Cardlytics, Inc. 10-K

ITEM 9A. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures We maintain “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based on the evaluation of our disclosure controls and procedures as of December 31, 2022, our Chief Executive Officer and Chief Financial Officer concluded that, as of such date, our disclosure controls and procedures were effective at the reasonable assurance level. 113 Table of Contents Management’s Report on Internal Control Over Financial Reporting Our management is responsible for establishing and maintaining an adequate system of internal control over financial reporting, as defined in the Exchange Act Rule 13a-15(f). Management conducted an assessment of our internal control over financial reporting based on the framework established in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control-Integrated Framework. Based on the assessment, management concluded that, as of December 31, 2022, our internal control over financial reporting was effective. Our independent registered public accounting firm has issued at attestation report on the effectiveness of our internal control over financial reporting, which appears in this Annual Report. Remediation of a Material Weakness We recognize the importance of the control environment as it sets the overall tone for the Company and is the foundation for all other components of internal control. Consequently, we designed and implemented remediation measures to address the material weakness related to our review and oversight of our third-party valuation specialists, as further described in Item 9A of our Annual Report on Form 10-K and Form 10-K/A filed with the SEC on March 1, 2022 and May 2, 2022, respectively. In light of the material weakness, we performed the following remediation actions during the year ended December 31, 2022: • Evaluated the design of the level of precision of the review of third-party valuation specialists • Enhanced level of precision of the review of third-party valuation specialists We consider our remediation efforts with respect to the material weakness to be complete as of December 31, 2022 because we believe the enhanced controls have operated for a sufficient period of time and management has concluded, through testing, that the controls are operating effectively. Changes in Internal Control Over Financial Reporting Except for our remediation of the material weakness described above, there was no change in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the three months ended December 31, 2022 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM To the shareholders and the Board of Directors of Cardlytics, Inc. Opinion on Internal Control over Financial Reporting We have audited the internal control over financial reporting of Cardlytics, Inc. and subsidiaries (the “Company”) as of December 31, 2022, based on criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2022, based on criteria established in Internal Control — Integrated Framework (2013) issued by COSO. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2022, of the Company and our report dated March 1, 2023, expressed an unqualified opinion on those financial statements. Basis for Opinion The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. 114 Table of Contents Definition and Limitations of Internal Control over Financial Reporting A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. /s/ DELOITTE & TOUCHE LLP Atlanta, Georgia March 1, 2023 ITEM 9B. OTHER INFORMATION. None. ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS Not applicable. 115 Table of Contents PART III. ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE The information required by this item is incorporated by reference to our Proxy Statement for the 2023 Annual Meeting of Stockholders to be filed with the Securities and Exchange Commission ("SEC") within 120 days of the fiscal year ended December 31, 2022. We have adopted a Code of Business Conduct and Ethics (the “Code of Conduct”) applicable to all of our employees, executive officers and directors. The Code of Conduct is available on our website at www.cardlytics.com. The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing the Code of Conduct and must approve any waivers of the Code of Conduct for employees, executive officers and directors. If we make any substantive amendments to the Code of Conduct or we grant any waiver from a provision of the Code of Conduct to any executive officer or director, we will promptly disclose the nature of the amendment or waiver on our website. Information contained on, or that can be accessed through, our website is not incorporated by reference into this Annual Report on Form 10-K. ITEM 11. EXECUTIVE COMPENSATION The information required by this item is incorporated by reference to our Proxy Statement for the 2023 Annual Meeting of Stockholders to be filed with the SEC within 120 days of the fiscal year ended December 31, 2022. ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT AND RELATED STOCKHOLDER MATTERS The information required by this item is incorporated by reference to our Proxy Statement for the 2023 Annual Meeting of Stockholders to be filed with the SEC within 120 days of the fiscal year ended December 31, 2022. ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS AND DIRECTOR INDEPENDENCE The information required by this item is incorporated by reference to our Proxy Statement for the 2023 Annual Meeting of Stockholders to be filed with the SEC within 120 days of the fiscal year ended December 31, 2022. ITEM 14. PRINCIPAL ACCOUNTING FEES AND SERVICES The information required by this item is incorporated by reference to our Proxy Statement for the 2023 Annual Meeting of Stockholders to be filed with the SEC within 120 days of the fiscal year ended December 31, 2022. PART IV. 116 Table of Contents ITEM 15. EXHIBITS, FINANCIAL STATEMENT SCHEDULES (a) The following documents are filed as part of this Annual Report: (i) Consolidated Financial Statements and Reports of Independent Registered Public Accounting Firm are shown in the Index to Financial Statements included in Part II, Item 8 of this Annual Report on Form 10-K. (ii) All financial statement schedules are omitted because they are not applicable or the required information is shown in the financial statements or notes thereto. (iii) Exhibits are incorporated herein by reference or are filed with this Annual Report as indicated below. (b) Exhibits: Incorporated by Reference Exhibit Exhibit Description Schedule /Form File Number Exhibit Filing Date 3.1 Amended and Restated Certificate of Incorporation of the Registrant S-1 333-222531 3.2 1/12/2018 3.2 Amended and Restated Bylaws of the Registrant S-1 333-222531 3.4 1/12/2018 4.1 Form of Common Stock Certificate of the Registrant S-1/A 333-222531 4.1 1/29/2018 4.2 Amended and Restated Investors’ Rights Agreement by and among the Registrant and certain of its stockholders, dated May 4, 2017 S-1 333-222531 4.2 1/12/2018 4.3 Description of Cardlytics, Inc. Common Stock 10-K 001-38386 4.3 3/3/2020 4.4 Indenture, dated as of September 22, 3030, by and between the Registrant ant U.S. Bank National Association, as Trustee. 8-K 001-38386 4.1 9/22/2020 4.5 Form of Global Note, representing the Registrant’s 1.00% Convertible Senior Notes due 2025 (included as Exhibit A to the Indenture filed as Exhibit 4.4) 8-K 001-38386 4.2 9/22/2020 10.1 Office Lease Agreement, dated as of August 5, 2013, by and between the Registrant and Jamestown Ponce City Market, L.P., as amended to date S-1 333-222531 10.12 1/12/2018 10.2† 2008 Stock Plan and Forms of Option Agreement, Notice of Stock Option Grant, Exercise Notice, Restricted Stock Unit Notice and Restricted Stock Unit Agreement thereunder, as amended to date S-1/A 333-222531 10.1 1/29/2018 10.3† 2018 Equity Incentive Plan and Forms of Stock Option Agreement, Notice of Exercise and Stock Option Grant Notice thereunder S-1/A 333-222531 10.2 1/29/2018 10.4† 2018 Employee Stock Purchase Plan S-1/A 333-222531 10.3 1/29/2018 10.5† Form of restricted securities unit award of the Registrant S-1 333-222531 10.8 1/12/2018 10.6† Form of Indemnity Agreement by and between the Registrant and each