Item 1A. Risk Factors
An investment in our Common Stock and our financial results are subject to a number of risks. You should carefully consider the risks described below and all other information contained in this Annual Report on Form 10-K and the documents incorporated by reference. Our business, prospects, financial condition or operating results could be harmed by any of these risks, as well as other risks not currently known to us or that we currently consider immaterial. Additional risks and uncertainties, including those generally affecting the industry in which we operate and risks that management currently deems immaterial, may arise or become material in the future and affect our business.
Risk Factors Related to Our Business
Unauthorized access to our systems or unauthorized disclosure of customer or cardholder data, whether through breach of our computer systems, computer viruses, or otherwise, could expose us to liability, protracted and costly litigation and damage our reputation.
Our services include the processing, transmission and storing of sensitive business and personal information about our customers, customers' customers, vendors, partners and other third parties. This information may include credit and debit card numbers, bank account numbers, personal identification numbers, names and addresses or other sensitive business information. This information may also be stored by third parties to whom we outsource certain functions or other agents ("associated third parties"). We may have responsibility to the card networks, FIs, and in some instances, our merchants, and/or ISOs, for our failure or the failure of our associated third parties to protect this information.
Information security risks for us and our competitors have substantially increased in recent years in part due to the proliferation of new technologies and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including hostile nation-state actors. The techniques used to obtain unauthorized access, disable or degrade service, sabotage systems or utilize payment systems in an effort to perpetrate financial fraud change frequently and are often difficult to detect and all of which we are vulnerable to. We have been the target of brute force attempts to obtain unauthorized access to our systems. Threats may derive from human error, fraud or on the part of employees or third parties, or may result from technological . Computer viruses can be distributed and spread rapidly over the internet and could infiltrate our systems or those of our associated third parties. Additionally, of service or other attacks could be launched us for a variety of purposes, including with our services or to create a for other activities. Our measures may not prevent down-time, access or use of sensitive data. While we maintain insurance coverage that will cover certain aspects of cyber risks, such insurance coverage may be to cover all . Furthermore, we do not control the actions of our third-party partners and customers in their systems. These third parties may experience security and any future experienced by these third parties, including those resulting from cyber attacks or other or in services, could affect our ability to conduct our business or us to liability. Further, our agreements with our bank sponsors and our third-party payment processors (as well as payment network requirements) require us to take certain protective measures to ensure the confidentiality of merchant and consumer data. Any such actions, attacks or to comply with these protective measures could our reputation, us to incur significant expenses in remediating the resulting impacts, us to liability, result in the of our bank sponsors or our ability to participate in the payment networks, or subject us to fees, , sanctions, or of our bank sponsor agreements or our third-party payment processor agreements.
As a result of information security risks, we must continuously develop and enhance our controls, processes and practices designed to protect our computer systems, software, data and networks from attack, damage or unauthorized access. This continuous development and enhancement will require us to expend additional resources, including to investigate and remediate significant information security vulnerabilities detected. Despite our investments in security measures, we are unable to assure that any security measures will not be subject to system or human error.
Our systems or our third-party providers' systems may fail, which could interrupt our service, cause us to lose business, increase our costs and expose us to liability.
We depend on the efficient and uninterrupted operation of our computer systems, software, data centers and telecommunications networks, as well as the systems and services of third parties. A system outage or data loss could have a
Table of Contents
material adverse effect on our business, financial condition, results of operations and cash flows. Not only could we suffer damage to our reputation in the event of a system outage or data loss, but we may also be liable to third parties. Many of our contractual agreements with FIs and certain other customers require the payment of penalties if we do not meet certain operating standards. Our systems and operations or those of our third-party providers could be exposed to damage or interruption from, among other things, fire, natural disaster, power loss or telecommunications failure.
The payment processing industry is highly competitive and such competition is likely to increase, which may adversely influence the prices we can charge to merchants for our services and the compensation we must pay to our distribution partners, and as a result, our profit margins.
The payment processing industry is highly competitive. We primarily compete in the SMB merchant, B2B customer, and embedded finance industry. We compete with FIs and their affiliates, independent payment processing companies and ISOs. We also compete with many of these same entities for production through distribution partners. Many of our distribution partners are not exclusive to us but also have relationships with our competitors, such that we have to continually expend resources to maintain those relationships. Our growth will depend on the continued growth of banking services, Electronic Payments, particularly Electronic Payments to SMB merchants, B2B customers and our ability to increase our market share through successful competitive efforts to gain new customers and distribution partners.
Additionally, many FIs and their subsidiaries or well-established payment-enabled technology providers with which we compete, have substantially greater capital, technological, management and marketing resources than we have. These factors may allow our competitors to offer better pricing terms to customers and more attractive compensation to distribution partners, which could result in a loss of our potential or current customers and distribution partners. Our current and future competitors may also develop or offer services that have price or other advantages over the services we provide.
We also face new, well capitalized, competition from emerging technology and non-traditional payment processing companies as well as traditional companies offering alternative banking services, Electronic Payments services and payment-enabled software solutions. If these new entrants gain a greater share of total Electronic Payments transactions, they could impact our ability to retain and grow our relationships with customers and distribution partners.
Increased customer or referral partner attrition could cause our financial results to decline.
