Item 1A. Risk Factors
There are many factors that affect our business, financial condition, results of operations and cash flows, some of which are beyond our control. The following is a description of some important factors that may cause our business, financial condition, results of operations and cash flows in future periods to differ materially from those currently expected or desired. Factors not currently known to us or that we currently deem to be immaterial may also materially and adversely affect our business, financial condition, results of operations and cash flows. You should carefully consider all of these risks described below, together with the other information included in this Annual Report on Form 10-K, before investing in our securities. As a result of any of these risks, known or unknown, you may lose all or part of your investment in our securities.
Risk Factors Summary
Risks Relating to our Business and Industry
A deterioration in general economic conditions, including due to inflation-related challenges, resulting in reduced consumer confidence and consumer and business spending and decreased demand for our products.
The unpredictability of our operating results due to the varying cyclicality of the financial card and electronic payment industries, changes in customer inventory management practices, capital requirements, competition, new product developments, technological changes and other factors.
Failure to retain existing key customers and attract new customers due to competitive products, pricing pressures, extended production lead times, or the financial health of our customers.
The highly competitive, saturated and consolidated nature of our marketplace.
Table of Contents
Our inability to develop new or enhanced products and related services, including due to our inability to undertake time-consuming and costly research and development activities, or the widespread adoption of technological changes, new products or industry standards, such as digital payment systems or mobile payments, which may render our products obsolete or irrelevant.
A cyber-attack or breach of our information technology systems resulting in losses of our intellectual property and/or sensitive cardholder data, harm to our competitive position and a loss of customer trust and confidence, and, as threats evolve, the necessity to invest in significant additional resources to enhance our information security and controls.
The usage, or lack thereof, of artificial intelligence technologies.
Disruptions, delays or other failures in our supply chain, including due to increased costs and inflationary pressures in our supply chain, single-source suppliers, or the failure or inability of our suppliers to comply with our codes of conduct or contractual requirements , trade restrictions, tariffs, foreign conflicts or political unrest in countries in which our suppliers operate, and our inability to pass related costs on to our customers or difficulty meeting customers’ delivery expectations due to extended lead times .
Changes in U.S. and global trade policy and the impact of tariffs have had and may continue to have a material adverse effect on our business and results of operations.
Any interruption of our information technology systems, including disruptions or failures of our third-party data centers, inhibiting our ability to serve our customers.
Defects in our software and computing systems, resulting in errors or delays in the processing of transactions and other interruptions in our business operations.
A disruption at any of our production facilities due to weather conditions, climate change, political instability, or social unrest and our inability to recover quickly or otherwise provide continuity of production to meet customer requirements.
Problems in our production processes, including as a result of mechanical or technological failures, which could lead to reduced production capacity and quality.
Defects in our products that may give rise to products recalls, product liability and warranty claims as well as damage to our reputation.
Failure to recruit, retain and develop qualified new and replacement personnel and implement effective succession processes amidst labor shortages and competitive labor markets.
Our indebtedness and the covenants and restrictions in the agreements governing our indebtedness limiting our ability to use our cash flow in certain areas of our business, capitalize on certain business opportunities and pursue our business strategies, all of which could be further impacted if we incur additional debt and could impact our ability to make debt service payments.
Our inability to make debt service payments and an inability to refinance our existing debt on favorable terms or at all.
Our inability to execute successfully on an acquisition strategy or strategic relationships.
We may not realize the potential benefits from the acquisition of Arroweye because of difficulties related to integration, the achievement of synergies and other challenges.
Our inability to divest or consolidate certain non-strategic businesses.
Our potential failure to comply with the Sarbanes-Oxley Act of 2002, including maintaining effective control over financial reporting and risks relating to investor confidence in our financial reports.
The impact of the increasing focus on ESG factors on our ability to produce our products in conformity with stakeholder preferences, and comply with stakeholder demands as well as comply with any new ESG-related legal or regulatory requirements or restrictions, and negative perceptions of our products due to the impact of our products and production processes on the environment and other ESG-related risks.
Damage to our reputation or brand image resulting from negative perceptions of our business or those entities or individuals with whom we do business.
Our inability to protect our trade secrets, intellectual property and proprietary software; to obtain additional intellectual property rights in the future; and to ensure our products are not infringing the intellectual property rights of others.
Our inability to renew licenses with key technology licensors, resulting in our loss of access to certain technologies upon which we rely to develop certain of our products.
Our inability to successfully access capital markets due to the effects of the low trading volume and fluctuating trading price of our common stock as well as terms of our outstanding indebtedness and unfavorable market conditions, which may lead to delays in innovation or the abandonment of our strategic initiatives.
Table of Contents
Our exposure to additional tax collection efforts by states, unclaimed property laws, or future increases in U.S. federal or state income taxes, resulting in additional expenses which we may be unable to pass along to our customers.
Our inability to realize the full value of our long-lived assets, which represent a significant portion of our total assets.
Challenges, costs and potential liabilities associated with compliance or failure to comply with existing or future data privacy and security laws, regulations and other requirements, including customer contractual requirements.
Our failure to comply with the standards of the PCI Security Standards Council and other industry standards, including due to an inability to continue to make investments in our facilities necessary to maintain compliance with such standards.
The effects of ongoing foreign conflicts on the global economy.
Adverse conditions in the banking system and financial markets, including bank and financial institution failures.
Our failure to comply with environmental, health and safety laws and regulations, including climate change regulations, that apply to our products and the raw materials we use in our production processes.
Risks Relating to Ownership of our Common Stock
Continued concentrated ownership of our shares by our significant stockholders and their ability to control decisions regarding our business direction and policies as well as the potential conflicts of interest that may arise between our significant stockholders and our other stockholders.
The impact of concentrated ownership of our common stock and the sale or perceived sale of a substantial amount of common stock on the trading volume and market price of our common stock.
Potential conflicts of interest for certain individuals serving on our Board of Directors due to their relationships with our significant stockholders.
The influence of securities analysts over the trading market for and price of our common stock, particularly due to the lack of substantial research coverage of our common stock.
The impact of stockholder activism or securities litigation on the trading price and volatility of our common stock.
Certain provisions of our organizational documents and other contractual provisions that may delay or prevent a change in control and make it difficult for stockholders other than our significant stockholders to change the composition of our Board of Directors.
General Risk Factors
Our inability to comply with numerous evolving and complex laws and regulations relating to financial reporting standards, corporate governance, data privacy, tax, trade regulations, environmental regulations and permit requirements, export controls, competitive practices, labor and health and safety.
Legal costs, the adequacy of our insurance policies, settlement costs and the risk of an adverse decision related to legal or regulatory proceedings or litigation.
Table of Contents
Risks Relating to our Business and Industry
Risks associated with reduced levels of consumer and business spending, inflation-related challenges and the effects of an economic downturn could adversely affect our business, financial condition and results of operations.
Our business depends heavily on consumer and business spending. Our revenue is exposed to general economic conditions that affect consumer confidence, spending, discretionary income or purchasing habits. A sustained deterioration in general economic conditions, particularly in the United States, or increases in interest rates may adversely affect our financial performance by reducing the demand for our payment card solutions or reducing the purchase of our higher margin products and credit card issuers may reduce credit limits, close accounts and become more selective in issuing credit cards. Certain of our customers, especially in the fintech space, could be severely impacted by reduced credit card spending, or cease to exist altogether. Additionally, an economic downturn or a global health emergency could result in extended voluntary or mandated closure of retail locations that sell certain of our products to consumers, including our Prepaid Debit Cards. These and other changes in economic conditions could therefore adversely impact our future revenues and profits and cause a materially adverse effect on our business, financial condition and results of operations.
Inflation has adversely affected us by increasing the costs of materials and labor needed to operate our business and could continue to adversely affect us in future periods. In response, we have increased in the past and may in the future increase, the sales prices of our products and related services in order to maintain satisfactory margins. Such increases may result in customer pushback or attrition and be difficult or impossible in future periods, all of which may have an adverse effect on our financial condition and results of operations.
Our operating results are unpredictable and may vary significantly from quarter to quarter and annually and may differ significantly from our expectations.
Our operating results are affected by a wide variety of factors that could materially and adversely affect revenue and profitability or lead to significant variability in our operating results. These factors include the varying cyclicality of the financial card and electronic payment industries, limited visibility into our customers’ anticipated purchasing needs, labor and supply challenges, capital requirements, Payment Card Brands standards and requirements, competition, new product developments, technological changes and other factors.
Furthermore, in periods of industry overcapacity or when our customers encounter difficulties, orders are more exposed to cancellations, reductions, price reductions or postponements, or changes in customer inventory management practices which in turn reduce our ability to forecast the next quarter or full-year production levels, revenue, profits and cash flows. For these reasons, our revenue and operating results and cash flows may differ materially from our expectations. This may have a material adverse effect on our business, financial condition and results of operations.
Failure to retain our existing customers or identify and attract new customers would have a material adverse effect on our business.
A substantial portion of our revenue is derived from several large customers. The Company had one customer that accounted for approximately 16% of total revenue for the year ended December 31, 2025. We have been serving this customer for nearly 20 years. In addition, more than half of our revenue for the year ended December 31, 2025 were from our top 10 direct customers, which include certain Resellers. We have been serving these top 10 direct customers for an average of more than 10 years. If one or more of our key customer relationships ends, or if we are unable to offer these and our other products and related services in a high quality and timely manner, our relationships with our customers may be adversely affected and customers may terminate their contracts with us.