of its directors and executive officers S-1 333-222531 10.9 1/12/2018 10.7† Form of Amended and Restated Separation Pay Agreement by and between the Registrant and each of Scott D. Grimes, Lynne M. Laube, David T. Evans and Kirk L. Somers S-1/A 333-222531 10.11 1/29/2018 10.8# Software License, Customization and Maintenance Agreement, dated as of November 4, 2010 by and between the Registrant and Bank of America, N.A., as amended to date S-1 333-222531 10.16 1/12/2018 117 Table of Contents 10.9# Master Agreement and Schedule #1 to the Master Agreement, dated May 3, 2018 and May 7, 2018, respectively, by and between the Company and JPMorgan Chase Bank, National Association 10-Q 001-38386 10.1 8/14/2018 10.10 Loan and Security Agreement, dated as of May 21, 2018, among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.2 8/14/2018 10.11 First Amendment to Loan and Security Agreement, dated March 27, 2019, among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.2 5/9/2019 10.12 Non-Employee Director Compensation Plan 10-K 001-38386 10.13 3/1/2022 10.13 Second Amendment to Loan and Security Agreement, dated May 14, 2019, among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.2 8/8/2019 10.14 Third Amendment to Loan and Security Agreement, dated September 24, 2019, among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 11/12/2019 10.15 2018 Amendment to Schedule #1 to the Master Agreement, dated October 23, 2018, by and between the Registrant and JPMorgan Chase Bank, N.A. 10-K 001-38386 10.22 3/3/2020 10.16 Fourth Amendment to Loan and Security Agreement, dated February 27, 2020, among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 5/11/2020 10.17 Second Amendment to Schedule #1, dated June 4, 2020, among Cardlytics, Inc. and JPMorgan Chase Bank, National Association 10-Q 001-38386 10.1 8/4/2020 10.18 Fifth Amendment to Loan and Security Agreement, dated September 17, 2020, amount Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 11/2/2020 10.19^ 2020 Amendment to General Services Agreement, dated December 2, 2020, by and between the Registrant and Bank of America, N.A. 10-K 001-38386 10.27 3/3/2021 10.20 Sixth Amendment to Loan and Security Agreement, dated December 30, 2020, amount Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-K 001-38386 10.28 3/3/2021 10.21 Form of Confirmation for Capped Call Transactions 8-K 001-38386 10.1 9/22/2020 10.22 Assumption Agreement and Seventh Amendment to Loan and Security Agreement, dated as of March 5, 2021, by and among Cardlytics, Inc., as Borrower, BSpears Merger Sub II, LLC, as additional borrower, and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 5/4/2021 10.23 Assumption Agreement and Seventh Amendment to Loan and Security Agreement, dated as of April 7, 2021, by and among Cardlytics, Inc., as Borrower, BSpears Merger Sub II, LLC, as additional borrower, and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 8/3/2021 118 Table of Contents 10.24 Assumption Agreement and Eighth Amendment to Loan and Security Agreement, dated as of May 5, 2021, by and among Cardlytics, Inc., as Borrower, BSpears Merger Sub II, LLC, as additional borrower, and Pacific Western Bank, as Lender 10-Q 001-38386 10.2 8/3/2021 10.25 Agreement and Plan of Merger, dated April 12, 2021, by and among Cardlytics, Inc., Bridg, Inc., Mr. T Merger Sub, Inc., and Shareholder Representative Services LLC 8-K 001-38386 10.1 11/18/2022 10.26 2020 Bonus Plan of the Registrant 10-K 001-38386 10.31 3/1/2022 10.27 2021 Bonus Plan of the Registrant 10-K 001-38386 10.32 3/1/2022 10.28 Assumption Agreement and Tenth Amendment to Loan and Security Agreement, dated as of April 29, 2022, by and among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10-Q 001-38386 10.1 5/2/2022 10.29 Form of Transition Agreement by and between the Registrant and Kirk L. Somers 10-Q 001-38386 10.1 8/2/2022 10.30 General Service Agreement dated as of July 7, 2022 by and between the Registrant and Bank of America, N.A. 10-Q 001-38386 10.2 8/2/2022 10.31 Statement of Work Agreement dated as of July 7, 2022 by and between the Registrant and Bank of