What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-03-01 compared with 2021-03-01 · 291 added, 272 removed, 521 unchanged (52% of the section changed)

6 unchanged sentences

In March 2020, the World Health Organization declared the outbreak of COVID-19 a pandemic, which continues to spread throughout the United States and the world and has resulted in authorities implementing numerous measures to contain the virus, including travel bans and restrictions, quarantines, shelter-in-place orders, and business limitations and shutdowns.

While we are unable to accurately predict the full impact that COVID-19 will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic and containment measures, our compliance with these measures has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our marketers, FI partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, marketers, FI partners and communities, our employees began working remotely in March 2020 and are still working from home.

In addition, many of our marketers and prospective marketers, as well as our FI partners, are working remotely.

While we are unable to accurately predict the full impact that COVID-19 will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic and containment measures, our compliance with these measures has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our marketers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, marketers, partners and communities, our employees began working remotely in March 2020 and are still largely working from home.

In addition, many of our marketers and prospective marketers, as well as our partners, are working remotely.

The disruptions to our operations caused by COVID-19 may result in inefficiencies, delays and additional costs that we cannot fully mitigate through remote or other alternative work arrangements.

In addition, given the economic uncertainty created by COVID-19, we have and may continue to see delays in our sales cycle, failures of marketers to renew at all or to renew at a reduced scope their agreements with us, requests from marketers for payment term deferrals as well as pricing concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

The extent of the impact of COVID-19 on our operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, its impact on industry events, and its effect on consumer spending, our marketers, FI partners, suppliers and vendors and other parties with whom we do business, all of which are uncertain and cannot be predicted at this time.

To the extent possible, we are conducting business as usual, with necessary or advisable modifications to employee travel, employee work locations, and cancellation of marketing events.

We will continue to actively monitor the rapidly evolving situation related to COVID-19 and may take actions that alter our business operations, including those that may be required by federal, foreign, state or local authorities, or that we determine are in the best interests of our employees, marketers, FI partners, suppliers, vendors and stockholders.

In addition, given the economic uncertainty created by COVID-19, including supply-chain disruptions and inflationary pressures, we have and may continue to see delays in our sales cycle, failures of marketers to renew at all or to renew at a reduced scope their agreements with us, requests from marketers for payment term deferrals as well as pricing concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

The extent of the impact of COVID-19 on our operational and financial performance will depend on certain developments, including the duration and spread of the outbreak, its impact on industry events, and its effect on consumer spending, our marketers, partners, suppliers and vendors and other parties with whom we do business, all of which are uncertain and cannot be predicted at this time.

To the extent possible, we are conducting business as usual, with necessary or advisable modifications to employee work locations.

At this point, the extent to which the COVID-19 pandemic may impact our business, results of operations and financial condition is uncertain.

More generally, the pandemic raises the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our solution and materially and adversely impact our results and financial condition even after the pandemic is contained and the shelter-in-place orders are lifted.

For example, we may be unable to collect receivables from those marketers significantly impacted by COVID-19, which may be more pronounced in each industry more directly impacted by the COVID-19 pandemic.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our marketers, our potential marketers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of COVID-19 on our business.

The full extent of COVID-19’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the duration and spread of the pandemic, a possible resurgence or mutations of the virus, the effectiveness and rollout of a vaccine or effective therapeutics for the virus, the virus’ impact on capital and financial markets, the timing of an economic recovery and any new information that may emerge concerning the severity of the virus, its spread to other regions as well as the actions taken to contain it, among others.

The full extent of COVID-19’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the duration and spread of the pandemic, the resurgence or additional mutations of the virus, the effectiveness of the vaccines or effective therapeutics for the virus, the virus’ impact on capital and financial markets, the timing of an economic recovery and any new information that may emerge concerning the severity of the virus, its spread to other regions as well as the actions taken to contain it, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

1 unchanged sentence

Unfavorable conditions in the global economy or the industries we serve could limit our ability to grow our business and negatively affect our operating results.

General worldwide economic conditions have experienced significant instability in recent years including the recent global economic uncertainty and financial market conditions caused by the COVID-19 pandemic.

These conditions make it extremely difficult for marketers and us to accurately forecast and plan future business activities and could cause marketers to continue to reduce or delay their marketing spending.

3 unchanged sentences

Historically, economic downturns have resulted in overall reductions in marketing spending.

Alternatively, as the market recovers from the pandemic, marketing spend may be volatile and unpredictable as certain industries recover at different speeds.

If macroeconomic conditions deteriorate or are characterized by uncertainty or volatility, marketers may curtail or freeze spending on marketing in general and for services such as ours specifically, which could have a material and adverse impact on our business, financial condition and operating results.

In addition, our business may be materially and adversely affected by weak economic conditions in the industries that we serve.

All of these industries have been negatively impacted by the pandemic and certain precautions taken to control the pandemic.

8 unchanged sentences

• our ability to maintain and grow our business in light of the global COVID-19 pandemic and precautions taken to reduce the risk of this virus;

• our ability to attract and retain marketers and FI partners;

• the amount and timing of revenue, operating costs and capital expenditures related to the operations and expansion of our business, particularly with respect to our efforts to attract new marketers and FI partners to our network;

• our ability to attract and retain marketers and partners;

• the revenue mix revenue generated from our operations in the U.S.

• decisions made by our FI partners to increase Consumer Incentives or use their FI share to fund their Consumer Incentives;

• the revenue mix generated from the operations of Cardlytics, Inc.

and its subsidiaries;

• decisions made by our FI partners to increase Consumer Incentives or use their Partners Share to fund their Consumer Incentives;

• changes in the economic prospects of marketers, the industries that we primarily serve, or the economy generally, which could alter marketers’ spending priorities or budgets;

• the termination or alteration of relationships with our FI partners in a manner that impacts ongoing or future marketing campaigns;

• the termination or alteration of relationships with our partners in a manner that impacts ongoing or future marketing campaigns;

• reputational harm;

• the amount and timing of expenses required to grow our business, including the timing of our payments of FI Share and FI Share commitments as compared to the timing of our receipt of payments from our marketers;

• the amount and timing of expenses required to grow our business, including the timing of our payments of Partner Share and Partner Share commitments as compared to the timing of our receipt of payments from our marketers;

• changes in demand for our solutions or similar solutions;

• seasonal trends in the marketing industry, including concentration of marketer spend in the fourth quarter of the calendar year and declines in marketer spend in the first quarter of the calendar year;

• seasonal trends in the marketing industry;

• competitive market position, including changes in the pricing policies of our competitors;

1 unchanged sentence

• quarantine, private travel limitation, or business disruption in regions affecting our operations, stemming from actual, imminent or perceived outbreak of contagious disease, including the COVID-19 pandemic;

• volatile recovery from the pandemic;

• other events or factors, including those resulting from war, such as the current hostilities between Russia and Ukraine or incidents of terrorism;

• expenses associated with items such as litigation, regulatory changes, cyberattacks or security breaches;

5 unchanged sentences

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

We may not be able to return to or sustain our revenue and billings growth rate in the future.

Our revenue increased 40% from $150.7 million in 2018 to $210.4 million in 2019.

Our revenue decreased 11% from $210.4 million in 2019 to $186.9 million in 2020.

Our billings increased 44% from $219.0 million in 2018 to $316.1 million in 2019.

Our billings decreased 17% from $316.1 million in 2019 to $263.4 million in 2020.

We may not be able to resume year-over-year revenue and billings growth in the near term or at all.

We expect revenue and billings growth rates will be negatively impacted by the COVID-19 pandemic, and you should not consider our revenue and billings growth in any specific historical periods as indicative of our future performance.

Our revenue and billings may be negatively impacted in future periods due to a number of factors, including slowing demand for our solutions, increasing competition, decreasing growth of our overall market, our inability to engage and retain a sufficient number of marketers or FI partners, or our failure, for any reason, to capitalize on growth opportunities.

We may not be able to sustain our revenue and billings growth rate in the future.

Our revenue decreased 11% from $210.4 million in 2019 to $186.9 million in 2020, but our revenue increased 43% from $186.9 million in 2020 to $267.1 million in 2021.

Our billings decreased 17% from $316.1 million in 2019 to $263.4 million in 2020, but our billings increased 50% from $263.4 million in 2020 to $394.1 million in 2021.

We may not be able to maintain year-over-year revenue and billings growth in the near term or at all.

We expect revenue and billings growth rates will continue to be negatively impacted by the COVID-19 pandemic, and you should not consider our revenue and billings growth in any specific historical periods as indicative of our future performance.

Our revenue and billings may be negatively impacted in future periods due to a number of factors, including slowing demand for our solutions, increasing competition, decreasing growth of our overall market, our inability to engage and retain a sufficient number of marketers or partners, or our failure, for any reason, to capitalize on growth opportunities.

If we are unable to maintain consistent revenue, revenue growth or billings growth, our stock price could be volatile, and it may be difficult for us to achieve and maintain profitability.

We are dependent upon the Cardlytics platform.

All of our revenue and billings during 2020 was derived from sales of advertising via the Cardlytics platform.

We have historically derived substantially all of our revenue and billings from the Cardlytics platform and expect to continue to derive substantially all of our future revenue and billings from sales of the Cardlytics platform for the foreseeable future.

Substantially all of our revenue and billings during 2020 and 2021 were derived from sales of advertising via the Cardlytics platform.

We have historically derived substantially all of our revenue and billings from our Cardlytics platform.