We experience attrition in customer credit and debit card processing volume resulting from several factors, including business closures, transfers of customers accounts to our competitors, unsuccessful contract renewal negotiations and account closures that we initiate for various reasons such as heightened credit risks or contract breaches by merchants. Our referral partners are a significant source of new business. If a referral partner switches to another processor, terminates our services, internalizes payment processing that we perform, merges with or is acquired by one of our competitors, or shuts down or becomes insolvent, we may no longer receive new customers referrals from such referral partner, and we risk losing existing merchants that were originally enrolled by the referral partner. We cannot predict the level of attrition in the future and it could increase. Higher than expected attrition could negatively affect our results, which could have a material effect on our business, financial condition, results of operations and cash flows.
Changes in card association and debit network fees or products could increase costs or otherwise limit our operations.
From time to time, card associations and debit networks increase the organization and/or processing fees (known as interchange fees) that they charge. It is possible that competitive pressures will result in us absorbing a portion of such increases in the future, which would increase our operating costs, reduce our profit margin, and adversely affect our business, operating results, and financial condition. In addition, the various card associations and networks prescribe certain capital requirements. Any increase in the capital level required would further limit our use of capital for other purposes.
Changes in payment network rules or standards could adversely affect our business, financial condition and results of operations.
Payment network rules are established and changed from time to time by each payment network as they may determine in their sole discretion and with or without advance notice to their participants. The timelines imposed by the payment networks or
Table of Contents
sponsor banks for expected compliance with new rules have historically been, and may continue to be, highly compressed, requiring us to quickly implement changes to our systems which increases the risk of non-compliance with new standards or the reduction of certain types of merchant activity. In addition, the payment networks could make changes to interchange or other elements of the pricing structure of the merchant acquiring industry that would have a negative impact on our results of operations.
To remain competitive and to continue to increase our revenues and earnings, we must continually update our products and services, a process which could result in increased costs and the loss of revenues, earnings, customers and distribution partners if the new products and services do not perform as intended or are not accepted in the marketplace.
The Electronic Payments industry in which we compete is subject to rapid technological changes and is characterized by new technology, product and service introductions, evolving industry standards, changing customer needs and the entrance of non-traditional competitors. We are subject to the risk that our existing products and services become obsolete, and that we are unable to develop new products and services in response to industry demands. Our future success will depend in part on our ability to develop or adapt to technological changes and the evolving needs of our resellers, customers and the industry at large. In addition, new products and offerings may not perform as intended or generate the business or revenue growth expected. Defects in our software and errors or delays in our processing of electronic transactions could result in additional development costs, diversion of technical and other resources from our other development efforts, loss of credibility with current or potential distribution partners and merchants, harm to our reputation, imposed by regulatory agencies, card networks, or exposure to liability . Any in the delivery of new products or services or the to differentiate our products and services could render them less , or possibly even , to our merchants. Additionally, the market for alternative payment processing products and services is evolving, and we may develop too rapidly or not rapidly enough for us to recover the costs we have incurred in developing new products and services.
Acquisitions create certain risks and may adversely affect our business, financial condition, or results of operations.
We have actively acquired businesses and expect to continue to make acquisitions of businesses and assets in the future. The acquisition and integration of businesses and assets involve a number of risks. These risks include valuation (negotiating a fair price for the business and assets), integration (managing the process of integrating the acquired business' people, products, technology, and other assets to realize the projected value and synergies), regulatory (obtaining any applicable regulatory or other government approvals), and due diligence (identifying risks to the prospects of the business, including undisclosed or unknown liabilities or restrictions). There can be no assurances that we will be able to complete suitable acquisitions for a variety of reasons, including the identification of and competition for acquisition targets, the need for regulatory approvals, the inability of the parties to agree to the structure or purchase price of the transaction and our inability to finance the transaction on commercially acceptable terms. In addition, any potential acquisition can subject us to a variety of other risks:
• If we are unable to successfully integrate the benefits plans, duties and responsibilities and other factors of interest to management of employees of the acquired business, we could lose employees to our competitors in the region, which could significantly affect our ability to operate the business and complete the integration;
• If the integration process causes any delays with the delivery of our services, or the quality of those services, we could lose customers to our competitors;
• Any acquisition may otherwise cause disruption to the acquired company's business and operations and relationships with financial institution sponsors, customers, merchants, employees and other partners;
• Any acquisition and the related integration could divert the attention of our management from other strategic matters including possible acquisitions and alliances and planning for new product development or expansion into new markets for payments technology and software solutions; and
• The costs related to the integration of an acquired company's business and operations into ours may be greater than anticipated.
Table of Contents
We are subject to economic and political risk, the business cycles of our customers and distribution partners and the overall level of consumer and commercial spending, which could negatively impact our business, financial condition and results of operations.
The Electronic Payments industry depends heavily on the overall level of consumer, commercial and government spending. We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits. A sustained deterioration in general economic conditions or increases in interest rates could adversely affect our financial performance by reducing the number or aggregate dollar volume of transactions made using Electronic Payments. If our customers make fewer sales of their products and services using Electronic Payments, or consumers spend less money through Electronic Payments, we will have fewer transactions to process at lower dollar amounts, resulting in lower revenue. In addition, a weakening in the economy could force customers to close at higher than historical rates, resulting in exposure to potential losses and a decline in the number of transactions that we process. We also have material fixed and semi-fixed costs, including rent, debt service, contractual minimums and salaries, which could limit our ability to quickly adjust costs and respond to changes in our business and the economy.
Global economic, political and market conditions affecting the U.S. markets may adversely affect our business, results of operations and financial condition, including our revenue growth and profitability.