America, N.A. 10-Q 001-38386 10.3 8/2/2022 10.32 Transition Letter Agreement between Lynne M. Laube and Cardlytics, Inc. 10-Q 001-38386 10.1 11/1/2022 10.33 Offer Letter Agreement between Karim Temsamani and Cardlytics, Inc. 10-Q 001-38386 10.2 11/1/2022 10.34 Severance Agreement between Karim Temsamani and Cardlytics, Inc. 10-Q 001-38386 10.3 11/1/2022 10.35 Severance Agreement between Nick Lynton and Cardlytics, Inc. 10-Q 001-38386 10.4 11/1/2022 10.36 2022 Inducement Plan 10-Q 001-38386 10.7 11/1/2022 10.37 Form of option grant notice and agreement under 2022 Inducement Plan 10-Q 001-38386 10.8 11/1/2022 10.38 Form of restricted stock unit grant notice and agreement under 2022 Inducement Plan 10-Q 001-38386 10.9 11/1/2022 10.39 Resignation and Release Agreement between Lynne Laube and Cardlytics, Inc. 8-K 001-38386 10.1 11/14/2022 10.40 Resignation and Release Agreement between Scott Grimes and Cardlytics, Inc. 8-K 001-38386 10.2 11/14/2022 10.41* Assumption Agreement and Eleventh Amendment to Loan and Security Agreement, dated as of November 29, 2022, by and among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10.42* Offer Letter Agreement between Amit Gupta and Cardlytics, Inc. 10.43* Severance Agreement between Amit Gupta and Cardlytics, Inc. 10..44* Assumption Agreement and Twelfth Amendment to Loan and Security Agreement, dated as of February 16, 2023, by and among Cardlytics, Inc., as Borrower and Pacific Western Bank, as Lender 10.45* Amendment to Inducement Plan 10.46* 2022 Bonus Plan of the Registrant 21.1 Subsidiaries of the Registrant 10-Q 001-38386 21.1 8/14/2018 23.1* Consent of Deloitte & Touche LLP, independent registered public accounting firm 119 Table of Contents 31.1* Certification of Principal Executive Officer Pursuant to Rules 13a-14(a) and 15d-14(a) under the Securities Exchange Act of 1934, as Adopted Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 31.2* Certification of Principal Financial Officer Pursuant to Rules 13a-14(a) and 15d-14(a) under the Securities Exchange Act of 1934, as Adopted Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 32.1** Certification of Principal Executive Officer and Principal Financial Officer Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 101.ins XBRL Instance Document - the instance document does not appear in the Interactive Data File because its XBRL tags are embedded within the Inline XBRL document 101.sch XBRL Taxonomy Schema Linkbase Document 101.cal XBRL Taxonomy Calculation Linkbase Document 101.def XBRL Taxonomy Definition Linkbase Document 101.lab XBRL Taxonomy Label Linkbase Document 101.pre XBRL Taxonomy Presentation Linkbase Document 104.0 Cover page formatted as Inline XBRL and contained in Exhibit 101 * Filed herewith ** Furnished herewith ^ Certain portions of this exhibit, indicated by asterisks, have been omitted pursuant to Item 601(b)(10) of Regulation S–K because they are not material and would likely cause competitive harm to the registrant if publicly disclosed. † Indicated management contract or compensatory plan # Confidential treatment has been granted from the Securities and Exchange Commission as to certain portions of this document 120 Table of Contents ITEM 16. FORM 10-K SUMMARY None. SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized. Cardlytics, Inc. March 1, 2023 By: /s/ Karim Temsamani Karim Temsamani Chief Executive Officer ( Principal Executive Officer ) Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated. Signature Title Date /s/ Karim Temsamani Chief Executive Officer and Director March 1, 2023 Karim Temsamani ( Principal Executive Officer ) /s/ Andrew Christiansen Chief Financial Officer March 1, 2023 Andrew Christiansen (Principal Financial and Accounting Officer) /s/ David L. Adams Director March 1, 2023 David L. Adams /s/ John V. Balen Board Chairman March 1, 2023 John V. Balen /s/ Jessica Jensen Director March 1, 2023 Jessica Jensen /s/ John Klinck Director March 1, 2023 John Klinck /s/ Aimée Lapic Director March 1, 2023 Aimée Lapic /s/ Chris Suh Director March 1, 2023 Chris Suh /s/ Tony Weisman Director March 1, 2023 Tony Weisman 121