Table of Contents
In addition, our customer relationships may be impacted by several factors beyond our control, including changes in customer purchasing and inventory management practices, more attractive product offerings from our competitors, pricing and inflationary pressures, Resellers’ and program managers’ ability to retain existing or gain new customers, the financial health of our customers and macroeconomic conditions affecting the payment card industry or our customers. Our business practices may also be subject to periodic audits by customers as part of their third-party risk management programs, the outcome of which may result in customer loss or cause us to incur significant costs to satisfy customer requirements. Because our contractual arrangements with customers generally do not include exclusivity clauses or commitments to order specified quantities of products on a medium or long-term basis, there is no guarantee that we will receive orders on a consistent basis or on favorable terms, or be able to renew contracts or purchase orders in a given year on favorable terms or at all. Additionally, as a result of labor shortages and supply-chain constraints, the Company has in the past experienced, and may in the future experience, extended production lead times which may result in difficulty meeting some customers’ delivery expectations . While we continue to proactively monitor, assess and take steps to minimize disruptions and delays in production, these disruptions and delays have caused, and may continue to cause, the Company to lose or delay customer opportunities.
If we experience difficulty attracting and retaining customers, particularly our key customers, our business, financial condition and results of operations would be materially and adversely affected.
We face competition that may result in a loss of our market share and/or a decline in our profitability.
Our marketplace is highly competitive, relatively saturated and increasingly consolidated. We expect these market dynamics to continue for new product innovations, and as competitors develop lower-cost production, competitors consolidate and other competitors attempt to enter the markets in which we operate.
Some of our competitors have larger global customer bases and significantly greater financial, sales and marketing, production, distribution, technical and other capabilities than we do. These competitors may be able to adapt more quickly to new technological requirements and changes in customer and/or regulatory requirements to lower production costs and prices, and utilize their global footprint to win customers with card needs in multiple markets and by producing cards in lower cost geographies. We also face competition from newly established competitors, suppliers of products and customers who develop their own products and related services.
If we cannot compete successfully, we may lose or fail to maintain market share, which could have a material adverse effect on our business, financial condition and results of operations.
Our future success depends upon our ability to develop, introduce and commercialize new products and related services which can be a lengthy and complex process. New and developing technology solutions and products could make our existing technology solutions and products obsolete or irrelevant. We may be unable to commercialize new or improved products and related services we may develop on a timely basis or at all.
Our ability to enhance our current products and related services and to develop and introduce innovative products and related services that address the increasingly sophisticated needs of our customers will significantly affect our future success. We may not be successful in developing, gaining market acceptance of, marketing or selling new or enhanced products and related services that meet these changing demands in a timely manner or at all. Our failure to do so would likely have a material adverse effect on our ability to retain existing customers or attract new ones.
Our ability to develop and deliver new products and related services successfully will depend on various factors, including our ability to:
effectively identify and capitalize upon opportunities in new and emerging product markets;
invest resources in innovation and research and development;
complete and introduce new products and integrated services solutions in a timely manner;
license any required third-party technology or intellectual property rights;
qualify for and obtain required industry compliance for our products;
effectively manage the supply chain and related risks;
comply with applicable data protection regulations;
Table of Contents
execute on our strategy to diversify our products by adding adjacent product and service offerings, including digital solutions; and
retain and hire personnel experienced in developing new products and related services.
The research and development of new or enhanced products and related services is a complex, time-consuming, costly and uncertain process requiring the accurate anticipation of technological, market and industry trends, as well as precise technical execution, and all such challenges could adversely affect our ability to meet customer demand for new or enhanced products. We have limited research and development resources compared to many of our competitors, which may result in an immature product development process and lengthy product roll-outs, and competitors may be able to develop and commercialize competing products more quickly and efficiently. Artificial intelligence and machine learning technologies have rapidly developed and if we cannot successfully integrate these technologies into our internal business processes and product and related service offerings in a timely, cost-effective, compliant and responsible manner, we may be at a competitive disadvantage. New or enhanced product and related service offerings may also expose us to additional risks, such as new sources of supplies, increased regulation or reputational harm. If we have difficulty producing innovative products, there could be a material adverse effect on our revenue, results of operations, reputation and business.
Additionally, opportunities to combine or package products and related service offerings and the ability to cross-sell products and related services or expand into new customer verticals or markets are critical to remaining competitive in our industry. As a result, part of our business strategy is to develop new products and related services, including digital solutions, that may be used in conjunction with or in addition to our existing offerings. If we are unable to identify adequate opportunities to cross-sell our products and related services or successfully leverage our offerings to new customer verticals or markets, this may have a material adverse effect on our business, financial condition and results of operations.
Further, the markets for our products and related services are subject to technological changes, frequent introductions of new products and related services, evolving industry standards and changing customer preferences and demands, and our product and service offerings could be rendered obsolete. In particular, the rise in the adoption in digital payment systems or mobile payments may make physical cards less attractive as a method of payment. Certain merchants are also increasingly offering “buy now pay later” installment programs directly to consumers which may eliminate the use of a payment card to complete a transaction. Mobile payments, biometric payments and direct installment payment programs allow consumers to make purchases without the need to carry a physical card and could, if widely adopted, reduce the number of debit and credit cards issued to consumers. In addition, other new and developing technology solutions and products, including artificial intelligence and machine learning capabilities, could make our existing technology solutions and products obsolete or irrelevant. Any of these factors could have a material adverse effect on our business, financial condition and results of operations.
Table of Contents
System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation.
The reliability and security of our information technology (“IT”) infrastructure and our ability to protect sensitive and confidential information for our customers, which include many financial institutions, is critical to our business. We have been and may continue to be a target of cyber-attacks or cyber intrusions via the Internet, computer viruses, break-ins, malware, phishing attacks, ransomware attacks, hacking, denial-of-service attacks or other attacks and similar disruptions from unauthorized use of or access to computer systems (including from internal and external sources). In addition, increased attention on and use of artificial intelligence in general or by our employees increases the risk of cyber-attacks and data breaches, which can occur more quickly and evolve more rapidly when artificial intelligence is used, or unintentional disclosure of our proprietary information. A breach of our security defenses could result in a loss of our intellectual property, the release of sensitive cardholder information and customer, consumer or employee personal data, or the loss of production capabilities at one or more of our production facilities. We may also be at risk from cyber-attacks on third parties with whom we do business to the extent their compromised systems interact with our systems or employees. For example, our employees, contractors, customers or other users of our systems are from time-to-time subject to fraudulent inducements by parties attempting to gain access to our data. We have no control over the level of response offered by any third party whose systems have been impacted by a cyber-security breach and to the extent we are also impacted by interacting with compromised systems or bad actors, we could also experience system disruptions, financial loss, fines or penalties and potential damage to our reputation. In recent years these types of incidents have become more prevalent and pervasive across industries, including in our industry.
In addition, our encryption systems are at risk of being breached or decoded. We use encryption technology designed to protect sensitive data while in transit and at rest. Also, smart cards are equipped with keys that encrypt and decode messages intended to secure transactions and maintain the confidentiality of data. The security afforded by this technology depends on the integrity of the encryption keys and the complexity of the algorithms used to encrypt and decode information. Any significant advances in technology that enable the breach of cryptographic systems, malicious software infiltration or that allow for the exploitation of weaknesses in such systems could result in a decline in the security we are able to provide through this technology. Any material breach of our secured systems could harm our competitive position, result in a loss of customer trust and confidence, and cause us to incur significant costs to remedy the damages caused by system or network disruptions, which could ultimately have a material adverse effect on our business, financial condition and results of operations.
The protective measures we have implemented may not prevent system or network disruptions and may be insufficient to prevent or limit the damage from any future security breaches. Our activities and investment in protective measures may not be deployed sufficiently quickly or successfully to protect our system or network against disruptions and may not prevent or limit the damage from any future security breaches. In addition, as these threats continue to evolve, we may be required to invest significant additional resources to modify and enhance our information security and controls or to investigate and remediate any security vulnerabilities.
A disruption or other failure in our supply chain could adversely affect our business and financial results.
We are subject to the risks inherent in production and distribution activities, including product quality control issues, disruptions or delays in our supply chain and other external factors over which we have no control. Raw materials used in our products may be sourced from a few key suppliers or a single key supplier. Specifically, certain key components for our payment card products include microchips, substrates (such as PVC), resin, modules, antennas and inlays, which we source from multiple suppliers located in various countries, primarily on a purchase order basis. For the year ended December 31, 2025 approximately 93% of the total value of our purchased microchips and antennas came from three main suppliers, and approximately 74% came from one supplier, including most of our contactless chips. We may enter into supplier agreements from time to time which commit us to purchase products at prices less favorable than those available in the market at the time of the order, or in quantities greater than our future needs. If such supplier is unable or delayed in fulfilling our microchip orders, we could fail to timely fulfill customer orders, which could damage our reputation and result in a loss of customers and customer opportunities and material harm to our financial results.
Table of Contents
Additionally, our Second Wave cards featuring a core made with ROBP, rely on a largely international supply chain to provide such plastic in accordance with our parameters. It is difficult and costly to monitor supplier compliance with our parameters, our codes of conduct, and applicable laws. Any failure by our suppliers to so comply could adversely affect our ability to produce payment cards at all or in a manner consistent with standards agreed upon with our customers, which could adversely affect our business, reputation and customer relationships. Moreover, in certain cases, such as with ROBP, microchip and resin suppliers, we may rely on suppliers for which there are not adequate and immediate replacements. If these suppliers terminate their relationships with us, fail to timely deliver required products or materials or at all, or otherwise fail to meet their obligations to us, we may be unable or delayed in our ability to produce products using components from these suppliers. We generally do not maintain large volumes of certain types of inventory, which makes us even more susceptible to harm if a supplier fails to deliver products or materials as required.
