SPOT · CIK 1639920
What Spotify Technology S.A. told the SEC could break it.
Spotify's register traces to a recurring theme: dependence on a handful of powerful third parties at nearly every layer of its business. Its content supply is concentrated, with Universal, Sony, Warner and Merlin accounting for about 72% of streams of label-delivered audio in 2025 under multi-year licenses that don't renew automatically; its infrastructure runs on Google Cloud Platform (plus third-party payment processors); and its distribution leans on Apple's App Store, whose conduct it has long contested — the European Commission fined Apple €1.84 billion in March 2024, though Apple has appealed and may not comply in ways that help Spotify. As a Luxembourg-domiciled company operating globally, it also faces cross-border risks from political instability and anti-corruption, sanctions and IP-protection regimes.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- Apple App Store platform conduct / antitrust dispute (EU fined Apple €1.84B in 2024; under appeal)medium
Spotify depends on the Apple App Store for distribution and has long contested Apple's conduct as anticompetitive; the European Commission found Apple's conduct illegal and fined it €1.84 billion in March 2024, but Apple has appealed and may not comply in ways that materially improve Spotify's business.
“In March 2024, the European Commission found that Apple's conduct was illegal under the European Union (the “EU”)'s antitrust rules and fined Apple €1.84 billion... we cannot assure you that Apple will comply with the decision in ways that materially improve our business. Apple has appealed the decision”
SEC filing →As of 2026 - global operations — Luxembourg domicile, FCPA/UK Bribery/sanctions, weak IP protection in some countrieslow
Spotify (organized under Luxembourg law, with substantial assets and directors/officers outside the U.S.) faces international risks including political/economic/social instability, FCPA/U.K. Bribery Act and export-control/sanctions compliance, reduced or ineffective IP protection in some countries, and difficulty for investors enforcing U.S. judgments.
“compliance with the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, import and export controls and economic sanctions laws imposed by the U.S. government, and similar laws in other jurisdictions; and reduced or ineffective protection of our intellectual property rights in some countries.”
Sole-source dependency
- Google Cloud Platform cloud-infrastructure dependence + third-party payment processorshigh
Spotify relies on Google Cloud Platform for its distributed cloud-computing infrastructure and on third-party providers for payment processing (credit/debit cards); interruptions, discontinuations, or providers becoming unwilling/unable to serve could materially disrupt its business.
“We rely on our systems and those of third parties to provide our products and services. For instance, Google Cloud Platform (“GCP”) provides a distributed computing infrastructure platform for business operations”
SEC filing →As of 2026
Supplier concentration
- music-licensing concentration — UMG, Sony, Warner & Merlin = ~72% of label-delivered streams; multi-year, non-auto-renewable licensesmedium
Content from Universal Music Group, Sony Music Entertainment, Warner Music Group and Merlin accounted for ~72% of streams of label-delivered audio content in 2025; these multi-year, worldwide licenses are not automatically renewable, and deterioration in relationships or failure/refusal to license could seriously harm Spotify's business.
“Our business may be adversely affected if our access to music is limited or delayed because of deterioration in our relationships with one or more of these rights holders or if they choose not to license to us fo[r]”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
Sony Music Entertainment
“ic Group, Sony Music Entertainment, Warner Music Group, and Music and Entertainment Rights Licensing Independent Network (“Merlin”), makes up the majority of music consumed on our Service. For the year ended December 31, 2025, this content accounted for approximately 72% of streams of audio content delivered by record labels.”
Cited →“ic Group, Sony Music Entertainment, Warner Music Group, and Music and Entertainment Rights Licensing Independent Network (“Merlin”), makes up the majority of music consumed on our Service. For the year ended December 31, 2025, this content accounted for approximately 72% of streams of audio content delivered by record labels.”
Cited →Alphabet Inc. (Google Cloud Platform)
“Google Cloud Platform (“GCP”) provides a distributed computing infrastructure platform for business operations, or what is commonly referred to as a cloud computing service.”
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch