominated by the pandemic, where all processes had to be adapted to the new conditions on short notice, the situation stabilized somewhat, as both partners and potential customers have since adjusted to the new normality. Due to the restrictions, they were confronted with significant hurdles in the change of work processes, which is why there were delays and projects had to be supported more strongly by cyan teams.

For cyan's solutions, the fundamental aim is to achieve fail-safe operation. In the event of a failure of the platform/software, this can lead to a standstill of operations at MVNOs or to unprotected end customers, which in turn can trigger a reduction in the number of end customers and claims for damages if cyan is at fault. To prevent outages, cyan relies on multiple data centers, a highly qualified operations team and continuous monitoring of systems.

In operational terms, recruiting continued to be hampered initially by the pandemic and subsequently by shortages in the labor market. For any company in the entire technology and software sector, hiring and retaining highly skilled staff is a key success factor. Key workers, especially in the fields of cybersecurity research, development and operations as well as sales, are indispensable with their knowledge, abilities as well as contacts for the development, sales and deployment of solutions. Through greater marketing efforts, a strategic objective of the Executive Board, it should be possible to raise the profile of cyan to direct customers, partners and end users, while also making it easier to attract personnel.

Competition Risk

The market for cybersecurity is characterized by above-average growth that is forecast to remain robust. This makes new market entries relatively attractive for startups and established providers despite high entry barriers. cyan was able to position itself early with its technology for cybersecurity and continues to see itself in a "window of opportunity", driven by cyber incidents that have become public knowledge and at the same time the goal of telecom companies to grow through relevant value-added services. No direct competitor currently has solutions on the market that combine OnNet and OnDevice security in the form of an in-house solution. The currently existing technological competitive advantage together with intensified marketing should lead to further significant customers, which will additionally strengthen cyan's position. Through targeted investments in research and development of the products coupled with the growth of the cybersecurity segment in new markets, the Executive Board expects to be able to maintain this advantage in the market and thus reduce the competitive risk.

Technological Risks

In the fight against cybercrime and threats on the internet, cyan not only faces a continuous competition with other companies, but also a race against cybercriminals. Among others, cyan is developing highly complex, network-integrated cybersecurity solutions for the detection of potential threats such as phishing, malware or identity theft for the users of smartphones and tablets. By using machine learning and artificial intelligence in its threat analysis processes, cyan can respond to new threats in a timely manner. Nonetheless there is a risk of cyan failing to respond in time to technological progress or to changing requirements in relation to cybersecurity products and services, or to changes in the entire cybersecurity market. Risks are also reduced through active research and development.

In addition, products can become obsolescent or even obsolete as the result of amendments to existing standards, or to the appearance of new ones. On the one hand, significant changes in the MVNO market environment can have negative implications for cyan in the BSS/OSS segment and, on the other hand, software can develop faults and have vulnerabilities. For its own development and in its own products, cyan also uses thirdparty and open-source software components (e.g. libraries). Despite thorough checks, these can harbor a residual level of risk in relation to compatibility and security. In order not to fall behind technologically and to maintain the market position, further developments and optimizations of the products are constantly carried out, as well as investments in research and development. In addition, an extensive information security management system has been established that monitors the risks, above all in relation to data processing.

Reputation and Brand Risk

cyan's direct customers are mostly large international corporations who entrust cyan with the security of data traffic and their end customers as well as the platform operation of the MVNO. Professional implementation and ongoing operation are important criteria by which technology companies like cyan are measured. With the launch of several customers such as Orange in France and Slovakia, an important effort has been achieved to build cyan's strong reputation. The cybersecurity solutions are offered "white-labeled", it is therefore crucial to ensure the best possible protection of the end customers' mobile devices, as reputational damage of the partner to the end customers will ultimately reflect on cyan. Equally significant is the medium and long-term marketing success. Reputational damage due to a (partial) failure is likewise possible in the BSS/OSS segment.

Increased marketing is intended to further highlight the strengths of the solutions to direct partners and potential customers, thereby supporting sales. Subsequently, increased awareness among end users should also increase penetration rates among existing customers. This results in a risk from the strategic alignment of the measures.

Risks in Connection to COVID-19

The overall and industry-wide impact and after-effects of the pandemic remain difficult to assess, with repeated waves and the associated restrictions. Although prevention concepts have been largely implemented at cyan and at customers in the meantime to ensure ongoing operations and protection of employees, health could remain at risk if the measures taken are not sufficient. Furthermore, consequences of closures of individual business sectors as a result of a renewed spread of the virus or new virus mutations cannot be foreseen. Closed stores of customers and travel restrictions may lead to lower sales. The risk of lost sales due to the delays remains. The financial impact of nonpayment of receivables due to the pandemic should be limited, as cyan has strong global partners with crisis-resistant business. At the same time, the upturn in consumption in recent months has led to a significant destabilization of supply chains and price increases.

Financial Risks

The main financial risks are the cluster and customer default risk, the liquidity risk, the interest rate risk, and the foreign exchange risk. Further information on financial risks can be found in the Notes to the Consolidated Financial Statements.

Cluster Risk and Risk of a Customer's Default

In the past financial year, no further license bundling agreements were concluded. At the same time, additional customers were acquired in both the Cybersecurity and the BSS/OSS segments. The Executive Board is committed to reducing the concentration of customer revenues, in particular by concluding contracts with new customers from other regions, and to placing revenues on a broader basis. As already explained in the section on targets and strategy, recurring revenue will be an important metric for Group management in the future.

Regardless of the current economic situation, there is a risk of insolvency on the part of one or more customers. The debtor-side risk of receivables failure, in particular of the failure of a large receivable, is classified as minor due to the increasingly diversified portfolio and experience from recent. Effective systems are employed to monitor creditworthiness.

Liquidity risk

To determine its liquidity needs, cyan operates a rolling financial and liquidity planning scheme. Attention is paid to ensuring that sufficient liquid assets are always available to settle any liabilities that fall due in the companies. The available liquid funds amounted to EUR 8.5 million as of December 31, 2021 and are maintained with banks that have a very high credit rating.

Liquidity at cyan is largely dependent on payments from customers. By winning new customers, cyan expects to improve its liquidity, although cyan is dependent on marketing by its partners. Nevertheless, there could be project delays, for example, as a result of which individual projects generate revenue only after a delay and, thus, generate a later cash flow, or there could be outright defaults by existing customers. In order to implement strategic projects or in the event of adverse economic conditions, the company may have to borrow money on the capital market or from financial institutions in the medium term. The liquidity risk is classified as medium.

Interest Rate Risk

The interest rate risk is insignificant due to the fact that cyan had only fixed-interest financial liabilities of EUR 7.7 million outstanding as of the reporting date and that no contracts contain interest rate adjustment clauses.

Foreign Exchange Risk

cyan is exposed to certain currency risks due to its underlying international business. In the financial year 2021, cyan recognized positive foreign currency effects in the Statement of Profit and Loss in the amount of EUR 2.0 million and negative effects in the amount of EUR 0.4 million. The Company's finance department constantly monitors these risks and in particular the foreign currency rates in order to be able to react appropriately. Efforts are made to conclude contracts in stable international currencies and to hold more volatile currencies only to the extent necessary. Where expenses and investments are not denominated in euros, exchange rate fluctuations may nevertheless affect the financial position of Group companies and have a negative impact on the Group's results and earnings. In particular, the valuation of assets in US dollars has an impact on earnings. This risk is to be classified as low.

Opportunities

In addition to the aforementioned risks, there are a large number of opportunities that represent key drivers for growth and further development at cyan. The opportunities are aggregated into four categories: technological change, expansion into new markets, increasing awareness, and new sales strategies. For details on the underlying market drivers in this context, reference is made to the description of industry-specific developments.

Opportunities Presented by New Markets

In an ever more connected world, the ability to use the internet safely plays an important role. Mobile devices, especially smartphones, play a particularly important role in this context. They have long since ceased to be used exclusively for sending text messages and voice telephony but have developed into an access key to an endless range of digital services. The improving network coverage, at minimum with 4G, and the widespread availability of internet-capable devices contributes to further growth in potential end users. At the same time, network operators are continuing to invest in expansion of 5G infrastructure, the advantage of which lies in high speeds and low latency levels. Together with the rise in encryption of traffic, this makes Deep Packet Inspection (DPI) more difficult, causing the focus to move onto DNS filter technology. Furthermore, cyan has demonstrated another important technological competence with the cloud-based deployment of the cybersecurity solution and is thus also ready for the massive cloud trend that can be observed in the industry.

It is expected that not only the number of smartphones will increase, but also the number of other internet-connected devices, Internet-of-Things (IoT). This leads to further fragmentation of the system landscape because there is usually no uniform hardware and software and numerous devices, especially smaller ones, do not have the computing power to run complex endpoint solutions directly yet. Nevertheless, many smart TVs, smartwatches, home automation devices, and even vehicles (connected mobility) are constantly connected to each other and to the internet. Network-integrated solutions can also protect users in this area. The end user expects a seamless user interface while at the same time being able to customize the solution to suit his or her personal needs.

Opportunities Presented by New Markets

In the last few years, cyan has already been able to reach new markets by expanding the product, gaining customers in additional countries and addressing additional end customer segments. There continues to be significant potential here.

cyan is constantly working on new solutions to provide end customers with the best possible protection. Not least by further developing the Seamless Security platform to include an OnNet solution for PCs in the fixed-line Internet and the convergent solution based on DNS-over-VPN, which will enable a broader range of accessible partners and also further upselling to existing customers.

cyan's cybersecurity is based on DNS a fundamental technology for the Internet and the BSS/OSS platform uses international standard interfaces and environments, making both solutions universally deployable internationally. With increased global presence by cyan and partners, new geographies can be tapped, offering additional potential on the revenue and sales side. In the MVNO/BSS/OSS market, further opportunities arise from special use cases in which lightweight digital solutions are required.

Opportunities due to Increasing Levels of Awareness

In recent years, the consequences of increasing digitization, such as data protection and cybersecurity, have increasingly become the focus of public attention. The European Union established a first milestone with its General Data Protection Regulation that entered into force in 2018. Since then, numerous prominent IT security incidents have become known, the security of foreign telecom equipment has been highlighted in the media, and the population has experienced an unprecedented wave of digitalization triggered by global home-office orders. As a consequence, security on the Internet for the general public at large as well as for national governments, including the European Union, has become an important topic. Awareness among the public is also prompting companies to invest more into cybersecurity. In view of the comparatively stringent European regulatory structure, European providers are viewed as trustworthy on the international stage. For cyan, this is an opportunity to benefit from the momentum this provides.

On the MVNO market, there are two drivers related to awareness: regulation due to consolidation and deregulation due to liberalization. Regulation of telecommunications markets is due to consolidation, especially for mobile and internet providers. Competition authorities are becoming active in this regard, especially in developed markets, to increase competition by obliging existing providers to offer wholesale agreements on certain terms for MVNOs. In emerging regions, on the other hand, market liberalization of protected telecom infrastructure and the opening to external investors is creating significant opportunities for MVNOs.

Opportunities Present by New Sales Strategies

An essential element of the company's strategy is a modified, more sustainable sales strategy, which on the one hand involves sales partners more closely, and on the other implements projects and features in stages at the customer's end and provides for active support in the go-to-market area as well as in end-customer sales. In the case of the former, the aim is to pursue focused leads and thus enable better partnership management from the outset. A staggered release in phases makes it possible to generate initial revenues earlier and at the same time provides end customers with regular feature updates to generate an upsell. To increase adoption by end customers, partners will be actively supported in go-to-market and marketing issues from day one. Initial feedback shows that there are significant opportunities to improve monetization by accelerating the process and driving more successful adoption of the solution.

Opportunities & Risks Profile

As a growth company, cyan operates in a continuously evolving technology industry that is characterized by disruptive innovations. This gives rise to risks and opportunities that are influenced by various factors. In the opinion of the Executive Board, the risk management system used at cyan is suitable for identifying, analyzing and quantifying the existing risks in order to manage them effectively. The Executive Board is committed to making the best possible use of opportunities, and to reducing risks as far as reasonably possible. In view of the still unreliable forecasting situation regarding the future development of the pandemic and the associated global consequences, future developments are subject to significant uncertainty. Changes in external and internal factors are therefore analyzed regularly and opportunistic measures are taken as required.

Based on the multi-year overall planning for the Group, which is based on the long-term assumption of an increase in revenues, in particular through additional new and existing customer business, there are no risks that could jeopardize the continued existence of

cyan. The Executive Board considers the risks described to be manageable and sees very good opportunities for cyan to grow in the future. As a result of the comprehensive restructuring including capital increases, cyan is in a good position to realize the adapted growth strategy.

Forecast Report

The company recognized very high non-recurring revenues in 2020, which were not repeated in fiscal year 2021. In addition, despite the new deals in the Cybersecurity segment, sales were slower than expected in 2021. As a result, the Executive Board of cyan AG adjusted the sales and earnings forecast made at the beginning of the year in August and announced a comprehensive Performance Improvement Program. The aim of these measures is to refocus the company and make a lasting successful new start from existing customers as well as from those in the pipeline.

The overall economic climate developed positively last year and forecasts indicate a more robust recovery of the economy in the medium term, especially for the coming year, albeit marked by significant risk factors. The investment behavior of cyan's partners, especially in the telecommunications sector, is closely linked to economic developments in many areas. Irrespective of this, cybersecurity continues to be an important topic in social, political and economic terms and is therefore growing at an above-average rate, detached from the general economic development. With the increase in mobility, the market for prepaid telecommunications services is also expected to strengthen, for example, due to tourists and business travelers.

These factors are also reflected in cyan's forecast. On the one hand, the more selective pipeline of potential new customers in both segments, cybersecurity and also BSS/OSS, recently developed exceptionally positively. On the other hand, the forecasts for existing customers again showed stronger growth. With the launch of Orange (Slovakia), educom, Lov, dtac, Liwa, and customers in advanced implementation phases, the number of addressable end customers has increased significantly. The growth in subscriptions and the associated recurring revenues should already be reflected in the business figures this year and contribute to growth in both the Cybersecurity and BSS/OSS segments. Consequently ARR (Annual Recurring Revenue) shall increase. In addition, project revenues are expected from ongoing implementations. Therefore, the Executive Board expects operating sales growth in the range of approximately 30-50% from EUR 8.5 million in the past fiscal year to between EUR 11 million and EUR 13 million for fiscal year 2022.

The cyan Group started the fiscal year 2022 with a reduced fixed cost base as a result of the comprehensive Performance Improvement Program which has been implemented in large parts in the third and fourth quarter. The cost reductions should be realized in the following quarters of 2022 after the non-recurring effects related to the program. Nevertheless, economic forecasts are difficult to make, particularly in view of the continued inflation of all input factors from labor to hardware and software. At Group level, the Executive Board expects an improvement in the operating margin (EBITDA) for 2022.

Takeover Disclosures

cyan AG is listed in the Open Market, Scale Segment of Deutsche Börse in Frankfurt am Main (Germany). The open market is not an organized market as defined in Section 2 (7) of the German Securities Acquisition and Takeover Act [Wertpapiererwerbs- and Übernahmegesetzes (WpÜG)]. This information is provided on a voluntary basis in the interests of the reader and is based on Sections 289a (1), and 315a (1) of the German Commercial Code [Handelsgesetzbuch (HGB)].

Composition of Subscribed Capital

The nominal capital (subscribed capital) on December 31, 2021 amounts to EUR 13.385.884 and consists of 13.385.884 bearer shares without a par value [Stückaktien] with a proportional contribution to the nominal capital of EUR 1.00 per share. The nominal capital is fully paid up. Every share carries one vote. The rights and obligations associated with them comply with relevant legislative provisions, in particular the German Stock Corporation Act (AktG), with due consideration of the stipulations in the Articles of Association of cyan AG. No voting agreements among shareholders have been disclosed to the Executive Board. On December 31, 2021, no treasury shares are being retained by the company. A capital increase was registered in April 2022, increasing the nominal capital to 14,889,700.