Worldwide financial market conditions, as well as various social and political tensions in the U.S. and around the world, may contribute to increased market volatility, may have long-term effects and may cause economic uncertainties or deterioration in the U.S. In addition, the fiscal and monetary policies of foreign nations, such as Russia and China, may have a severe impact on U.S. financial markets. We are monitoring the conflicts between Russia and Ukraine, Israel and Hamas, and the larger conflict among the U.S., Israel, Iran and other middle eastern countries. While we do not expect that such conflicts will themselves be material to our business, geopolitical instability and adversity arising from such conflict (including additional conflicts that could arise from such conflicts), the imposition of sanctions, taxes and/or tariffs against one of the countries or their response to such sanctions (including acts, such as cyber attacks and sanctions other countries) could affect the global economy or specific international, regional and domestic markets, which could have a material effect on our business, results of operations or financial condition.
Any new legislation that may be adopted in the U.S. could significantly affect the regulation of U.S. financial markets. Areas subject to potential change, amendment or repeal include the Dodd-Frank Act and the authority of the Federal Reserve Board and the FSOC. The U.S. may also potentially withdraw from or renegotiate various trade agreements and take other actions that would change current trade policies of the U.S. We cannot predict which, if any, of these actions will be taken or, if taken, their effect on the financial stability of the U.S. Such actions could have a significant adverse effect on our business, financial condition and results of operations, particularly in view of the regulatory oversight we presently face. We cannot predict the effects of these or similar events in the future on the U.S. economy in general, or specifically on our business model or growth strategy, which typically involves the use of debt financing. To the extent a downturn in the U.S. economy impacts our merchant accounts, regulatory changes increase the burden we face in operating our business, or disruptions in the credit markets prevent us from using debt to finance future acquisitions, our financial condition and results of operations may be materially and impacted.
We rely on FIs and other service and technology providers. If they fail or discontinue providing their services or technology generally or to us specifically, our ability to provide services to customers may be interrupted, and, as a result, our business, financial condition and results of operations could be adversely impacted.
We rely on various FIs to provide clearing services in connection with our settlement activities. If such FIs should stop providing clearing services, we must find other FIs to provide those services. Additionally, we rely on FIs to facilitate our Payables and money transmission services offerings. If we are unable to find a replacement financial institution, we may no longer be able to provide these services to certain customers, which could negatively affect our revenues, earnings and cash flows.
We also rely on third parties to provide or supplement bankcard processing services and for infrastructure hosting services. We also rely on third parties for specific software and hardware used in providing our products and services. The termination by our service or technology providers of their arrangements with us or their failure to perform their services efficiently and effectively
Table of Contents
may adversely affect our relationships with our merchants and, if we cannot find alternate providers quickly, may cause those merchants to terminate their relationship with us.
We also rely in part on third parties for the development and access to new technologies, or updates to existing products and services for which third parties provide ongoing support, which increases the cost associated with new and existing product and service offerings. Failure by these third-party providers to devote an appropriate level of attention to our products and services could result in delays in introducing new products or services, or delays in resolving any issues with existing products or services for which third-party providers provide ongoing support.
Fraud by customers or others could cause us to incur losses.
We have potential liability for fraudulent Electronic Payment transactions or credits initiated by customers or others. Examples of customer fraud include when a merchant or other party knowingly uses a stolen or counterfeit credit or debit card, card number, or other credentials to record a false sales or credit transaction, processes an invalid card, or intentionally fails to deliver the merchandise or services sold in an otherwise valid transaction. Criminals are using increasingly sophisticated methods to engage in illegal activities such as counterfeiting and fraud. Failure to effectively manage risk and prevent fraud could increase in the future. Increases in chargebacks, ACH returns or other liabilities could have a material effect on our financial condition, results of operations and cash flows.
We incur liability when our customers refuse or cannot reimburse us for chargebacks resolved in favor of their customers or ACH returns.
We have potential liability for chargebacks associated with the transactions we process. If a billing dispute between a merchant and a cardholder is not ultimately resolved in favor of the merchant, the disputed transaction is "charged back" to the merchant's bank and credited or otherwise refunded to the cardholder. The risk of chargebacks is typically greater with those merchants that promise future delivery of goods and services rather than delivering goods or rendering services at the time of payment. If we or our bank sponsors are unable to collect the chargeback from the merchant's account or reserve account (if applicable), or if the merchant refuses or is financially unable (due to bankruptcy or other reasons) to reimburse the merchant's bank for the chargeback, we may bear the loss for the amount of the refund paid to the cardholder. Any increase in chargebacks not paid by our merchants could increase our costs and decrease our revenues. Similarly, if a return is made against a customer for whom we have collected an ACH payment and that customer does not have adequate funds to offset such a return, we may incur a . We have policies to manage merchant-related credit risk and often mitigate such risk by requiring collateral and monitoring transaction activity. Notwithstanding our programs and policies for managing credit risk, it is possible that a on such obligations by one or more of our customers could have a material effect on our business.
If we fail to comply with the applicable requirements of the card networks, they could seek to fine us, suspend us or terminate our registrations for membership. If we incur fines or penalties for which our customers or ISOs are responsible that we cannot collect, we may have to bear the cost of such fines or penalties .
We are subject to card association and network rules that could subject us to a variety of fines or penalties that may be levied by the card networks for certain acts or omissions. The rules of the card networks are set by the card networks themselves and may be influenced by card issuers, some of which are our competitors with respect to processing services. Many banks directly or indirectly sell processing services to merchants in direct competition with us. These banks could attempt, by virtue of their influence on the networks, to alter the networks' rules or policies to the detriment of non-members, including us. The termination of our registrations or our membership status as a service provider or merchant processor, or any changes in a card association or other network rules or standards, including interpretation and implementation of the rules or standards, that increase the cost of doing business or limit our ability to provide transaction processing services to our customers, could have a material adverse effect on our business, financial condition, results of operations and cash flows. If a customer or an ISO fails to comply with the applicable requirements of the card associations and networks, we or the customer or ISO could be subject to a variety of or that may be levied by the card associations or networks. If we cannot collect or pursue collection of such amounts from the applicable customer or ISO, we may have to bear the cost of such or , resulting in lower earnings for us. The of our registration, or any changes in the Visa or Mastercard rules that would our registration, could require us to stop providing Visa and Mastercard payment processing services, which would make it for us to conduct our business on its current scale.
Table of Contents
The loss of, for example, key personnel or of our ability to attract, recruit, retain and develop qualified employees could adversely affect our business, financial condition and results of operations.
Our success depends upon the continued services of our senior management and other key personnel who have substantial experience in the Electronic Payments industry and the markets in which we offer our services. In addition, our success depends in large part upon the reputation within the industry of our senior managers who have developed relationships with our distribution partners, payment networks and other payment processing and service providers. Further, in order for us to continue to successfully compete and grow, we must attract, recruit, develop and retain personnel who will provide us with expertise across the entire spectrum of our intellectual capital needs. Our success is also dependent on the skill and experience of our sales force, which we must continuously work to maintain. While we have many key personnel who have substantial experience with our operations, we must also develop our personnel to provide succession plans capable of maintaining the continuity of our operations. The market for qualified personnel is competitive, and we may not succeed in recruiting additional personnel or may fail to effectively replace current personnel who depart with qualified or successors.
We may be responsible for the actions of our vendors in some circumstances.
We use third parties to provide services to us including IT related services and sales related functions. Should a cybersecurity related event or other act of negligence occur as a result of a third-party service provider, we may be liable for those actions.
Operational failures and resulting interruptions in the availability of our products or services could harm our business and reputation.
Our business depends heavily on the reliability of our systems. An operational failure that results in an interruption in the availability of our products and services could harm our business or cause us to lose clients. An operational failure could involve the hardware, software, data, networks or systems upon which we rely to deliver our services and could be caused by our actions, the actions of third parties or events over which we may have limited or no control. Events that could cause operational failures include, but are not limited to, hardware and software defects or malfunctions, ransomware, denial-of-service and other cyberattacks, human error, earthquakes, hurricanes, floods, fires, natural disasters, pandemics, power losses, disruptions in telecommunications services, , military or political , terrorist attacks, computer viruses or other malware, or other events. In the event of operational or or to our business due to these occurrences, we may not be to or quickly recover all of our business functions, assets and data through our business continuity program. Implementation , of service or hardware device could our relationship with clients and could cause us to incur substantial expenses, including those related to the payment of service credits, product or other liabilities. A of our services or network could cause us to experience data or a reduction in revenue, and significantly impact our clients’ businesses and the customers they serve. In addition, a significant of service or product could have a impact on our reputation and could cause our current and potential clients to choose another service provider. As a provider of payments solutions and other financial services, clients, regulators and others may require business continuity and recovery plans including frequent testing of such plans. Meeting these various requirements may require a significant investment of time and money. Any of these developments could have a material impact on our business, results of operations and financial condition.
If we fail to keep pace with technological change, including as a result of artificial intelligence, we could lose clients or have trouble attracting new clients.
If we fail to keep pace with technological change, including as a result of artificial intelligence, we could lose clients or have trouble attracting new clients. The markets for our products and services are characterized by constant and rapid technological change, evolving industry standards, frequent introduction of new products and services, and increasing client expectations. Our ability to respond timely to these changes, including by enhancing our current products and services and developing and introducing new products and services, will significantly affect our future success. In addition, competitors and other third parties may incorporate artificial intelligence into products and offerings more quickly or more successfully than we do, which could impair our ability to compete effectively and adversely affect our results of operations. Furthermore, the success of certain of our products and services rely, in part, on financial institutions, business partners and other third parties promoting the use of or distributing our products and services.
Table of Contents
Legal, Regulatory Compliance and Tax Risks
Legal proceedings could have a material adverse effect on our business, financial condition or results of operations.
In the ordinary course of business, we may become involved in various litigation matters, including but not limited to commercial disputes and employee claims, and from time to time may be involved in governmental or regulatory investigations or similar matters arising out of our current or future business. Any claims asserted against us, regardless of merit or eventual outcome, could harm our reputation and have an adverse impact on our relationship with our merchants, distribution partners and other third parties and could lead to additional related claims. Certain claims may seek injunctive relief, which could disrupt the ordinary conduct of our business and operations or increase our cost of doing business. Our insurance or indemnities may not cover all claims that may be asserted against us, and any asserted it, regardless of merit or eventual outcome, may our reputation and cause us to expend resources in our defense. Furthermore, there is no guarantee that we will be in ourselves in future . Should the ultimate judgments or settlements in any pending or future or significantly exceed our insurance coverage, they could have a material effect on our business, financial condition and results of operations.
We are subject to extensive government regulation, and any new laws and regulations, industry standards or revisions made to existing laws, regulations or industry standards affecting the Electronic Payments industry may have an unfavorable impact on our business, financial condition and results of operations.
Our business is affected by laws and regulations and examinations that affect us and our industries. Regulation and proposed regulation of the payments industry has increased significantly in recent years. Failure to comply with regulations or guidelines may result in the suspension or revocation of a license or registration, the limitation, suspension or termination of service, including money transmission services, and the imposition of civil and criminal penalties, including fines, or may cause customers or potential customers to be reluctant to do business with us, any of which could have an adverse effect on our financial condition.
Interchange fees are subject to intense legal, regulatory and legislative scrutiny. In particular, the Dodd-Frank Act limits the amount of debit card fees charged by certain issuers, allowing merchants to set minimum dollar amounts for the acceptance of credit cards and allowing merchants to offer discounts or other incentives for different payment methods. These types of restrictions could negatively affect the number of debit transactions, which would adversely affect our business. The Dodd-Frank Act also created the CFPB, which has assumed responsibility for enforcing federal consumer protection laws, and the FSOC, which has the authority to determine whether any non-bank financial company, which may include us within the definitional scope, should be supervised by the Federal Reserve because it is systemically important to the U.S. financial system. Any such designation would result in increased regulatory burdens on our business, which increases our risk profile and may have an adverse impact on our business, financial condition and results of operations.
We and many of our merchants may be subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices. That statement and other laws, rules and or regulations, including the Telemarketing Sales Act, may directly impact the activities of certain of our merchants and, in some cases, may subject us, as the merchant's electronic processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we were deemed to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of the merchant through our services. Various federal and state regulatory enforcement agencies, including the Federal Trade Commission and state attorneys general, have authority to take action against non-banks that engage in unfair or deceptive practices or violate other laws, rules and regulations and to the extent we are processing payments or providing services for a merchant that may be in of laws, rules and regulations, we may be subject to enforcement actions and as a result may incur and liabilities that may impact our business.
Our business may also be subject to the FCRA, which regulates the use and reporting of consumer credit information and also imposes disclosure requirements on entities that take adverse action based on information obtained from credit reporting agencies. We could be liable if our practices under the FCRA are not in compliance with the FCRA or regulations under it.
Separately, the Housing Assistance Tax Act of 2008 included an amendment to the Internal Revenue Code that requires the filing of yearly information returns by payment processing entities and third-party settlement organizations with respect to
Table of Contents
payments made in settlement of Electronic Payment transactions and third-party payment network transactions occurring in that calendar year. Transactions that are reportable pursuant to these rules are subject to backup withholding requirements. We could be liable for penalties if our information returns do not comply with these regulations.
These and other laws and regulations, even if not directed at us, may require us to make significant efforts to change our products and services and may require that we incur additional compliance costs and change how we price our services to merchants. Implementing new compliance efforts may be difficult because of the complexity of new regulatory requirements and may cause us to devote significant resources to ensure compliance. Furthermore, regulatory actions may cause changes in business practices by us and other industry participants which could affect how we market, price and distribute our products and services, which could limit our ability to grow, reduce our revenues or increase our costs. In addition, even an inadvertent failure to comply with laws and regulations, as well as rapidly evolving social expectations of corporate fairness, could damage our business or our reputation.
We may not be able to successfully manage our intellectual property and may be subject to infringement claims.
We rely on a combination of contractual rights and copyright, trademark, patent and trade secret laws to establish and protect our proprietary technology. Third parties may challenge, circumvent, infringe or misappropriate our intellectual property, or such intellectual property may not be sufficient to permit us to take advantage of current market trends or otherwise to provide competitive advantages, which could result in costly redesign efforts, discontinuance of service offerings or other competitive harm. Others, including our competitors, may independently develop similar technology, duplicate our services or design around our intellectual property and, in such cases, we could not assert our intellectual property rights against such parties. Further, our contractual arrangements may not effectively prevent disclosure of our confidential information or provide an adequate remedy in the event of unauthorized disclosure of our confidential information. We may have to to enforce or determine the scope and enforceability of our intellectual property rights and know-how, which is expensive, could cause a of resources and may not prove . Also, because of the rapid pace of technological change in our industry, aspects of our business and our services rely on technologies developed or licensed by third parties, and we may not be to obtain or continue to obtain licenses and technologies from these third parties on reasonable terms or at all. The of intellectual property protection or the to license or otherwise use third-party intellectual property could our business and ability to compete.
We may also be subject to costly litigation if our services and technology are alleged to infringe upon or otherwise violate a third party's proprietary rights. Third parties may have, or may eventually be issued, patents that could be infringed by our products, services or technology. Any of these third parties could make a claim of infringement against us with respect to our products, services or technology. We may also be subject to claims by third parties for patent, copyright or trademark infringement, breach of license or violation of other third-party intellectual property rights. Any claim from third parties may result in a limitation on our ability to use the intellectual property subject to these claims. Additionally, in recent years, individuals and groups have been purchasing intellectual property assets for the sole purpose of making of or other and attempting to extract settlements from companies like ours. Even if we believe that intellectual property related are without merit, such is time consuming and expensive and could result in the of the time and attention of our management and employees. of intellectual property or also might require us to redesign affected products or services, enter into settlement or license agreements, pay awards or face a temporary or permanent prohibiting us from marketing or selling certain of our products or services. Even if we have an agreement for indemnification such costs, the indemnifying party, if any in such circumstances, may be to uphold our contractual obligations. If we cannot or do not license the technology on reasonable terms or substitute similar technology from another source, our revenue and earnings could be impacted.