Our operating results could suffer due to:

2 unchanged sentences

• failure by our FI partners to increase engagement with our solutions within their customer bases, improve their customers’ user experience, increase customer awareness, leverage additional customer outreach channels like email or otherwise promote our incentive programs on their websites and mobile applications, including by making the programs difficult to access or otherwise diminishing their prominence;

• our failure to offer compelling incentives to our FIs’ customers;

• FI partners may elect to use their FI share to fund their Consumer Incentives;

• our failure to offer compelling incentives to our FI partners’ customers;

• FI partners may elect to use their Partner Share to fund their Consumer Incentives;

• the introduction by competitors of products and technologies that serve as a replacement or substitute for, or represent an improvement over, the Cardlytics platform;

• FIs developing their own technology to support purchase intelligence marketing or other incentive programs;

• FI partners developing their own technology to support purchase intelligence marketing or other incentive programs;

• technological innovations or new standards that the Cardlytics platform does not address;

• sensitivity to current or future prices offered by us or competing solutions.

In addition, we are required to pay a majority of Consumer Incentives associated with the Cardlytics platform marketing campaigns regardless of whether the amount of such Consumer Incentives exceeds the amount of billings that we are paid by the applicable marketer.

In addition, in the majority of instances we would be required to pay Consumer Incentives associated with the Cardlytics platform marketing campaigns even if the amount of such Consumer Incentives exceeded the amount of billings that we are paid by the applicable marketer.

Further, we are often required to pay such Consumer Incentives before we receive payment from the applicable marketer.

4 unchanged sentences

We must have FI partners with a sufficient number of customers and levels of customer engagement to ensure that we have robust purchase data and marketing space to support a broad array of incentive programs for marketers.

In addition, we pay most of our FI partners an FI Share, which is a negotiated and fixed percentage of our billings less certain costs.

During 2018, Bank of America, National Association (“Bank of America”) accounted for over 60% of the total FI Share we paid to all FIs.

No other FI partner accounted for over 10% of FI Share during this period.

For each year during 2019 and 2020, Bank of America and JPMorgan Chase Bank, National Association (“Chase”) combined to account for over 75% of the total FI Share we paid to all FIs, with each representing over 25%.

No other FI partner accounted for over 10% of FI Share during these periods.

In addition, we pay most of our FI partners a Partner Share, which is a negotiated and fixed percentage of our billings less certain costs.

During 2019, 2020 and 2021, Bank of America, National Association (“Bank of America”) and JPMorgan Chase Bank, National Association (“Chase”) combined to account for over 75% of the total Partner Share we paid to all FI partners, with each representing over 25%.

No other partner accounted for over 10% of Partner Share during these periods.

Our agreements with a substantial majority of our FI partners have three- to seven-year terms but are generally terminable by the FI partner on 90 days or less prior notice.

20 unchanged sentences

Accordingly, our ability to efficiently grow our revenue will specifically depend on our ability to maintain our relationships with the large FIs that are currently part of our network and establish relationships with the large FIs that are not currently part of our network.

In addition, we must continue to maintain our relationships with our existing bank processor and digital banking provider partners and attract new such partners because these partners aggregate smaller FIs into our network.

In addition, we must continue to maintain our relationships with our existing bank processor and digital banking provider FI partners and attract new such FI partners because these FI partners aggregate smaller FIs into our network.

We have in the past and may in the future be unsuccessful in attempts to establish and maintain relationships with large FIs.

1 unchanged sentence

Our future success will depend, in part, on our ability to expand into new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have recently entered new industries such as travel and entertainment, direct to consumer, and grocery, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have recently entered new industries such as travel and entertainment, direct-to-consumer, grocery and gas, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

As we market to a wider group of potential marketers and their agencies, we will need to adapt our marketing strategies to meet the concerns and expectations of customers in these new industries.

5 unchanged sentences

We derive a material portion of our revenue from a limited number of marketers, and the loss of one or more of these marketers could adversely impact our business, results of operations and financial conditions.

Our marketer base is concentrated with our top five marketers representing 23%, 27% and 35% of revenue for 2018, 2019 and 2020, respectively.

We do not have long-term commitments from most of these marketers.

Although our revenue and accounts receivable span a large number of marketers segregated by both geography and industry, we derive a material portion of our revenue from a concentrated marketer base.

During 2019, 2020 and 2021, our top five marketers accounted for 27%, 35% and 29% of our revenue, respectively, with one marketer accounting for over 10% during each period, respectively.

As of December 31, 2020 and 2021, our top five marketers accounted for 31% and 19% of our accounts receivable, respectively, with one marketer representing over 10% and no marketers representing over 10% as of each period, respectively.

We do not have material long-term commitments from most of these marketers.

If we were to lose one or more of our significant marketers, our revenue may significantly decline.

In addition, revenue from significant marketers may vary from period-to-period depending on the timing or volume of marketing spend.

Further, our credit risk is concentrated among a limited number of marketers.

The loss of one or more of our significant marketers could adversely affect our business, results of operations and financial conditions.

Further, our top five marketers represented 23%, 26% and 31% of accounts receivable as of December 31, 2018, 2019 and 2020, respectively.

Accordingly, our credit risk is concentrated among a limited number of marketers and the failure of any significant marketer to satisfy its obligations to us, on a timely basis or at all, could materially and adversely affect our business, results of operations and financial conditions.

If we do not effectively grow and train our sales team, we may be unable to add new marketers or increase sales to our existing marketers and our business will be adversely affected.

We continue to be substantially dependent on our sales team to obtain new marketers and to drive sales with respect to our existing marketers.

We believe that the characteristics and skills of the best salespeople for our solutions are still being defined, as our market is relatively new.

Further, we believe that there is, and will continue to be, significant competition for sales personnel with the skills and technical knowledge that we require.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, integrating and retaining sufficient numbers of sales personnel to support our growth.

New hires require significant training and it may take significant time before they achieve full productivity.

Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business.

In addition, as we continue to grow, a large percentage of our sales team will be new to our company and our solutions.

If we are unable to hire and train sufficient numbers of effective sales personnel, or the sales personnel are not successful in obtaining new marketers or increasing sales to our existing marketers, our business will be adversely affected.

A breach of the security of our systems could result in a disruption of our operations, or a third-party’s entry into our FI partners’ systems, which would be detrimental to our business, financial condition and operating results.

We leverage our FI partners’ purchase data and infrastructures to deliver our solutions.

We do not currently receive or have access to any personally identifiable information ("PII") from our FI partners, although we may obtain or have access to PII in the future as our business evolves.

An actual or perceived breach of the security of our systems could result in a disruption of our operations, or a third-party’s entry into our FI partners’ systems, which would be detrimental to our business, reputation, financial condition and operating results.

We leverage our FI partners’ purchase data and infrastructures to deliver our Cardlytics platform.

We do not currently receive or have access to any personally identifiable information ("PII") from our FI partners, although we may obtain or have access to PII from our FI partners in the future as our business evolves.

However, because of the interconnected nature of our infrastructure with that of our FI partners, there is a risk that third parties may attempt to gain access to our systems, or our FI partners’ systems through our systems, for the purpose of stealing sensitive or proprietary data, accessing sensitive information on our network, or disrupting our or their respective operations.

Additionally, we receive and have access to PII as a result of other aspects of our business.

In turn, we may be a more visible target for cyberattacks and/or physical breaches of our databases or data centers, and we may in the future suffer from such attacks or breaches.

Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase.

In addition to traditional computer “hackers,” threat actors, software bugs, malicious code (such as viruses and worms), employee theft or misuse, denial-of-service attacks (such as credential stuffing), and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions).

We also may be the subject of phishing attacks, viruses, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware, malicious or unintentional actions or in actions by employees or others with authorized access to our network that create or expose vulnerabilities or other similar issues.

Current or future criminal capabilities, discovery of existing or new vulnerabilities in our systems and attempts to exploit those vulnerabilities or other developments may compromise or breach the technology protecting our systems.

1 unchanged sentence

In the event that our protection efforts are unsuccessful, and our systems are compromised such that a third-party gains entry to our or any of our FI partners’ systems, we could suffer substantial harm.

In addition, due to the COVID-19 pandemic, we have transitioned all of our employees to work remotely, which may make us more vulnerable to cyberattacks.

In addition, due to the COVID-19 pandemic, we have transitioned the vast majority of our employees to remote work, which may make us more vulnerable to cyberattacks.

A security breach could result in operational or administrative disruptions, or impair our ability to meet our marketers’ requirements, which could result in decreased revenue.

Also, our reputation could suffer irreparable harm, causing our current and prospective marketers and FI partners to decline to use our solutions in the future.

Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

In any event, a breach of the security of our systems or data could materially harm our business, financial condition and operating results.

Further, we could be forced to expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

In any event, an actual or suspected breach of the security of our systems or data could materially harm our business, financial condition and operating results.

We cannot assure you that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security lapse or breach.

2 unchanged sentences

The successful assertion of one or more large claims against us that exceeds available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results and reputation.

Our business could be adversely affected if marketers or their agencies are not satisfied with our solutions or our systems and infrastructure fail to meet their needs.

We derive nearly all of our revenue from marketers and their agencies.

Accordingly, our business depends on our ability to satisfy marketers and their agencies with respect to their marketing needs.

We are in the process of updating our platforms.

Any failure of, or delays in the performance (or in the case of the self-service tool, the rollout) of, our systems could cause service interruptions or impaired system performance.

Such failures in our systems could cause us to fail to maximize our earning potential with respect to any given marketing campaign.

Such failures in our systems could also cause us to over-run on campaigns, thus committing us to higher redemptions, which may negatively affect the profitability of the affected campaigns.

If sustained or repeated, these performance issues could adversely affect our business, financial condition or operating results, and further reduce the attractiveness of our solutions to new and existing marketers and cause existing marketers to reduce or cease using our solutions, which could also adversely affect our business, financial condition or operating results.