The details regarding the development of nominal capital and capital reserves is shown in the Consolidated Statement of Changes in Equity and in the explanations in the Notes to the Consolidated Financial Statements.

Restrictions on Voting Rights and Transfers

The company is not aware of any agreements between shareholders of cyan AG that aim to restrict voting rights or the transfer of shares.

Shares Held in Capital

To the Executive Board's knowledge, there were two direct or indirect shareholdings with more than ten percent of the voting rights in cyan AG as of the reporting date for the 2021 Annual General Meeting: Tansanit Stiftung and Alexander Schütz.

Shares with Special Rights

All shares carry identical rights. No shares grant special rights, in particular they do not confer any powers of control.

Voting Rights of Employee Shares

In cases where employees of cyan are shareholders of cyan AG, the Executive Board is not aware of any special issues regarding the exercising of voting rights. Neither the rights-based communities of employees nor allied voting agreements between employee shareholders are known.

Appointment and Dismissal of Directors, Changes to the Articles of Association

Appointment and dismissal of members of the Executive Board are based upon Sections 84, 85 of the German Stock Corporation Act (AktG). Section 84 AktG defines that Executive Board members are appointed by the Supervisory Board for a period in office of no more than five years. In accordance with the Articles of Association of cyan AG, the Executive Board can comprise one or more people. The number of members is stipulated by the Supervisory Board. The Articles of Association also provide no special regulations for the appointment and dismissal of individual members – or of all members – of the Executive Board.

Section 179 of AktG stipulates that changes to the Articles of Association require a decision at the shareholder's meeting, whereby amendments that only relate to the version can be, and also were, transferred to the Supervisory Board in accordance with Section 15 of the Articles of Association of cyan AG. Any such amendment becomes valid once recorded in the register of companies. In accordance with Section 18 of the Articles of Association of cyan AG, any decisions taken at the shareholder's meeting require a simple majority of the votes cast, unless otherwise stipulated in the Articles of Association or by enforceable legislative stipulations.

Powers of the Executive Board to Issue or to Buy Back Shares

At the Annual General Meeting 2021, a new authorized capital "Authorized Capital 2021" was created in the Articles of Association of cyan AG. The Executive Board is authorized, with the approval of the Supervisory Board, to increase the company's nominal capital on one or more occasions by up to a total of EUR 4,963,372.00 by June 22, 2026 by issuing up to 4,963,372 new no-par value bearer shares in return for cash and/or noncash contributions. In principle, shareholders are to be granted subscription rights; the statutory subscription right may also be granted in such a way that the new shares are underwritten by a bank or an equivalent institution pursuant to Section 186 (5) sentence 1 of the German Stock Corporation Act (AktG) with the obligation to offer them for subscription to the shareholders of the company. However, the Executive Board is authorized, with the approval of the Supervisory Board, to exclude the statutory subscription right of shareholders to the extent necessary to compensate for fractional amounts; if, in the case of a capital increase against contributions in kind, the shares are granted for the purpose of acquiring companies, parts of companies or interests in companies (including increasing existing interests) or for the purpose of acquiring receivables from the company; if a capital increase against cash contributions does not exceed 10 % of the capital stock and the issue price of the new shares is not significantly lower than the stock market price (Section 186 (3) sentence 4 AktG) – when exercising this authorization under exclusion of subscription rights in accordance with Section 186 (3) sentence 4 AktG, the exclusion of subscription rights on the basis of other authorizations in accordance with Section 186 (3) sentence 4 AktG must be taken into account; to the extent necessary to grant the holders of option and/or convertible bonds issued by the company subscription rights to new shares to the extent to which they would be entitled after exercising their option or conversion rights. The Executive Board is authorized, with the approval of the Supervisory Board, to determine the further details of the capital increase and its implementation. The Supervisory Board is authorized to amend the wording of the Articles of Association in accordance with the scope of the implementation of the capital increase from authorized capital.

After partial utilization, the authorized capital amounts to EUR 417.00 as of April 4, 2022.

Authorizations to Issue Bonds with Options and/or Convertible Notes

At the Annual General Meeting 2019, "Conditional Capital 2019/I" and 2021, "Conditional Capital 2021/I" were created. As a result, the nominal capital of the Company is conditionally increased by up to EUR 360,000.00 through the issue of up to 360,000 new nopar value bearer shares (Conditional Capital 2019/I) and EUR 4,016,902.00 through the issue of up to 4,016,902 new no-par value bearer shares (Conditional Capital 2021/I). The conditional capital increase will only be carried out to the extent that the holders of convertible bonds and/or bonds with options issued on the basis of the authorization of the Annual General Meeting by July 2, 2024 or June 22, 2026 exercise their conversion or option rights or conversion obligations under such bonds are fulfilled and insofar as no other forms of fulfilment are used for servicing. The new shares shall participate in profits from the beginning of the financial year in which they are created through the exercise of conversion or option rights or the fulfilment of conversion obligations. The Executive Board is authorized, with the approval of the Supervisory Board, to determine the further details of the implementation of the conditional capital increase. The Supervisory Board is authorized to amend the wording of the Articles of Association in accordance with the respective utilization of the conditional capital.

Authorization to Issue Stock Options

The nominal capital of the Company is conditionally increased by up to EUR 586,470.00 by issuing up to 586,470 new no-par value bearer or registered shares (Conditional Capital 2021/II). The conditional capital increase is exclusively for the purpose of granting subscription rights to shares (stock options) to members of the Executive Board of the Company or to managing directors of companies affiliated with the Company and to employees of the Company or of companies affiliated with the Company granted on the basis of the authorization of the Annual General Meeting on June 23, 2021. The shares shall be issued at the issue price specified in the above authorization. The conditional capital increase will only be implemented to the extent that subscription rights are exercised and the Company does not grant treasury shares or cash compensation to settle the subscription rights. The new shares shall carry dividend rights from the beginning of the financial year for which, at the time the subscription right is exercised, no resolution has yet been passed by the Annual General Meeting on the appropriation of net income. The Executive Board of the Company or, insofar as members of the Executive Board of the Company are concerned, the Supervisory Board of the Company is authorized to determine the further details of the conditional capital increase and its implementation. The Supervisory Board is authorized to amend the wording of the Articles of Association in line with the issue of subscription shares.

Agreements Subject to the Condition of a Change of Control

The financing contracts concluded with the main bank partners include market-standard Change-of-Control regulations; under certain conditions, these can trigger a redefinition of existing credit agreements. Furthermore, these are no agreements between cyan AG and third parties that are conditional upon a change of control following a takeover bid and that could have implications of this nature solely or in their totality.

Compensation Agreements

No agreements have been made with members of the Executive Board in the event of a takeover bid which could lead to compensation or other payments by the company.

Munich, April 2022

The Executive Board

Consolidated Financial Statements

Consolidated Financial Statements

Statement of Comprehensive Income

Statement of Profit and Loss

in EUR thousand	Notes	2021	2020
Revenues	1	8,483	21,293
Other operating income	2	3,030	2,076
Income from reversals of impairment losses	2	111	-
Change in inventories and capitalized own work	2	-798	2,011
Costs of materials and services	3	-5,372	-4,274
Personnel expenses	4	-11,435	-11,108
Value adjustments	5	-437	-6,096
Other expenses	6	-5,901	-8,958
EBITDA		-12,320	-5,058
Depreciation and amortization	7	-5,742	-5,981
Operating result (EBIT)		-18,062	-11,039
Financial income	8	727	704
Financial expenses	8	-163	-143
Earnings before taxes		-17,497	-10,478
Taxes on income and earnings	9	3,620	1,210
Result after taxes		-13,877	-9,268

a In 2020, income from reversal of impairment losses from receivables was reported under other operating income.

Other Comprehensive Income (OCI)

in EUR thousand	Notes	2021	2020
Actuarial resultsa		-	-0
Gains (losses) from exchange rate differencesb		179	-209
Total result for the fiscal year		-13,698	-9,477

^a Not recyclable

^b Recyclable

^c The entire results are attributable to the shareholders of the company.

Earnings per Share

in EUR per share	Notes	2021	2020
Undiluted earnings per share		-1.30	-0.95
Diluted earnings per share		-1.22	-0.95

Consolidated Statement of Financial Position

		Assets

in EUR thousand	Notes	31/12/2021	31/12/2020
Intangible assets		54,453	58,864
Patents, trademark rights, customer relationships and
similar rights	10	11,405	12,894
Software	10	11,432	14,300
Development costs	10	837	891
Goodwill	10	30,779	30,779
Tangible assets		4,943	5,999
Land and buildings	11	4,432	5,321
Machines and other equipment	11	117	89
Business and office equipment	11	394	589
Other receivables	14, 15	33	41
Financial receivables	14, 15	300	572
Contract costs	12	4,255	5,118
Contract assets	12	13,274	14,588
Deferred tax assets	13	733	192
Non-current assets		77,992	85,373
Trade receivables and other receivables	14, 15	2,843	3,149
Contract assets	12	3,447	2,934
Inventories		353	10
Tax receivables	15	214	548
Other receivables and assets	14, 15	2,119	1,502
Financial receivables	14, 15	272	272
Cash and cash equivalents	16	8,504	2,490
Current assets		17,753	10,905
Total assets		95,745	96,278

Equity and Liabilities

in EUR thousand	Notes	31/12/2021	31/12/2020
Share capital	17	13,386	9,775
Reserves		59,393	62,905
Capital reserves		78,455	68,269
Other reserves		113	-66
Reserves according to IAS 19		-1	-1
Profit / loss carried forward		-19,174	-5,297
Equity		72,779	72,680
Provisions	20	7	7
Contract liabilities	12	-	230
Leasing liabilities	14, 18	3,832	4,970
Other financial liabilities	14, 18	5,199	3,650
Other non-current liabilities	14, 19	206	206
Deferred tax liabilities	13	3,139	5,311
Non-current liabilities		12,384	14,374
Trade payables and other liabilities	14, 19	3,723	4,887
Provisions	20	1,818	1,903
Financial liabilities	14, 18	15	6
Leasing liabilities	14, 18	1,207	1,180
Convertible notes	14, 18	2,450	-
Tax liabilities		1,370	1,248
Current liabilities		10,582	9,224
Total liabilities		22,966	23,599
Total equity and liabilities		95,745	96,278

Consolidated Statement of Cash Flows

in EUR thousand	Notes	2021	2020
Result before tax from continuing operations		-17,497	-10,478
Result before tax from discontinued operations		-	-
Earnings before tax		-17,497	-10,478
Adjustments to reconcile profit before tax to net cash flows
Profit/loss from the decrease in assets		0	13
Depreciation of immaterial and tangible assets		5,742	5,981
Change in provisions		-85	-424
Financial income		-727	-704
Financial expenses		163	143
Other expenses/income with no influence on liquid funds		-925	-8,814
		-13,329	-14,284
Working capital adjustments
Change in inventories		-343	4
Change in contract assets and contract costs		4,312	2,505
Change in trade receivables and other receivables		-302	480
Change in trade payables and other liabilities		165	2,246
Change in contract liabilities		-	230
Net cash flow from earnings before taxes		-9,498	-8,820
Income taxes paid		33	109
Cash flow from operating activities	17	-9,464	-8,711
Purchases of immaterial and tangible assets		-325	-1,044
Purchase of financial assets		274	274
Disposal of immaterial and intangible assets		1	-
Interest received		0	7
Cash flow from investing activities	18	-51	-763
Proceeds from the issue of share capital		13,797	-
Proceeds from loans and borrowings		1,558	3,558
Proceeds from the issue of convertible notes		2,450	-
Repayments of financial liabilities		-1	-5
Repayments of participation rights		-	-545
Repayments of leasing liabilities		-1,251	-1,164
Interest paid		-94	-71
Cash flow from financing activities	19	16,460	1,773
Change in cash and cash equivalents		6,945	-7,701
Cash and cash equivalents at the beginning of the fiscal year		2,490	8,512
Cash and cash equivalents at the end of the fiscal year		8,504	2,490
thereof effect of exchange rate differences on cash and cash
equivalents received in foreign currency		-931	1,679

Consolidated Statement of Changes in Equity

in EUR thousand	Nominal capital	Capital reserves	Currency reserve	Reserves according to IAS 19	Profit / loss carried forward	Total
01/01/2020	9,775	68,269	143	-1	3,971	82,157
Net loss /profit for the year					-9,268	-9,268
Changes in the scope of consolidation						-
Miscellaneous result after taxation			-209	0		-209
Total result for the financial year	-	-	-209	0	-9,268	-9,477
Capital increase						-
31/12/2020	9,775	68,269	-66	-1	-5,297	72,680
Net loss /profit for the year					-13,877	-13,877
Changes in the scope of consolidation						-
Miscellaneous result after taxation			179	0		179
Total result for the financial year	-	-	179	0	-13,877	-13,698
Share-based remuneration						-
Capital increase	3,611	10,186				13,797
31/12/2021	13,386	78,455	113	-1	-19,174	72,779

Notes to the Consolidated Financial Statements

Notes to the Consolidated Financial Statements

Information About the Company

cyan AG, headquartered in Munich (Theatinerstraße 11, 80333 Munich, Germany), is a stock corporation registered in the Commercial Register B of the Munich Local Court under HRB 232764. cyan AG has been listed on the Frankfurt Stock Exchange in the Scale Segment of the Open Market since March 2018. cyan AG acts as a holding company within the Group. Operational services are provided by the Austrian subsidiary I-New Unified Mobile Solutions GmbH (formerly I-New Unified Mobile Solutions AG) and its subsidiaries, in particular cyan Security Group GmbH. I-New Unified Mobile Solutions GmbH operates as a Mobile Virtual Network Enabler (MVNE). cyan Security Group GmbH offers cybersecurity solutions for end customers of mobile network operators (MNOs), mobile virtual network operators (MVNOs), and financial service providers.

Accounting Principles

The following section presents the main accounting and valuation methods used for these consolidated financial statements. These principles – unless otherwise indicated – were used for all of the years presented.

The consolidated financial statements comprise the Consolidated Statement of Comprehensive Income, the Consolidated Statement of Financial Position, the Consolidated Statement of Cash Flows, the Consolidated Statement of Changes in Equity and the Notes to the Consolidated Financial Statements.

The Executive Board of cyan AG has approved the consolidated financial statements and their submission to the Supervisory Board on April 25, 2022.

Basis of Preparation

The consolidated financial statements for the fiscal year ended December 31, 2021 were prepared on a voluntary basis exercising the option defined in Section 315e German Commercial Code (HGB) in accordance with the International Financial Reporting Standards (IFRS) applicable on the reporting date, as applied in the EU. The designation IFRS comprises the International Accounting Standards (IAS) which remain valid, the International Financial Reporting Standards (IFRS) as well as interpretations of the Standing Interpretations Committee (SIC) and the International Financial Reporting Interpretations Committee (IFRIC). The valuation was based on the assumption that the corporate group will continue as a going concern.

The layout of the statement of comprehensive income is based on the total cost method. Individual items in the statement of comprehensive income and the balance sheet are grouped together for ease of understanding or due to their lack of material significance. In accordance with IAS 1, capital assets and liabilities are classified on the basis of maturity. These items are classified as current if they fall due within one year. Otherwise, they are classified as non-current.

The Accounting and Valuation Methods were applied consistently to the consolidated financial statements and to figures from the previous year.

Implications due to COVID-19

As already stated in the Management Report, the coronavirus pandemic has developed into a global economic crisis. In this respect, cyan is mainly affected by delays in project implementations and postponements of contract conclusions. As announced in the interim report, this circumstance was also reflected in the annual results for 2021. The cost-saving measures implemented in 2021 will be fully visible in 2022.

In connection with COVID-19, cyan has also assessed whether there is an indication of impairment of assets according to IFRS 9. Assuming that the lockdown will lead to increased investments in digitalization and, due to the increased home office activity in all industries, also in the protection against cybercrime, cyan assumes that the general economic downturn will not affect the telecommunications industry in particular and thus cyan's main customers, which is why the expected loss rates have not been adjusted.

Any effects of the COVID-19 pandemic were also taken into account as part of the impairment analysis (IAS 36). For this purpose, the weighted average cost of capital (WACC) was adjusted. The analysis showed that the values in use of the assets continue to be higher than the book values and therefore there was no need for impairment.

Functional Currency

The consolidated financial statements of cyan AG are prepared in thousand Euro. The use of automatic calculation aids may result in rounding differences when adding up rounded amounts.

The management takes the view that the consolidated financial statements include all adjustments required to give a true and fair view of cyan's assets, financial and earnings positions.

The financial statements of subsidiaries whose functional currency is other than the Euro are translated in accordance with the functional currency principle. Balance sheet items are translated at the closing rate. Income and expense items are translated at the average exchange rate for the year. Resulting translation differences are recognized in other comprehensive income (OCI) and presented in the currency translation reserve in equity until the disposal of the subsidiary.

Currency translation differences arising from exchange rate fluctuations between the recognition of the transaction and its cash effect or measurement at the balance sheet date are recognized in profit or loss and reported in the operating result.

The following table shows the foreign exchange rates of those foreign currencies in which cyan AG and its subsidiaries transacts their business:

	Average rate		Closing rate
	2021	2020	31/12/2021	31/12/2020
Argentine Peso (ARS)	112.744		116.130
Bangladeshi Taka (BDT)	100.439	97.098	97.383	103.874
Chilean Peso (CLP)	903.213	905.061	964.440	870.660
Colombian Peso (COP)	4,460.464	4,272.080	4,509.062	4,212.021
Mexican Peso (MXN)	23.990	24.512	23.616	24.291
Peruvian Sol (PEN)	4.678	4.079	4.595	4.676
Hungarian Forint (HUF)	358.463	351.205	367.500	359.020
US Dollar (USD)	1.184	1.141	1.130	1.217

Estimates and Assumptions

The preparation of the consolidated financial statements requires estimates and assumptions that affect the figures reported in the consolidated financial statements. The actual results may diverge from these estimates. The estimates and their underlying assumptions are subject to continuous review. Amendments of balance sheet estimates are recorded in the period in which the estimate was changed, and in all later periods of time. IFRS-based valuations performed by the management that have a substantial impact on the consolidated financial statements and estimates that carry a substantial risk of a major adjustment in the following year are explained in the respective items.

Impairment of Assets

The assessment of recoverability of intangible assets, goodwill, and property, plant and equipment, is based on assumptions for the future. The assumptions employed for the impairment tests of goodwill are explained in the notes to the consolidated statement of financial position in section 10, Intangible Assets. The determination of the useful life of assets involves estimates.

Receivables

Impairments of receivables are accounted for on the basis of assumptions about the probability of default in accordance with the model of expected credit losses.

Other Provisions

Other provisions are set up in response to current liabilities resulting from events in the past that give rise to an outflow of resources with an economic benefit, employing a figure that most probably reflects that value, based on reliable estimates. Details of provisions can be found in the explanations to the consolidated statement of financial position in section 20, Provisions.

Taxes on Income

The application and subsequent valuation of actual as well as deferred taxes are subject to uncertainties arising from complex taxation legislation in the different national jurisdictions, and that are also subject to regular amendments. Furthermore, the valuation of losses carried forward is contingent upon future results. Management assumes that it has come to a reasonable estimate of the uncertainties surrounding taxation and of future results. However, due to the existing uncertainties surrounding taxation and in relation to the estimation of future results, there is a risk of variances arising between actual results and the assumptions made in relation to the impact of these on the tax liabilities and deferred taxes. The following sections on the taxation of income explain tax-related details in greater depth.

Revenue from Contracts with Customers

The assessment of contracts with customers by the criteria of IFRS 15 is based on the estimates and assumptions in relation to the identification of separate performance-related obligations within a contract and the distribution of the transaction price to these in accordance with their individual selling prices. More detailed explanations are provided in the Accounting and Valuation Methods under "Revenue from Contracts with Customers".

Leasing

Substantial estimates as lessee and lessor were required for the calculation of rights-ofuse and their associated leasing liabilities and receivables respectively. These are explained in greater detail in the part on leasing of the Accounting and Valuation Methods section.

Scope of consolidation and consolidation method

The scope of consolidation is determined in accordance with the provisions of IFRS. In addition to the financial statements of cyan AG, the consolidated financial statements also include the financial statements of the companies controlled by cyan AG (and its subsidiaries).

Subsidiaries are companies that are controlled by cyan AG. Control exists when cyan AG is able to exercise control over these associated entities, is exposed to variable returns from its involvement with those entities and has the ability to affect the amount of those returns through its control over those entities. The financial statements of subsidiaries are included in the consolidated financial statements from the date cyan AG obtains control over the subsidiary until the date cyan AG ceases to have control.

The scope of consolidation as of December 31, 2021 is as follows:

Company	Registered office	Share	Fully consolidated since	Fully consolidated until
cyan AG	Germany
CYAN International Solutions GmbHa	Austria	100%	01/01/2018	30/06/2020
CYAN Licencing GmbH	Austria	100%	01/01/2018
CYAN Mobile Security GmbHa	Austria	100%	01/01/2018	30/06/2020
CYAN Networks Software Gesellschaft mbHa	Austria	100%	01/01/2018	30/06/2020
cyan Seamless Solution Mèxico, S.A. de C.V. (fmr. I-New Unified Mobile Solutions,
S.A. de C.V.)	Mexico	100%	31/07/2018
cyan security Argentina SRLb	Argentina	100%	30/06/2021
cyan security Chile S.p.A	Chile	100%	31/07/2018
cyan security Colombia S.A.S.	Colombia	100%	31/07/2018
cyan security Ecuador SASc	Ecuador	100%	31/12/2020
cyan Security Group GmbH	Austria	100%	01/01/2018
cyan security Peru S.A.C.	Peru	100%	31/07/2018
cyan security USA, Inc.	USA	100%	31/07/2018
I-New Bangladesh Ltd.	Bangladesh	100%	31/07/2018
I-New Hungary Kft.	Hungary	100%	31/07/2018
I-New Unified Mobile Solutions GmbH	Austria	100%	31/07/2018
Say:Hola! S.A.S.d	Colombia	100%	31/07/2018	31/03/2020
smartspace GmbH	Austria	100%	31/07/2018

^a With the merger agreements dated August 20, 2020 and August 28, 2020, the companies were merged into the parent company by way of an up-stream merger.

b In 2021, cyan security Argentina SpA was established.

c In 2020, cyan security Ecuador SAS was founded.

^d With the closing balance sheet of March 31, 2020, the liquidation of Say: Hola! S.A.S. was completed and it was therefore deconsolidated in 2020.

The consolidated financial statements were produced on the premise that cyan AG is the parent company of cyan. The consolidated financial statements include all companies under the controlling influence ("control") of the parent company by way of full consolidation.

The following table shows the changes in the scope of consolidation:

	Full consolidation		At-equity
	31/12/2021	31/12/2020	31/12/2021	31/12/2020
Balance at the beginning of the
reporting period	13	16	0	0
Included for the first time	1	1	0	0
Deconsolidation due to mergers	0	3	0	0
Deconsolidated	0	1	0	0
Balance at the end of the reporting
period	14	13	0	0

Newly applicable and amended accounting standards

For the first time, application of the following amended standards is mandatory:

Standard	Content	Effective
IFRS 9, IAS 39, IFRS 7,
IFRS 4 und IFRS 16	Interest Rate Benchmark Reform Phase II	01/01/2021
	COVID-19-related amendments to rental concessions -
IFRS 16	date of application	01/04/2021
	Insurance contracts - extension of the period for
IFRS 4	temporary exemption from the application of IFRS 9	01/01/2021

The changes had no material effect on cyan's assets, financial and earnings positions.

The following amendments or new versions of standards and interpretations are not yet mandatory or applicable or have not yet been adopted by the EU:

Standard	Content	Effective
IFRS 17	Insurance Contracts	01/01/2023
	Classification of liabilities as current or non-current:
	Amendments relating to the disclosure of accounting
IAS 1	policies	01/01/2023
IAS 8	Accounting estimates - changes	01/01/2023
	Changes relating to deferred taxes on leases and
IAS 12	decommissioning obligations	01/01/2023
Various	Improvements to IFRS, Cycle 2018-2022	01/01/2022
IFRS 3	Amendments to references to the framework in IFRSs	01/01/2022
	Property, plant and equipment: Income before reaching
IAS 16	the ready-for-use state	01/01/2022
	Provisions, contingent liabilities and contingent
	receivables: Scope of performance costs for onerous
IAS 37	contracts	01/01/2022

The standards listed – if adopted by the EU – will not be applied early. From today's perspective, the amendments and new versions of the standards and interpretations are not expected to have a material impact on cyan's assets, financial and earnings positions.

Accounting and Valuation Methods

Revenues from Contracts with Customers

cyan has applied IFRS 15 Revenues from Contracts with Customers. According to IFRS 15, the time when the transfer of title to goods and services takes place, and the point where the customer can make use of them, is decisive in relation to the time when revenue is generated. To this end, cyan has applied the 5-step model for quantifying the extent and timing of the revenue recognition:

• ^◼ Identification of the contract
• ^◼ Identification of performance-related obligations
• ^◼ Determination of the transaction price
• ^◼ Distribution of the transaction price across the performance-related obligations
• ^◼ Recognize revenue either over time or at point of time

In its customer contracts, cyan has identified the following performance-related obligations: Granting of Licenses, Technical Support and Maintenance as well as updates.

Granting of Licenses

In the process of selling licenses by cyan, the customer acquires the right to use intellectual property and thus revenue is recognized when the license is sold. Critical to the timing of this is the point from which the customer is able to use the license and therefore to derive benefit from it. One example of this involves the licenses for using the cybersecurity software developed by cyan. Another involves the licenses for using the BSS/OSS software solution developed by i-new.

Technical Support and Maintenance

During the term of the contract, further services are to be delivered, for example in the form of technical support and maintenance. In this case it is assumed that an obligation to provide such services exists in accordance with IFRS 15.26 e) and therefore revenue is recognized over the specified period of time.

In the context of technical support for the BSS/OSS solution, provision of as well as support and maintenance for the technical platform, used for connection to the MNO, is included. The services delivered in the BSS/OSS segment are not hosting services because these do not become the property of customers when they use the solution transferred to them but can instead also be used at the same time by other customers.

Updates

Irregular updates occur with the BSS/OSS software solution. However, unrestricted use can still be made of the software solution originally provided, even without updates.

For customer contracts in the cybersecurity segment, ongoing updates of databases may be provided. These are fully automated and involve the use of self-learning algorithms. The original version of the software provided, installed on customer systems, remains functionally capable and can still be used effectively, even without updates, to provide end customers with a corresponding level of cybersecurity. While updates can improve quality and topicality, neither of these is critical in terms of software functionality because these updates only relate to part of the functional scope and are not essential for the ability of customers to use the software and/or the licenses. Therefore, these updates are also based upon the premise of an obligation to provide said services in

accordance with IFRS 15.26 e) and therefore on the recognition of revenue over a specific period of time.

Revenues are recognized at the transaction price. The transaction price is the consideration in exchange for the anticipated level of performance delivered. Anticipated discounts and cash discounts as well as amounts obtained on behalf of third parties (sales tax) are deducted from this. If the service and the payment take place within a one-year period, no adjustment needs to be made in terms of applying any interest charges.

The transaction prices should be regarded as fixed, particularly with regard to the point in time at which revenue is recognized (sales quantity x unit price). In relation to contracts that include longer payment terms, it is assumed that a significant financing component exists for those revenues that are allocated to services that are already provided at the beginning of the contract. The transaction price assigned to this service is therefore discounted and then an interest component is added to it.

The over-time recognition of revenue is based on the elapsed contractual term as a proportion of the full term of the contract in question. The management has reached the considered view that the proportion of time that has elapsed at closing date in relation to the total time anticipated for delivery of a service represents a reasonable measure for the level of completion of these performance obligations as defined in IFRS 15.

The usual target payment period for cyan is 30 days.

Agreements to take back purchases are only included on a 'best effort' basis and therefore have no impact on the allocation of the transaction price or the recognition of revenue.

In cases where a service is delivered before consideration is received, contract assets are capitalized. Trade receivables are disclosed if there is a direct entitlement to receive payment.

Wherever additional costs are incurred when concluding a contract and where its associated sales revenues are generated over a one-year period, these costs must be recognized as assets and then written down progressively as actual sales revenues are generated.

Taxes on Income

Income tax expenses (or tax income) for the period is the amount of tax payable on the taxable income of the current period based on the applicable rate of tax on earnings (reconciled to include changes in deferred taxation claims and liabilities arising from temporary variances and, where applicable, any unused tax losses).

Deferred taxes on income (expenses or income) result from temporary variances between the book value of an asset or a debt on the balance sheet and its tax value. In accordance with IAS 12 (taxes on earnings), the deferred tax assets and deferred taxes reflect all temporary valuation and balance sheet variances between the tax balance sheet and the IFRS final accounts. Moreover, deferred taxes are formed on the basis of tax losses carried forward.

At cyan AG, the trade tax loss carried forward amounts to approximately EUR 7.8 million (2020: EUR 7 million) and a corporation income tax loss carried forward amounts to roughly EUR 7.8 million (2020: EUR 7 million). In future, since it will be improbable to carry forward unused losses, no provision is being set up for deferred taxation.

In relation to the consolidated tax-sharing agreement of December 18, 2014, cyan Security Group GmbH as group leader forms a tax corporation with cyan Networks Software GmbH in accordance with Section 9 of the Austrian Corporate Income Tax Code (öKStG). Over the last few years, this fiscal group of companies has been extended to include several group members. The core concept for taxation of the group involves grouping together the tax results of financially affiliated entities with the group leader. All companies that belong to the group calculate their respective revenues separately. The resultant taxation charge is then charged to the group leader (standalone method) in the form of distributions of the tax burden. The results of all companies are unified with the group leader and taxation is levied accordingly.

With a contribution and contribution in kind contract dated Jul 5, 2019, cyan AG has contributed its entire holding in cyan Security Group GmbH to its subsidiary I-New Unified Mobile Solutions GmbH as an investment in kind. As a result of restructuring, the existing group was dissolved and a new group was set up, with I-New Unified Mobile Solutions GmbH as group leader and with cyan Security Group GmbH, CYAN Mobile Security GmbH, cyan Networks Software GmbH, CYAN International Solutions GmbH, CYAN Licencing GmbH, and smartspace GmbH as group members.

Since in 2020 a retroactive merger was agreed, whereby cyan Mobile Security Group GmbH, cyan Networks Software GmbH, and CYAN International GmbH merged with cyan Security Group GmbH, in 2020 only I-New Unified Mobile Solutions GmbH, cyan Security Group GmbH, CYAN Licencing GmbH, and smartspace GmbH are now included in the group.

For following years, group loss carry-forward losses amounting to about EUR 30 million are available. Without any time limit, these can be offset to the extent of 75 % against future profits.