Changes in tax laws and regulations could adversely affect our results of operations and cash flows from operations.
Changes in tax laws in our significant tax jurisdictions could materially increase the amount of taxes we owe, thereby negatively impacting our results of operations as well as our cash flows from operations. For example, restrictions on the deductibility of interest expense in a U.S. jurisdiction without a corresponding reduction in statutory tax rates could negatively impact our effective tax rate, financial position, results of operations and cash flows in the period that such a change occurs and future periods.
Table of Contents
During 2025, the the One Big Beautiful Bill Act was enacted in the U.S., including provisions such as the permanent extension of certain expiring provisions of the Tax Cuts and Jobs Act, modifications to the international tax framework, and the restoration of favorable tax treatment for certain business provisions. The legislation has multiple effective dates beginning in 2025.
Our risk management policies and procedures may not be fully effective in mitigating our risk exposure in all market environments or against all types of risks.
We operate in a rapidly changing industry. Accordingly, our risk management policies and procedures may not be fully effective to identify, monitor, manage and remediate our risks. Some of our risk evaluation methods depend upon information provided by others and public information regarding markets, merchants or other matters that are otherwise inaccessible by us. In some cases, that information may not be accurate, complete or up-to-date. Additionally, our risk detection system is subject to a high degree of "false positive" risks being detected, which makes it difficult for us to identify real risks in a timely manner. If our policies and procedures are not fully effective or we are not always successful in capturing all risks to which we are or may be exposed, we may suffer harm to our reputation or be subject to litigation or regulatory actions that materially increase our costs and subject us to reputational that could limit our ability to grow and cause us to existing merchant clients.
The financial services industry continues to be highly regulated and subject to new laws or regulations in many jurisdictions, including the U.S. states in which we operate, which could restrict the products and services we offer, impose additional compliance costs on us, render our current operations unprofitable or even prohibit our current or future operations.
We are required to comply with frequently changing federal, state, and local laws and regulations that regulate, among other things, the terms of the financial products and services we offer. New laws or regulations may require us to incur significant expenses to ensure compliance. Federal and state regulators of consumer financial products and services are also enforcing existing laws, regulations, and rules more aggressively, and enhancing their supervisory expectations regarding the management of legal and regulatory compliance risks. For example, State attorneys general have indicated that they will take a more active role in enforcing consumer protection laws, including through the establishment of state consumer protection agencies as well as the use of Dodd-Frank Act provisions that authorize state attorneys general to enforce certain provisions of federal consumer financial laws and obtain civil money penalties and other relief available to the CFPB.
The application of traditional federal and state consumer protection statutes and related regulations to innovative products offered by financial technology companies such as us is often uncertain, evolving and unsettled. To the extent that our products are deemed to be subject to any such laws, we could be subject to additional compliance obligations, including state licensing requirements, disclosure requirements and usury or fee limitations, among other things. Application of such requirements and restrictions to our products and services could require us to make significant changes to our business practices (which may increase our operating expenses and/or decrease revenue) and, in the event of retroactive application of such laws, subject us to litigation or enforcement actions that could result in the payment of damages, restitution, monetary penalties, injunctive restrictions, or other sanctions, any of which could have a material adverse effect on our business, financial position, and results of operations.
Recently, federal bank regulators have increasingly focused on the risks related to bank and non-bank financial service company partnerships, raising concerns regarding risk management, oversight, internal controls, information security, change management, and information technology operational resilience. This focus is demonstrated by recent regulatory enforcement actions against banks that have allegedly not adequately addressed these concerns while growing their non-bank financial service offerings. Additionally, there are ongoing investigations by federal and state governmental entities concerning a prepaid debit card product program that was offered by the Company through an independent program manager. We could be subject to additional regulatory scrutiny with respect to that portion of our business that could have a material adverse effect on the business, financial condition, results of operations and growth prospects of the Company.
Further, we may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and these changes may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. In addition, we expect to continue to launch new products and services in the coming years, which may subject us to additional legal and regulatory requirements under federal, state and local laws and regulations. To the extent the
Table of Contents
application of these laws or regulations to our new offerings is unclear or evolving, including changing interpretations and the implementation of new or varying regulatory requirements by federal or state governments and regulators, this may significantly affect or change our proposed business model, increase our operating expenses and hinder or delay our anticipated launch timelines for new products and services.
Disruptions or security failures in our information technology systems, including as a result of cybersecurity incidents, could create liability for us and/or limit our ability to effectively monitor, operate and control our operations and adversely affect our reputation, business, financial condition, results of operation and cash flows.
We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. The Company relies upon operational and information systems, some of which are managed by third parties, to process, transmit and store electronic information and to manage or support a variety of our business processes, activities and products. Additionally, we collect and store sensitive data, including the personally identifiable information of our customers and employees, in data centers and on information systems (including systems that may be controlled or maintained by third parties). The Company’s business, and in particular, the debit card and cash management solutions business and global payments business, is dependent on its ability to process and monitor, on a daily basis, a large number of transactions, many of which are highly complex, across numerous and diverse markets. These transactions, as well as the information technology services provided to clients, often must adhere to client-specific guidelines, as well as legal and regulatory standards. Due to the breadth and geographical reach of the Company’s client base, developing and maintaining its operational and information systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts.
Although the Company continues to take protective measures to maintain the confidentiality, integrity and security of our operational and information systems and infrastructure, the techniques used in cyberattacks are becoming increasingly diverse and sophisticated. For example, the Company’s operational and information systems or infrastructure, or those of our third-party providers, may be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, computer viruses or other malicious code, cyberattacks and other incidents that could create a cybersecurity event, any of which could remain undetected for an extended period of time. Furthermore, the Company may not be able to ensure that all of its clients, suppliers, counterparties and other third parties have appropriate controls in place to protect themselves from or to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Given the increasingly high volume of transactions, certain may be repeated or compounded before they can be discovered and rectified. In addition, the increasing reliance on information systems, and the occurrence and potential impact of attacks on such systems, both generally and in the financial services industry, have increased government and regulatory of the measures taken by companies to protect cybersecurity and . As these , and government and regulatory oversight of associated risks continue to evolve, the Company may be required to expend additional resources to or expand upon the security measures it currently maintains. Although the Company has developed, and continues to invest in, systems and processes that are designed to detect and prevent security and , a of its systems and global payments infrastructure or those of our non-bank financial service partners and processors could result in: to the Company and its customers; of business and/or customers; to its reputation; the incurrence of additional expenses (including the cost of notification to consumers, credit monitoring and forensics, and fees and imposed by the card networks); to its business; an to grow its online services or other businesses; additional regulatory or ; and/or exposure to civil and possible financial liability — any of which could have a material effect on the Company’s business, financial condition and results of operations. We have not encountered cybersecurity or that have materially and affected, or are reasonably likely to materially and affect, the Company’s business, results of operations or financial condition; however, the impacts of such or in the future may be material.
While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For information on our cybersecurity risk management, strategy and governance, see Part I, Item 1C., Cybersecurity
Table of Contents
Risk Related to Our Capital Structure
We face risks related to our substantial indebtedness.
We have a substantial amount of indebtedness and may incur other debt in the future. Our level of debt and the covenants to which we agreed could have negative consequences on us, including, among other things, (i) requiring us to dedicate a large portion of our cash flow from operations to servicing and repayment of the debt; (ii) limiting funds available for strategic initiatives and opportunities, working capital and other general corporate needs and (iii) limiting our ability to incur certain kinds or amounts of additional indebtedness, which could restrict our ability to react to changes in our business, our industry and economic conditions.
Substantially all of our indebtedness is variable rate debt, primarily based on SOFR, which replaced LIBOR effective June 30, 2023. As a result of this variable rate debt, an increase in interest rates generally would adversely affect our profitability. We may enter into pay-fixed interest rate swaps or other derivative transactions to limit our exposure to changes in floating interest rates. Such instruments may result in economic losses should interest rates decline to a point lower than our fixed rate commitments. We would be exposed to credit-related losses, which could impact the results of operations in the event of fluctuations in the fair value of the interest rate swaps due to a change in the credit worthiness or non-performance by the counterparties to the interest rate swaps.
The credit agreements governing our existing credit facilities and any other debt instruments we may issue in the future will contain restrictive covenants that may impair our ability to conduct business.
The credit agreements governing our existing credit facilities contain operating covenants and financial covenants that may limit management's discretion with respect to certain business matters. In addition, any debt instruments we may issue in the future will likely contain similar operating and financial covenants restricting our business. Among other things, these covenants will limit our ability to:
• pay dividends, or redeem or purchase equity interests;
• incur additional debt;
• incur liens;
• change the nature of our business;
• engage in transactions with affiliates;
• sell or otherwise dispose of assets;
• make acquisitions or other investments; and
• merge or consolidate with other entities.
In addition, the 2024 Credit Agreement which governs our revolving credit facility contains a total net leverage ratio financial covenant that is applicable when 35% or more of the revolving credit facility is drawn at quarter end. The Residual Finance Credit Facility requires Finance SPV to comply with certain restrictions including minimum liquidity of $2.0 million, minimum tangible net worth of $5.0 million, maximum default ratio of 2.5%, maximum delinquency ratio of 5.0%, and a minimum excess spread ratio of 1.00 to 1.00.
A breach of any of these covenants could result in a default or event of default under our 2024 Credit Agreement or the Residual Finance Credit Facility. If an event of default occurred, the applicable lenders or agents could elect to terminate borrowing commitments and declare all borrowings and loans outstanding thereunder, together with accrued and unpaid interest and any fees and other obligations, to be immediately due and payable. In addition, or in the alternative, the applicable lenders or agents could exercise their rights under the security documents entered into in connection with the 2024 Credit Agreement
Table of Contents
and the Residual Finance credit facility. Any acceleration of amounts due under the 2024 Credit Agreement would likely have a material adverse effect on us.
Risks Related to Ownership of Our Stock
Our largest stockholder, Thomas C. Priore, recently submitted a non-binding proposal to our Board of Directors to acquire all of the outstanding shares of the Company’s common stock for a price in the range of $6.00 to $6.15 per share. Uncertainty regarding a potential going-private transaction could create significant uncertainty to our business, including disruption to our management and employees, and contribute to volatility in our stock price.
On November 9, 2025, Mr. Priore, who directly or beneficially owns approximately 60% of our outstanding common stock as of November 9, 2025, submitted a non-binding proposal to our Board on behalf of himself and his affiliated entities (the “Proposing Shareholders”) to acquire all of the outstanding shares of the Company’s common stock (a “Take Private Transaction”) for a price in the range of $6.00 to $6.15 per share. The Board has established a special committee comprised of disinterested and independent directors in response to interest expressed by the Proposing Shareholders in exploring the Take Private Transaction. Any potential Take Private Transaction may be subject to numerous conditions, including financing availability and regulatory approvals.
We may incur significant costs in connection with the evaluation of, and response to, any proposal regarding a Take Private Transaction. The potential of a Take Private Transaction may also divert the attention of management and employees from the ongoing operation of our business and may impact employee morale and retention, all of which could impair our ability to execute our strategic plans, meet operational objectives, and respond to competitive pressures. Our customers may also react negatively to a Take Private Transaction, including any related negative publicity regarding the Company. Further, the possibility of a Take Private Transaction may contribute to continued or increased volatility in our stock price.
Because we have no current plans to pay cash dividends on our Common Stock for the foreseeable future, you may not receive any return on investment unless you sell your Common Stock for a price greater than that which you paid for it.
We intend to retain future earnings, if any, for future operations, expansion, and debt repayment and have no current plans to pay any cash dividends for the foreseeable future. The declaration, amount, and payment of any future dividends on shares of Common Stock will be at the sole discretion of our Board of Directors. Our Board of Directors may take into account general and economic conditions, our financial condition, and results of operations, our available cash and current and anticipated cash needs, capital requirements, contractual, legal, tax, and regulatory restrictions, implications on the payment of dividends by us to our stockholders or by our subsidiaries to us, and such other factors as our Board of Directors may deem relevant. In addition, our ability to pay dividends is limited by covenants of our existing and outstanding indebtedness and may be limited by covenants of any future indebtedness we or our subsidiaries incur. As a result, you may not receive any return on an investment in our Common Stock unless you sell our Common Stock for a price greater than that which you paid for it.
Mr. Thomas Priore, our Chief Executive Officer and Chairman, controls the Company, and his interests may conflict with ours or yours in the future.
Thomas Priore and his affiliates have the ability to elect all of the members of our Board of Directors and thereby control our policies and operations, including the appointment of management, future issuances of our Common Stock or other securities, the payment of dividends, if any, on our Common Stock, the incurrence or modification of debt by us, amendments to our Amended and Restated Certificate of Incorporation and our Amended and Restated Bylaws, and the entering into of extraordinary transactions, and their interests may not in all cases be aligned with your interests. In addition, Thomas Priore may have an interest in pursuing acquisitions, divestitures, and other transactions that, in his judgment, could enhance his investment, even though such transactions might involve risks to you. For example, he could cause us to make acquisitions that increase our indebtedness or cause us to sell revenue-generating assets. Additionally, in certain circumstances, acquisitions of debt at a discount by purchasers that are related to a debtor can give rise to cancellation of indebtedness income to such debtor for U.S. federal income tax purposes.
Table of Contents
Our Amended and Restated Certificate of Incorporation provides that neither he nor any of his affiliates, or any director who is not employed by us (including any non-employee director who serves as one of our officers in both his director and officer capacities) will have any duty to refrain from engaging, directly or indirectly, in the same business activities or similar business activities or lines of business in which we operate. So long as Thomas Priore continues to own a significant amount of our combined voting power, even if such amount is less than 50%, he will continue to be able to strongly influence or effectively control our decisions. Furthermore, so long as Thomas Priore and his respective affiliates collectively own at least 50% of all outstanding shares of our Common Stock entitled to vote generally in the election of directors, they will be able to appoint individuals to our Board of Directors. In addition, given his level of control, Thomas Priore will be able to determine the outcome of all matters requiring stockholders' approval and will be able to cause or prevent a change of control of the Company or a change in the composition of our Board of Directors and could preclude any unsolicited acquisition of the Company. The concentration of ownership could you of an to receive a premium for your shares of Common Stock as part of a sale of the Company and ultimately might affect the market price of our Common Stock.
Future sales of common stock by our directors and officers, or their pledgees, as a result of foreclosure could adversely affect the price of common stock and could, in the future, result in a loss of control of our company.
Upon the approval of our Board, our directors and officers may pledge shares of common stock as collateral for personal loans or investments in favor of third parties. Depending on the status of the various loan obligations for which the stock would ultimately serve as collateral and the trading price of our common stock, our directors and/or officers, and their affiliates, may experience foreclosure that could result in the sale of the pledged stock, in the open market or otherwise. Sales by these pledgees may not be subject to the volume limitations of Rule 144 of the Securities Act. Even in the absence of shares being sold, the act of pledging shares and the risk of sales of shares may create a misalignment of interests between insider pledgors and the Company’s stockholders, as the insider may be incentivized to take actions that limit his or her exposure to such sales. Either scenario could potentially subject the Company and its insiders to stockholder lawsuits, particularly in an environment of declining share prices.
If we fail to maintain effective internal control over financial reporting, we may not be able to accurately report our financial results
Section 404 of the Sarbanes-Oxley Act of 2002 requires us to annually evaluate the effectiveness of our internal control over financial reporting as of the end of each year and to include a management report assessing the effectiveness of our internal control over financial reporting in our Annual Report on Form 10-K. If we fail to maintain the adequacy of our internal control, we may be unable to accurately report our financial results, or report them within the required timeframes.
While we continue to dedicate resources to ensure we have effective internal controls over financial reporting, failure to achieve and maintain an effective internal control environment could have a material adverse effect on our ability to timely generate accurate financial statements in conformity with accounting principles generally accepted in the United States, and, resultingly, on the market's perception of our business and on our stock price.