In addition, negative publicity resulting from issues related to our marketer relationships, regardless of accuracy, may damage our business by adversely affecting our ability to attract new marketers or marketing agencies and maintain and expand our relationships with existing marketers.

If the use of our solutions increases, or if marketers or partners demand more advanced features from our solutions, we will need to devote additional resources to improving our solutions, and we also may need to expand our technical infrastructure at a more rapid pace than we have in the past.

This may involve purchasing or leasing data center capacity and equipment, upgrading our technology and infrastructure and introducing new or enhanced solutions.

It may take a significant amount of time to plan, develop and test changes to our infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements.

There are inherent risks associated with changing, upgrading, improving and expanding our technical infrastructure.

Any failure of our solutions to operate effectively with future infrastructure and technologies could reduce the demand for our solutions, resulting in marketer or partner dissatisfaction and harm to our business.

Also, any expansion of our infrastructure would likely require that we appropriately scale our internal business systems and services organization, including without limitation implementation and support services, to serve our growing marketer base.

If we are unable to respond to these changes or fully and effectively implement them in a cost-effective and timely manner, our solutions may become ineffective, we may lose marketers and/or partners, and our business, financial condition and operating results may be negatively impacted.

If we fail to generate sufficient revenue to offset our contractual commitments to FIs, our business, results of operations and financial conditions could be harmed.

We have a minimum FI Share commitment with a certain FI partner totaling $10.0 million over a 12-month period following the completion of certain milestones by the FI partner, which were not met as of December 31, 2020.

Any expected shortfall penalty will be accrued during the 12-month period following the completion of the milestones.

To the extent that we are unable to generate revenue from marketers sufficient to offset our FI Share commitments and other obligations, our business, results of operations and financial conditions could be harmed.

Bringing new FI partners into our network can require considerable time and expense and can be long and unpredictable.

Our FI partners and FI partner prospects engage in highly regulated businesses, are often slow to adopt technological innovation and have rigorous standards with respect to providing third parties, like us, with access to their data.

Our operating results depend in part on expanding our FI network to maintain and enhance the scale of our solutions.

The length of time that it takes to add an FI partner to our network, from initial evaluation to integration into our network, varies substantially from FI to FI and may take several years.

Our sales and integration cycle with respect to our FI partners is long and unpredictable, requires considerable time and expense and may not ultimately be successful.

It is difficult to predict exactly when, or even if, a new FI partner will join our network and we may not generate revenue from a new FI partner in the same period as we incurred the costs associated with acquiring such FI partner, or at all.

Once an FI partner has agreed to work with us, it may take a lengthy period of time for the implementation of our solutions to be prioritized and integrated into the FI partner’s infrastructure.

Because a substantial portion of our expenses are relatively fixed in the short-term, our operating results will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our stock to decline.

Ultimately, if additions to our FI network are not realized in the time period expected or not realized at all, or if an FI partner terminates its agreement with us, our business, financial condition and operating results could be adversely affected.

We have a minimum Partner Share commitment to a certain FI partner totaling $10.0 million over a 12-month period beginning on April 1, 2022.

To the extent that we are unable to generate revenue from marketers sufficient to offset our Partner Share commitments and other obligations, our business, results of operations and financial conditions could be harmed.

If we are unable to successfully integrate Dosh’s, Bridg's and Entertainment's businesses and employees, it could have an adverse effect on our future results and the market price of our common stock.

The success of our acquisitions of Dosh, Bridg and HSP EPI Acquisition, LLC ("Entertainment") will depend, in part, on our ability to integrate Dosh’s, Bridg’s and Entertainment's operations and to realize the anticipated benefits, including in certain instances annual net operating synergies and cost reductions from combining the businesses.

These integrations may be complex and time-consuming.

The failure to successfully integrate and manage the challenges presented by the integration processes may result in our failure to achieve some or all of the anticipated benefits of the acquisitions.

Potential difficulties that may be encountered in the integration processes, which may be enhanced as a result of our efforts to integrate both businesses concurrently, include the following:

• complexities associated with managing the larger combined company;

• integrating personnel from Dosh, Bridg and Entertainment with Cardlytics personnel;

• current and prospective employees may experience uncertainty regarding their future roles with our company, which might adversely affect our ability to retrain, recruit and motivate key personnel;

• difficulties ensuring the proper controls and policies are implemented and followed in the acquired and expanded business;

• increased cyber threats due to the expanded profile of the enlarged business as well as the challenges associated with ensuring the integrating and protecting the expanded IT footprint with security and prevention, detection and response protocols;

• potential lost sales and customers if Dosh's or Bridg's or Entertainment's partners or advertising clients, or our partners or advertising clients, decide not to do business with the combined company;

• issues associated with running a consumer-facing mobile application including proper notifications, rewards, and charges;

• potential lost sales and customers if our FI or advertising clients decide not to do business with the combined company;

• potential unknown liabilities and unforeseen expenses associated with the acquisitions;

• performance shortfalls as a result of the diversion of management's attention caused by integrating the companies' operations;.

• Legal or regulatory hurdles regarding privacy or other data rights in the United States and abroad;

• Unanticipated challenges in expanding the businesses in the United States and abroad.

In addition, acquisitions are inherently risky, and our due diligence processes in connection with the acquisitions may have failed to identify significant problems, liabilities or other shortcomings or challenges of Dosh’s, Bridg's or Entertainment's businesses.

If any of these events were to occur, our ability to maintain relationships with customers, suppliers and employees or our ability to achieve the anticipated benefits of the acquisition could be adversely affected or could reduce our future earnings or otherwise adversely affect our business and financial results and, as a result, adversely affect the market price of our common stock

We have a short operating history, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

3 unchanged sentences

Any success that we may experience in the future will depend in large part on our ability to, among other things:

• maintain and expand our network of FI partners.

• maintain and expand our network of partners.

• build and maintain long-term relationships with marketers and their agencies;

• develop and offer competitive solutions that meet the evolving needs of marketers;

• expand our relationships with FI partners to enable us to use their purchase data for new solutions;

• expand our relationships with partners to enable us to use their purchase data for new solutions;

• improve the performance and capabilities of our solutions;

4 unchanged sentences

• attract, hire, train, integrate and retain qualified and motivated employees.

Any failure of our FI partners to effectively deliver and promote the online incentive programs that comprise the Cardlytics platform could materially and adversely affect our business.

We have spent the last several years and significant resources building out technology integrations with our FI partners to facilitate the delivery of incentive programs to our FIs’ customers and measuring those customers subsequent in-store or digital spending.

We are also reliant on our network of FI partners to promote their digital incentive programs, increase customer awareness and leverage additional customer outreach channels like email, all of which can increase customer engagement, as well as expand our network of FI partners.

We believe that key factors in the success and effectiveness of our incentive program include the level of accessibility and prominence of the program on the FI partners’ website and mobile applications, as well as the user interface through which a customer is presented with marketing content.

In certain cases, we have little control over the prominence of the incentive program and design of the user interface that our FI partners choose to use.

To the extent that our FI partners deemphasize incentive programs, make incentive programs difficult to locate on their website and/or mobile applications and/or fail to provide a user interface that is appealing to FIs' customers, FIs' customers may be less likely to engage with the incentive programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

In addition, a failure by FIs to properly deliver or sufficiently promote marketing campaigns would reduce the efficacy of our solutions and impair our ability to attract and retain marketers and their agencies.

Any failure of our partners to effectively deliver and promote the online incentive programs that comprise the Cardlytics platform could materially and adversely affect our business.

We have spent the last several years and significant resources building out technology integrations with our partners to facilitate the delivery of incentive programs to our partners’ customers and measuring those customers subsequent in-store or digital spending.

We are also reliant on our network of partners to promote their digital incentive programs, increase customer awareness and leverage additional customer outreach channels like email, all of which can increase customer engagement, as well as expand our network of partners.

We believe that key factors in the success and effectiveness of our incentive program include the level of accessibility and prominence of the program on the partners’ website and mobile applications, as well as the user interface through which a customer is presented with marketing content.

In certain cases, we have little control over the prominence of the incentive program and design of the user interface that our partners choose to use.

To the extent that our partners de-emphasize incentive programs, make incentive programs difficult to locate on their website and/or mobile applications and/or fail to provide a user interface that is appealing to partners' customers, partners' customers may be less likely to engage with the incentive programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

In addition, a failure by our partners to properly deliver or sufficiently promote marketing campaigns would reduce the efficacy of our solutions and impair our ability to attract and retain marketers and their agencies.

As a result, the revenue we generate from our Cardlytics platform solution may be adversely affected, which would materially and adversely affect our business, financial condition and results of operations.

Our business could be adversely affected if marketers or their agencies are not satisfied with our solutions or our systems and infrastructure fail to meet their needs.

We derive nearly all of our revenue from marketers and their agencies.

Accordingly, our business depends on our ability to satisfy marketers and their agencies with respect to their marketing needs.

With respect to the Cardlytics platform, we rely on our Offer Management System ("OMS") to facilitate the creation of marketing campaigns and evaluate the results of campaigns, and our Offer Placement System ("OPS"), to track impressions, engagement, activation and redemptions and to target consumers and present offers.

Further, we are in the process of updating our platform with a self-service tool.

Any failure of, or delays in the performance (or in the case of the self-service tool, the rollout) of, our systems, including without limitation our OMS, OPS, or self-service tool, could cause service interruptions or impaired system performance.

Such failures in our systems could cause us to maximize our earning potential with respect to any given marketing campaign.

Such failures in our systems could also cause us to over-run on campaigns, thus committing us to higher redemptions, which may negatively affect the profitability of the affected campaigns.

If the use of our solutions increases, or if marketers or FI partners demand more advanced features from our solutions, we will need to devote additional resources to improving our solutions, and we also may need to expand our technical infrastructure at a more rapid pace than we have in the past.

This may involve purchasing or leasing data center capacity and equipment, upgrading our technology and infrastructure and introducing new or enhanced solutions.

There are inherent risks associated with changing, upgrading, improving and expanding our technical infrastructure.

Any failure of our solutions to operate effectively with future infrastructure and technologies could reduce the demand for our solutions, resulting in marketer or FI partner dissatisfaction and harm to our business.

If we are unable to respond to these changes or fully and effectively implement them in a cost-effective and timely manner, our solutions may become ineffective, we may lose marketers and/or FI partners, and our business, financial condition and operating results may be negatively impacted.

If we do not effectively grow and train our sales team, we may be unable to add new marketers or increase sales to our existing marketers and our business will be adversely affected.

We continue to be substantially dependent on our sales team to obtain new marketers and to drive sales with respect to our existing marketers.

We believe that the characteristics and skills of the best salespeople for our solutions are still being defined, as our market is relatively new.

Further, we believe that there is, and will continue to be, significant competition for sales personnel with the skills and technical knowledge that we require.

New hires require significant training and it may take significant time before they achieve full productivity.

In addition, as we continue to grow, a large percentage of our sales team will be new to our company and our solutions.

We generally do not have long-term commitments from marketers, and if we are unable to retain and increase sales of our solutions to marketers and their agencies or attract new marketers and their agencies, our business, financial condition and operating results would be adversely affected.

13 unchanged sentences

Larger marketers may themselves have a substantial amount of purchase data and they may also seek to augment their own purchase data with additional purchase, impression and/or demographic data acquired from third-party data providers, which may allow them to develop, individually or with partners, internal targeting and measurement capabilities.

Because many of our agreements are not long-term with our marketers or their agencies, we may not be able to accurately predict future revenue streams, and we cannot guarantee that our current marketers will continue to use our solutions, or that we will be able to replace departing marketers with new marketers that provide us with comparable revenue.

Because many of our agreements with our marketers or their agencies are not long-term, we may not be able to accurately predict future revenue streams, and we cannot guarantee that our current marketers will continue to use our solutions, or that we will be able to replace departing marketers with new marketers that provide us with comparable revenue.

If we are unable to retain and increase sales of our solutions to existing marketers and their agencies or attract new marketers and their agencies for any of the reasons above or for other reasons, our business, financial condition and operating results would be adversely affected.

1 unchanged sentence

We have incurred net losses since inception and expect to incur net losses in the future.

We incurred net losses of $53.0 million, $17.1 million and 55.4 million in 2018, 2019 and 2020, respectively.

We incurred net losses of $17.1 million, $55.4 million and $128.6 million in 2019, 2020 and 2021 respectively, respectively.

As of December 31, 2021, we had an accumulated deficit of $522.6 million.

11 unchanged sentences

The market for purchase intelligence is nascent and we believe that there is no one company with which we compete directly across our range of solutions.

With respect to the Cardlytics platform, we believe that we are the only company that enables marketing through FI channels at scale.

In the future, we may face competition from online retailers, credit card companies, established enterprise software companies, advertising and marketing agencies, digital publishers and mobile pay providers with access to a substantial amount of consumer purchase data.

With respect to the Cardlytics platform, we believe that we are the only company that enables marketing through FI channels at scale, although we believe we currently have competition from other companies that deliver similar solutions on a smaller scale.

In the future, we may face competition from online retailers, credit card companies, established enterprise software companies, advertising and marketing companies and agencies, digital publishers and mobile pay providers with access to a substantial amount of consumer purchase data.

While we may successfully partner with a wide range of companies that are to some extent currently competitive to us, these companies may become more competitive to us in the future.

11 unchanged sentences

Our future success depends on our ability to adapt and innovate.

To attract, retain and increase new marketers and FI partners, we will need to expand and enhance our solutions to meet changing needs, add functionality and address technological advancements.

If we are unable to adapt our solutions to evolving trends in the marketing industry, if we are unable to properly identify and prioritize appropriate solution development projects or if we fail to develop and effectively market new solutions or enhance existing solutions to address the needs of existing and new marketers and FI partners, we may not be able to achieve or maintain adequate market acceptance and penetration of our solutions, and our solutions may become less competitive or obsolete.

To attract, retain and increase new marketers and partners, we will need to expand and enhance our solutions to meet changing needs, add functionality and address technological advancements.

If we are unable to adapt our solutions to evolving trends in the marketing industry, if we are unable to properly identify and prioritize appropriate solution development projects or if we fail to develop and effectively market new solutions or enhance existing solutions to address the needs of existing and new marketers and partners, we may not be able to achieve or maintain adequate market acceptance and penetration of our solutions, and our solutions may become less competitive or obsolete.

In addition, new, more effective or less costly technologies may emerge that use data sources that we do not have access to, that use entirely different analytical methodologies than we do or that use other indicators of purchases by consumers.

2 unchanged sentences

Our ability to collect and use data may be restricted or prevented by a number of other factors, including:

• the failure of our network or software systems, or the network or software systems of our FI partners;

• decisions by our FI partners to restrict our ability to collect data from them (which decision they may make at their discretion) or to refuse to implement the mechanisms that we request to ensure compliance with our legal obligations or technical requirements;

• decisions by our FI partners to limit our ability to use their purchase data outside of the applicable banking channel;

• decisions by our FIs’ customers to opt out of the incentive program or to use technology, such as browser settings, that reduces our ability to deliver relevant advertisements;

• interruptions, failures or defects in our or our FI partners’ data collection, mining, analysis and storage systems;

• the failure of our network or software systems, or the network or software systems of our partners;

• decisions by our partners to restrict our ability to collect data from them (which decision they may make at their discretion) or to refuse to implement the mechanisms that we request to ensure compliance with our legal obligations or technical requirements;

• decisions by our partners to limit our ability to use their purchase data outside of the applicable banking channel;

• decisions by our partners’ customers to opt out of the incentive program or to use technology, such as browser settings, that reduces our ability to deliver relevant advertisements;

• interruptions, failures or defects in our or our partners’ data collection, mining, analysis and storage systems;

• changes in regulations impacting the collection and use of data;

• changes in browser or device functionality and settings, and other new technologies, which impact our FI partners’ ability to collect and/or share data about their customers;

• changes in browser or device functionality and settings, and other new technologies, which impact our partners’ ability to collect and/or share data about their customers;

• changes in international laws, rules, regulations and industry standards or increased enforcement of international laws, rules, regulations, and industry standards.

1 unchanged sentence

The efficacy of some of our solutions depends upon third-party data providers.

We rely on several third parties to assist us in matching our anonymized identifiers, which we call Cardlytics IDs, with third-party identifiers.

This matching process enables us to use purchase intelligence to measure in-store and online campaign sales impact or provide marketers with valuable visibility into the behaviors of current or prospective customers both within and outside the context of their marketing efforts.

If any of these key data providers were to withdraw or withhold their identifiers from us, our ability to provide our solutions could be adversely affected.

Replacements for these third-party identifiers may not be available in a timely manner or under economically beneficial terms, or at all.

We rely on several third parties to assist us in matching our anonymized identifiers with third-party identifiers.

This matching process enables us to, among other things, use purchase intelligence to measure in-store and online campaign sales impact or provide marketers with valuable visibility into the behaviors of current or prospective customers both within and outside the context of their marketing efforts.

If any of these key data providers were to withdraw or withhold their identifiers from us, our ability to provide our solutions could be adversely affected, and certain marketers may severely limit their spending on our solutions, or stop spending with us entirely.

Replacements for any of these third-party identifiers may not fit the needs of certain marketers, or be available in a timely manner or under economically beneficial terms, or at all.

Defects, errors or delays in our solutions could harm our reputation, which would harm our operating results.

1 unchanged sentence

This risk is compounded by the complexity of the technology underlying our solutions and the large amounts of data that we leverage and process.

In addition, with regard to the Cardlytics platform, if we are unable to attribute Consumer Incentives to our FIs’ customers in a timely manner, our FI partners may limit or discontinue their use of our solutions.

In addition, with regard to the Cardlytics platform, if we are unable to attribute Consumer Incentives to our partners’ customers in a timely manner, our FI partners may limit or discontinue their use of our solutions.

Any such error, failure, malfunction, disruption or delay could result in damage to our reputation and could harm our business, financial condition and operating results.

2 unchanged sentences

We contract with our primary third-party data center, located in Atlanta, Georgia, and our redundancy data center, located in Suwanee, Georgia, pursuant to agreements that expire in 2023, subject to earlier termination upon material breach and a failure to cure.

If for any reason our arrangements with our third-party data centers are terminated, or if we are unable to renew our agreements on commercially reasonable terms, we may be required to transfer that portion of our operations to new data center facilities, and we may incur significant costs and possible service interruption in connection with doing so.

Further, protection of our third-party data centers against damage or interruption from fire, flood, tornadoes, power loss, telecommunications or equipment failure or other disasters and events beyond our control is important to our continued success.

Any damage to, or failure of, the systems of the data centers that we utilize, or of our own equipment located within such data centers, could result in interruptions to the availability or functionality of our solutions.

In addition, the failure of the data centers that we utilize to meet our capacity requirements could result in interruptions in the availability or functionality of our solutions or impede our ability to scale our operations.

Any damage to the data centers that we utilize, or to our own equipment located within such data centers, that causes loss of capacity or otherwise causes interruptions in our operations could materially adversely affect our ability to quickly and effectively respond to our marketers’ or FI partners’ requirements, which could result in loss of their confidence, adversely impact our ability to attract new marketers and/or FI partners and force us to expend significant resources.

If for any reason our arrangements with our third-party data centers or other data-hosting solutions are terminated, or if we are unable to renew our agreements on commercially reasonable terms, we may be required to transfer that portion of our operations to new data center facilities or other data-hosting solutions, and we may incur significant costs and possible service interruption in connection with doing so.

Further, protection of our third-party data centers or other data-hosting solutions against damage or interruption from fire, flood, tornadoes, power loss, telecommunications or equipment failure or other disasters and events beyond our control is important to our continued success.

Any damage to, or failure of, the systems of the data centers or other data-hosting solutions that we utilize, or of our own equipment located within such data centers, could result in interruptions to the availability or functionality of our solutions.

In addition, the failure of the data centers or other data-hosting solutions that we utilize to meet our capacity requirements could result in interruptions in the availability or functionality of our solutions or impede our ability to scale our operations.

Any damage to the data centers or other data-hosting solutions that we utilize, or to our own equipment located within such data centers, that causes loss of capacity or otherwise causes interruptions in our operations could materially adversely affect our ability to quickly and effectively respond to our marketers’ or partners’ requirements, which could result in loss of their confidence, adversely impact our ability to attract new marketers and/or partners and force us to expend significant resources.

The occurrence of any such events could adversely affect our business, financial condition and operating results.

3 unchanged sentences

Seasonality could have a material impact on our revenue, operating results, cash flow from operations and other key performance metrics from period to period.

Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, or our corporate culture is negatively impacted by the COVID-19 pandemic, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be harmed.

As of December 31, 2021, we had 591 full-time employees.

We intend to further expand our overall headcount and operations, with no assurance that we will be able to do so while effectively maintaining our corporate culture.

Additionally, our corporate culture may be negatively impacted by the COVID-19 pandemic.

We believe our corporate culture is one of our fundamental strengths as it enables us to attract and retain top talent and deliver superior results for our customers.

As we grow and change, integrate acquired businesses and their employees, and as the COVID-19 pandemic continues, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively.

In turn, the failure to preserve our culture could negatively affect our ability to attract, recruit, integrate and retain employees, continue to perform at current levels and effectively execute our business strategy.

If we are unable to attract, integrate and retain additional qualified personnel, including top technical talent, our business could be adversely affected.

Our future success depends in part on our ability to identify, attract, integrate and retain highly skilled technical, managerial, sales and other personnel, including top technical talent from the industry and top research institutions.

We face intense competition for qualified individuals from numerous other companies, including other software and technology companies, many of whom have greater financial and other resources than we do.

These companies also may provide more diverse opportunities and better chances for career advancement.

Some of these characteristics may be more appealing to high-quality candidates than those we have to offer.

In addition, new hires often require significant training and, in many cases, take significant time before they achieve full productivity.

We may incur significant costs to attract and retain qualified personnel, including significant expenditures related to salaries and benefits and compensation expenses related to equity awards and we may lose new employees to our competitors or other companies before we realize the benefit of our investment in recruiting and training them.

Moreover, new employees may not be or become as productive as we expect, as we may face challenges in adequately or appropriately integrating them into our workforce and culture.

In addition, as we move into new geographies, we will need to attract and recruit skilled personnel in those areas.

We have little experience with recruiting in geographies outside of the U.S., and may face additional challenges in attracting, integrating and retaining international employees.

If we are unable to attract, integrate and retain suitably qualified individuals who are capable of meeting our growing technical, operational and managerial requirements, on a timely basis or at all, our business will be adversely affected.

We are dependent on the continued services and performance of our senior management and other key personnel, the loss of any of whom could adversely affect our business.

Our future success depends in large part on the continued contributions of our senior management and other key personnel, including our cofounder and chief executive officer, Lynne Laube.

In particular, the leadership of key management personnel is critical to the successful management of our company, the development of our solutions and our strategic direction.

We do not maintain “key person” insurance for any member of our senior management team or any of our other key employees.

Our senior management and key personnel are all employed on an at-will basis, which means that they could terminate their employment with us at any time, for any reason and without notice.

The loss of any of our key management personnel could significantly delay or prevent the achievement of our development and strategic objectives and adversely affect our business.

Further, if members of our management and other key personnel in critical functions across our organization are unable to perform their duties or have limited availability due to COVID-19, we may not be able to execute on our business strategy and/or our operations may be negatively impacted.

Our international sales and operations subject us to additional risks that can adversely affect our business, operating results and financial condition.

1 unchanged sentence

While substantially all of our operations are located in the U.S., we have an office in the U.K.

and a research and development and support office in Visakhapatnam, India and may continue to expand our international operations as part of our growth strategy.

and Canada, and a research and development and support office in Visakhapatnam, India and may continue to expand our international operations as part of our growth strategy.

Our ability to convince marketers to expand their use of our solutions or renew their agreements with us is directly correlated to our direct engagement with such marketers or their agencies.

16 unchanged sentences

Bribery Act, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our software in certain foreign markets, and the risks and costs of non-compliance;

• potential changes in a specific country’s or region’s political or economic climate, including the current hostilities between Russia and Ukraine;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements;

10 unchanged sentences

If we are not able to scale our IT infrastructure in a cost-effective and secure manner, our ability to offer competitive solutions will be harmed and our business, financial condition and operating results may suffer.

We must also continue to manage our employees, operations, finances, research and development and capital investments efficiently.

We must also continue to manage our employees, operations, finances, research and development and capital investments efficiently in an environment where nearly all employees are working from home.

Our productivity and the quality of our solutions may be adversely affected if we do not integrate and train our new employees quickly and effectively or if we fail to appropriately coordinate across our executive, research and development, technology, service development, analytics, finance, human resources, marketing, sales, operations and customer support teams.

2 unchanged sentences

Failure to manage our future growth effectively could cause our business to suffer, which, in turn, could have an adverse impact on our business, financial condition and operating results.

As of December 31, 2020, we had 471 full-time employees.

We intend to further expand our overall headcount and operations, with no assurance that we will be able to do so while effectively maintaining our corporate culture.

Additionally, our corporate culture may be negatively impacted by the COVID-19 pandemic.

We believe our corporate culture is one of our fundamental strengths as it enables us to attract and retain top talent and deliver superior results for our customers.

As we grow and change, and as the COVID-19 pandemic continues, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively.

We are dependent on the continued services and performance of our senior management and other key personnel, the loss of any of whom could adversely affect our business.

Our future success depends in large part on the continued contributions of our senior management and other key personnel, including our cofounder and chief executive officer, Lynne Laube.

In particular, the leadership of key management personnel is critical to the successful management of our company, the development of our solutions and our strategic direction.

We do not maintain “key person” insurance for any member of our senior management team or any of our other key employees.

Our senior management and key personnel are all employed on an at-will basis, which means that they could terminate their employment with us at any time, for any reason and without notice.

The loss of any of our key management personnel could significantly delay or prevent the achievement of our development and strategic objectives and adversely affect our business.

Further, if members of our management and other key personnel in critical functions across our organization are unable to perform their duties or have limited availability due to COVID–19, we may not be able to execute on our business strategy and/or our operations may be negatively impacted.

If we are unable to attract, integrate and retain additional qualified personnel, including top technical talent, our business could be adversely affected.

These companies also may provide more diverse opportunities and better chances for career advancement.

Some of these characteristics may be more appealing to high-quality candidates than those we have to offer.

In addition, new hires often require significant training and, in many cases, take significant time before they achieve full productivity.

Moreover, new employees may not be or become as productive as we expect, as we may face challenges in adequately or appropriately integrating them into our workforce and culture.

In addition, as we move into new geographies, we will need to attract and recruit skilled personnel in those areas.

We have little experience with recruiting in geographies outside of the U.S., and may face additional challenges in attracting, integrating and retaining international employees.

If currency exchange rates fluctuate substantially in the future, the results of our operations could be adversely affected.

3 unchanged sentences

Fluctuations in the exchange rates between the U.S.

dollar, British pound and Indian rupee could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

dollar, British pound, Canadian dollar and Indian rupee could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

Although we may in the future decide to undertake foreign exchange hedging transactions to cover a portion of our foreign currency exchange exposure, we currently do not hedge our exposure to foreign currency exchange risks.

30 unchanged sentences

The inability to integrate successfully the business, technologies, products, personnel or operations of any acquired business, or any significant delay in achieving integration, could have a material adverse effect on our business, financial condition and operating results.

If our proposed acquisition of Dosh is not completed, we will have incurred substantial costs that may adversely affect our financial results and operations and the market price of our common stock.

If our acquisition of Dosh is not completed, the price of our common stock may decline to the extent that the current market price of our common stock reflects a market assumption that the acquisition will be completed.

In addition, we have incurred and will incur substantial costs in connection with the proposed acquisition.

These costs are primarily associated with the fees of attorneys, accountants and our financial advisors.

In addition, we diverted significant management resources in an effort to complete the acquisition and are subject to restrictions contained in the Merger Agreement on the conduct of our business during the pendency of the acquisition.

If the acquisition is not completed, we will have received little or no benefit in respect of such costs incurred.

Also, if the acquisition is not completed under certain circumstances that resulted in litigation, we may be exposed to monetary damages.

Further, if the acquisition is not completed, we may experience negative reactions from the financial markets and our FIs, marketers, and employees.

Each of these factors may adversely affect the trading price of our common stock and our financial results and operations.

If we are unable to successfully integrate Dosh’s business and employees, it could have an adverse effect on our future results and the market price of our common stock.

The success of our acquisition of Dosh will depend, in part, on our ability to integrate Dosh’s operations and to realize the anticipated benefits, including annual net operating synergies and cost reductions from combining the businesses.

This integration may be complex and time-consuming.

The failure to successfully integrate and manage the challenges presented by the integration process may result in our failure to achieve some or all of the anticipated benefits of the acquisition.

Potential difficulties that may be encountered in the integration process include the following:

• complexities associated with managing the larger combined company;

• integrating personnel from the two companies;

• potential lost sales and customer if Dosh's FI or advertising clients decide not to do business with the combined company;

• potential lost sales and customers if our FI or advertising clients decide not to do business with the combined company;

• potential unknown liabilities and unforeseen expenses associated with the acquisition;

• performance shortfalls as a result of the diversion of management's attention caused by integrating the companies' operations.

In addition, acquisitions are inherently risky, and our due diligence processes in connection with the acquisition may fail to identify significant problems, liabilities or other shortcomings or challenges of Dosh’s business.

Charges to earnings resulting from our acquisitions may cause our operating results to suffer .

Under accounting principles, we have allocated the total purchase price of Dosh’s and Bridg’s net tangible assets and intangible assets based on their fair values as of the date of the acquisitions, and we have recorded the excess of the purchase price over those fair values as goodwill.

Our management’s estimates of fair value will be based upon assumptions that they believe to be reasonable but that are inherently uncertain.

The following factors, among others, could result in material charges that would cause our financial results to be negatively impacted:

• impairment of goodwill;

• charges for the amortization of identifiable intangible assets and for stock-based compensation;

• accrual of newly identified pre-acquisition contingent liabilities that are identified subsequent to the finalization of the purchase price allocation.

Additional costs may include costs of employee redeployment, relocation and retention, including salary increases or bonuses, taxes and termination of contracts that provide redundant or conflicting services.

Some of these costs may have to be accounted for as expenses that would negatively impact our results of operations.

We may in the future may become involved in securities class action litigation that could divert management's attention and harm our business and insurance coverage may not be sufficient to cover all costs and damages.

It is common for securities class-action litigation to follow an acquisition.

It is common for securities class-action litigation to follow acquisitions.

Responding to any litigation could divert management's attention and harm our business.

10 unchanged sentences

Regulatory, legislative or self-regulatory developments regarding Internet privacy matters could adversely affect our ability to conduct our business.

Through our consumer application, users accumulate rewards that could be deemed subject to abandoned property laws and/or could be deemed to constitute stored value subject to certain legal requirements under applicable state and federal laws and regulations.

The Dosh application enables consumers to accumulate non-monetary rewards (“Dosh Rewards”) within the application, which may be converted to U.S.

dollars only when certain requirements are met.

Dosh Rewards have no cash value but users are able to receive U.S.

dollar payouts from Dosh based on Dosh Rewards provided that certain requirements are met.

State regulators could deem that Dosh Rewards constitute property that is subject to state property laws, which could potentially create a large liability for us as well as legal and related compliance obligations and costs to manage escheatment of any Dosh Rewards constituting abandoned property.

Additionally, state and/or federal regulators could conclude that Dosh Rewards constitute monetary value or money and therefore subject to regulation pursuant to laws regulating the issuance, sale, redemption, and maintenance of stored value, prepaid access, or gift cards (or similar terminology).

Such laws and regulations may include, but are not necessarily limited to, U.S.

state money-transmitter licensing laws and the federal Bank Secrecy Act (including registration requirements), and our failure to comply with applicable laws could expose us to monetary penalties or damages and adversely affect our ability to operate our business in its current form.

Bringing new FI partners into our network can require considerable time and expense and can be long and unpredictable.

Our operating results depend in part on expanding our FI network to maintain and enhance the scale of our solutions.

The length of time that it takes to add an FI partner to our network, from initial evaluation to integration into our network, varies substantially from FI to FI and may take several years.

Our sales and integration cycle with respect to our FI partners is long and unpredictable, requires considerable time and expense and may not ultimately be successful.

Once an FI partner has agreed to work with us, it may take a lengthy period of time for the implementation of our solutions to be prioritized and integrated into the FI partner’s infrastructure.

Bringing new FI partners into our network may impede our ability to accurately forecast the performance of our network.

Bringing new FI partners into our network may impede our ability to accurately predict how certain marketing campaigns will perform, and thus may impede our ability to accurately forecast the performance of our network.

Such inaccurate predictions could result in marketing campaigns underperforming, which impact the total fees we can collect from marketers, or over performing, which may result is us paying certain Consumer Incentives to consumers without adequate compensation from the marketers.

Such inaccurate predictions could result in marketing campaigns underperforming, which impacts the total fees we can collect from marketers, or over performing, which may result is us paying certain Consumer Incentives to consumers without adequate compensation from the marketers.

The amount of time it will take us to be able to understand the impact of a new FI partner on our network is uncertain and difficult to predict.

1 unchanged sentence

If we are not able to maintain and enhance our brand, our business, financial condition and operating results may be adversely affected.

We believe that developing and maintaining awareness of the Cardlytics brand in a cost-effective manner is critical to achieving widespread acceptance of our existing solutions and future solutions and is an important element in attracting new marketers and FI partners.

Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.

Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to deliver valuable solutions for our marketers, their agencies and our FI partners.

In the past, our efforts to build our brand have involved significant expense.

Brand promotion activities may not yield increased revenue and billings, and even if they do, any increased revenue and billings may not offset the expenses that we incurred in building our brand.

If we fail to successfully promote and maintain our brand or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract enough new marketers or FI partners or retain our existing marketers or FI partners and our business could suffer.

If we fail to successfully promote and maintain our brand or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract enough new marketers or partners or retain our existing marketers or partners and our business could suffer.

Risks Related to our Outstanding Convertible Senior Notes

58 unchanged sentences

ASU 2020-06 will be effective for SEC-reporting entities for fiscal years beginning after December 15, 2021 (or, in the case of smaller reporting companies, December 15, 2023), including interim periods within those fiscal years.

However, early adoption is permitted in certain circumstances for fiscal years beginning after December 15, 2020, including interim periods within those fiscal years.

For reporting periods reported after January 1, 2022 we will adopt this standard using the modified retrospective method which allows for a cumulative-effect adjustment to the opening balance sheet without restating prior periods.

When effective, we expect the elimination of the separate accounting described above to reduce the interest expense that we expect to recognize for the notes for accounting purposes.

6 unchanged sentences

Risks Related to Regulatory and Intellectual Property Matters

Regulatory, legislative or self-regulatory developments regarding Internet privacy matters could adversely affect our ability to conduct our business.

We, our FI partners and our marketers are subject to a number of domestic and international privacy and security laws, rules and regulations that apply to online services and the Internet generally.

These laws, rules and regulations often include restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of personal data.

In the U.S., the rules and regulations to which we, directly or contractually through our FI partners, or our marketers may be subject include those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal frameworks with which we, directly or contractually through our FI partners, or our marketers may be required to comply.

For example, in the U.S., the California Consumer Privacy Act (“CCPA”), took effect on January 1, 2020.

The CCPA creates privacy rights for individual California consumers and increases the privacy and security obligations on entities handling broadly defined personal information.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

We and our FI partners are subject to stringent and changing privacy and data security laws, contractual obligations, self-regulatory schemes, government regulation, and standards related to data privacy and security.

The actual or perceived failure by us, our customers, our partners, or other third parties upon whom we rely to comply with such obligations could harm our reputation, result in significant expense, subject us to significant fines and liability or otherwise adversely affect our business.

We collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect and share personal information and other information (“Process” or “Processing”) necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.

We, our FI partners, our marketers and other third parties upon whom we rely are subject to a number of domestic and international privacy and security laws, rules, regulations and guidance regarding privacy, information security and Processing (“Data Protection Laws”) as well as laws and regulations regarding online services and the Internet generally.

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers may be subject include those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

The regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many of these obligations conflict with each other, and interpretation of these laws, rules and regulations and their application to our solutions in the U.S.

and foreign jurisdictions is ongoing and cannot be fully determined at this time.

A number of existing bills are pending in the U.S.

Congress that contain provisions that would regulate how companies can use cookies and other tracking technologies to collect and utilize user information.

Additionally, new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally.

regulators also may implement “Do-Not-Track” legislation, particularly if the industry does not implement a standard.

Effective January 1, 2014, the California Governor signed into law an amendment to the California Online Privacy Protection Act of 2003.

Such amendment requires operators of commercial websites and online service providers, under certain circumstances, to disclose in their privacy policies how such operators and providers respond to browser “do not track” signals.

In addition, the regulatory environment for the collection and use of consumer data by marketers is evolving in the U.S.

and internationally and is currently, in part, a self-regulatory framework, which relies on market participants to ensure self-compliance.

The voluntary nature of this self-regulatory framework may change.

The California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the United States.

The CCPA gives California residents expanded rights to request access to and deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA also increases the privacy and security obligations on entities handling personal information, which is broadly defined under the law.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages of up to $750 per citizen, which is expected to increase data breach litigation.

The CCPA also imposes requirements on businesses that “sell” information (which is defined broadly under the CCPA);

there is significant ambiguity regarding what constitutes a sale and many of our or our partner’s business practices may qualify.

Further, California voters approved a new privacy law, the California Privacy Rights Act (“CPRA”), in the November 3, 2020 election.

2 unchanged sentences

New legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally.

Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts

In the EU, the European Commission adopted the European General Data Protection Regulation ("GDPR"), which went into effect in May 2018.