Company	2021	2020
cyan AG	32.975%	32.975%
CYAN International Solutions GmbH	a -	a -
CYAN Licencing GmbH	25.0%	25.0%
CYAN Mobile Security GmbH	- a	- a
CYAN Networks Software Gesellschaft mbH	- a	- a
cyan Seamless Solution México,, S.A. de C.V.	30.0%	30.0%
Cyan security Argentina SpA	25.0%	-
cyan security Chile S.p.A	27.0%	27.0%
cyan security Colombia S.A.S.	31.0%	32.0%
cyan security Ecuador SAS	22.0%	25.0%
cyan Security Group GmbH	25.0%	25.0%
cyan security Peru S.A.C.	29.5%	29.5%
cyan security USA, Inc.	26.5%b	26.5%b
I-New Bangladesh Ltd.	- c	- c
I-New Hungary Kft.	9.0%	9.0%
I-New Unified Mobile Solutions GmbH	25.0%	25.0%
Say:Hola! S.A.S.	d -	d -
smartspace GmbH	25.0%	25.0%

For the fully consolidated companies, the following rates of income tax were applied:

^a Merged

^b 21% + 5.5% ^c Tax exempt

^d Deconsolidated

Intangible Assets and Goodwill

Purchased intangible assets are valued in accordance with IAS 38 at acquisition costs or costs of production and any applicable impairments less scheduled pro-rata temporis depreciation. Extraordinary depreciation is applied if circumstances exist that justify an impairment.

Software licenses acquired are capitalized as assets on the basis of acquisition costs and commissioning of the software. These costs are amortized over the estimated useful life, which is between 3 and 5 years.

Since the period of time during which brand rights are expected to generate cashflows cannot be estimated, these are not amortized of a defined timeframe. Instead, they are written down when impairment occurs.

Research expenses are expensed as incurred. Development expenses are capitalized as assets whenever the corresponding criteria for IAS 38 are satisfied. Capitalized development expenses are carried at cost of production, less depreciation and impairment, assuming a depreciation period of between 3 and 10 years.

Intangible assets acquired in the context of a corporate merger are recognized separately from goodwill and are measured at fair value at the time of acquisition.

During the subsequent periods, intangible assets acquired in the context of a corporate merger as well as individually acquired intangible assets are valued on the basis of their acquisition costs less cumulative impairment and any cumulative depreciation charges.

Goodwill arises in the course of corporate acquisitions from the associated consideration paid and the total of all non-controlling interests in the company acquired less the balance of identifiable assets and debt taken on measured at fair value. If the difference is negative, the calculation for the consideration transferred and the purchase price allocation needs to be reexamined. If a further examination yields a negative difference, this is recorded on the statement of consolidated income. If the variance figure is positive, goodwill is recognized.

During the acquisition of cyan Security Group GmbH and its subsidiaries, goodwill, technologies and customer relationships were capitalized. Goodwill is not subject to scheduled depreciation. IAS 36 requires an impairment test to be carried out once a year. If any indication for an impairment is discovered, such impairment test is to be conducted immediately.

The technologies are depreciated on a straight-line basis over their useful life (7 years). The customer relationships are amortized over the estimated useful life (9 to 12 years).

Tangible Assets (Property, Plant and Equipment)

Tangible assets (property, plant and equipment) are carried in the balance sheet as assets at their acquisition costs less cumulative depreciation. Acquisition costs comprise the purchase price, ancillary costs and subsequent acquisition costs less any deductions they may contain on the purchase price.

Subsequent costs are included in the book value of an asset or may if necessary be recorded as a separate asset figure, but only if it is probable that the company will obtain a future economic benefit from the asset and if the costs of that asset can be established reliably. The book value of any part that is replaced is derecognized. All other repair and maintenance costs are recorded to the statement of comprehensive income for the reporting period in which they are incurred.

Tangible assets are depreciated using the straight-line method over their estimated useful life. When defining the estimated useful life, due account is taken of the expected economic and technical service life. The estimated useful life for tangible assets: 3 to 5 years for IT equipment, 4 to 10 years for other business and office equipment and 33.33 years for buildings. The recoverability of book values and periods of use for assets is examined on every balance sheet date and is adjusted as and when necessary. Whenever assets are sold, decommissioned or scrapped, the difference between the net proceeds and the net book value of the asset is recorded as a profit or a loss in other operating income or expenditure.

Investment grants are recorded under equity and liabilities, as part of other liabilities, using the gross method without affecting net income. Investment grants are recognized as other income in the consolidated statement of comprehensive income over the useful life of the assets for which they were obtained for.

Impairment & Impairment Test

An impairment test, as defined in IAS 36, must be conducted at least once a year for goodwill, intangible assets with an indefinite useful life and intangible assets that are not yet available for use. The recoverability of book values for all other assets, with the exception of the ones that are valued at their fair value in the statement of profit and loss, or that are subject to special regulations from a different standard governing the checking of recoverability, only needs to be checked if there are indications for an impairment.

Since corresponding data for carrying out an impairment test at the level of individual assets frequently do not exist, cash generating units are formed for the purposes of an impairment check. These are defined as the smallest identifiable group of assets that generate cash inflows that are almost entirely independent of the cash inflows from other assets or from other groups of assets. For the purposes of the impairment test, a goodwill figure is established at the time of acquisition and is allocated by cyan to those cash-generating units (or groups of them) that are expected to deliver a benefit resulting from the synergies of the merger. Cash-generating units to which a proportion of that goodwill was assigned need to be examined on an annual basis for impairment. If indications of impairment are found to exist for a unit, it may be necessary to conduct impairment tests more frequently. If the achievable amount of a cash-generating unit is less than the book value of the unit, the cost of impairment must first be allocated to the book value of each goodwill figure and then proportionally to other assets on the basis of the book value of each of those assets, as a proportion of total book value of assets within that unit. Here, the achievable amount is the higher figure from value-in-use and associated fair value less disposal costs.

The impairment test is conducted using the value-in-use concept, the achievable figure is established on the basis of the value-in-use.

Any resulting impairment loss is recognized in the statement of profit and loss, hence with an effect on earnings. If the reason for an impairment ceases to exist in a subsequent period, the impairment loss is reversed affecting earnings. Any impairment loss relating to goodwill cannot be reversed in future periods.

Leasing

A decisive factor for recognition on the balance sheet in accordance with IFRS 16 is whether the leased object constitutes an identifiable asset where the lessee can determine the form of use and is entitled to the economic benefits from the asset. For each lease, the lessee records a liability for future lease payments to be made. At the same time, a right-of-use asset is capitalized at the present value of the future lease payments and is subsequently depreciated on a straight-line basis. This standard affects cyan particularly in conjunction with the leasing of office premises, server rooms, data lines and vehicles.

The valuation of a leasing liability is based on the present value of the future lease payments. Leasing payments are discounted using the incremental borrowing rate. The rights of use corresponding to the leasing liability are adjusted to reflect any advance or deferred lease payments.

The incremental borrowing rate used to discount lease liabilities was derived from the interest rate on German federal bonds taking due account of the markup for the credit rating, the sovereign risk and the inflation differential. The average weighted incremental borrowing rate applied by cyan is 1.25 % (2020: 1.28%).

The leasing liability features the following maturities:

in EUR thousand	31/12/2021	31/12/2020
Leasing liabilities	5,039	6,150
Thereof non-current	3,832	4,970
Thereof current	1,207	1,180

IFRS 16 mandates estimates that influence the valuation of the usage rights as well as the leasing liabilities. These include the contract duration and the applied incremental borrowing rate to discount future leasing payment obligations.

The following table shows the impact of lease contracts in the statement of profit and loss.

in EUR thousand	31/12/2021	31/12/2020
Depreciation of buildings	757	671
Depreciation of other equipment, operating and office equipment	80	104
Interest expense	69	71
Income from subleasing of rights of use in connection with buildings	274	274
Interest income	3	5

The total lease payments in 2021 amounted to EUR 1,251 thousand (2020: EUR 1,164 thousand).

cyan leases various office premises, server rooms, vehicles and fiber-optic cables. Lease contracts for office premises usually run for 10 years or for an indefinite period, 5 years for colocation services, 5 years for vehicles and 5 years for fiber-optic cables.

In 2019, a shortage of space prompted the leasing of a larger office, and the office used previously was sub-let starting November 2019. The term of that subletting contract is the same as the term of the lease contract. For this, the usage rights were derecognized, and a leasing receivable was set up. As a result of the sub-lease to a customer, a leasing receivable was capitalized in 2020. In addition, there is a sublease agreement relating to the rental of server space, which is the reason why a lease receivable has also been capitalized.

Extension & Termination Option

A number of cyan's property and plant lease contracts include extension and termination options. Contractual terms of this kind are used to assure cyan of maximum operational flexibility in relation to the assets used by the group. The majority of existing extension and termination options can only be exercised by the group and by its respective lessors.

The application of IFRS 16 at cyan in 2021 has a positive impact of EUR 1,251 thousand on EBITDA because in conjunction with IFRS 16, no rental cost is incurred. Since in relation to sub-leases associated with IFRS 16 no lease revenue is recorded, this has a negative impact on EBITDA amounting to EUR 274 thousand. In addition, with cyan Peru, cyan Chile and cyan Colombia, foreign exchange losses to the value of EUR 122 thousand were recognized, as a result of contracts denominated in foreign currencies. These are set against depreciation amounting to EUR 836 thousand that reduce the EBIT. After interest expenses of EUR 69 thousand and interest income of EUR 3 thousand, the effect from IFRS 16 on the period result amounted to EUR -47. Interest incurred is disclosed in the financial results.

The following table shows the receivables from financial leasing arrangements:

in EUR thousand	31/12/2021	31/12/2020
Due in one year	274	274
Due in 1 to 2 years	183	274
Due in 2 to 3 years	118	183
Due in 3 to 4 years	-	118
Due in 4 to 5 years	-	-
Due in more than five years	-	-
Total undiscounted leasing payments	575	849
Non-guaranteed residual values	-	-
Financial income not yet realized	-3	-6
Present value of lease payments to be received	572	843
Impairment for uncollectible lease payments	-	-
Net investment value from leases	572	843

Undiscounted leasing payments:

in EUR thousand	31/12/2021	31/12/2020
Due within one year	274	274
Due in more than one year	301	575

Net investment value from leasing:

in EUR thousand	31/12/2021	31/12/2020
Due within one year	272	271
Due in more than one year	300	572

The elective application according to IFRS 16.5 for short-term leasing arrangements with a term of up to one year and for leasing arrangements where the underlying asset is a low value good (less than EUR 5,000) have been adopted. The associated lease payments are recorded as expense in a straight-line fashion over the term of the lease arrangement. A total of EUR 241 thousand was incurred for short-term lease arrangements, and EUR 5 thousand for low-value lease arrangements.

Financial Instruments

IFRS 9 contains three valuation categories which represent valuation at amortized acquisition costs, valuation at fair value with changes recognized through the statement of profit and loss and valuations at the fair value with changes in value recognized through other comprehensive income.

At this time, and for the following reasons, at cyan only the valuation at amortized acquisition costs is being applied.

Fundamentally, the fair values for financial instruments do not differ from their book values because the interest-related receivables and liabilities either virtually correspond to current market rates, or the instruments are current.

In the case of trade receivables (receivables from goods and services), other receivables, cash and cash equivalents as well as the trade payables (liabilities from goods and services) and other liabilities, due to the predominantly short-term nature of these items, their book values by and large match their associated fair values.

The financial liabilities are subject to fixed interest rates, but there are no significant differences to the fair values or the fair values are almost identical to the book values in the case of fixed interest rates.

Impairments must be recognized in relation to financial assets that are valued on the basis of amortized acquisition cost, and to contract assets.

cyan makes use of the simplified procedure for trade receivables, which under certain conditions for the assessment of impairment for these financial assets allows to always take place at the level of the expected credit loss using a distribution matrix.

As a basis for estimated, expected credit losses, experience-based values are derived from actual historical credit losses from the previous 3 years. In relation to receivables and leasing receivables with an impaired credit rating ('Level 3') and for contract assets, specific provisions for bad debt are set up.

Inventories

Inventories are valued at the lower figure from purchase costs or manufacturing costs and the net disposal value. The net disposal value is the estimated proceeds from a sale, less the estimated costs of completion and the sale transaction. Purchase costs or manufacturing costs are established on the basis of the moving average price procedure.

Provisions for Severance Payments

Provisions for performance-based liabilities are set up to cover the legal entitlement of employees. Employees are entitled to a severance payment when they reach retirement age and when the employer terminates their employment. The level of these claims is determined by the number of years of service and by the salary level at the severance date. Calculated in accordance with actuarial principles based on the projected unit credit method. Contribution-oriented liabilities exist for salaried staff in Austria whose employment relationship began after December 31, 2002. These severance obligations are settled by the ongoing payment of corresponding contributions to an employee pension fund into an account held by the employees and amount to EUR 103 thousand (2020: EUR 103 thousand). In addition, voluntary severance payments amounting to EUR 6 thousand (2020: EUR 0 thousand) were incurred.

Liquid Assets

Cash and cash equivalents are classified as cash in hand and as credit balances in banks and may include other short-term highly liquid capital assets with an original term of up to three months. They are recorded at nominal value.

Financial Liabilities

In accordance with IFRS 9, financial liabilities are recognized initially at the associated fair value less any transaction costs incurred. The following assessment is based on amortized cost. The difference between the cash-inflow (after deduction of transaction costs) and the repayment figure is recorded in the statement of comprehensive income over the term of the financial liabilities, applying the effective interest method.

Trade payables are liabilities from the payment of goods or services that were acquired from suppliers in the course of normal business activity. Trade payables are classified as short-term liabilities if payment falls due within one year or sooner. Initially, trade payables are recorded at their fair value, and are then valued as amortized costs by applying the effective interest method.

The book value of other liabilities corresponds to the associated fair value, as they are mainly current.

Provisions

Provisions are set up if the company as the result of a past event incurs a current (legal or factual) liability for which it is probable that the company will be obliged to fulfill it, and where a reliable estimate of the value of that liability can be performed. The valuation of provisions is based on the present value of the best possible estimate by the management expenses required at the end of the reporting period to fulfill the current liability. The expenses for a provision are recorded in the statement of comprehensive income.

Corporate Acquisitions/Acquisitions of Other Business Units

No corporate acquisitions took place in 2021 and 2020.

When I-New Unified Mobile Solutions GmbH was acquired by cyan AG in 2018, an earnout clause was agreed with the former shareholders which provides for a results-based supplement to the purchase price when defined EBITDA thresholds are achieved in the following years of 2019 to 2021. Due to a one-off license deal, the EBITDA threshold was exceeded in 2019.

To determine the supplement to the purchase price, a consolidated balance sheet and income statement were set up for the original I-New Group (elimination of inclusion of cyan Security Group GmbH) including explanatory details. In 2019, the original I-New group achieved an EBITDA of EUR 11,525 thousand which led to the recognition of a liability amounting to EUR 817 thousand for the earn-out payment to former shareholders. In 2020 the EBITDA was EUR 8,040 thousand so a liability of EUR 1,021 thousand was recognized. EBITDA in 2021 amounts to EUR -2,373 thousand, which is why no liability has been recognized.

Segment Reporting

Reporting across the business segments takes place in a way that coincides with the internal reporting body to the Executive Board that acts as the main decision-making body (Management Approach). Accordingly, the Executive Board is responsible for the allocation of company resources for both segments.

cyan has two segments that are used to manage the company: Cybersecurity and BSS/OSS, oriented on the type of products they offer. The Executive Board decided in favor of this form of segmentation because it best reflects the opportunity & risk structure of the company. The distinctive nature of customer groups and the technical solutions and products used provide clear separation between the segments.

Cybersecurity

This segment includes all the services delivered by cyan that are based on application of the filter technology used in B2B2C business. In this segment, cyan delivers its services in conjunction with products such as OnNet Security, OnDevice Security, Child Protection or Clean Pipe. The growth prospects in this segment are viewed in a very favorable light. Market studies predict double-digit growth rates for the coming years.

At present, the geographical focus is primarily on Europe, but other regions (such as North America, Asia and Africa) are to be supplied by cyan with cybersecurity gradually.

BSS/OSS

In this segment, MVNOs are offered the entire range of products needed to operate a virtual mobile operator. The array of solutions offered by cyan includes connection to the network of an MNO, billing, the management of credit balances, provisioning, etc.

The primary geographic focus of this segment is on South America. Here the strong market position of the company is to be expanded through the acquisition of new customers and, at the same time, the range of services is to be extended continuously. However, cyan is also endeavoring to establish a foothold in EMEA with its BSS/OSS solution.

Segment Reporting

Segment reporting, in accordance with IFRS 8, is to be based on internal control and reporting (Management Approach). The line of separation between the business segments and their corresponding report contents are therefore based, as mentioned previously, on the reporting structure within cyan, with the Executive Board as the main decision-making body.

Accordingly, operational segments with mandatory reporting requirements are defined as the Cybersecurity segment (consisting of cyan Security Group GmbH and its subsidiary), and the BSS/OSS segment (consisting of I-New Unified Mobile Solutions GmbH and its subsidiaries with the exception of the subsidiaries assigned to the Cybersecurity division). Both segments are constituent parts of the corporation that conduct business activities that give rise to sales revenues and expenditures, the results of which are monitored by the Executive Board of cyan AG for the purposes of measuring success and resource allocation, with separate financial information available for each. While both segments operate in the technology and software sector, each offers distinctive products and services, which is why each is monitored separately by the Executive Board of cyan AG.

Both business segments outperform the quantitative threshold values. No further business segments exist beyond these two. The "Transition" column includes the activities of cyan AG that have not been allocated to either of these two segments and to consolidations performed at group level.

	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	2021	2020	2021	2020	2021	2020	2021	2020
Segment total revenuesa	7,335	19,673	3,479	5,707	11	-	10,825	25,379
Segment revenues	5,195	18,180	3,288	3,113	-	-	8,483	21,293
EBITDA	-2,368	8,437	-7,365	-11,327	-2,587	-2,167	-12,320	-5,058

^a Sum of revenue, other operating income, income from reversals of impairment losses and changes in inventories

Employees are allocated to the segments as follows (average for the period):

	BSS/OSS		Cybersecurity		Transition		Total
	2021	2020	2021	2020	2021	2020	2021	2020
Employees (FTE)	81	83	69	66	0	0	150	149
	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	2021	2020	2021	2020	2021	2020	2021	2020
Impairment	-	-229	-	-	-	-	-	-229

The following table shows cyan's non-current tangible assets, intangible assets and deferred tax assets by country of origin.

BSS/OSS Cybersecurity			Transition			Total
in EUR thousand	31/12/2021	31/12/2020	31/12/2021	31/12/2020	31/12/2021	31/12/2020	31/12/2021	31/12/2020
Americas	1,777	1,625	-	-	-	-	1,777	1,625
APAC	18	23	-	-	-	-	18	23
EMEA	13,527	15,974	44,773	47,386	35	47	58,334	63,407
Non-current tangible
assets, intangible
assets and deferred
tax assets	15,322	17,622	44,773	47,386	35	47	60,130	65,055

The countries of the respective customers / companies are allocated to the Americas, APAC and EMEA regions as follows:

• ^◼ Americas: Argentina, Chile, Ecuador, Colombia, Mexico, Peru, USA
• ^◼ APAC (Asia and Pacific): Bangladesh, New Zealand, Thailand
• ^◼ EMEA (Europe, Middle East and Africa): Germany, France, Italy, Ireland, Austria, Poland, Switzerland, Slovenia, Spain, Hungary, Cyprus

The following table shows how the additions of long-term tangible assets and intangible assets of cyan by their region of origin.

	BSS/OSS		Cybersecurity		Transition		Total
in EUR thousand	31/12/2021	31/12/2020	31/12/2021	31/12/2020	31/12/2021	31/12/2020	31/12/2021	31/12/2020
Americas	41	1,261	-	-	-	-	41	1,261
APAC	-5	75	-	-	-	-	-5	75
EMEA	327	223	132	2,668	-	40	460	2,931
Additions to non current tangible assets, intangible
assets	362	1,559	132	2,668	-	40	495	4,267

In 2020, an intra-Group addition in the APAC region was declared in the BSS/OSS segment. Due to immateriality, the correction was made in 2021.

The accounting and valuation methods of the reporting segments match the group's accounting and valuation methods described above.

Note to the Statement of Comprehensive Income

[1] Revenues

All revenues result from contracts with customers as defined by IFRS 15 and include all revenues resulting from cyan's ordinary business activities. In the financial year, a number of new customer contracts were concluded. However, some of which will only be relevant to sales in the next financial year. In 2020, a license deal was concluded with Virgin Mobile, which explains the significantly higher revenues in the BSS/OSS segment compared to 2021.

The following chart shows cyan's revenues broken down by the region of origin of the business partner.

	BSS/OSS		Cybersecurity		Total
in EUR thousand	2021	2020	2021	2020	2021	2020
Americas	1,219	14,433	-	-	1,219	14,433
thereof Colombia	413	1,040	-	-	413	1,040
thereof Mexico	331	12,883	-	-	331	12,883
thereof other countries	475	510	-	-	475	510
APAC	1,414	3,343	13	-	1,427	3,343
thereof Bangladesh	232	2,075	-	-	2,075	2,075
thereof New Zealand	1,182	1,268	-	-	1,268	1,268
thereof other countries	-	-	13	-	13	-
EMEA	2,580	404	3,257	3,113	5,837	3,517
thereof Austria	538	118	2,592	2,824	3,130	2,941
there of Slovenia	1,856	182	-	-	1,856	182
thereof other countries	186	104	660	290	845	393
Revenues	5,213	18,180	3,270	3,113	8,483	21,293

In the Cybersecurity segment, the revenues of one (2020: 2) customer exceed the 10% threshold (EUR 2,564 thousand; 2020: EUR 2,860 thousand), while in the BSS/OSS segment this applies to two (2020: 3) customers (EUR 3,038 thousand; 2020: EUR 16,752 thousand).

At the end of the reporting period, an amount of EUR 17,302 thousand is attributable to the allocated transaction prices of the unfulfilled performance obligations. The following table shows the allocated transaction prices of the performance obligations not yet settled by due date.

in EUR thousand	Up to 1 year	2 -5 years	5 years
Transaction prices	3,552	13,750	-

[2] Other Operating Income, Income from Reversals of Impairment Losses and Changes in Inventories

Other income, income from reversals of impairment losses and changes in inventories comprise the following items:

in EUR thousand	2021	2020
Change in inventories and capitalized own work	-798	2,011
Income from subsidies/research grants	970	762
Income from reversal of impairment losses	111	983
Exchange rate gains	1,979	164
Other	80	167
Other income, income from reversals of impairment losses and
changes in inventories	2,342	4,086

The changes in inventories shown relate to contract costs to fulfill customer contracts in accordance with IFRS 15. In 2020, contract costs were capitalized. Additionally, in 2020, changes in inventories included capitalized development costs in accordance with IAS 38. From April 2021, the contract costs will be dissolved over the term of the contract due to the commencement of service provision.

The research grant refers to an Austrian grant for research and development expenses, which is paid out by the Austrian tax authorities.

The exchange rate gains largely stem from the valuation of contract assets.

[3] Costs of Materials and Services Procured

The Statement of Profit and Loss and the Statement of Comprehensive Income include expenses for materials and services procured as follows:

in EUR thousand	2021	2020
Cost of materials	-308	-386
Cost of services procured	-5,065	-3,888
Cost of materials and services procured	-5,372	-4,274

The purchased services mainly relate to external services such as various services (e.g. maintenance services and technical consulting) in Germany, in the EU and in third countries.

[4] Personnel Expenses

Personnel expenses include the following items:

in EUR thousand	2021	2020
Salaries	-9,438	-8,755
Expenses for social security contributions and payroll taxes	-2,099	-1,984
Other personnel expenses	102	-370
Personnel expenses	-11,435	-11,108

The average number of employees is 150 (2020: 149). These are divided as follows on the based on their geographical locations:

in EUR thousand	2021	2020
European Union (excl. Austria)	29	31
Austria	86	84
South America	29	29
Asia	6	5
Rest of the world	-	-
Average number of employees	150	149

[5] Impairment of Trade Receivables, and Contract Assets

In 2021, the impairment loss on trade accounts receivable and contract assets relates to write-downs of receivables in the amount of EUR 51 thousand. In addition, specific valuation allowances of EUR 386 thousand were recognized for the customer Truu (Mexico). In 2020, the impairment loss of trade receivables and contract assets mainly related to the impairment of contract assets due to Wirecard's filing for bankruptcy in the amount of EUR 4,785 thousand. There was also a depreciation of EUR 565 thousand on the Virgin Mobile contract. The remaining amount of EUR 746 thousand represented specific valuation allowances.

[6] Other Expenses

Other expenses include the following items (type of expenses)

in EUR thousand	2021	2020
Consulting fees	-2,549	-2,494
Advertising expenses	-659	-913
Rental expenses	-313	-365
Fees	-307	-195
Insurance	-187	-242
Research and development	-189	-330
Travel expenses	-103	-221
Exchange rate differences	-433	-2,166
Other	-1,161	-2,032
Other expenses	-5,901	-8,958

Consulting expenses include expenses for technical advice, legal and tax advice and other consulting services. Other expenses include exchange losses, administrative expenses, monetary transaction charges and contributions.

[7] Depreciation

The statement of comprehensive income includes expenses for depreciation and amortization as follows:

in EUR thousand	2021	2020
Amortisation of intangible assets	-4,635	-4,889
Depreciation on property, plant and equipment	-1,108	-1,092
Depreciation and amortization	-5,742	-5,981

Further information on depreciation and amortization can also be found in Notes 10 and 11, and in the accounting policies under intangible assets, property, plant and equipment, and leases.

[8] Financial Income and Financial Expenses

Other interest income comprise EUR 724 thousand from the recognition of financing components included in customer contracts in accordance with IFRS 15. The interest expenses are attributable to external financing (e.g. bank and other loans). As further loans were taken out at the end of 2020, interest on loans increased in 2021.

in EUR thousand	2021	2020
Interest income
Loans	0	0
Other	727	704
Financial income	727	704
Interest and similar expenses
Leasing liabilities	-69	-71
Interest on loans	-57	-11
Other	-37	-61
Financial expenses	-163	-143
Financial result	564	561

[9] Taxes on Income

Actual tax refund claims and tax liabilities are netted if the company has an enforceable right to offsetting and if it intends to achieve a net basis settlement or to offset claims against liabilities simultaneously.

in EUR thousand	2021	2020
Expenses for current income taxes	881	-489
Tax credits/back payments for previous years	11	31
Change in deferred income taxes	2,728	1,669
Income taxes	3,620	1,210

Tax Transition Account

The group tax rate is defined as the ratio of recorded income tax expenses to the earnings before taxes. The cost of tax is calculated at the applicable tax rates in the various jurisdictions. In accordance with IAS 12, the tax rate to be applied is the most suitable one for the information interests of the final account addressees. In most cases, this is the tax rate in the country in which the company is headquartered. Since cyan AG, a company based in Germany, operates solely as a holding company while the majority of its operational subsidiaries have their head offices in Austria, Austrian corporation tax is applied at the rate of 25% (2020: 25%) when the tax transition account is created.

Transition of the computed tax on income at the recorded cost of tax on revenues is presented as follows:

in EUR thousand	2021	2020
Income before income taxes	-17,497	-10,478
Income tax expense based on the Austrian corporate income tax rate
(25%)	4,374	2,619
Differences due to different tax rates	31	-3
Tax-free income	2,305	842
Non-deductible expenses	-2,464	-577
Taxes from previous periods	11	31
Losses of the current year - for which no deferred tax asset was
recognized	-4,313	-1,638
Recognition of tax effects of previously unrecognized loss
carryforwards	9	349
Foreign taxes	625	-408
Changes in estimates from previous years	309	-
Other differences	5	-6
Effective Group tax expense	892	1,210

Notes to the Statement of Financial Position

[10] Intangible Assets

The following table shows the development of intangible assets:

in EUR thousand	Patents, customer relations & similar rights	Software	Development costs	Goodwill	Total
As of 01/01/2020
Acquisition costs	17,689	22,247	966	30,779	71,681
Accumulated depreciation	-3,168	-4,748	-21	-	-7,937
Book value	14,520	17,499	945	30,779	63,744
Financial year 31/12/2020
Initial book value	14,520	17,499	945	30,779	63,744
Additions - purchases	-	43	-	-	43
Disposals acquisition costs	-0	-1,716	-	-	-1,716
Disposals accumulated depreciation	0	1,705	-	-	1,705
Depreciation	-1,626	-3,234	-54	-	-4,914
thereof impairment	-	-229	-	-	-229
Currency difference depreciation	-	4	-	-	4
Book value	12,894	14,301	891	30,779	58,865
Currency translation acquisition
costs	-	-1	-	-	-1
Currency translation accumulated
depreciation	-	0	-	-	0
As of 01/01/2021 Acquisition costs	17,688	20,572	966	30,779	70,006
Accumulated depreciation	-4,794	-6,273	-75	-	-11,142
Book value	12,894	14,300	891	30,779	58,864
Financial year 31/12/2021
Initial book value	12,894	14,300	891	30,779	58,864
Additions	156	68	-	-	223
Disposals	-	-	-	-	-
Depreciation	-1,645	-2,935	-54	-	-4,634
thereof impairment	-	-	-	-	-
Currency difference depreciation	-	0	-	-	0
Book value	11,405	11,432	837	30,779	54,453
As of 31/12/2021
Currency translation acquisition
costs	-	-0	-	-	-0
Currency translation accumulated
depreciation	-	0	-	-	0
Acquisition costs	17,844	20,640	966	30,779	70,229
Accumulated depreciation	-6,439	-9,208	-129	-	-15,776
Book value	11,405	11,432	837	30,779	54,453

The depreciation in the Group's statement of profit and loss also includes the depreciation of contract costs amounting to EUR - 11 thousand (2020: EUR - 11 thousand).

The development costs capitalized amount to EUR 837 thousand (2020: EUR 891 thousand) and primarily comprise personnel costs.

Due to the loss in value of software in 2020, an impairment loss of EUR 229 thousand had to be recognized.

Brand rights which have an unlimited useful life and that are disclosed under Patents, customer relationships & other rights, are recognized with a book value of EUR 32 thousand (2020: EUR 32 thousand).

In the consolidated financial statements, goodwill to the amount of EUR 30,779 thousand is disclosed. This results from the acquisition of cyan Security Group GmbH by cyan AG as part of the stock market flotation in 2018. Goodwill was therefore assigned entirely to the cash-generating unit (CGU) of Cybersecurity which already existed from cyan companies even prior to acquisition of the holding in I-New Unified Mobile Solutions GmbH in July 2018 and that at the same time constitutes a business segment in accordance with IFRS 8. For CGU Cybersecurity, an impairment test was therefore a mandatory requirement.

In addition, the achievable amount of the CGU must be set alongside its book value. The achievable amount is the higher of the two figures from the fair value less sale costs and value-in-use. In accordance with the evaluation hierarchy in IFRS 13, the fair values need to be established primarily on the basis of market prices, and can for example be linked to existing binding purchase offers, secondary pricing on active markets or comparable transactions within the sector at similar times. If it is not possible to apply the market price-based method, capital value-based methods such as the discounted cashflow method used in this case can be applied.

As an achievable amount for CGU, its value-in-use is determined by means of a discounted cashflow calculation. This involves deriving cashflows from the business plan including the cashflow plan that is approved by the Executive Board and that is updated on a regular basis. Future expansion investments and restructuring costs are only included in the determination of value-in-use to the extent that an official obligation to do so exists because the value-in-use must always correspond to the asset value or to the group of asset values in their current condition. The discounting rate takes the form of a post-tax rate of interest that reflects current market estimates, the fair value of the money and the specific risks to the asset value and/or the CGU. The corresponding pretax rate of interest is based on an iterative process. To determine quantifiable amounts using capital value-based methods, the weighted average capital cost (WACC) is used. The WACC, the planned sales revenues and the growth rate for the perpetual annuities constitute the most important planning assumptions and it is to these that the achievable figure reacts most sensitively.

The interest applied to equity is defined using the Capital Asset Pricing Model (CAPM) which comprises the basic rate of interest, a market risk premium and a beta factor. The rate of interest debt corresponds to the risk premium on corporate loans for comparable companies. To disclose sovereign risk appropriately, due account is taken of corresponding cash inflows. On this basis, the WACC is defined as approximately 10.4%. Due to the volatile financial market environment, the development of capital costs (and in particular the sovereign risk premiums) are monitored continually. Financial surpluses anticipated after the detailed planning period of five years are incorporated using a terminal value calculation, based on the assumption of an infinite growth rate of 3 %.

The impairment test did not give rise to any need for value adjustment.

cyan has conducted an analysis into the sensitivity of the impairment tests against amendments to the key assumptions upon which a determination of the achievable figure for the Cybersecurity CGU is based. The view of the management is that every possible amendment to those key assumptions that can be viewed as reasonable and upon which the achievable figure for the CGU is based, would not give rise to a situation where the total book value exceeds the recoverable total value.

[11] Tangible assets

The development of tangible assets can be depicted as follows:

in EUR thousand	Building equipment	Machinery and similar equipment	Other equipment/o ffice equipment	Total
As of 01/01/2020
Acquisition costs	3,452	371	1,144	4,967
Accumulated depreciation	-1,245	-311	-495	-2,052
Book value	2,207	60	649	2,916
Financial year 31/12/2020
Initial book value	2,207	60	649	2,916
Additions	3,896	50	279	4,225
Reclassification of acquisition costs	-	5	-5	-
Reclassification of accumulated depreciation	-	-0	0	-
Disposals acquisition costs	-700	-351	-272	-1,323
Disposals accumulated depreciation	688	351	265	1,304
Depreciation	-715	-23	-317	-1,056
Currency difference	7	1	2	10
Book value	5,382	92	601	6,075
Currency translation acquisition costs	-85	52	-14	-48
Currency translation accumulated depreciation As of 01/01/2021	24	-55	2	-29
Acquisition costs	6,562	127	1,132	7,821
Accumulated depreciation	-1,242	-38	-542	-1,822
Book value	5,321	89	589	5,999
Financial year 31/12/2021
Initial book value	5,321	89	589	5,999
Additions	46	57	169	272
Reclassification of acquisition costs	-	1	-1	-
Reclassification of accumulated depreciation	-	-1	1	-
Disposals acquisition costs	-39	-	-281	-321
Disposals accumulated depreciation	-	5	140	145
Depreciation	-838	-34	-224	-1,096
Currency difference	6	-0	-1	5
Book value	4,495	117	392	5,004
As of 31/12/2021
Currency translation acquisition costs	-82	-0	6	-76
Currency translation accumulated depreciation	19	0	-3	16
Acquisition costs	6,487	184	1,024	7,696
Accumulated depreciation	-2,055	-68	-630	-2,752
Book value	4,432	117	394	4,943

This table also includes the rights-of-use that arise as a consequence of IFRS 16.

The following table shows the development of rights-of-use in the Tangible assets section of the balance sheet.

in EUR thousand	Buildings	Vehicles	Fibre Optic	Total
As of 01/01/2020
Acquisition costs	2,707	173	289	3,170
Accumulated depreciation	-522	-55	-80	-657
Book value	2,185	118	209	2,512
Financial year 31/12/2020
Initial book value	2,185	118	209	2,512
Currency difference acquisition costs	-75	-	-7	-82
Currency difference accumulated depreciation	17	-	0	17
Initial book value after currency
differences	2,127	118	203	2,448
Additions	3,162	35	2	3,199
Disposals acquisition costs	-9	-18	-	-27
Disposals accumulated depreciation	-	18	-	18
Depreciation	-671	-45	-58	-775
Currency difference	7	-	2	9
Book value	4,616	226	351	5,193
As of 01/01/2021
Acquisition costs	5,781	190	282	6,253
Accumulated depreciation	-1,165	-82	-134	-1,381
Book value	4,616	108	148	4,872
Financial year 31/12/2021
Initial book value	4,616	108	148	4,872
Additions	45	-	125	169
Disposals acquisition costs	-39	-74	-186	-299
Disposals accumulated depreciation	-	35	85	120
Depreciation	-757	-31	-49	-836
Currency difference	6	-	-1	5
Book value	3,871	38	122	4,031
Currency translation acquisition costs	-81	-	7	-74
Currency translation acquisition costs As of 31/12/2021	18	-	-4	14
Acquisition costs	5,706	116	228	6,050
Accumulated depreciation	-1,898	-78	-103	-2,079
Book value	3,807	38	125	3,971

[12] Contract Assets, Contract Costs and Contract Liabilities from Contracts with Customers

The following table shows the amount of contract costs (costs of initiating a contract and contract performance costs), receivables, contract assets and contract liabilities arising from contracts with customers in accordance with IFRS 15:

in EUR thousand	31/12/2021	31/12/2020
Costs of initiating a contract	46	57
thereof non-current	46	57
thereof current	-	-
Contract performance costs	4,209	5,061
thereof non-current	4,209	5,061
thereof current	-	-
Trade accounts receivable	2,843	3,149
thereof non-current	-	-
thereof current	2,843	3,149
Contract assets	16,721	17,522
thereof non-current	13,274	14,588
thereof current	3,447	2,934
Contract liabilities	-	230
thereof non-current	-	230
thereof current	-	-

The costs of initiating a contract include special bonuses for the conclusion of customer contracts. These have been capitalized and are amortized over the term of the contract. They are shown in the balance sheet as non-current assets, as the contract term is longer than 1 year. Contract performance costs largely comprise personnel costs, services procured and travel expenses. As the performance obligations agreed in the contracts have been partially fulfilled as of April 2021, the capitalized contract performance costs are amortized over the term of the contract and are presented as non-current.

In connection with the bankruptcy filing of Wirecard Technologies GmbH, the contract assets recognized in 2019 on the basis of the Wirecard contract were impaired by 100 % (i.e., EUR 4,785 thousand) in 2020.

The contract assets were divided into non-current and current contract assets in accordance with the requirements of IAS 1.

The contract liabilities are based on services already invoiced, which were released in full at the time the services were rendered.

[13] Deferred Taxes

The tax effects of temporary differences, tax losses carried forward and tax credits that give rise to deferred tax assets and to deferred tax liabilities are as follows.

in EUR thousand	31/12/2021	31/12/2020
Deferred tax assets
Non-current assets	318	17
Current assets	327	686
Non-current provisions and liabilities	10	-
Current provisions and liabilities	91	82
Losses carried forward	317	45
Other (asset items, cash procurement costs)	-	-
Deferred tax liabilities
Non-current assets	3	3
Current assets	40	55
Non-current provisions and liabilities	0	0
Current provisions and liabilities	287	582
Other (asset items, cash procurement costs)	-	0
Net deferred tax assets	733	192

Due to tax planning, future profits are anticipated against which deferred tax assets can be offset.

in EUR thousand	31/12/2021	31/12/2020
Deferred tax assets
Non-current assets	2	92
Current assets	6,018	8,899
Non-current provisions and liabilities	785	1,031
Current provisions and liabilities	497	489
Losses carried forward	7,876	6,269
Other (asset items, cash procurement costs)	19	19
Deferred tax liabilities
Non-current assets	10,434	12,112
Current assets	6,514	2,510
Non-current provisions and liabilities	-	-
Current provisions and liabilities	1,387	7,488
Other (asset items, cash procurement costs)	-	-
Net deferred tax liabilities	3,139	5,311

Deferred tax assets and deferred tax liabilities are netted for each country if certain conditions are met. These conditions are met if there is a legally enforceable right to set off current tax assets against current tax liabilities, if they relate to income taxes levied by the same taxation authority and cyan intends to settle its current tax assets and liabilities on a net basis. The deferred tax liabilities originate from the companies in Austria and Germany. The deferred tax assets originate from the remaining countries.

The development of deferred taxes and the breakdown of changes into components that do and do not have an effect on earnings are shown in the table below:

in EUR thousand	Deferred tax assets	Deferred tax liabilities	Currency difference
Balance as at 01/01/2020	432	7,160	-
Changes affecting net income	-240	1,848	-60
Changes not affecting net income	-	-	-
Balance at 31/12/2020	192	5,311	-
Balance as at 01/01/2021	192	5,311	-
Changes affecting net income	542	2,172	-14
Changes not affecting net income	-	-	-
Balance at 31/12/2021	733	3,139

According to the eco-social tax reform in Austria, which was passed in January 2022, the corporate income tax rate will be reduced to 24 % in 2023 and to 23% as of 2024. The calculation of deferred taxes in these consolidated financial statements is based on the current corporate income tax rate of 25%. Taking into account the reduced tax rates, deferred tax assets would decrease by EUR 62 thousand.

[14] Financial Instruments

	a		Book values	Book values
in EUR thousand	IFRS 9	Level	31/12/2021	31/12/2020
Assets
Leasing receivables (non-current)	AC	n/a	300	572
Leasing receivables (current)	AC	n/a	272	272
Cash and cash equivalents	AC	n/a	8,504	2,490
Trade receivables and other receivables	AC	n/a	2,843	3,149
Other receivables	AC	n/a	33	41
Other receivables and assets	AC	n/a	2,119	1,502
Liabilities
Leasing liabilities (non-current)	AC	n/a	3,832	4,970
Leasing liabilities (current)	AC	n/a	1,207	1,180
Financial liabilities	AC	n/a	15	6
Convertible notes	AC	n/a	2,450	-
Trade payables and other liabilities	AC	n/a	3,723	4,887
Other non-current financial liabilities	AC	n/a	5,199	3,650
Other non-current liabilities	AC	n/a	206	206

^a Classification according to IFRS 9 (AC = accumulated cost)

A fair value measurement according to Level 2 (based on net present value) resulted in a fair value of EUR 567 thousand for the lease receivables as of December 31, 2021.

Non-current financial liabilities include fixed-interest loans from the Austrian Research Promotion Agency (FFG) and a fixed-interest loan from Erste Bank. The FFG loans are measured at amortized acquisition costs and amount to EUR 634 thousand as of December 31, 2021. A fair value measurement according to Level 2 (based on net present value) resulted in a fair value of EUR 637 thousand. The fixed-interest loan from Erste Bank is also measured at amortized acquisition costs and amounts to EUR 4,565 thousand as of December 31, 2021. A fair value measurement according to Level 2 (capital value-oriented) resulted in a fair value of EUR 4,610 thousand.

In the case of trade accounts receivable, other receivables, cash and cash equivalents, trade accounts payable and other liabilities, it is assumed that the carrying amounts essentially correspond to the fair values due to the predominantly short-term nature of the items.

In 2021, an agreement regarding the issuance of convertible bonds was reached between cyan AG (issuer) and NICE & GREEN S.A. (investor). The nominal value of the convertible note amounts to EUR 8.4 million and will be drawn in eight tranches of EUR 1.05 million each. The investor can dissolve the agreement if the share price falls below 115% of the fixed minimum price (EUR 10.472). In the event of a termination, the investor will receive the outstanding nominal value of the drawn tranches either in the form of converted shares based on the conversion price or the tranches will be repaid, in which case the outstanding nominal value will be divided by 0.97. The investor has the right to choose the conversion price. The issuer has the right to choose which option is executed. If the tranches are drawn, the investor is generally obliged to convert. cyan has the option to prevent a conversion by repaying the investor the amount stated in the conversion notice divided by 0.97. If conversion is not prevented, conversion takes place at the conversion price. The conversion price is defined as the maximum value between the fixed minimum price (EUR 10.472) and 95% of the value of the lowest share price of the last 6 trading days. If the share price is greater than or equal to EUR 12.043, the investor has the obligation to draw the tranches, below that it is optional. There is no regular interest. Currently, 4 tranches (totaling EUR 4.2 million) have already been drawn. As can be seen in the statement of changes in equity, 152,207 shares amounting to EUR 1.75 million have already been converted. The convertible notes are measured at amortized acquisition costs and amount to EUR 2,450 thousand as of December 31, 2021. A fair value measurement according to Level 2 (capital value-oriented) resulted in a fair value of EUR 2,476 thousand.

[15] Receivables

The receivables are broken down by maturity date, as follows:

in EUR thousand	31/12/2021	31/12/2020
Other receivables	33	41
Financial receivables	300	572
Non-current receivables	333	613
Trade receivables	2,843	3,149
Receivables from taxes on income	214	548
Accruals and deferred income	448	590
Other receivables and assets	1,943	1,184
Current receivables	5,449	5,471
Receivables	5,782	6,083

The majority of the non-current other receivables consist of security deposits. Non of which were overdue nor impaired.

From the trade receivables, contract assets and leasing receivables, provisions were deducted for bad debt amounting to EUR 832 thousand (2020: EUR 7,401 thousand) and for impairments in accordance with IFRS 9 amounting to EUR 70 thousand (2020: EUR 176 thousand).

The other current receivables primarily comprise leasing receivables and research grants.

The following table shows the performance of impairments from goods and services, contract assets and leasing receivables:

in EUR thousand	2021
Impairment losses 01/01	176
Allocation	25
Reversal of impairment losses	-136
Currency difference	-5
Foreign currency valuation	10
Impairment losses 31/12	70

The following table shows the performance of impairments from financial assets, the creditworthiness of which is impaired on the reporting date:

in EUR thousand	2021
Impairment losses 01/01	7,401
Allocation	386
Reversal of impairment losses	-6
Utilization	-
Currency difference	50
Foreign currency valuation	-
Impairment losses 31/12	7,832

The allocations are attributable to impairment losses from Mexico

Assignment for Security

cyan has assigned trade receivables to the Erste Bank der oesterreichischen Sparkassen AG (short form "Erste Bank") as security for all receivables and other claims by Erste Bank in relation to the lines of credit and loans it has already extended to cyan Security Group GmbH. Erste Bank has provided cyan with no advance against a receivable. These receivables were derecognized because a right of recourse means that all threats and opportunities, first among this being the risk of business failure, lie with cyan. The thirdparty debtors (garnishees) have been advised of this assignment. In accordance with an agreement with the Bank, customers settle their liabilities by making payment to an account specially set up at the Bank for this purpose, to which cyan has the power of disposition over the paid-in funds. The receivables are held in a business model for the collection of payment flows, consistent with the carry-forward approach to receivables. The book value for trade receivables at year-end, transferred but not posted to expenses, amounts to EUR 4,565 thousand. The book value of the secured credit at year-end also amounts to EUR 4,565 thousand.

[16] Cash and Cash Equivalents

The following table includes details of cash and cash equivalents:

in EUR thousand	31/12/2021	31/12/2020
Cash on hand	2	2
Deposits with credit institutions	8,501	2,487
Cash and cash equivalents	8,504	2,490

[17] Equity

On December 31, 2021, the nominal capital has a value of EUR 13,385,884 (2020: EUR 9,774,538) and is fully paid-up. The performance of nominal capital and capital reserves is shown in the consolidated statement of changes in equity.

On the reporting date, 13,385,884 shares were outstanding (December 31, 2020: 9,774,538 shares) with a par value of EUR 1.00 per share (December 31, 2020: EUR 1.00). Further details are explained in the 'cyan share' chapter.

Following a capital increase of EUR 121,021 in March 2019, the authorized capital of EUR 3,300,000 approved by the Annual General Meeting ('AGM') on January 19, 2018 amounted to EUR 2,628.979 in the financial year 2019 after a partial utilization, and was cancelled by resolution at the AGM on July 3, 2019. At the same time, the AGM decided on new authorized capital of EUR 4,442,972. Further to that, a capital increase of EUR 888,594 took place on July 11, 2019. During the AGM on July 3, 2019, it was also decided to create contingent capital of EUR 4,442,972.

The Executive Board is authorized by a resolution at the AGM of July 2, 2020 to increase the nominal capital further after approval of the Supervisory Board by EUR 4,887,269.00 up until July 1, 2025 by an injection of cash and/or assets over one or more occasions, and the subscription rights of the shareholders can be excluded (authorized capital).

On the basis of the conditional capital resolved on July 3, 2019, 152,207 subscription shares were issued. By resolution of May 12, 2021, the conditional capital amounts to EUR 4,290,765.00 after the issue of subscription shares in the financial year 2021.

On June 23, 2021, the Annual General Meeting resolved to cancel the authorized capital of July 2, 2020, and to create new authorized capital (2021/I) under which the nominal capital can be increased once or several times by up to EUR 4,963,372.00 against cash and/or non-cash contributions, whereby the subscription rights of shareholders may be excluded. At the same time the AGM also resolved to partially reduce the Conditional Capital 2019/I to EUR 360. 000.00 and to create two new conditional capitals (2021/I by EUR 4,016,902.00 and 2021/II by EUR 586,470.00).

Based on the Annual General Meeting on June 23, 2021, the nominal capital was increased by EUR 2,481,686 and EUR 977,453.00 to EUR 13,385,884.00. After partial utilization, the authorized capital (2021/I) amounted to EUR 1,504,233.00.

The following tables explain the weighted average of shares outstanding for the calculation of earnings per share.

Calculation of weighted average of shares outstanding 2021:

Transaction date	Shares outstanding	Treasury shares	Total shares	Weighting (days)	Weight. avg. of shares outstanding
31/12/2020	9,774,538	-	9,774,538	365	9,774,538
28/02/2021	59,704	-	59,704	306	59,704
31/03/2021	61,011	-	61,011	275	45,967
30/04/2021	31,492	-	31,492	245	21,138
21/09/2021	2,481,686	-	2,481,686	101	686,713
23/11/2021	977,453	-	977,453	38	101,762
31/12/2021	13,385,884	-	13,385,884		10,689,822

Calculation of weighted average of shares outstanding 2020:

Transaction date	Shares outstanding	Treasury shares	Total shares	Weighting (days)	Weight. avg. of shares outstanding
31/12/2019	9,774,538	-	9,774,538	365	9,287,219
31/12/2020	9,744,538	-	9,774,538		9,774,538

The capital reserves result from payments made by the shareholders and conversion of convertible notes respectively. The other reserves include IAS 19 accruals and foreign currency reserves. The reserve made in accordance with IAS 19 originates from amendments to actuarial assumptions relating to a provision for severance pay the effects of which are disclosed in Other comprehensive income. The other reserves relate to currency differences arising from exchange rate differences from translation of the annual accounts of foreign subsidiaries.

[18] Financial Liabilities

The non-current financial liabilities primarily comprise leasing liabilities, and also consist of utilized lines of credit. Interest has been applied to leasing liabilities at the incremental borrowing rate over the appropriate contractual term. Fixed rates of interest of 1.00 % and 0.75% were applied to these lines of credit.

[19] Trade Payables and Other Liabilities

Other liabilities are broken down by maturity date, as follows:

in EUR thousand	31/12/2021	31/12/2020
Advance payments received	32	31
Trade payables	996	2,076
Trade accounts payable	1,028	2,107
Liabilities to employees	89	124
Social security contributions	1,839	1,068
Accruals and deferred income	277	129
Other	490	1,459
Other current liabilities	2,695	2,780
Trade accounts payable and other current liabilities	3,723	4,887
Non-current liabilities	206	206
Trade accounts payable and other liabilities	3,929	5,093

Trade payables were all due within one year. Trade payables are not secured and are usually settled within 30 days of being recorded.

The social security contributions relate to social security expenses for the employees. The majority deferred income relates to the accrual of licenses.

[20] Provisions

The provisions include the following items:

in EUR thousand	Personnel expenses	Consulting expenses	Other	Total
Book value at 01/01/2020	1,694	452	182	2,328
Use/resolution	1,271	594	174	2,039
Allocations to provisions	960	373	281	1,614
Book value at 31/12/2020	1,384	231	289	1,903
Use/resolution	664	231	297	1,192
Allocations to provisions	679	346	81	1,106
Book value at 31/12/2021	1,399	346	73	1,818

The non-current provisions relate to the following provision for severance pay:

in EUR thousand	31/12/2021	31/12/2020
Present value of the severance payment obligation as of 01/01	7	6
Service cost for the period	-	1
Interest expense	-	-
Severance payments	-	-
Revaluations from experience adjustments	-	0
Revaluations from changes in demographic assumptions	-	-
Revaluation from changes in financial assumptions	-	-
Currency difference	0	-
Present value of severance payment obligations as of 31/12	7	7

The provision for severance pay was established from actuarial calculations and involved assumptions about the discount rates applied, future increases in salary and mortality. No further information on actuarial assumptions is provided due to the immateriality of the provision. Future deviations from the assumptions taken can give rise to changes to the value of the provision. Due to the amount of the provision, since this would only have a very slight impact, a sensitivity analysis was waived.

Notes to the Consolidated Cash Flow Statement

The cash flow statement has been prepared using the indirect method. It shows the changes in cash and cash equivalents resulting from the inflow and outflow of funds during the reporting period and distinguishes between cash flows from operating, investing and financing activities. The funds reported in the cash flow statement are cash and cash equivalents.

[21] Cash flow from Operating Activities

The cash flow from operating activities shows the cash flows from the provision and acceptance of services during the reporting period and includes changes in current assets.

[22] Cash flow from Investing Activities

The cash flow from investing activities mainly comprises cash outflows for the purchase of tangible assets and intangible assets.

[23] Cash flow from Financing Activities

The cash flow from financing activities comprises the issue and conversion of convertible notes as well as the proceeds from borrowings and payment of interest. Cash outflows for leases are also included.

The following table shows the changes in liabilities from financing activity:

in EUR thousand	01/01/2021	Cash flows	Foreign exchange difference	New leasing contracts	Other	31/12/2021
Short-term interest bearing loans	6	9	-	-	-	15
Long-term interest bearing loans	3,650	1,549	-	-	-	5,199
Leasing liabilities	6,150	-1,251	69	182	-112	5,039
Convertible notes	-	2,450	-	-	-	2,450
Financial liabilities	9,806	2,757	69	182	-112	12,702

in EUR thousand	01/01/2020	Cash flows	Foreign exchange difference	New leasing contracts	Other	31/12/2020
Short-term interest
bearing loans	9	-3	-	-	-	6
Long-term interest
bearing loans	94	3,556	-	-	-	3,650
Leasing liabilities	3,447	-1,164	-151	3,947	71	6,150
Financial liabilities	3,550	2,389	-151	3,947	71	9,806

Financial Instruments and Risk Management

General Information

The main financial instruments used by cyan are deposits, trade receivables, leasing liabilities, financing liabilities and trade payables. cyan does not use any derivative financial instruments.

cyan has to take account of the following risks:

• ^◼ Liquidity Risk
• ^◼ Credit / Solvency Risk
• ^◼ Foreign Exchange Risk
• ^◼ Change of Interest Rate Risk

Liquidity Risk

The liquidity risk designates the risk of being unable to meet payment commitments through a lack of funds. Diligent liquidity risk management means having sufficient funds and an appropriate level of approved lines of credit in order to settle liabilities that fall due and to close market positions.

At the end of the reporting period, cyan held immediately available deposits with credit institutions and at hand of EUR 8,504 thousand (31.12.2020: EUR 2,490 thousand) that are expected to be able to generate funding to manage liquidity risk at any time.

Liquidity at cyan depends primarily on payments from customers. Since the majority of cyan's customers have settled their payment obligations in the past, and since there are no indications that this is going to change in future, cyan does not view its liquidity as being under threat. Through the acquisition of new customers, cyan assumes that its liquidity position will improve, hence the risk of cyan becoming unable to honor its payment obligations can be viewed as very low.

An analysis of the maturity of all liabilities existing on balance sheet date is shown below, which also illustrates the liquidity risk of cyan:

in EUR thousand	Up to 1 year	2‑5 years	5 years
31/12/2021
Bank liabilities	15	5,199	-
Trade payables	1,028	-	-
Leasing liabilities	1,207	2,399	1,433
Other financial liabilities	-	2,450	-
31/12/2020
Bank liabilities	6	3,650	-
Trade payables	2,107	-	-
Leasing liabilities	1,180	3,521	1,449
Other financial liabilities	-	-	-

Convertible bonds were issued and partially converted in 2021. In 2020, a loan was taken out with Erste Bank, which was received in 2020 and partly in 2021.

Credit & Solvency Risk

The solvency risk designates asset losses resulting from the non-fulfillment of contractual obligations by the business partners. Management of the solvency risk of investment transactions is performed by the Executive Board.

The cash and cash equivalents are primarily held at banks with a good credit rating. Balances are kept in current bank accounts. The credit risk is therefore low.

The contract assets and contract costs for the total amount of EUR 22.6 million relate to four customers (ACN/Flash Mobile, Virgin Mobile, Orange and iSolution/MTEL) which represent a cluster risk that is not collateralized. In 2020, as a consequence of the balance sheet scandal surrounding Wirecard, a 100 % write-down of contract assets was applied because cyan anticipates no payment of funds from its registered claim in the context of insolvency proceedings. The full contract assets from the Wirecard contract amount to EUR 5,000 thousand. This event was not foreseeable and the Executive Board estimates the risk of failure for ACN/Flash Mobile, Virgin Mobile, Orange and iSolution/MTEL as small.

Receivables are classified as financial assets with impaired creditworthiness in cases where specific indications for an impairment exist (in particular serious financial difficulties on the part of the debtor, failure to pay or delayed payment, increased risk of insolvency). In cases where payments become overdue by more than 180 days, a provision is considered. Depreciation (a write-down) takes place when an inability to pay (insolvency) is established, or when a receivable is judged to be irredeemable for other reasons. In cases where the reasons for impairment cease to apply, a reversal takes place, up to the level of acquisition costs carried forward.

The maximum theoretical risk of failure equates to the receivables itemized in the balance sheet.

Since defaults varied greatly from one country to another, it has been decided not to view this situation in a group-based format. The following tables contain information about the risk of default and the recorded and expected credit losses for financial instruments, classified by geographical region:

Chile

in EUR thousand	Loss rate	Gross book value	Value adjustment
2021
Not overdue	0.00%	353	-
1 -30 days overdue	0.00%	37	-
31 -60 days overdue	0.00%	-	-
61 -90 days overdue	0.00%	-	-
More than 90 days overdue	0.00%	-	-

2020

Not overdue	13.05%	37	5
1 -30 days overdue	15.55%	71	11
31 -60 days overdue	33.53%	-	-
61 -90 days overdue	34.30%	-	-
More than 90 days overdue	34.30%	58	19

Peru

in EUR thousand	Loss rate	Gross book value	Value adjustment
2021
Not overdue	0.00%	7	-
1 -30 days overdue	0.00%	-	-
31 -60 days overdue	0.00%	-	-
61 -90 days overdue	0.00%	-	-
More than 90 days overdue	0.00%	339	-

2020

Not overdue	16.66%	2	0
1 -30 days overdue	20.08%	-	-
31 -60 days overdue	21.57%	-	-
61 -90 days overdue	21.57%	-	-
More than 90 days overdue	21.57%	327	81

Colombia

in EUR thousand	Loss rate	Gross book value	Value adjustment
2021
Not overdue	0.55%	128	1
1 -30 days overdue	0.59%	-	-
31 -60 days overdue	3.24%	-	-
61 -90 days overdue	6.91%	-	-
More than 90 days overdue	8.52%	184	16
2020
Not overdue	1.34%	89	1

1 -30 days overdue	1.54%	-	-
31 -60 days overdue	7.83%	-	-
61 -90 days overdue	19.83%	-	-
More than 90 days overdue	21.74%	197	42

Mexico

in EUR thousand	Loss rate	Gross book value	Value adjustment
2021
Not overdue	44.09%	42	18
1 -30 days overdue	49.00%	11	5
31 -60 days overdue	65.80%	10	7
61 -90 days overdue	71.54%	-	-
More than 90 days overdue	79.09%	2	1

2020

Not overdue	17.64%	48	8
1 -30 days overdue	19.70%	13	3
31 -60 days overdue	36.92%	-	-
61 -90 days overdue	42.54%	15	6
More than 90 days overdue	50.10%	5	2

Austria

in EUR thousand	Loss rate	Gross book value	Value adjustment
2021
Not overdue	0.99%	927	9
1 -30 days overdue	1.41%	821	12
31 -60 days overdue	2.91%	5	0
61 -90 days overdue	4.64%	-	-
More than 90 days overdue	5.98%	12	1

2020
Not overdue	1.71%	154	3
1 -30 days overdue	2.43%	28	1
31 -60 days overdue	4.51%	5	0
61 -90 days overdue	6.76%	-	-
More than 90 days overdue	8.65%	22	2

The loss rates take into account forward-looking aspects (such as macroeconomic changes) with a percentage markup.

Segments

The following table shows the value adjustments from trade receivables, contract assets and leasing receivables arranged by segment:

	BSS/OSS		Cybersecurity
in EUR thousand	2021	2020	2021	2020
Value adjustment IFRS 9	-111	-983	-	-
Currency difference	-	-	-	-
Other specific allowances	386	746	-	4,785
Write-offs of accounts receivable	18	565	33	-
Value adjustments	293	328	33	4,785

Value adjustments as defined in IFRS 9 have performed as follows in the 2021 balance sheet:

in EUR thousand	BSS/OSS	Cybersecurity
Value adjustments 01/01/2020	1,315	-
Allocation	-	-
Dissolution	-983	-
Currency difference	22	-
Foreign currency valuation	-177	-
Value adjustments 31/12/2020	176	-
Value adjustments 01/01/2021	176	-
Allocation	25	-
Dissolution	-136	-
Currency difference	-5	-
Foreign currency valuation	10	-
Value adjustments 31/12/2021	70	-

In 2021, contract assets have changed as follows:

in EUR thousand	BSS/OSS	Cybersecurity
Contract asset value 01/01/2020	8,907	4,751
Allocation	12,798	34
Dissolution	-4,184	-4,785
Contract asset value 31/12/2020	17,522	-
Contract asset value 01/01/2021	17,522	-
Allocation	2,593	-
Dissolution	-3,394	-
Contract asset value 31/12/2021	16,721	-

Foreign Exchange Risk

Foreign exchange risk is defined as the potential loss resulting from fluctuating exchange rates. Because of the international nature of its business, cyan is exposed to certain foreign exchange risks. The finance department of the company constantly monitors these risks, and in particular the foreign exchange risks, to enable it to respond appropriately. In the event of a substantial foreign exchange risk arising at short notice, this could have adverse implications for the asset, financial and earnings position of cyan.

On the reporting date, cyan holds contract assets to the value of USD 18.3 million (2020: USD 21.3 million) that are subject to a foreign exchange risk. Changes to the exchange rate can have an impact, positive or negative, on earnings. A change in the value of the USD of 5% that the management views as a reasonable possible change in the exchange rate has an impact on earnings to the value of EUR 0.8 million (2020: EUR 0.8 million).

Wherever expense items and investment items are not denominated in Euro, fluctuations in exchange rates can impair cyan's ability to meet its financial obligations and/or can adversely affect the earnings position of cyan. In summary, due to the low level of

expenditure in non-euro currencies, this risk can be classified as limited, and it is therefore not quantified.

Change of Interest Rate Risk

The interest rate risk is defined as the risk of interest charges and/or earnings changing in an adverse manner. All loans have fixed interest rates so the change of interest rate risk can be classified as minimal, and no sensitivity analysis was conducted.

Capital management

Information relating to the earnings, financial and asset position (capital management) of cyan is provided in the management report.

Other Explanations

Related Companies and People

Since all subsidiaries are fully consolidated, this means that transactions are eliminated, so there are no transactions to report with regard to related companies and people.

Share-based remuneration

At the Company's Annual General Meeting in 2021, a stock option program and the creation of conditional capital were resolved. The Executive Board was authorized, with the approval of the Supervisory Board, to grant subscription rights to a total of up to 498,500 no-par value bearer or registered shares in the Company to members of the Executive Board of the Company or managing directors of companies affiliated with the Company on one or more occasions up to and including June 22, 2026. Insofar as members of the Executive Board are concerned, the Supervisory Board has been authorized.

Upon exercise of the stock options, the exercise price is payable for each share to be subscribed. The exercise price per share corresponds to EUR 22.00 for 60% of the stock options of a beneficiary and EUR 80.00 for the remaining 40% of the stock options of a beneficiary.

The performance targets correspond for 60% of the stock options of a beneficiary to the achievement of a stock market price of at least EUR 40.00 at the end of the vesting period and for the other 40 % of the stock options of a beneficiary to the achievement of a stock market price of at least EUR 150.00 at the end of the vesting period. Accordingly, the beneficiaries may only exercise up to 60 % of their stock options if the stock market price at the end of the vesting period is at least EUR 40.00. The beneficiaries may exercise the stock options at any time. The beneficiaries may only exercise the remaining up to 40% of their stock options if the stock market price at the end of the vesting period is at least EUR 150.00. Exercisable stock options can generally be exercised by the beneficiaries within an exercise period of four years. The exercise period begins after the date on which the waiting period has expired.

Information on the Compensation of the Executive Board and the Supervisory Board

Renumeration of the Members of the Executive Board

As of December 31, 2021 the Executive Board of cyan AG comprises the following members:

• ^◼ Frank von Seth (since 01/01/2021)
• ^◼ Markus Cserna
• ^◼ Michael Sieghart (until 31/12/2021)
• ^◼ Peter Arnoth (until 31/12/2020)
• ^◼ Martin Wachter (from 01/12/2021 until15/12/2021)

By resolution dated September 13, 2021, Mr. Wachter was appointed by the Supervisory Board to the Executive Board of cyan AG. By resolution of December 15, 2021, Mr. Wachter's appointment was rescinded by the Supervisory Board.

The compensation of the members of the Executive Board of cyan AG comprises the following components:

in EUR thousand		2021			2020
	Current fixed remuneration	Current variable remuneration	Total	Current fixed remuneration	Current variable remuneration	Total
Frank von Seth	101	-	101	-	-	-
Markus Cserna	63	-	63	67	50	117
Michael Sieghart	92	67	159	101	50	151
Peter Arnoth	-	-	-	73	-	73
Martin Wachter	3	-	3	-	-	-
Total remuneration	258	67	325	241	100	341

The compensation of the Executive Board consists of fixed salaries and one-time bonuses. The bonus payments amounted to 2.45 % of Group EBITDA for Peter Arnoth in 2020. A target bonus of EUR 250,000.00 was agreed for Markus Cserna, a target bonus of EUR 200,000.00 for Michael Sieghart and a target bonus of EUR 90,000.00 for Frank von Seth, which are calculated depending on the achievement of precisely defined targets (linked to EBITDA and operating cash flow). Furthermore, it was decided that Frank von Seth is not entitled to any variable compensation in 2021.

The Executive Board members also receive remuneration from subsidiaries that is not included in the above disclosures. The remuneration of the members of the Executive Board of cyan AG, which originates from subsidiaries, breaks down as follows.

in EUR thousand		2021			2020
	Current fixed remuneration	Current variable remuneration	Total	Current fixed remuneration	Current variable remuneration	Total
Frank von Seth	235	-	235	-	-	-
Markus Cserna	293	-	293	269	-	269
Michael Sieghart	228	-	228	235	-	235
Peter Arnoth	-	-	-	291	-	291
Martin Wachter	7	-	7	-	-	-
Total remuneration	761	-	761	795	-	795

Besides the regular fixed remuneration, benefits in kind total EUR 39 thousand (2020: EUR 32 thousand) and cash expenses total EUR 7 thousand (2020: EUR 12 thousand). A target bonus of EUR 210,000.00 was agreed for Frank von Seth, which is also calculated depending on the achievement of precisely defined targets (linked to EBITDA and operating cash flow). In accordance with the termination agreement with Mr. Peter Arnoth, he received a severance payment of EUR 291 thousand in 2020.

Compensation of the Members of the Supervisory Board

The members of the Supervisory Board of cyan AG are:

• ^◼ Gerd Alexander Schütz (from 05/01/2021 until 31/12/2021)
• ^◼ Stefan Schütze
• ^◼ Lucas Prunbauer
• ^◼ Volker Rofalski (until 31/12/2020)
• ^◼ Alexandra Reich (since 23/06/2021)
• ^◼ Trevor D. Traina (since 23/06/2021)

The members of the Supervisory Board of cyan AG received the following remuneration:

in EUR thousand	Period of appointment	2021	2020
Alexander Schütz	05/01/2021 -31/12/2021	40	-
Stefan Schütze	01/01/2018 ‑ 31/12/2022	30	40
Volker Rofalski	01/01/2018 ‑ 31/12/2020	-	30
Lucas Prunbauer	30/11/2018 ‑ 31/12/2022	30	35
Alexandra Reich	23/06/2021 -31/12/2026	30	-
Trevor D. Traina	23/06/2021 -31/12/2026	30	-

Details on Employees

The average number of employees during the financial year 2021 was 150 (2020: 149). The composition of personnel expenses can be found in Note 4, Personnel expenses.

Contingent Liabilities and Obligations

Contingent liabilities comprise guarantees for rental deposits and credit cards and amount to EUR 1,499 thousand as of the reporting date (Dec. 31, 2021: EUR 1,552 thousand).

Audit Fees

The expenses for the auditor of the consolidated financial statements attributable to the financial year are itemized as follows:

in EUR thousand	2021	2020
Expenses for audit services	174	117
thereof from previous years	12	-
Expenses for other certification services	-	-

Significant Events after the Balance Sheet Date

The date of approval of the consolidated financial statements by the Executive Board in accordance with IAS 10.17 is April 25, 2022. These consolidated financial statements are subject to approval by the Supervisory Board (Section 171 (2) AktG). Between the balance sheet date of December 31, 2021 and the release for publication, a number of events occurred, including the termination of the convertible bond program and the implementation of a non-cash capital increase, the appointment of a new Supervisory Board and the assumption of the role of Chairman by Stefan Schütze. A detailed analysis of the effects of these events is included in the Group management report.

Frank von Seth CEO

Markus Cserna CTO

Assurance by the Legal Representatives

Assurance by the Legal Representatives

We assure that, to the best of our knowledge, the consolidated financial statements convey a true and fair picture of the actual assets, financial and earnings positions of the Group, in accordance with the applicable accounting principles and that the representations in the management report on the business performance, including on the results and the position of the Group are such that an image is provided that is a true and fair reflection of the actual conditions and that the essential risks and opportunities in terms of expected development of the group are described in it.

Munich, in April 2022

Executive Board of cyan AG

Frank von Seth CEO

Markus Cserna CTO

Independent Auditor's Report

Independent Auditor's Report

This is a convenience translation of the German original. Solely the original text in the German language is authoritative.

To the CYAN AG, Munich,

[Audit] Opinions

We have audited the consolidated financial statements of CYAN AG and its subsidiaries (the Group), which comprise the consolidated statement of financial position as at 31 December 2021, and the consolidated statement of comprehensive income, consolidated statement of changes in equity and consolidated statement of cash flows for the financial year from 1 January to 31 December 2021, and notes to the consolidated financial statements, including a summary of significant accounting policies. In addition, we have audited the group management report of CYAN AG, which is combined with the management report of CYAN AG ("combined management report"), for the financial year from 1 January to 31 December 2021.

In our opinion, on the basis of the knowledge obtained in the audit,

• ^◼ the accompanying consolidated financial statements comply, in all material respects, with the IFRS as adopted by the EU, and the additional requirements of German commercial law pursuant to § [Article] 315e Abs. [paragraph] 1 HGB [Handelsgesetzbuch: German Commercial Code] and, in compliance with these requirements, give a true and fair view of the assets, liabilities, and financial position of the Group as at 31 December 2021, and of its financial performance for the financial year from 1 January to 31 December 2021, and
• ^◼ the accompanying combined management report as a whole provides an appropriate view of the Group's position. In all material respects, this combined management report is consistent with the consolidated financial statements, complies with German legal requirements and appropriately presents the opportunities and risks of future development.

Pursuant to § 322 Abs. 3 Satz [sentence] 1 HGB, we declare that our audit has not led to any reservations relating to the legal compliance of the consolidated financial statements and of the combined management report.

Basis for the [Audit] Opinions

We conducted our audit of the consolidated financial statements and of the combined management report in accordance with § 317 HGB and in compliance with German Generally Accepted Standards for Financial Statement Audits promulgated by the Institut der Wirtschaftsprüfer [Institute of Public Auditors in Germany] (IDW). Our responsibilities under those requirements and principles are further described in the "Auditor's Responsibilities for the Audit of the Consolidated Financial Statements and of the Combined Management Report" section of our auditor's report. We are independent of the group entities in accordance with the requirements of European law and German commercial and professional law, and we have fulfilled our other German professional responsibilities in accordance with these requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our [audit] opinions on the consolidated financial statements and on the combined management report.

Other Information

The management board is responsible for the other information. The other information comprises the parts of the annual report obtained by us after the date of the auditor's report, with the exception of the audited consolidated financial statements and combined management report and our audit opinion.

Our [audit] opinions on the consolidated financial statements and on the combined management report do not cover the other information, and consequently we do not express an [audit] opinion or any other form of assurance conclusion thereon.

In connection with our audit, our responsibility is to read the other information and, in so doing, to consider whether the other information

• ^◼ is materially inconsistent with the consolidated financial statements, with the combined management report or our knowledge obtained in the audit, or
• ^◼ otherwise appears to be materially misstated.

If, based on the work we have performed, we conclude that there is a material misstatement of this other information, we are required to report that fact. We have nothing to report in this regard.

Responsibilities of the Management Board and the Supervisory Board for the Consolidated Financial Statements and the Combined Management Report

The management board is responsible for the preparation of the consolidated financial statements that comply, in all material respects, with IFRS as adopted by the EU and the additional requirements of German commercial law pursuant to § 315e Abs. 1 HGB and that the consolidated financial statements, in compliance with these requirements, give a true and fair view of the assets, liabilities, financial position, and financial performance of the Group. In addition, the management board is responsible for such internal control as they have determined necessary to enable the preparation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the consolidated financial statements, the management board is responsible for assessing the Group's ability to continue as a going concern. They also have the responsibility for disclosing, as applicable, matters related to going concern. In addition, they are responsible for financial reporting based on the going concern basis of accounting unless there is an intention to liquidate the Group or to cease operations, or there is no realistic alternative but to do so.

Furthermore, the management board is responsible for the preparation of the combined management report that, as a whole, provides an appropriate view of the Group's position and is, in all material respects, consistent with the consolidated financial statements, complies with German legal requirements, and appropriately presents the opportunities and risks of future development. In addition, the management board is responsible for such arrangements and measures (systems) as they have considered necessary to enable the preparation of a combined management report that is in accordance with the applicable German legal requirements, and to be able to provide sufficient appropriate evidence for the assertions in the combined management report.

The supervisory board is responsible for overseeing the Group's financial reporting process for the preparation of the consolidated financial statements and of the combined management report.

Auditor's Responsibilities for the Audit of the Consolidated Financial Statements and of the Combined Management Report

Our objectives are to obtain reasonable assurance about whether the consolidated financial statements as a whole are free from material misstatement, whether due to fraud or error, and whether the combined management report as a whole provides an appropriate view of the Group's position and, in all material respects, is consistent with the consolidated financial statements and the knowledge obtained in the audit, complies with the German legal requirements and appropriately presents the opportunities and risks of future development, as well as to issue an auditor's report that includes our [audit] opinions on the consolidated financial statements and on the combined management report.

Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with § 317 HGB and in compliance with German Generally Accepted Standards for Financial Statement Audits promulgated by the Institut der Wirtschaftsprüfer (IDW) will always detect a material misstatement. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these consolidated financial statements and this combined management report.

We exercise professional judgment and maintain professional skepticism throughout the audit.

We also:

• ^◼ Identify and assess the risks of material misstatement of the consolidated financial statements and of the combined management report, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our [audit] opinions. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
• ^◼ Obtain an understanding of internal control relevant to the audit of the consolidated financial statements and of arrangements and measures (systems) relevant to the audit of the combined management report in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an [audit] opinion on the effectiveness of these systems.
• ^◼ Evaluate the appropriateness of accounting policies used by the management board and the reasonableness of estimates made by the management board and related disclosures.
• ^◼ Conclude on the appropriateness of the management board's use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Group's ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in the auditor's report to the related disclosures in the consolidated financial statements and in the combined management report or, if such disclosures are inadequate, to modify our respective [audit] opinions. Our conclusions are based on the audit evidence obtained up to the date of our auditor's report. However, future events or conditions may cause the Group to cease to be able to continue as a going concern.
• ^◼ Evaluate the overall presentation, structure and content of the consolidated financial statements, including the disclosures, and whether the consolidated financial

statements present the underlying transactions and events in a manner that the consolidated financial statements give a true and fair view of the assets, liabilities, financial position and financial performance of the Group in compliance with IFRSs as adopted by the EU and the additional requirements of German commercial law pursuant to § 315e Abs. 1 HGB.

• ^◼ Obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the Group to express [audit] opinions on the consolidated financial statements and on the combined management report. We are responsible for the direction, supervision and performance of the group audit. We remain solely responsible for our [audit] opinions.
• ^◼ Evaluate the consistency of the combined management report with the consolidated financial statements, its conformity with [German] law, and the view of the Group's position it provides.
• ^◼ Perform audit procedures on the prospective information presented by the management board members in the combined management report. On the basis of sufficient appropriate audit evidence we evaluate, in particular, the significant assumptions used by the management board as a basis for the prospective information, and evaluate the proper derivation of the prospective information from these assumptions. We do not express a separate [audit] opinion on the prospective information and on the assumptions used as a basis. There is a substantial unavoidable risk that future events will differ materially from the prospective information.

We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

Bielefeld, 25 April 2022

Dr. Stückmann und Partner mbB Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft

(Gäbel) (Teipel) Wirtschaftsprüfer Wirtschaftsprüfer

[German Public Auditor]

Further Information

Further Information

Disclaimer

Statements on future events and developments

This report contains statements on future events and developments, based on current assessments of the management. Such statements are based on current expectations and certain assumptions and estimates made by the management. They are subject to risks, uncertainties and other factors that may cause the actual circumstances, including cyan's assets, financial and earnings positions, to differ materially or to be more negative than those expressly or implicitly assumed or described in these statements.

The business activities of cyan are subject to a number of risks and uncertainties that may cause statement, estimate or prediction in relation to future events and developments to be inaccurate. Statements on future events and developments must not be perceived as guaranties or assurances that such future events or developments will actually materialize.

Note on rounding

The figures in this report have been rounded in accordance with prevailing commercial principles. Consequently, rounding differences may occur. Therefore, the sum of the individual values shown may differ from the precisely shown total.

Gender-neutral formulation

In the interest of legibility, gender-differentiating formulations have been dispensed with throughout. The relevant terms apply to all sexes within the framework of equal rights. The shortened manner of speech has only editorial reasons and does not represent any evaluations on the part of cyan.

English translation

This English version has been translated based on the German report. In case of deviations, the German version prevails. The report is available for download in both languages in the Investor Relations section of the website.

ir.cyansecurity.com

Imprint

Publisher

cyan AG Theatinerstraße 11 80333 Munich Germany

VAT ID: DE315591576 HR Munich: HRB 232764

cyansecurity.com

Investor Relations

cyan AG Investor Relations ir@cyansecurity.com

ir.cyansecurity.com

Graphic design/layout

cyan AG Inhouse with firesys

Theatinerstraße 11 80333 Munich, Germany cyan AG

www.cyansecurity.com