Changes in the financial or business condition of our suppliers, political instability, social or civil unrest, war or adverse market conditions in a supplier’s country, including any new global health emergency, climate change, extreme weather events, demand from other customers of such suppliers or failure to comply with our codes of conduct or other contractual requirements, could render our suppliers unable to provide us with, or render us unable or unwilling to accept, the components we need and thus subject us to losses or increased costs or adversely affect our ability to bring products to market. Further, the failure of our suppliers to deliver goods and services in sufficient quantities, in compliance with applicable standards, contract requirements, or laws and regulations, and in a timely manner could adversely affect our customer service levels, our reputation and our overall business. For example, during the COVID-19 pandemic, we experienced delays in the supply of, and increased costs of, materials necessary to operate our business, which made it difficult to produce our products in a timely manner. In addition, any increases in the costs of goods and services for our business, including because of inflationary pressures or tariffs, may adversely affect our profit margins if we are unable to pass along any higher costs in the form of price increases or otherwise achieve operational cost efficiencies. If a supplier engages in illegal, unethical or other questionable conduct, we may not have visibility into these practices, we may in certain circumstances be deemed to have concurrent responsibility with our supplier for such conduct, and we, and our customers, may face legal or reputational harm in addition to interruptions to our supply chain.
Changes in U.S. and global trade policy and the impact of tariffs have had and may continue to have a material adverse effect on our business and results of operations.
Our business and results of operations has been and may continue to be adversely affected by uncertainty and changes in U.S. trade policies, including tariffs, trade agreements or other trade restrictions imposed by the U.S. or other governments. For example, beginning in the first quarter of 2025, the U.S. administration has announced, delayed, re-imposed and revised a series of broad-based, as well as country-, bloc- and sector-specific, tariffs on goods imported into the United States, as well as other trade policy changes. Further, in August 2025, the U.S. administration announced plans to impose tariffs on imported semiconductor chips and in January 2026, imposed tariffs on certain imported semiconductors. While such tariffs did not impact semiconductors used in our products, we have been adversely impacted by tariffs on other imported materials and components used in our products, and we may be adversely impacted by tariffs on imported semiconductors or other materials and components in the future. Further, on February 20, 2026, the U.S. Supreme Court issued a ruling invalidating certain tariffs previously imposed under the International Emergency Economic Powers Act (“IEEPA”). Following the Supreme Court’s decision, the U.S. administration announced its intention to invoke other laws to collect tariffs and announced new tariffs on imports from all countries, in addition to any existing non-IEEPA tariffs. Such actions have given, and may continue to give, rise to further escalations of trade measures by the United States and impacted countries, including the announcement of retaliatory tariffs on certain goods imported from the United States. Further developments with regard to the timing and manner in which tariffs are implemented, the amount, scope and nature of tariffs, the countries subject to new or additional tariffs imposed by the United States, and tariffs imposed by other countries on goods imported from the United States are rapidly evolving and may change unexpectedly at any time, making it difficult for us to predict future developments regarding global tariffs or other trade restrictions or their ultimate effects on our business and results of operations.
Table of Contents
Our business requires access to certain raw materials and components used in our products, including technology, substrates, and other materials which we source from multiple suppliers located in various countries. In addition, some manufacturing equipment and spare parts purchased from various countries may also be affected. Any imposition of or increase in tariffs on imports of such materials, as well as corresponding price increases for such materials, has increased and may continue to increase our costs. Our access to certain raw materials and components used in our products may also be adversely impacted by tariffs. In addition, our domestic suppliers may incur tariffs leading to increased prices. To the extent that we have been or will be unable to pass all or any such cost increases on to our customers, such cost increases have adversely affected and could continue to adversely affect our profitability. Higher materials costs could also diminish our ability to develop new projects, particularly during times of economic uncertainty, and limit our ability to pursue growth opportunities.
In addition, tariffs or other trade restrictions may lead to continuing uncertainty and volatility in U.S. and global financial and economic conditions, declining consumer confidence and inflation, and ultimately reduced demand for our products and related services. Such conditions have and could continue to have a material adverse impact on our business, results of operations and cash flows. Also, disruptions and volatility in the financial markets may lead to adverse changes in the availability, terms and cost of capital. Such adverse changes have increased and could continue to increase our costs of capital and limit our access to external financing sources to fund acquisitions, capital projects, or refinancing of debt maturities on similar terms, which could in turn reduce our cash flows and limit our ability to pursue growth opportunities. There is no guarantee that we can avoid the impact of tariff and related economic effects in the future, and these trade measures and retaliations may directly impair our business by reducing demand for our products and related services, increasing trade-related costs or disrupting established supply chains.
Interruptions in our operations, particularly in our IT systems, could have a material adverse effect on our business and reputation.
Our business is dependent upon our ability to execute, in an efficient and uninterrupted fashion, necessary business functions, including the operation of complex IT systems and production equipment. In addition, a significant portion of the communication between our employees, customers and suppliers depends on our IT systems. The reliability of our IT infrastructure and software, and our ability to expand and continually update technologies in response to our changing needs, are critical to our business.
To serve our customers and operate certain aspects of our business, we depend on data centers and computing infrastructure that is both our own and provided by third party vendors. To the extent applications and data used in our business are hosted by third party vendors at their facilities, we do not control the operation of such facilities or in some cases the hardware and infrastructure within them. Any disruption of, interference with, or inability to keep up with our capacity needs by our third-party data centers or hosted infrastructure partners could interrupt our business operations. In addition, any problems faced by those third-parties with their or our telecommunications network providers, or with the systems by which our telecommunications providers allocate capacity among their customers, including us, could adversely affect the experience of our customers. Our ability to serve our customers also largely depends on the efficient and uninterrupted operation of our own computer information systems and complex production equipment, much of which relies on computer operating systems, residing at our leased facilities. The proper functioning of such systems can be adversely affected by the increasing age and usage of such systems, among other things. Any interruption in our business applications, systems or networks, including due to new system implementations, server downtime, failure to upgrade or patch software, facility issues, natural disasters or energy disruptions, could have a material adverse impact on our operations, sales and operating results. Additionally, we have a limited number of employees with the expertise required to operate such internal applications, systems and networks as well as remediate them in the event of a failure, and thus the attrition of such employees could result in our inability to quickly and effectively resolve future IT issues.
We could suffer damage to our brand and reputation in the event of a system outage or data loss or interruption and also be liable to third parties, including our customers. Some of our contractual agreements require the payment of penalties if our systems do not meet certain operating standards, and failure to operate in accordance with the standards of one or more of the Payment Card Brands could result in a loss of compliance of our facilities, any of which could have a material adverse effect on our business.
Table of Contents
In addition, to successfully operate our business, we must be able to protect our processing and other systems from interruption, including from events that may be beyond our control. Protective measures we have established for continuation of core business operations in the event of a catastrophic event may be insufficient to prevent or limit the damage from any future disruptions, and any such disruption could have a material adverse effect on our business, financial condition and results of operations.
We may experience software defects, which could harm our business and reputation and expose us to potential liability.
The sophisticated software and computing systems underlying our services may contain undetected errors or defects when first introduced or when new versions are released. In addition, we may experience difficulties in installing or integrating our technology on systems used by our customers. Defects in our software, errors or delays in the processing of digital transactions or other difficulties could result in the interruption of business operations, delays in market acceptance, additional development and remediation costs, diversion of technical and other resources, loss of customers, negative publicity or exposure to liability claims, any of which could have a material adverse effect on our business, financial condition and results of operations.
Disruptions in production at one or more of our facilities may have a material adverse impact on our business, results of operations and/or financial condition.
Any serious disruption at any of our facilities, including as a result of public health emergencies, severe weather conditions, climate change, natural disasters, hostilities, political instability, social unrest, network outages, or terrorist activities could impair our ability to use our facilities and have a material adverse impact on our revenues and increase our costs. In the event of a disruption at one of our facilities, our other facilities may not have sufficient capacity or necessary specialized equipment, may have higher production costs, may take significant time to increase production or may fail to meet our customers’ requirements, any of which could negatively impact our business, results of operations and financial condition. Production disruptions may cause our customers to seek alternative supply, which could further adversely affect our profitability.
Additionally, all of our production facilities are currently leased, and we are subject to risks associated with our current and future real estate leases. As each lease expires, we may fail to negotiate renewals, either on commercially acceptable terms or at all, we may be unable to find replacement locations with adequate capacity for our unique equipment and both current and future operational needs, and we may experience disruption or significant cost in relocating, any of which could have an adverse effect on our operations, customer relationships and financial performance.
Our business could suffer from problems in production quality, materials and process, which could reduce, delay or interrupt production of our products, resulting in adverse impacts to our business and financial results.
Our production processes are highly complex, require complex and costly equipment and must continually be modified to improve yields and performance. We may experience production difficulties due to machinery or technology failures, human or other errors, or because of external factors beyond our control, such as delay of, or quality issues with, materials provided by suppliers, interruption of our electrical service or a natural disaster, any of which can reduce product yields or quality, or interrupt production. We may not have adequate and timely replacements for failing or malfunctioning machinery available. Additionally, we have experienced malfunctions and errors, including human error, relating to the operation of certain production machinery and systems that, in some instances, have resulted in the delivery to our customers of products that did not meet their standards or specifications or failed to function in the marketplace. Such problems have resulted, and may in the future result, in our inability to properly fulfill customer orders and/or our obligation or election to replace products at our cost and expense, provide credit to or reimburse customers for related damages. We may also be subject to claims relating to such issues.
Table of Contents
As the complexity of both our products and our technological processes has become more advanced, production tolerances have been reduced and requirements for precision have become more demanding. If we do not advance our production processes at the market rate, we may experience lower production quality than the market standard. We may also risk non-compliance with certain industry standards if we experience failure of certain required operations or processes, such as those related to facility security, which may impede our ability to deliver products to our customers. The occurrence of any of these risks could damage our reputation and result in the loss of business, which could have an adverse impact on our business, financial condition and results of operations.
Costs relating to product defects, and any related product liability and warranty claims may materially adversely affect our business.
We offer highly complex services and products and, accordingly, from time to time, defects have occurred. Such defects can give rise to significant costs, including relating to recalling products, replacing defective items, writing down defective inventory, the loss of potential sales and claims by third parties, and our reputation could suffer. In addition, the occurrence of such defects may give rise to product liability and warranty claims, including liability for damages. We may also incur liability for damages claims from customers in excess of the amounts they pay us for our products, including consequential damages. In addition, our customers may recall their products if they are defective or make compensatory payments in accordance with industry or business practice or to maintain good customer relationships. If such a recall or payment is caused by a defect in one of our products, our customers may seek to recover all or a portion of their losses from us. If any of these risks materialize, there could be a material adverse effect on our business, financial condition and results of operations.
The failure to effectively recruit, retain and develop qualified personnel and implement effective succession processes could adversely affect our success and could have a material adverse effect on our business, financial condition and results of operations.
Our business functions are complex and require wide-ranging expertise and intellectual capital. If we fail to recruit, retain and develop personnel who can provide the needed expertise across the entire spectrum of our operating and intellectual capital needs, including due to leadership changes, then the ability of our business to successfully compete and grow may be adversely affected. The market for qualified personnel is highly competitive and we have previously experienced labor availability issues in several of our facilities. This shortage of labor has resulted, and may in the future result, in increased compensation and recruiting expenses which could have a material adverse effect on our profitability, particularly if we are unable to pass all such expenses on to our customers or are limited in our ability to find suitable workers.
In addition, we rely, in part, on the accumulated knowledge, skills and experience of our key personnel, including our executive officers. The loss of the services of any of our key personnel could have a material adverse effect on our business, financial condition and results of operations because we may not be able to replace them on a timely basis or without incurring increased costs, or at all. We may not succeed in recruiting sufficient personnel to support our production needs or may fail to effectively replace current personnel who depart with qualified or effective successors. Personnel shortages have resulted, and may in the future result, in extended production lead times and difficulty in meeting customers’ delivery expectations, which could result in the loss of customers and damage to our reputation and have a material adverse effect on our business, financial condition and results of operations.
The covenants and restrictions contained in agreements governing our indebtedness may adversely affect our business and results of operations, may restrict our ability to grow and could make it difficult or impossible to timely make our debt service payments or refinance our debt when it comes due.
We maintain a substantial amount of debt, and we may incur additional debt in the future to help fund our business. The agreements governing our indebtedness do not fully prohibit us or our subsidiaries from incurring additional indebtedness in the future, and to the extent that we incur additional indebtedness, the risks associated with our substantial indebtedness described below, including our possible inability to service our debt, may increase. Our substantial indebtedness and interest expense could have important consequences to us, including:
Table of Contents
limiting our ability to use significant cash flow from operations in other areas of our business, including for working capital, research and development, expanding our infrastructure, capital expenditures and other general business activities and investment opportunities in our company, because we must dedicate a substantial portion of these funds to pay interest, make principal payments and/or otherwise service our debt;
impacting our cash flows, results of operations and financial condition when interest rates rise, because the interest rate on our revolving credit facility is a floating rate that varies depending on market interest rates and issuance or refinancing of other debt in the future may be incurred at higher interest rates than current debt;
limiting our ability to retain or attract customers and our ability to attract or retain qualified employees due to our significant amount of debt and the related implications of such debt for the Company’s long-term financial condition;
limiting our ability to obtain additional financing in the future for working capital, capital expenditures, debt service requirements, acquisitions and the execution of our strategy, and other expenses or investments planned by us;
limiting our flexibility and our ability to capitalize on business opportunities and to react to competitive pressures and adverse changes in government regulation, our business and our industry;
limiting our ability to timely make our debt service payments or to satisfy our other obligations under our indebtedness (which could result in an event of default and acceleration if we fail to comply with the requirements of our indebtedness);
limiting our ability, or increasing the costs, to refinance indebtedness prior to maturity dates;
increasing our vulnerability to a downturn in our business and to adverse economic and industry conditions generally; and
placing us at a competitive disadvantage as compared to our competitors that are less leveraged.
Additionally, the terms of the agreements governing our indebtedness restrict, and any additional indebtedness we may incur in the future could similarly restrict, our ability to operate our business and to pursue our business strategies. Among other things, these agreements restrict our ability to do the following (in each case, subject to a number of important exceptions and qualifications as set forth in the respective agreements):
incur additional indebtedness;
create liens or use assets as security in other transactions;
enter into certain asset sale transactions or other dispositions of assets;
declare or pay dividends, repurchase or redeem stock, or make other distributions to stockholders;
make investments in other businesses or joint ventures;
merge or consolidate, or sell, transfer, lease or dispose of substantially all of our assets; and
enter into transactions with affiliates.
If we are unable to generate or borrow sufficient cash to make payments on our indebtedness, our financial condition could be materially harmed. We may not be able to refinance our existing long-term debt if necessary, or we may only be able to do so at a higher interest rate or on other less favorable terms.
Our ability to repay or refinance our borrowings will depend on our financial and operating performance, which will be affected by economic, financial, competitive, business and other factors, some of which are beyond our control. We cannot guarantee that our business will generate sufficient cash flow from operations to service our indebtedness or to fund our other liquidity needs. If we are unable to meet our debt obligations or fund our other liquidity needs, we may need to restructure or refinance all or a portion of our indebtedness on or before maturity or sell certain of our assets. In 2024, we refinanced our existing indebtedness that was due to mature in March 2026, and extended our maturity dates for both our long-term debt and senior secured revolving credit facility. Amounts borrowed and outstanding under our long-term debt agreement and credit facility are required to be repaid in full, together with any accrued and unpaid interest, no later than July 15, 2029 (and may be subject to earlier mandatory prepayment upon certain events). We cannot guarantee that we will be able to restructure or refinance any of our indebtedness on commercially reasonable terms, if at all, which could cause us to default on our debt obligations and impair our liquidity. Further, any renewal or refinancing may occur on less favorable terms for both the long-term debt and credit facility. If we refinance on terms less favorable to us than the current terms, our interest expense may increase significantly, which could impact our results of operations and impair our ability to use our funds for other purposes.
Table of Contents
We may not be able to successfully execute our acquisition strategy or integrate acquisitions or strategic investments successfully, or successfully enter into, maintain and leverage business relationships, which could adversely affect our financial condition and results of operations.
We have sought and intend to continue to seek acquisition opportunities, strategic investments, and business relationships to potentially expand into new markets and to enhance our position in existing markets. We may not be able to successfully identify suitable acquisition or relationship opportunities, prevail against competing potential acquirers or business partners, negotiate appropriate acquisition terms, obtain financing that may be needed, extend our product or service offerings into areas in which we have limited experience, enter into new geographic markets, complete proposed acquisitions or successfully integrate acquired businesses into our existing operations. Regularly considering strategic acquisitions, investments, or relationships can also divert management’s attention from other business concerns and lead to significant negotiation, due diligence and other expenses, regardless of whether we pursue or consummate any transaction or arrangement. Even if an acquisition, investment, or business partnership is successfully integrated, it could result in unforeseen liabilities, cause us to lose key employees or other business relationships or may not otherwise perform as planned. If any of these or other factors limit our ability to achieve the anticipated benefits of a transaction or relationship, or if we encounter other unexpected costs and liabilities in connection with the foregoing, our business, financial condition and results of operations could be materially and adversely affected.
We may not realize the potential benefits from the acquisition of Arroweye because of difficulties related to integration, the achievement of synergies and other challenges.
We completed the acquisition of Arroweye on May 6, 2025. Prior to the completion of the acquisition, we and Arroweye operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the full achievement of substantial benefits. If we are not able to successfully complete the integration of Arroweye’s business with ours, the anticipated benefits of the acquisition may not be realized fully or may take longer than expected to be realized. Specifically, the following issues, among others, must be addressed in combining Arroweye’s operations with ours in order to realize the anticipated benefits of the acquisition:
combining the companies’ logistics, marketing, and administration methods;
combining Arroweye’s business with our business in a manner that permits us to achieve the synergies anticipated to result from the acquisition, the failure of which would result in the anticipated benefits of the acquisition not being realized in the time frame currently anticipated or at all;
maintaining existing agreements with customers, suppliers and talent and avoiding delays in entering into new agreements with prospective customers, suppliers, and talent;
addressing differences in corporate cultures and management philosophies;
integrating the companies’ administrative and information technology infrastructure;
developing products and technology that allow value to be unlocked in the future;
ensuring the effectiveness of Arroweye’s internal control over financial reporting; and
evaluating and forecasting the financial impact of the acquisition transaction, including accounting charges.
In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day-to-day business operations, which may disrupt our ongoing business and the business of the combined company. We have incurred, and may continue to incur, significant, non-recurring costs in connection with the acquisition and integrating the operations of CPI and Arroweye. Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the near term or at all.
Table of Contents
We may not be able to sell, exit or reconfigure businesses or facilities that we determine no longer are aligned with our strategy or that should be consolidated.
In executing our strategy, we have consolidated certain of our facilities and divested certain of our businesses. We will continue to evaluate such opportunities.
We may not be able to sell non-strategic businesses on terms that are acceptable to us, or at all. In addition, if the sale of any non-strategic business cannot be consummated or is not practical, alternative courses of action, including relocation of operations or closure, may not be available to us or may be more costly than anticipated. Any such consolidation or divestiture could adversely affect our continuing business and expenses, revenues, results of operations, cash flows and financial position.
We are considered an accelerated filer and are required to comply with the Sarbanes-Oxley Act of 2002, and our inability to maintain effective internal control over financial reporting in the future could result in investors losing confidence in the accuracy and completeness of our financial reports and negatively affect the market price of our common stock.
As a public company, we are required to maintain internal control over financial reporting and to report any material weaknesses in such internal controls. The Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) requires our independent registered public accounting firm to attest to the effectiveness of our internal control over financial reporting. The costs associated with compliance with these and future laws and related rules and interpretations could have a material impact on our results of operations.
Management has assessed the effectiveness of the Company’s internal control over financial reporting. See Item 9A – Controls and Procedures – Management’s Report on Internal Control over Financial Reporting. We have identified material weaknesses and significant deficiencies in our internal controls in the past and we may identify additional material weaknesses or significant deficiencies in the future. If any such control deficiencies occur in the future, we may not detect errors on a timely basis, our financial statements may be materially misstated, investors may lose confidence in the accuracy and completeness of our financial reports and we may be unable to timely produce our financial reports. Any of the foregoing could negatively affect the market price of our common stock, perhaps significantly. In addition, we could become subject to investigations by any stock exchange on which our securities are listed, the SEC or other regulatory authorities, or litigation or disputes with stockholders, which could require additional financial and management resources and result in more costly directors’ and officers’ insurance, which could have an adverse impact on our business.
Expectations of stakeholders relating to environmental, social and governance matters may impose additional costs and expose us to new risks as well as have an adverse effect on our business, financial condition, results of operations, and cash flows.
Many investors, regulators, customers, employees and other stakeholders are increasingly focused on corporate responsibility and ESG matters. Some investors may use these factors to guide their investment strategies and may choose not to invest in the Company if they believe our ESG practices or assessment performance are inadequate, which may hinder our access to capital. In addition to the topics typically considered in such assessments, for card production companies, issues of emissions and plastic waste are of particular importance. For example, increased attention to conservation measures and negative consumer attitudes about plastic products or other components in our products could have an adverse impact on demand for our products.
There have also been changing consumer concerns and perceptions (whether accurate or inaccurate) regarding the potentially adverse environmental effects or sourcing of certain substances and components the Company uses in its products, including PVC plastic. We may be unable to produce or procure our products in conformity with these preferences and concerns, or doing so may require significant research and development costs, increased costs to procure alternative raw materials and components, and additional capital expenditures.
Table of Contents
Furthermore, customer, investor and consumer ESG expectations have been varied, rapidly evolving and increasing. Specifically, certain customers are beginning to request that the Company provide information on its plans relating to certain environmental matters such as greenhouse gas (“GHG”) emissions, waste sent to landfills and energy usage. The enhanced stakeholder focus on ESG issues requires the continuous monitoring of various and evolving standards, which is time consuming and costly. In addition, if we communicate certain ESG initiatives or goals, we could fail, or be perceived to fail, to meet them, or we could be criticized for the scope of such initiatives or goals or our approach to meeting those goals.
Additionally, future ESG and climate risk reporting requirements may result in additional costs to monitor, track and report sustainability measures. The failure to implement ESG strategies, meet our ESG goals or evolving stakeholder expectations or standards or comply with any new ESG-related laws, regulations or restrictions could adversely affect our business, financial condition, results of operations and cash flows.
Damage to our reputation or brand image can adversely affect our business.
Our reputation forms the foundation of our relationships with key stakeholders and other constituencies, including employees, consumers, customers and suppliers, and maintaining a positive reputation globally is critical to the successful operation of our business. Negative publicity surrounding us, our activities, our personnel or our business partners, consumer perception of our response to political and social issues or catastrophic events, and campaigns by activists, whether or not warranted, connecting us, our personnel, our supply chain or our business partners to a failure to maintain high ethical, business and environmental, social and governance practices, including with respect to human rights, workplace conditions and employee health and safety, whether actual or perceived, could adversely impact our reputation and brand image and may decrease demand for our products, thereby adversely affecting our business, results of operations, cash flows or financial condition.
We may be unable to adequately protect our trade secrets and intellectual property rights against misappropriation or infringement, which may have a material adverse effect on our business.
Our ability to protect our intellectual property is important to our business. We depend on patents and other intellectual property rights to protect our products, proprietary designs and technological processes against misappropriation by others. Our existing or future patents may be challenged, invalidated or circumvented. Our patents have been and may in the future be challenged as invalid. Furthermore, we may have difficulty obtaining additional patents and other intellectual property protections in the future. The patents and intellectual property rights that we receive may be insufficient to provide us with meaningful protection or commercial advantage. Moreover, effective patent, trademark, service mark, copyright and trade secret protection may not be available in every country in which we provide services or sell or license products.
Our efforts to prevent the misappropriation or infringement of our intellectual property or the intellectual property of our customers may not succeed. We actively seek to protect our proprietary rights and trade secrets by engaging in litigation and by entering into confidentiality agreements with our employees, consultants, and strategic partners and controlling access to and distribution of our technologies, documentation and other proprietary information. Nevertheless, unauthorized parties may attempt to copy aspects of our products or technologies or to obtain and use information that we regard as proprietary and may use such information to interfere with our business. Enforcing our intellectual property rights has in the past caused and may in the future cause us to incur significant costs. These costs and other consequences from the unauthorized use of our intellectual property could have a material adverse effect on our business, financial condition and results of operations.
Table of Contents
Companies in our industry aggressively protect their intellectual property rights. Our products often contain technology provided to us by other parties such as suppliers or customers, and we compete in an industry that is highly active in generating intellectual property. We may have little or no ability to determine in advance whether such technology infringes the intellectual property rights of a third party. From time to time, we receive notices or are named in litigation that claim we have infringed upon, misappropriated or misused other parties’ proprietary rights or that challenge the validity of our patents. In addition to the costs and distraction that result from intellectual property litigation and infringement claims, an adverse outcome in these types of disputes could prevent us from offering some of our products and related services or from enforcing our intellectual property rights. Settlements can involve royalty or other payments that could reduce our profit margins and may have a material adverse effect on our financial results. Our suppliers, customers and licensors may not be required to fully indemnify us for the costs of defending against infringement claims. In addition, we may be required to indemnify some customers and strategic partners related to allegations, regardless of merit, that our products infringe on the intellectual property rights of others.
We also face risks related to open-source software. Certain of our software is derived from open-source software, which is generally made available to the public by its authors and/or other third parties. Open-source software is often made available under licenses, which impose certain obligations in the event we distribute derivative works of the open-source software. These obligations may require us to make source code for the derivative works available to the public and/or license such derivative works on terms different from those customarily used to protect our intellectual property and we may incur additional costs to the extent we use open-source software that is subject to licensing. With respect to our proprietary software, we generally license such software under terms that prohibit combining it with open-source software. Despite these restrictions, parties may combine our proprietary software with open-source software without our authorization, in which case we might nonetheless be required to release the source code of our proprietary software. Usage of open-source software can lead to greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties, controls on the origin or development of the software or remedies against the licensors. Many of the risks associated with open-source software cannot be eliminated and could have a material adverse effect on our business, financial condition and results of operations.
In addition, the rise of artificial intelligence and machine learning technologies may expose us to increasing risk with regard to both protecting our intellectual property and defending against misappropriation claims. Such technologies are imperfect and the use of artificial intelligence or machine learning technologies by us, our customers or parties with whom we conduct business, and by unrelated third parties could inadvertently cause us to infringe upon other parties’ intellectual property ownership or rights or could alternatively infringe upon our intellectual property rights. As a result, we may be subject to claims we have infringed upon, misappropriated or misused other parties’ intellectual property. We may also have to resort to litigation to enforce our intellectual property rights, either of which could result in substantial costs and diversion of our resources.
We rely on licensing arrangements in production and other fields, and actions taken by any of our licensing partners could have a material adverse effect on our business.
Many of our products integrate third-party technologies that we license or otherwise obtain the right to use, including software relating to smart card operating systems. As part of our strategy, we have entered into licensing agreements with other leading industry participants that provide us with access to technology owned by third parties. For example, we license card technology for use in certain of our products, and we rely on our commercial arrangements with the licensors of such technology for the continued use of these platforms. These licensors may not continue to renew their licenses with us on similar terms or at all, which could negatively impact our revenue. We have also entered into cross-licensing agreements with certain of our competitors that provide for an exchange of intellectual property, including the sharing of certain patent rights in our respective portfolios, and we continue to do so as we pursue additional growth initiatives. If we are unable to enter into new cross-licensing agreements or continue to successfully renew existing cross-licensing agreements, we may lose our access to certain technologies that we rely upon to develop certain of our products and or be forced to cease or delay certain growth initiatives, which could have a material adverse effect on our business.
Table of Contents
Our ability to raise capital in the future may be limited, which could lead to delays in innovation and abandonment of our strategic initiatives.
In the future, we may need to raise additional funds through the issuance of new equity securities, debt or a combination of both. The terms of our outstanding indebtedness and the low trading volume and fluctuating trading price of our common stock may adversely affect our ability to access capital markets, and any such financing may not be available on favorable terms, or at all. If adequate funds are not available on acceptable terms, we may be unable to fund our capital requirements. We may be unable to access capital due to unfavorable market conditions or other market factors outside of our control, and we may not be able to raise additional capital when needed. Any failure to achieve adequate funding will delay our products and related services innovation and development and could lead to abandonment of one or more of our strategic initiatives. Any of these events could materially harm our business, financial condition and prospects.
We may become subject to additional tax collection obligations, claims for uncollected amounts, and assessments from unclaimed property audits, new U.S. tax legislation could expose us to additional liabilities and our income tax positions or unclaimed property practices may be challenged by relevant authorities, all of which could adversely affect our cash flows and financial results.
We are required to collect and remit sales tax in multiple U.S. states. Changes in a state’s economic “nexus” laws or sales tax rates could result in additional tax expenses in the event we are unable to pass these expenses along to our customers and additional administrative burden to collect and remit sales tax in such jurisdictions.
In addition, we are subject to U.S. federal and state income taxes. Our tax receivables may not be realized, and o ur tax expense and the tax positions included in our financial statements, which are subject to estimates, could be impacted by changes in rules or interpretations of existing tax laws and changes in U.S. federal and state tax legislation and tax rates. New legislation may be enacted which could increase income tax rates in jurisdictions where we operate or have nexus and materially impact our tax provision, cash tax liability and effective tax rate. Additionally, o ur income tax positions may be challenged by relevant tax authorities and we may not be successful in defending against any such challenge, which may adversely affect our future cash flows and financial results.
We are also subject to unclaimed property (escheat) laws in various states which require us to turn over to certain government authorities the property of others held by us that has been unclaimed for a specified period of time. We are subject to audit by individual U.S. states with regard to our escheatment practices. Such audits may cause us to incur significant costs related to outside professional fees and divert management’s time away from business operations. Additionally, we may be subject to assessments, penalties or fines that could adversely affect our financial results. The legislation and regulations related to tax and unclaimed property matters tend to be complex and subject to varying interpretations by both government authorities and taxpayers.
Our long-lived assets represent a significant portion of our total assets, and we may never realize their full value.
Our long-lived assets recorded as of December 31, 2025 include $108.4 million of plant, equipment, leasehold improvements and operating lease right-of-use assets, $18.5 million of net intangible assets, and $48.8 million of goodwill.
We perform goodwill impairment testing on an annual basis as of October 1 of each year. Other long-lived assets, such as identifiable intangible assets and plant, equipment and leasehold improvements are reviewed for impairment whenever events, changes or circumstances indicate that the carrying amount of an asset or asset group may not be recoverable. If we were to conclude that a future write-down of our long-lived assets is necessary, we would have to record the appropriate charge, which could result in a material adverse effect on our results of operations. A write-down of our long-lived assets may result from, among other things, deterioration in our performance and a decline in expected future cash flows and could have a material adverse effect on our business, financial condition and results of operations.
Table of Contents
Current and prospective regulations, changes in our product offerings and customer contractual requirements addressing consumer privacy and data use and security could increase our costs of operations, increase the risk of regulatory enforcement, or claims, which could adversely affect our operations, results of operations and financial condition.
In operating a payment card business, we manage large amounts of personally identifiable information of cardholders, including cardholder names, account numbers, healthcare provider names and health savings account numbers, and similar information and are thus subject to laws and requirements relating to data privacy and security, which continue to evolve and may become increasingly difficult to comply with. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, imposes obligations on companies like ours, which process consumer personal information on behalf of their customers, including to use, retain or disclose consumer personal information solely for certain limited purposes, including to provide services to our customers according to the terms of our customer contracts. Other states have enacted or amended similar data privacy laws and regulations. Furthermore, to the extent these laws apply to our customers, our customers have imposed, and may continue to impose additional, privacy related contractual obligations on us, adherence to which may require additional investment in resources and internal processes. Additionally, as we continue to innovate our products and related services offerings, including potentially leveraging the use of artificial intelligence and machine learning capabilities, and expand into new lines of business, and as the number of jurisdictions enacting privacy and related laws increases and the scope of these laws and enforcement efforts expand, we have and may continue to become subject to additional data privacy and security legal requirements and regulations. The legal, political and business environments in these areas are rapidly changing, and subsequent legislation, regulation, litigation, court rulings or other events could expose the Company to increased program costs, liability and reputational damage. New products and related services we develop may also require that we obtain and retain more personally identifiable information for a longer period of time than we have done historically. We have incurred significant expenses to meet the obligations of current privacy-related laws and requirements, and we expect to continue to incur these as well as additional expenses if we become subject to additional privacy-related laws and regulations, which will continue to necessitate us making changes to our internal processes, procedures and systems. Failure to comply with existing or future data privacy and security laws, regulations and requirements could result in fines, sanctions, penalties, civil lawsuits or other adverse consequences as well as loss of customer and consumer confidence, which could materially adversely affect our results of operations, overall business and reputation.
Our failure to operate our business in accordance with the standards of the PCI Security Standards Council or other industry standards applicable to our customers, such as Payment Card Brands compliance standards, could have a material adverse effect on our business.
Many of our customers issue their cards on the networks of the Payment Card Brands that are subject to the standards of the PCI Security Standards Council or other standards and criteria relating to service providers’ and producers’ facilities, products and physical and logical security which we must satisfy to be eligible to supply products and related services to such customers. Most of our contractual arrangements with our customers may be terminated, or customers may cease doing business with us, if we fail to comply with these standards and criteria.
We make significant investments in our high-security facilities to meet these standards and criteria and changes in them. Further investments may be costly, and if we are unable to continue to meet these standards and criteria, we may become ineligible to provide products and related services that have been an important part of our revenue and profitability. For the year ended December 31, 2025, the vast majority of our products and related services were subject to compliance with the standards of one or more of the Payment Card Brands. If we fail to comply with one or more of the standards of the Payment Card Brands or of the PCI Security Standards Council for one or more of our facilities, we may lose the ability to produce cards for or provide services to banks issuing credit or debit cards on the Payment Card Brand networks. Additionally, certain of our facilities operate under variances of certain of these standards. If such variances are not granted in the future or if we are required to move or alter a facility in order to maintain compliance, we may incur significant costs and delays, or may lose our ability to offer services in that facility, which would be disruptive to our business and have an adverse effect on our customer relationships and financial results. If, as a result of noncompliance with standards of the PCI Security Standards Council or the Payment Card Brands, we are not able to produce cards for or provide services to any or all of the issuers issuing debit or credit cards on such networks, we could lose a substantial number of our customers, which could have a material adverse effect on our business, financial condition and results of operations.
Table of Contents
Prolonged military action in foreign conflicts has impacted and may continue to have adverse effects on the global economy, and such effects could materially adversely affect our business, operations, operating results and financial condition.
Governments in the United States, United Kingdom and European Union have each imposed export controls on certain products and financial and economic sanctions on certain industry sectors and parties in Russia due to the Russia-Ukraine war. Additionally, hostilities in several parts of the Middle East are ongoing and could develop to have a more widespread economic and geopolitical effect in the Middle East, Europe or other regions, and could result in economic sanctions between or among countries. The continuation or escalation of geopolitical tensions or military action related to the conflict and the imposition of additional economic sanctions could continue to adversely affect the global economy and financial markets, disrupt trade and accelerate inflationary pressures, among other things, which could negatively affect the demand for our products and further intensify problems in the global supply chain. Although we do not have any operations in the affected areas, we believe we have experienced shortages in raw materials and increased costs for transportation and energy due in part to the negative impact of the foreign military conflicts on the global economy, which impacts may persist or worsen as these conflicts continue or escalate. Such conflicts also increase the risk of retaliatory acts impacting U.S. companies, which may include disruptions to our or our customers’ or suppliers’ technology infrastructure, including through cyberattack, ransom attack or cyber-intrusion. The extent and duration of any military action, sanctions and resulting market and economic disruptions are impossible to predict but could be substantial.
Conditions in the banking system and financial markets, including the failure of banks and financial institutions, could have an adverse effect on our business, financial condition and results of operations.
Events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past led and may in the future lead to market-wide liquidity problems. For example, in March 2023, the Federal Deposit Insurance Corporation took control and was appointed receiver of Silicon Valley Bank and Signature Bank, after each bank was unable to continue its operations. These events exposed vulnerabilities in the banking sector, including uncertainties, significant volatility and contagion risk, any or all of which could have an adverse effect on our business, financial condition and results of operations.
In addition to the market-wide impacts, our reliance on financial institutions and non-traditional financial service providers such as fintechs as our primary customers exposes us to additional risk from adverse events affecting the industry. Certain financial institutions’ failures, the migration of deposits from smaller financial institutions to larger ones due to reduced confidence in or concerns about the stability of smaller financial institutions or non-traditional financial service providers, as well as consumers opening fewer new accounts at these institutions, may impact the quantity and timing of orders for our products. Additionally, uncertainty in the banking sector, as well as broader economic conditions in general, may cause banks and financial institutions to implement precautionary measures such as reducing spending on card programs or being more selective about issuing or renewing cards to customers. Any of the foregoing events could result in lower demand for our products, which in turn could have a material adverse effect on our business, financial condition and results of operations.
Critical vendors, third-party manufacturers or other third parties on which we rely could also be adversely affected by the liquidity and other risks related to bank failures. These could include delayed access to, or the uninsured loss of, deposits or other financial assets and difficulty in accessing commercial financing on acceptable terms or at all due to tightening credit markets, unfavorable covenant terms and higher interest rates. Any third-party bankruptcy or insolvency, or any breach or default by a third party on which we rely, or the loss of any significant supplier relationships, could result in material adverse impacts on our business, financial condition and results of operations.
Table of Contents
Environmental, health and safety laws and regulations, including climate change regulations, expose us to liability and any such liability may have a material adverse effect on our business.
We are subject to environmental, health and safety laws and regulations in each jurisdiction in which we operate. Such regulations govern, among other things, emissions of pollutants into the air, wastewater discharges, waste disposal, the investigation and remediation of soil and groundwater contamination, and the health and safety of our employees. For example, the handling of certain materials and equipment we use in our production processes is subject to health and safety and environmental laws and regulations. We are also required to obtain environmental permits from governmental authorities for certain of our operations. If we violate or fail to comply with these laws, regulations or permits, we could be fined or otherwise sanctioned by regulators.
As with other companies engaged in similar activities or that own or lease real property, we face inherent risks of environmental liability at our current and historical production facilities. Certain environmental laws impose strict and, in certain circumstances, joint and several liabilities on current or previous owners or operators of real property for the cost of the investigation, removal or remediation of hazardous substances as well as liability for related damages to natural resources. In addition, we may discover new facts or conditions that may change our expectations or be faced with changes in environmental laws or their enforcement that would increase our liabilities. Furthermore, our costs of complying with current and future environmental and health and safety laws, or our liabilities arising from past or future releases of, or exposure to, regulated materials, may have a material adverse effect on our business, financial condition and results of operations.
The increasing concern over climate change has resulted in a broad range of proposed and promulgated federal, state and local regulations aimed at mitigating the effects of climate change. Because we use materials in many of our products and engage in production processes that may be the subject of certain of these regulations, if enacted, such regulations could result in additional costs and adverse effects on our business in the form of (i) additional taxes, (ii) potential fines for noncompliance, (iii) restrictions on output, (iv) additional expenditures to either purchase new, or modify existing, equipment or processes, (v) required acquisition or trading of emission allowances and/or (vi) increased costs in the price of energy and/or in procuring alternative or additional raw materials from our suppliers. These developments and further legislation that may be enacted could negatively affect our operations and increase our production costs. Climate change regulation continues to evolve, and while it is not possible to accurately estimate either a timetable for implementation or our future compliance costs relating to implementation, such regulation could have a material adverse effect on our business, results of operations, financial position, capital expenditures and reputation.
Risks Relating to Ownership of our Common Stock
Certain stockholders own a significant percentage of our common stock, and such stockholders may influence major corporate decisions of the Company and our interests may conflict with the interests of other holders of our common stock.
Parallel49 Equity, through management of the Tricor Pacific Capital Partners (Fund IV), Limited Partnership and Tricor Pacific Capital Partners (Fund IV) US, Limited Partnership (collectively, “Parallel49”), formerly our controlling stockholder, owned approximately 24% of our common stock, in the aggregate, as of December 31, 2025. Tricor Pacific Capital Inc. (the “Tricor Family Office”) owned approximately 19% of our common stock, in the aggregate, as of December 31, 2025.
Table of Contents
As a result of their ownership, Parallel49 and the Tricor Family Office, may have the ability to influence the outcome of matters submitted to a vote of all stockholders and, through our Board of Directors, the ability to influence decision-making with respect to our business direction and policies. Matters over which Parallel49 and the Tricor Family Office, directly or indirectly, may exercise influence include the election of directors, approval of business combinations or dispositions and other extraordinary transactions. Parallel49 and the Tricor Family Office may also have interests that differ from the interests of other holders of our securities and may vote in a way that may be adverse to other stockholders’ interests. The concentration of ownership may have the effect of delaying, preventing, or deterring a change of control of the Company, which could materially and adversely affect the market price of our securities.
The concentration of ownership by our significant stockholders and the sale or availability for sale of substantial amounts of our common stock may adversely impact the market price and liquidity of our common stock.
Parallel49 and the Tricor Family Office maintain a significant ownership position in the Company. Continued concentrated ownership could result in a limited number of shares being available to be traded in the market, resulting in reduced liquidity, and historically the price of our common stock has experienced volatility due to the limited number of shares available to trade on the open market.
Additionally, sales of substantial amounts of our common stock in the public market, including sales by our significant stockholders, or the perception that these sales could occur, could adversely affect the market price of our common stock and could materially impair our ability to raise capital through equity offerings in the future. The shares of our common stock held by Parallel49 and the Tricor Family Office may be registered for resale, which means that they may be offered and sold to the public in the future without regard to the volume limitations under Rule 144 of the Securities Act. Parallel49 sold a portion of its shares through an underwriter in 2024, and another portion to the Tricor Family Office in a privately negotiated transaction in 2025. If some or all of the remaining shares are sold by Parallel49 or the participants in their funds or the Tricor Family Office, either through sale on the open market, through privately negotiated transactions or through a distribution to the participants in their funds, or if it is perceived that they will be sold, the market price of our common stock could decline.
Conflicts of interest may arise because directors who are principals of or who were nominated by our significant stockholders serve on our Board of Directors.
We are party to separate director nomination agreements with Parallel49 (the “Parallel49 Director Nomination Agreement”) and the Tricor Family Office (the “Tricor Family Office Director Nomination Agreement” and together with the Parallel49 Director Nomination Agreement, the “Director Nomination Agreements”). Three members of our Board of Directors, Nicholas Peters, who is an officer of Parallel49 (and its predecessor), H. Sanford Riley, and Lisa Oleson, who is the Chief Financial Officer of the Tricor Family Office, each were nominated to serve on our Board of Directors by Parallel49 pursuant to the Parallel49 Director Nomination Agreement. Subject to certain limitations, the Director Nomination Agreements grant Parallel49 and the Tricor Family Office the right to nominate a certain number of individuals to our Board of Directors based on their percentage ownership of our common stock.
Parallel49, the Tricor Family Office, and entities controlled by each may in the future hold equity interests in entities that directly or indirectly compete with us, and companies in which it currently invests may begin directly or indirectly competing with us. As a result, when conflicts between the interests of Parallel49 or the Tricor Family Office, on the one hand, and of our other stockholders, on the other hand, arise, such directors may not be disinterested. Although our directors and officers have a duty of loyalty to the Company under Delaware law and our Amended and Restated Certificate of Incorporation, transactions that we enter into in which a director or officer has a conflict of interest are generally permissible so long as (1) the material facts relating to the director’s or officer’s relationship or interest as to the transaction are disclosed to our Board of Directors and a majority of our disinterested directors approves the transaction, (2) the material facts relating to the director’s or officer’s relationship or interest as to the transaction are disclosed to our stockholders and a majority of our disinterested stockholders approve the transaction or (3) the transaction is otherwise fair to us. Our Amended and Restated Certificate of Incorporation also provides that any principal, officer, member, manager and/or employee of Parallel49 or any entity that controls, is controlled by or under common control with Parallel49 (other than any company that is controlled by us) or any investment funds managed by Parallel49 will not be required to offer any transaction opportunity of which such person becomes aware to us and could take any such opportunity for himself, herself or itself or offer such opportunity to other companies in which such person has an investment, unless such opportunity is offered to such person solely in his, her or its capacity as one of our directors.
Table of Contents
Securities analysts may publish unfavorable research or reports about our business or may not publish at all, which could cause our stock price or trading volume to decline.
The trading market for our common stock could be influenced to some extent by the research and reports that industry or financial analysts publish about the Company and our business. We do not control these analysts. Historically, we have not attracted substantial research coverage, and the current or future analysts who publish information about our common stock may have relatively little experience with us, which could affect their ability to accurately forecast our results and could make it more likely that we fail to meet their estimates. If one or more of these analysts provide inaccurate or unfavorable research, issue an adverse opinion regarding our stock price, cease coverage of us or fail to publish reports covering us regularly, we could lose visibility in the market, which in turn could cause our stock price or trading volume to decline.
Our business and operations could be negatively affected by stockholder activism and securities litigation.
Stockholder activism, which could take many forms or arise in a variety of situations, has become increasingly prevalent in recent years. Previously, a stockholder in the Company publicly expressed criticism regarding the Company’s strategic direction, capital allocation priorities and corporate governance in connection with an attempt to nominate a director candidate at our 2023 annual meeting of stockholders. We could also face similar criticism from others, and may be more prone to stockholder activist demands if and when Parallel49 or the Tricor Family Office reduces ownership in the Company. Additionally, we have in the past been subject to actual and threatened securities litigation following volatility in the price of our common stock, and may again be subject to securities litigation, including as a result of the volatility in the price of our common stock, related to stockholder activism, or otherwise.
Stockholder activism, including potential proxy contests and advance stockholder proposals, and securities litigation could result in substantial costs and divert management’s and our Board of Directors’ attention and resources from our business. Additionally, stockholder activism or securities litigation could give rise to perceived uncertainties as to our future, adversely affect our relationships with customers and make it more difficult to attract and retain qualified personnel. These matters could also hinder the execution of our business and growth strategies or constrain our capital deployment opportunities. Further, the price of our common stock could be subject to significant fluctuation or otherwise be adversely affected. Any adverse determination in litigation could also subject us to significant liabilities.
Certain provisions of our organizational documents and other contractual provisions may make it difficult for stockholders to change the composition of our Board of Directors and may discourage hostile takeover attempts that some of our stockholders may consider to be beneficial.
Certain provisions of our Amended and Restated Certificate of Incorporation and Amended and Restated By-laws may have the effect of delaying or preventing changes in control if our Board of Directors determines that such changes in control are not in the best interests of us and our stockholders. The provisions in our Amended and Restated Certificate of Incorporation and Amended and Restated By-laws include, among other things, the following:
the ability of our Board of Directors to issue shares of preferred stock and to determine the price and other terms, including preferences and voting rights, of those shares without stockholder approval;
stockholder action may only be taken at a special or regular meeting and not by written consent, and special meetings may only be called by a majority of the total number of directors that we would have if there were no vacancies on our Board of Directors;
advance notice procedures and information and disclosure requirements for nominating candidates to our Board of Directors or presenting matters at stockholder meetings; and
allowing only our Board of Directors to fill vacancies on our Board of Directors.
Table of Contents
We have entered into the Parallel49 Director Nomination Agreement that provides Parallel49 the right to designate nominees for election to our Board of Directors for so long as Parallel49 collectively beneficially owns 5% or more of the total number of shares of our common stock then outstanding. We have also entered the Tricor Family Office Director Nomination Agreement that provides the Tricor Family Office the right to nominate individuals for election to the Company’s Board of Directors for so long as the Tricor Family Office beneficially owns 10% or more of the total number of shares of our common stock then outstanding. The number of nominees that Parallel49 is entitled to designate under the Parallel49 Director Nomination Agreement bears the same proportion to the total number of members of our Board of Directors as the number of shares of common stock beneficially owned by Parallel49 bears to the total number of shares of common stock outstanding, rounded up to the nearest whole number. The number of directors that the Tricor Family Office is entitled to nominate under the Tricor Family Office Director Nomination Agreement is based on the percentage of the outstanding common stock over which the Tricor Family Office and Parallel49 collectively have direct voting control in relation to the total number of directors then serving on the Board, limited by the greater of the number of directors that Parallel49 is then entitled to nominate or has serving on the Board pursuant to the Parallel49 Director Nomination Rights Agreement. In addition, Parallel49 and the Tricor Family Office are entitled to designate or nominate the replacement for any of its board designees whose board service terminates prior to the end of such designee’s term. Parallel49 and the Tricor Family Office, subject to certain limitations, also have the right to have their designees participate on committees of our Board of Directors, subject to compliance with applicable law and stock exchange rules.
We have elected in our Amended and Restated Certificate of Incorporation not to be subject to Section 203 of the Delaware General Corporation Law, an anti-takeover law. In general, Section 203 prohibits a publicly held Delaware corporation from engaging in a business combination, such as a merger, with a person or group owning 15% or more of the corporation’s voting stock for a period of three years following the date the person became an interested stockholder, unless (with certain exceptions) the business combination or the transaction in which the person became an interested stockholder is approved in a prescribed manner. Accordingly, we will not be subject to any anti-takeover effects of Section 203. However, our Amended and Restated Certificate of Incorporation contains provisions that have the same effect as Section 203, except that they provide that Parallel49, their affiliates (including any investment funds managed by Parallel49) and any person that becomes an interested stockholder as a result of a transfer of 5% or more of our voting stock by the forgoing persons to such person are excluded from the “interested stockholder” definition in our Amended and Restated Certificate of Incorporation and are therefore not subject to the restrictions set forth therein that have the same effect as Section 203.
While these provisions have the effect of encouraging persons seeking to acquire control of the Company to negotiate with our Board of Directors, they could enable the Board of Directors to hinder or frustrate a transaction that some, or a majority, of our stockholders might believe to be in their best interests and, in that case, may prevent or discourage attempts to remove and replace incumbent directors. In addition, the potential issuance of preferred stock may delay or prevent a change in control of us or discourage bids for our common stock at a premium over the market price. It may also adversely affect the market price and the voting and other rights of the holders of our common stock as it could be issued with voting, liquidation, dividend and other rights superior to the rights of our common stock.
In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our Board of Directors, which is responsible for appointing the members of our management.
Table of Contents
General Risk Factors
We are required to comply with complex laws and regulations in the United States and other countries and are exposed to business risks associated with our international business. Moreover, changes in such laws could occur at any time and could impact us in significantly negative ways that we are unable to predict or protect against.
We are subject to numerous evolving and complex laws and regulations which apply, among other things, to financial reporting standards, corporate governance, data privacy, tax, unclaimed property, trade regulations, environmental regulations and permit requirements, export controls, competitive practices, and labor and health and safety laws and regulations in each jurisdiction in which we operate. Though we currently have limited international operations, the expansion thereof in the future may increasingly expose us to risks associated with international business operations, including political instability (e.g., the threat of or actual war, terrorist attacks or civil unrest), inconsistent regulations across jurisdictions, unanticipated changes in the regulatory environment, and import and export restrictions. We may not be in full compliance at all times with the laws and regulations to which we are subject and we may not have obtained the permits, authorizations or licenses that we need. Any failure to comply with applicable laws or regulations could result in fines or sanctions. In such a case, or if any of these international business risks were to materialize, there could be a material adverse effect on our business, financial condition and results of operations.
Our business and financial results may be materially adversely affected by various legal and regulatory proceedings.
We are subject to legal proceedings, lawsuits and other claims in the normal course of business and could become subject to additional claims in the future, some of which could be material. A future adverse ruling, settlement or unfavorable development could result in charges that could have a material adverse effect on our business, operating results or financial condition. In addition, litigation can be costly, and the expenses and damages arising from any liability could harm our business. Furthermore, our insurance may not be adequate to cover claims against us or any liability that may be imposed on us.
Item 1B.
Unresolved Staff Comment s
None.
Item 1C. Cybersecurity
Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In seeking to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrusted to us, a top priority.
The Board of Directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company , including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled “System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation” included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.
Table of Contents
Risk Management and Strategy
Our policies and processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the frameworks established by the National Institute of Standards and Technology (“NIST”) and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas:
Collaboration
We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer and supplier disclosure, public disclosure and reporting of such incidents can be made by management and the Board of Directors in a timely manner.
Risk Assessment
Annually, the Security Committee (defined below) conducts a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes and inform a broader enterprise-level risk assessment that is analyzed by the Security Committee and presented to the Board of Directors, Audit Committee and members of management.
Technical Safeguards
The Company’s cybersecurity program evaluates new threats to learn new attacker techniques, adopt defenses and implement new safeguards designed to protect our information systems from cybersecurity threats. These safeguards are evaluated and improved based on, for example, vulnerability assessments, cybersecurity threat intelligence and incident response experience. Independent assessments of the safeguards by external third-party consultants, which also include the detection of threats, are evaluated and improvements to systems are assessed and incorporated where appropriate.
Incident Response and Recovery Planning
In an effort to effectively respond to a security event, we follow a comprehensive cybersecurity incident response plan. We regularly review, test and evaluate the plan for effectiveness.
Third-Party Risk Management
We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.
Table of Contents
Education and Awareness
Our Company policies require our employees to assist in the protection of our customers’ data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigation strategies and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.
External Assessments
Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We conduct regular independent cyber audits to assess our controls and alignment against the NIST Cybersecurity Framework, compromise assessments to baseline and assess if a current or past compromise had occurred within our infrastructure, and maintain industry certifications and attestations that demonstrate our dedication to protecting customer data. The results of significant assessments are reported to management, the Board of Directors and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments, as appropriate.
Governance
Board Oversight
The Board of Directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee, as part of its risk oversight function, is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments and relevant internal and industry cybersecurity incidents.
Management’s Role
Our Chief Technology Officer (“CTO”), Chief Legal and Compliance Officer (“CLCO”) and Director of Information and Cybersecurity (“DC”) have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the “Security Committee”), which drives alignment on security decisions across the Company. The CTO and DC each have over 20 years of experience serving in various roles in information technology fields; the CTO has over 25 years of global technology leadership across fintech, software, and payments industries, leading technology, product, and engineering organizations for multinational companies, with extensive experience in implementing software solutions and managing risk across the entire technology lifecycle. The DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 20 years of experience managing risks and related disclosure requirements, including risks arising from cybersecurity threats, at publicly traded companies . The Security Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents by meeting at least quarterly to evaluate security performance metrics, prioritizing risks identified through threat intelligence, vulnerability and risk assessments, external audits, and incident response insights, and reviewing the progress of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies .
Table of Contents
Item 2.
Propertie s
Information regarding each of our facilities, which may include multiple leases at each location, is set forth below.
Location
Operations
Square
Footage
Owned/
Leased
Littleton, Colorado
Debit and Credit card production
Leased
Roseville, Minnesota
Debit and Credit personalization services; and Prepaid Debit card packaging services, fulfillment
Leased
Fort Wayne, Indiana
Debit and Credit card production
Leased
Nashville, Tennessee
Debit and Credit card personalization services, instant issuance, fulfillment
Leased
Las Vegas, Nevada
Debit and Credit card production and personalization
Leased
Denver, Colorado
Corporate facility
Leased
Henderson, Nevada
Corporate facility
Leased
Item 3.
Legal Proceeding s
The Company may be subject to routine legal proceedings in the ordinary course of business. The Company believes that the ultimate resolution of any such matters will not have a material adverse effect on its business, financial condition or results of operations .