For example, on March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act, or CDPA, which becomes effective on January 1, 2023, and on June 8, 2021, Colorado enacted the Colorado Privacy Act, or CPA, which takes effect on July 1, 2023.

The CPA and CDPA are similar to the CCPA and CPRA but aspects of these state privacy statutes remain unclear, resulting in further legal uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply.

Complying with the CCPA, CPRA, CDPA, CPA, or other laws, regulations, amendments to or re-interpretations of existing laws and regulations, and contractual or other obligations relating to privacy, data protection, data transfers, data localization, or information security may require us to make changes to our services to enable us or our customers to meet new legal requirements, incur substantial operational costs, modify our data practices and policies, and restrict our business operations.

Any actual or perceived failure by us to comply with these laws, regulations, or other obligations may lead to significant fines, penalties, regulatory investigations, lawsuits, significant costs for remediation, damage to our reputation, or other liabilities.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal frameworks with which we, directly or contractually through our partners, our marketers or other third parties upon whom we rely may be required to comply, even if we are not established or based in such jurisdictions.

An example of the type of international regulation to which we may be subject is the U.K.’s Privacy and Electronic Communications Regulations 2011 (“PECR”), which implements the requirements of Directive 2009/136/EC (which amended Directive 2002/58/EC), which is known as the ePrivacy Directive.

The PECR regulates various types of electronic direct marketing that use cookies and similar technologies.

The PECR also imposes sector-specific breach reporting requirements, but only as applicable to providers of particular public electronic communications services.

Additional EU member state laws of this type may follow.

The European General Data Protection Regulation ("GDPR") is another example of the type of data protection legislation that may present a risk to our business.

The GDPR imposes additional obligations and risk upon our business and increases substantially the penalties to which we could be subject in the event of any non–compliance.

The GDPR imposes more stringent data protection requirements and requires us and our customers to give more detailed disclosures about how we collect, use and share personal information;

contractually commit to data protection measures in our contracts with clients;

maintain adequate data security measures;

notify regulators and affected individuals of certain data breaches;

meet extensive privacy governance and documentation requirements;

and honor individuals’ data protection rights, including their rights to access, correct and delete their personal information.

The GDPR provides greater penalties for noncompliance than previous data protection laws.

Administrative fines under the GDPR can amount up to 20 million Euros or four percent of the group’s annual global turnover, whichever is highest.

These existing and proposed laws, regulations and industry standards can be costly to comply with and can delay or impede the development of new solutions, result in negative publicity and reputational harm, increase our operating costs, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices.

Further, the Court of Justice of the European Union ruled in July 2020 that the Privacy Shield, used by thousands of companies to transfer data between the European Union and United States, was invalid and could no longer be used.

In September 2020, Switzerland concluded that the Swiss-U.S.

Privacy Shield Framework does not provide an adequate level of protection for data transfers from Switzerland to the United States.

Alternative transfer mechanisms may be used, including the standard contractual clauses (“SCCs”), while the authorities interpret the decisions and scope of the invalidated Privacy Shield, but the SCCs have also been called into question in the same ruling that invalidated Privacy Shield.

At present, there are few if any viable alternatives to the SCCs, so future developments may necessitate further expenditures on local infrastructure, changes to internal business processes, or may otherwise affect or restrict sales and operations.

We may also be obligated to assist our customers, partners, and vendors with their own compliance obligations under the GDPR, which could require expenditure of significant resources.

Assisting our customers, partners, and vendors in complying with the GDPR, or complying with the GDPR ourselves, may cause us to incur substantial operational costs or require us to change our business practices.

The GDPR also imposes strict rules on the transfer of personal data out of the European Economic Area, or EEA, to the United States.

Although one of the primary mechanisms for legally transferring personal data (known as Privacy Shield) was invalidated, the European Commission released a set of “Standard Contractual Clauses” in June 2021 that is designed to be a valid mechanism by which entities can validly transfer personal data out of the EEA to jurisdictions that the European Commission has not found to provide an adequate level of protection.

The Standard Contractual Clauses, however, require parties that rely upon that legal mechanism to comply with additional obligations, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data.

Moreover, due to potential legal challenges, there exists some uncertainty regarding whether the Standard Contractual Clauses will remain a valid mechanism for transfers of personal data out of the EEA.

Additionally, Brexit took effect in January 2020, which will lead to further legislative and regulatory changes.

While the Data Protection Act of 2018, which “implements” and complements the GDPR achieved Royal Assent on May 23, 2018 and is now effective in the United Kingdom, it is still unclear whether transfer of data from the EEA to the United Kingdom will remain lawful in the long term under the GDPR.

With the expiry of the transition period on December 31, 2020, companies will have to comply with the GDPR and the GDPR as incorporated into United Kingdom national law, which has the ability to separately fine up to the greater of £17.5 million or 4% of global turnover.

The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example around how data can lawfully be transferred between each jurisdiction, which exposes us to further compliance risk.

We may incur liabilities, expenses, costs, and other operational losses under the GDPR and under privacy laws of applicable EU Member States and the United Kingdom in connection with any measures we take to comply with them.

Complying with these numerous, complex and often changing laws and regulations is expensive and difficult, and failure to comply with any privacy laws or data security laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive or confidential patient or consumer information, whether by us, one of our business associates or another third-party, could adversely affect our business, financial condition and results of operations, including but not limited to:

investigation costs, material fines and penalties;

compensatory, special, punitive and statutory damages;

consent orders regarding our privacy and security practices;

requirements that we provide notices, credit monitoring services and/or credit restoration services or other relevant services to impacted individuals;

adverse actions against our licenses to do business;

and injunctive relief.

Further, many federal, state and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations.

If passed, we will likely incur additional expenses and costs associated with complying with such laws.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our FI partners or marketers may limit the use and adoption of, and reduce the overall demand for, our solutions.

Legislation and regulation of online businesses, including privacy and data protection regimes, is expansive, not clearly defined and rapidly evolving.

Such regulation could create unexpected costs, subject us to enforcement actions for compliance failures, or restrict portions of our business or cause us to change our business model.

Although the European Commission announced a decision of “adequacy” concluding that the UK ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the EEA to the UK, some uncertainty remains, as this adequacy determination must be renewed after four years and may be modified or revoked in the interim.

In addition to governmental regulation, we are also subject to the terms of our external and internal privacy and security policies, representations, certifications, standards, publications and frameworks, and contractual obligations to third parties related to privacy, information security and Processing (“Data Protection Obligations”), including without limitation, operating rules and standards imposed by industry organizations.

Government regulation and industry standards may increase the costs of doing business online.

Federal, state, municipal and foreign governments and agencies have adopted and could in the future adopt, modify, apply or enforce laws, policies, regulations and standards covering user privacy, data security, technologies such as cookies that are used to collect, store and/or process data, online marketing, the use of data to inform marketing, the taxation of products and services, unfair and deceptive practices, and the collection (including the collection of information), use, processing, transfer, storage and/or disclosure of data associated with unique individual Internet users.

Although we do not believe we have collected or retained data that is traditionally considered PII under U.S.

law, such as names, email addresses, addresses, phone numbers, social security numbers, credit card numbers, financial data or health data, we typically do collect and store Internet Protocol addresses and other device identifiers, which are or may be considered personal data in some jurisdictions or otherwise may be the subject of legislation or regulation.

Furthermore, we may elect to use PII in the future for our current solutions or solutions we may introduce.

In addition, certain U.S.

laws impose requirements on the collection and use of information from or about users or their devices.

Other existing laws may in the future be revised, or new laws may be passed, to impose more stringent requirements on the use of identifiers to collect user information, including information of the type that we collect.

Changes in regulations could affect the type of data that we may collect;

restrict our ability to use identifiers to collect information, and, thus, affect our ability to actually collect that information;

the costs of doing business online, and, therefore, the demand for our solutions;

the ability to expand or operate our business;

and harm our business.

For instance, California enacted the California Consumer Privacy Act ("CCPA") on June 28, 2018, which took effect on January 1, 2020.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches includes statutorily defined damages of up to $750 per citizen and that is expected to increase data breach litigation.

The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states.

In the event that we are subject to or affected by the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Additionally, our FI partners may choose to alter or discontinue our program in light of the CCPA, which could adversely affect our financial condition.

In particular, there has been increasing public and regulatory concern and public scrutiny about the use of PII.

Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or our solutions or that the definition of “PII” is expanded in the future.

If this is the case, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have a material adverse effect on our business, financial condition or operating results.

Any inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, policies or standards could result in additional cost and liability to us;

damage our reputation;

affect our ability to attract new marketers and FI partners and maintain relationships with our existing marketers and FI partners;

and adversely affect our business, financial condition or operating results.

Privacy and security concerns, whether valid or not, may inhibit market adoption of our solutions.

regulators also may implement “Do-Not-Track” legislation, particularly if the industry does not implement a standard.

Effective January 1, 2014, the California Governor signed into law an amendment to the California Online Privacy Protection Act of 2003.

Some of our activities may also be subject to the laws of foreign jurisdictions, whether or not we are established or based in such jurisdictions.

In the U.K., for example, the Privacy and Electronic Communications Regulations 2011 ("PECR"), implement the requirements of Directive 2009/136/EC (which amended Directive 2002/58/EC), which is known as the ePrivacy Directive.

The PECR regulates various types of electronic direct marketing that use cookies and similar technologies.

The PECR also imposes sector-specific breach reporting requirements, but only as applicable to providers of particular public electronic communications services.

Additional EU member state laws of this type may follow.

We may be required to, or otherwise may determine that it is advisable to, develop or obtain additional tools and technologies for validation of certain of our limited sales related to online purchases to compensate for a potential lack of cookie data.

Given that existing and proposed Data Protection Laws, industry standards and Data Protection Obligations can impose increasingly complex and burdensome obligations, and with substantial uncertainty over the interpretation and application of these requirements, we and our partners have faced and may face additional challenges in addressing and complying with them, and making necessary changes to our privacy policies and practices.

In particular, there has been increasing public and regulatory concern and public scrutiny about the use of personally identifiable information.

To comply with our data protection and privacy obligations, we may be required to:

fundamentally change our business models or practices, including, changing the information we collect or share;

incur material costs and expenses;

or divert management’s time and attention.

Any of these effects could materially adversely affect our business operations and financial results, and may limit the adoption and use of, and reduce the overall demand for, our products, which could have an adverse impact on our business.

Additionally, our partners may choose to alter or discontinue our program in light of the CCPA or other laws or regulations, which could adversely affect our financial condition.

We may, for example, be required to, or otherwise may determine that it is advisable to, develop or obtain additional tools and technologies for validation of certain of our limited sales related to online purchases to compensate for a potential lack of cookie data.

Even if we are able to do so, such additional tools may be subject to further regulation, time consuming to develop or costly to obtain, and less effective than our current use of cookies.

In addition, certain information, such as Internet Protocol addresses as collected and used by us may constitute “personal data” in certain non-U.S.

jurisdictions, including in the U.K., and therefore certain of our activities could be subject to EU laws applicable to the processing and use of personal data.

More generally, the regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws, rules, regulations and standards regarding the collection, use, storage and disclosure of information, web browsing and geolocation data collection and data analytics.

Interpretation of these laws, rules and regulations and their application to our solutions in the U.S.

and foreign jurisdictions is ongoing and cannot be fully determined at this time.

In addition, the regulatory environment for the collection and use of consumer data by marketers is evolving in the U.S.

and internationally and is currently a self-regulatory framework, which relies on market participants to ensure self-compliance.

The voluntary nature of this self-regulatory framework may change.

and foreign governments have enacted, considered or are considering legislation or regulations that could significantly restrict industry participants’ ability to collect, augment, analyze, use and share anonymous data, such as by regulating the level of consumer notice and consent required before a company can place cookies or other tracking technologies.

A number of existing bills are pending in the U.S.

Congress that contain provisions that would regulate how companies can use cookies and other tracking technologies to collect and utilize user information.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various solutions, including but not limited to our marketers and their agencies and our FI partners.

If this were to occur, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business.

Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

In addition, if we were to gain knowledge that we inadvertently received PII from our FI partners, our failure to comply with applicable laws and regulations, or to protect personal data, could result in enforcement action against us, including fines, imprisonment of our officers and public censure, claims for damages by consumers and other affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse impact on our operations, financial performance and business.

Even the perception of privacy or security concerns, whether or not valid, may harm our reputation and inhibit adoption of our solution by current and future marketers and marketing agencies.

While we strive to comply with applicable Data Protection Laws and Data Protection Obligations to the extent possible, we may at times fail to do so, or may be perceived to have failed to do so.

For example, if we inadvertently received personal information from our partners, we may not comply with applicable Data Protection Laws and Data Protection Obligations with respect to that personal information.

Moreover, despite our efforts, we may not be successful in achieving compliance if our personnel or vendors do not comply with applicable Data Protection Laws and Data Protection Obligations.

Additionally, in many cases we or our partners take steps to anonymize information such that it no longer constitutes personal information;

we may fail, or be accused of failing, to properly anonymize such information.

If we, or our business associates or other third parties upon whom we rely fail, or are perceived to have failed, to address or comply with applicable data protection laws, privacy policies and data protection obligations, or if our privacy policies are, in whole or part, found to be inaccurate, incomplete, deceptive, unfair or misrepresentative of our actual practices, it could:

increase our compliance and operational costs;

expose us to regulatory scrutiny, actions, fines and penalties;

result in reputational harm;

lead to a loss of consumers;

reduce the use of our products by end users or our customers;

affect our ability to attract new marketers and partners and maintain relationships with our existing marketers and partners;

lead to special, compensatory punitive and statutory damages, litigation, injunctive relief, or consent orders regarding our privacy and security practices;

introduce requirements that we provide notices, credit monitoring services and/or credit restoration services or other relevant services to impacted individuals;

lead to an inability to Process data;

lead to other adverse actions against our licenses to do business;

or otherwise adversely affect our business.

If the use of matching technologies, such as cookies, pixels and device identifiers, is rejected by Internet users, restricted or otherwise subject to unfavorable terms, such as by non-governmental entities, our validation methodologies could be impacted and we may lose customers and revenue.

17 unchanged sentences

and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.

As of December 31, 2020, we had four issued patents and are pursuing ten additional patents.

As of the date of filing, we had seven issued patents relating to our software.

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented.

Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers.

We have registered the “Cardlytics” name and logo in the U.S.

We have registered, or are registering, the “Cardlytics,” “Dosh," "Bridg" and "Entertainment" names and logos in the U.S.

and certain other countries.

6 unchanged sentences

Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them.

Bank of America also has a right to purchase some of the source code underlying the Cardlytics platform upon the occurrence of specified events, which could compromise the proprietary nature of our platform and/or allow Bank of America to discontinue the use of our solutions.

Additionally, other FIs have a right to obtain the source code underlying Cardlytics OPS through the release of source code held in escrow upon the occurrence of specified events, which could compromise the proprietary nature of our platform and/or allow these FIs to discontinue the use of our solutions.

Bank of America also has a right to purchase some of the source code underlying the Cardlytics platform upon the occurrence of specified events, which could compromise the proprietary nature of the Cardlytics platform and/or allow Bank of America to discontinue the use of our solutions.

Additionally, other FIs have a right to obtain the source code underlying Cardlytics Ad Server through the release of source code held in escrow upon the occurrence of specified events, which could compromise the proprietary nature of the Cardlytics platform and/or allow these FIs to discontinue the use of our solutions.

In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes.

9 unchanged sentences

Some companies, including certain of our competitors, own larger numbers of patents, copyrights and trademarks than we do, which they may use to assert claims against us.

Third parties may also assert claims of intellectual property rights infringement against our FI partners, whom we are typically required to indemnify.

Third parties may also assert claims of intellectual property rights infringement against our partners, whom we are typically required to indemnify.

As the numbers of solutions and competitors in our market increases and overlap occurs, claims of infringement, misappropriation and other violations of intellectual property rights may increase.

9 unchanged sentences

• enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or intellectual property rights;

• indemnify our FI partners and other third parties.

• indemnify our partners and other third parties.

In addition, royalty or licensing agreements, if required or desirable, may be unavailable on terms acceptable to us, or at all, and may require significant royalty payments and other expenditures.

50 unchanged sentences

• general economic, regulatory and market conditions.

Recently, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID–19 pandemic.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

25 unchanged sentences

The forum selection clause in our amended and restated certificate of incorporation may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

We have identified a material weakness in our internal control over financial reporting, and if our remediation of such material weakness is not effective, or if we fail to develop and maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

In the course of preparing our financial statements for the year ended December 31, 2021, we identified a material weakness in our internal control over financial reporting.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

The material weakness identified pertains to significant acquisitions, including the oversight of third-party valuation specialists and sufficiently precise reviews of the related valuation reports for our goodwill and acquired intangible assets, contingent consideration and liabilities assumed.

If we are unable to further implement and maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to record, process and report financial information accurately, and to prepare financial statements within required time periods could be adversely affected, which could subject us to litigation or investigations requiring management resources and payment of legal and other expenses, negatively affect investor confidence in our financial statements and adversely impact our stock price.

If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by Nasdaq, the SEC or other regulatory authorities, which could require additional financial and management resources.

Furthermore, we cannot assure you that the measures we have taken to date, and actions we may take in the future, will be sufficient to remediate the control deficiencies that led to our material weakness in our internal control over financial reporting or that they will prevent or avoid potential future material weaknesses.

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business.

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to implement and maintain effective internal control over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our common stock.

In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the Nasdaq.

General Risk Factors

7 unchanged sentences

Any such losses or damages could have a material adverse effect on our business, financial condition and operating results.

In addition, the facilities of significant marketers, FI partners or third-party data providers may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or material adverse effects on our business.

In addition, the facilities of significant marketers, partners or third-party data providers may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or material adverse effects on our business.

An active trading market for our common stock may not develop or be sustained.

4 unchanged sentences

We are unable to predict the effect that sales, particularly sales by our directors, executive officers, and significant stockholders, may have on the prevailing market price of our common stock.

All of our outstanding shares of common stock are available for sale in the public market, subject only to the restrictions of Rule 144 under the Securities Act in the case of our affiliates.

With the exception of 172,880 shares issued in the purchase of Entertainment, which are subject to holding periods under the restrictions of Rule 144 under the Securities Act as of the time of this filing, all of our outstanding shares of common stock are available for sale in the public market, subject only to the restrictions of Rule 144 under the Securities Act in the case of our affiliates.

In addition, the shares of common stock subject to outstanding options under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans, as well as shares issuable upon vesting of restricted stock unit awards, will become eligible for sale in the public market in the future, subject to certain legal and contractual limitations.

16 unchanged sentences

Such additional costs going forward could negatively affect our financial results.

As a public company, we are obligated to develop and maintain proper and effective internal control over financial reporting and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our common stock.

We are required, pursuant to Section 404, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting on an annual basis.

Our independent registered public accounting firm is required to attest to the effectiveness of our internal control over financial reporting in our annual report.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors