What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-03-14 compared with 2023-03-01 · 203 added, 259 removed, 541 unchanged (46% of the section changed)

5 unchanged sentences

Unfavorable conditions, including inflationary pressure, in the global economy or the industries we serve could limit our ability to grow our business and negatively affect our operating results.

General worldwide economic conditions have experienced significant instability in recent years including the recent global economic uncertainty and financial market conditions.

For example, inflation rates, particularly in the United States and United Kingdom, have increased recently to levels not seen in years, and increased inflation may result in decreased demand for our products and solutions, increases in our operating costs (including our labor costs), reduced liquidity and limits on our ability to access credit or otherwise raise capital.

General worldwide economic conditions have created significant instability in recent years.

For example, inflation rates have fluctuated significantly in recent periods, and increased inflation may result in decreased demand for our products and solutions, increases in our operating costs (including our labor costs), reduced liquidity and limitations on our ability to access credit or otherwise raise capital.

In addition, the Federal Reserve has raised, and may again raise, interest rates in response to concerns about inflation, which coupled with reduced government spending and volatility in financial markets may have the effect of further increasing economic uncertainty and heightening these risks.

Additionally, financial markets around the world experienced volatility following the invasion of Ukraine by Russia in February 2022.

These conditions make it extremely difficult for marketers and us to accurately forecast and plan future business activities and could cause marketers to continue to reduce or delay their marketing spending.

Additionally, financial markets around the world experienced volatility following the invasion of Ukraine by Russia in February 2022 and escalating conflicts in the Middle East in late 2023.

Further, concerns have recently arisen with respect to the financial condition of a number of banking organizations in the United States, in particular those with exposure to certain types of depositors and large portfolios of investment securities.

While we do not have any exposure to banking organizations that have entered receivership or become insolvent, we do maintain our cash at financial institutions, at times in balances that exceed the current insurance limits set forth by the Federal Deposit Insurance Corporation (the "FDIC").

If other banks and financial institutions enter receivership or become insolvent in the future due to financial conditions affecting the banking system and financial markets, our ability to access our cash, cash equivalents and investments, including our ability to transfer funds, make payments or receive funds, may be threatened and could have a material adverse effect on our business and financial condition.

These conditions make it extremely difficult for marketers and us to accurately forecast and plan future business activities and could cause marketers to begin or continue to reduce or delay their marketing spending.

Historically, economic downturns have resulted in overall reductions in marketing spending.

Alternatively, as the market recovers from the pandemic, marketing spend may be volatile and unpredictable as certain industries recover at different speeds.

If macroeconomic conditions deteriorate or are characterized by uncertainty or volatility, marketers may curtail or freeze spending on marketing in general and for services such as ours specifically, which could have a material and adverse impact on our business, financial condition and operating results.

In addition, our business may be materially and adversely affected by weak economic conditions in the industries that we serve.

All of these industries have been negatively impacted by the pandemic and inflationary pressure and certain precautions taken to control the pandemic and inflationary pressure.

All of these industries have been negatively impacted by inflationary pressure and certain precautions taken to control inflationary pressure.

We cannot predict the timing, strength or duration of any economic slowdown or recovery.

In addition, we cannot predict the timing, strength or duration of any economic slowdown or recovery.

In addition, even if the overall economy is robust, we cannot assure you that the market for services such as ours will experience growth or that we will experience growth.

7 unchanged sentences

• the revenue mix revenue generated from our operations in the U.S.

• the revenue mix generated from the operations of Cardlytics, Inc.

and its subsidiaries;

• decisions made by our FI partners to increase Consumer Incentives or use their Partners Share to fund their Consumer Incentives;

• the revenue mix generated from the operations of Cardlytics and its subsidiaries;

• decisions made by our FI partners to increase Consumer Incentives or use their Partner Share to fund their Consumer Incentives;

• changes in the economic prospects of marketers, the industries that we primarily serve, or the economy generally, which could alter marketers' spending priorities or budgets;

6 unchanged sentences

• exposure related to our international operations and foreign currency exchange rates;

• quarantine, private travel limitation, or business disruption in regions affecting our operations, stemming from actual, imminent or perceived outbreak of contagious disease, including the COVID-19 pandemic;

• volatile recovery from the pandemic, including inflationary pressure;

• other events or factors, including those resulting from war, such as the current hostilities between Russia and Ukraine or incidents of terrorism;

• quarantine, private travel limitation, or business disruption in regions affecting our operations, stemming from actual, imminent or perceived outbreak of contagious disease;

• other events or factors, including those resulting from war, such as hostilities between Russia and Ukraine, and the current armed conflict in the Middle East, and incidents of terrorism;

• expenses associated with items such as litigation, regulatory changes, cyberattacks or security breaches;

1 unchanged sentence

• costs related to acquisitions of other businesses or technologies.

• our ability to maintain and grow our business in light of the global COVID-19 pandemic and precautions taken to reduce the risk of this virus.

Fluctuations in our quarterly operating results, non-GAAP metrics and other metrics and the price of our common stock may be particularly pronounced in the current economic environment due to the uncertainty caused by and the unprecedented nature of the current COVID-19 pandemic.

Fluctuations in our quarterly operating results, non-GAAP and other metrics and the price of our common stock may be particularly pronounced in the current economic environment.

Each factor above or discussed elsewhere in this "Risk Factors" section or the cumulative effect of some of these factors may result in fluctuations in our operating results.

2 unchanged sentences

We may not be able to sustain our revenue and billings growth rate in the future.

Our revenue increased 43% from $186.9 million in 2020 to $267.1 million in 2021, and our revenue increased 12% from $267.1 million in 2021 to $298.5 million in 2022.

Our billings increased 50% from $263.4 million in 2020 to $394.1 million in 2021, and our billings increased 12% from $394.1 million in 2021 to $442.5 million in 2022.

Our revenue increased 4% to $309.2 million in 2023 from $298.5 million in 2022 and increased 12% to $298.5 million in 2022 from $267.1 million in 2021.

Our billings increased 2% to $453.4 million in 2023 from $442.5 million in 2022 and increased 12% to $442.5 million in 2022 from $394.1 million in 2021.

We may not be able to maintain year-over-year revenue and billings growth in the near term or at all, and you should not consider our revenue and billings growth in any specific historical periods as indicative of our future performance.

6 unchanged sentences

• any decline in demand for the Cardlytics platform by marketers or their agencies;

• failure by our FI partners to increase engagement with our solutions within their customer bases, improve their customers’ user experience, increase customer awareness, leverage additional customer outreach channels like email or otherwise promote our incentive programs on their websites and mobile applications, including by making the programs difficult to access or otherwise diminishing their prominence;

• failure by our FI partners to increase engagement with our solutions within their customer bases, adopt our new technology and products, improve their customers’ user experience, increase customer awareness, leverage additional customer outreach channels like email or otherwise promote our incentive programs on their websites and mobile applications, including by making the programs difficult to access or otherwise diminishing their prominence;

• our failure to offer compelling incentives to our FI partners' customers;

4 unchanged sentences

• sensitivity to current or future prices offered by us or competing solutions.

In addition, in the majority of instances we would be required to pay Consumer Incentives associated with the Cardlytics platform marketing campaigns even if the amount of such Consumer Incentives exceeded the amount of billings that we are paid by the applicable marketer.

Further, we are often required to pay such Consumer Incentives before we receive payment from the applicable marketer.

Accordingly, if the amount of Consumer Incentives that we are required to pay materially exceeds the billings that we receive or we encounter any significant failure to ultimately collect payment, our business, financial condition and operating results could be adversely affected.

In addition, we are often required to pay Consumer Incentives before we receive payment from the applicable marketer.

Accordingly, if we encounter any significant failure to ultimately collect payment, our business, financial condition and operating results could be adversely affected.

If we are unable to grow our revenue and billings from sales of the Cardlytics platform, our business and operating results would be harmed.

3 unchanged sentences

In addition, we pay most of our FI partners a Partner Share, which is a negotiated and fixed percentage of our billings less certain costs.

During 2020 and 2021, our top two FI partners combined to account for over 75% of the total Partner Share we paid to all partners, with each representing over 25%.

No other partner accounted for over 10% of Partner Share during these periods.

During 2022, our top three FI partners combined to account for over 80% of the total Partner Share we paid to all partners, with the top two FI partners each representing over 20% and third largest FI partner representing over 10% of Partner Share.

During the years ended December 31, 2023, 2022 and 2021, our top three FI partners combined to account for over 85%, 80% and 75%, respectively, of the total Partner Share we paid to all partners.

During 2023, the top FI partner represented over 50% and the second and third largest FI partners represented over 10% of Partner Share.

During 2022 and 2021 the top two FI partners represented over 20% and 25%, respectively, and the third largest FI partner represented over 10%, of Partner Share for each period.

No other partner accounted for over 10% of Partner Share during these periods.

Our agreements with a substantial majority of our FI partners have three- to seven-year terms but are generally terminable by the FI partner on 90 days or less prior notice.

If an FI partner terminates its agreement with us, we would lose that FI as a source of purchase data and online banking customers.

Our agreements with a substantial majority of our FI partners have three- to seven-year terms but are generally terminable by the FI partner on 90 days or more prior notice.

If an FI partner terminates its agreement with us, we would lose that FI partner as a source of purchase data and online banking customers.

Our FI partners may elect to withhold from us or limit the use of their purchase data for many reasons, including:

6 unchanged sentences

To the extent that we breach or are alleged to have breached the terms of our agreement with any FI partner, or a disagreement arises with an FI partner regarding the interpretation of our contractual arrangements, which has occurred in the past and may occur again in the future, such an FI partner may be more likely to cease providing us data or to terminate its agreement with us.

The loss of Bank of America, Chase, Wells Fargo or any other significant FI partner would significantly harm our business, results of operations and financial conditions.

The loss of Chase, Bank of America, Wells Fargo or any other significant FI partner would significantly harm our business, results of operations and financial conditions.

We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

1 unchanged sentence

In developing this guidance, our management must make certain assumptions and judgments about our future performance.

Some of those key assumptions relate to the impact of COVID-19 and the associated economic uncertainty on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

Some of those key assumptions relate to the impact of unfavorable macroeconomic conditions and the associated economic uncertainty on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

Furthermore, analysts and investors may develop and publish their own projections of our business, which may form a consensus about our future performance.

Our business results may vary significantly from such guidance or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, which could adversely affect our operations and operating results.

Furthermore, if we make downward revisions of any publicly announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

Our business results may vary significantly from such guidance or that consensus due to a number of factors, many of which are outside of our control, which could adversely affect our operations and operating results.

If we fail to maintain our relationships with current FI partners or attract new FI partners, we may not be able to sufficiently grow our revenue, which could significantly harm our business, results of operations and financial condition.

2 unchanged sentences

Accordingly, our ability to efficiently grow our revenue will specifically depend on our ability to maintain our relationships with the large FIs that are currently part of our network and establish relationships with the large FIs that are not currently part of our network.

In addition, we must continue to maintain our relationships with our existing bank processor and digital banking provider FI partners and attract new such FI partners because these FI partners aggregate smaller FIs into our network.

We have in the past and may in the future be unsuccessful in attempts to establish and maintain relationships with large FIs.

If we are unable to maintain our relationships with current FI partners and attract new FI partners, maintain our relationships with our existing bank processor and digital banking provider partners or attract new bank processor and digital provider partners, our business, results of operations and financial condition would be significantly harmed, and we may fail to capture a material portion of the native bank advertising market opportunity.

If we are unable to maintain our relationships with current FI partners and attract new FI partners, our business, results of operations and financial condition would be significantly harmed, and we may fail to capture a material portion of the native bank advertising market opportunity.

Our future success will depend, in part, on our ability to expand into new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have recently entered new industries such as travel and entertainment, direct-to-consumer, grocery and gas, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

We have historically generated a substantial majority of our revenue from marketers in the restaurant, brick and mortar retail, telecommunications and cable industries, and have expanded into new industries such as travel and entertainment, direct-to-consumer, grocery and gas, and believe that our future success will depend, in part, on our ability to expand adoption of our solutions in new industries.

As we market to a wider group of potential marketers and their agencies, we will need to adapt our marketing strategies to meet the concerns and expectations of customers in these new industries.

4 unchanged sentences

If we are unable to successfully market our solutions to appeal to marketers and their agencies in new industries, we may not be able to achieve our growth or business objectives.

An actual or perceived breach of the security of our systems could result in a disruption of our operations, or a third-party’s entry into our FI partners’ systems, which would be detrimental to our business, reputation, financial condition and operating results.

An actual or perceived breach of the security of our systems, or those of third parties upon which we rely, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences.

We leverage our FI partners' purchase data and infrastructures to deliver our Cardlytics platform.

We do not currently receive or have access to any personally identifiable information ("PII") from our FI partners, although we may obtain or have access to PII from our FI partners in the future as our business evolves.

There is a risk that third parties may attempt to gain access to our systems, or our FI partners’ systems through our systems, for the purpose of stealing sensitive or proprietary data, accessing sensitive information on our network, or disrupting our or their respective operations.

Additionally, we receive and have access to PII as a result of other aspects of our business.

In turn, we may be a more visible target for cyberattacks and/or physical breaches of our databases or data centers, and we may in the future suffer from such attacks or breaches.

Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase.

In addition to traditional computer “hackers,” threat actors, software bugs, malicious code (such as viruses and worms), employee theft or misuse, denial-of-service attacks (such as credential stuffing), and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions).

We also may be the subject of phishing attacks, viruses, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware, malicious or unintentional actions or in actions by employees or others with authorized access to our network that create or expose vulnerabilities or other similar issues.

Current or future criminal capabilities, discovery of existing or new vulnerabilities in our systems and attempts to exploit those vulnerabilities or other developments may compromise or breach the technology protecting our systems.

We do not currently receive or have access to any PII from our FI partners, although we may obtain or have access to PII from our FI partners in the future as our business evolves.

Additionally, we receive, collect, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and have access to personal data as a result of other aspects of our business.

As such, we may be a more visible target for cyberattacks or physical breaches of our systems, databases or data centers, and we may in the future suffer from such attacks or breaches.

There is a risk that actors may attempt to gain access to our systems, for the purpose of stealing personal data, sensitive or proprietary data, accessing sensitive information on our network, or disrupting our or their respective operations.

Cyberattacks, malicious internet-based activity and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a

variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, and ability to provide our service.

In addition to traditional computer "hackers," we and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), threat actors, software bugs, malicious code (such as viruses and worms), employee theft or misuse, denial-of-service attacks, credential attacks, credential harvesting, and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions).

We also may be the subject of viruses, malware installation, server malfunction, software or hardware failures, loss of data or other computer assets, adware, malicious or unintentional actions or in actions by employees or others with authorized access to our network that create or expose vulnerabilities, attacks enhanced or facilitated by artificial intelligence ("AI"), and other similar threats or other similar issues.

In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Due to a variety of both internal and external factors, including defects or misconfigurations of our technology, our services could become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure networks and detect and block attacks.

In the event that our protection efforts are unsuccessful, and our systems are compromised such that a third-party gains entry to our or any of our FI partners' systems, we could suffer substantial harm.

In addition, a vast majority of our employees work remotely, which may make us more vulnerable to cyberattacks.

In addition, many of our employees work remotely, which may make us more vulnerable to cyberattacks and has increased risks to our systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

A security breach could result in operational or administrative disruptions, or impair our ability to meet our marketers’ requirements, which could result in decreased revenue.

Also, our reputation could suffer irreparable harm, causing our current and prospective marketers and FI partners to decline to use our solutions in the future.

Further, we could be forced to expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

In any event, an actual or suspected breach of the security of our systems or data could materially harm our business, financial condition and operating results.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions.

Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners' supply chains have not been compromised.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps designed to detect, mitigate, and remediate vulnerabilities in our systems (such as our hardware and software, including that of third parties upon which we rely).

We may not, however, detect and remediate all such vulnerabilities, at all or on a timely basis.

Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.

Even if we have issued or otherwise made patches for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner.

Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform.

Further, we could expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection

technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations.

Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents.

Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In any event, an actual or perceived breach of the security of our, or the third parties on which we rely, systems or data could materially harm our business, financial condition and operating results.

Security incidents and associated consequences may prevent or cause customers to stop using our platform, deter new customers from using our platform, and negatively impact our ability to grow and operate our business.

We cannot assure you that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security lapse or breach.

2 unchanged sentences

The successful assertion of one or more large claims against us that exceeds available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results and reputation.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Our business could be adversely affected if marketers or their agencies are not satisfied with our solutions or our systems and infrastructure fail to meet their needs.

2 unchanged sentences

We are in the process of updating our platforms.

Any failure of, or delays in the performance (or in the case of the self-service tool, the rollout) of, our systems could cause service interruptions or impaired system performance.

Any failure or delays in the performance of our systems could cause service interruptions or impaired system performance.

Such failures in our systems could cause us to fail to maximize our earning potential with respect to any given marketing campaign.

10 unchanged sentences

If we fail to generate sufficient revenue to offset our contractual commitments to FIs, our business, results of operations and financial conditions could be harmed.

We have a minimum Partner Share commitment to a certain FI partner totaling $10.0 million over a 12-month period which began on April 1, 2022.

To the extent that this commitment is expected to exceed the amount of Partner Share otherwise payable to such FI partner in the absence of such commitment, we accrue any expected shortfall over the commitment period.

We accrued for zero and $3.2 million of expected minimum Partner Share commitment shortfalls as of December 31, 2021 and 2022, respectively.

We had a minimum Partner Share commitment to a certain FI partner totaling $10.0 million over a 12-month period which ended on March 31, 2023.

The Partner Share shortfall totaled $4.5 million, which is included within Partner Share liability on our condensed consolidated balance sheet.

We have paid, or are paying, this shortfall on a quarterly basis from October 1, 2023 through June 30, 2024.

During the years ended December 31, 2023 and 2022, we recognized $1.3 million and $3.2 million, respectively, of expected minimum Partner Share commitment shortfalls within Partner Share and other third-party costs on our condensed consolidated statements of operations.

As of December 31, 2023, we paid $1.2 million of our shortfall.

To the extent that we are unable to generate revenue from marketers sufficient to offset our Partner Share commitments and other obligations, our business, results of operations and financial conditions could be harmed.

If we are unable to successfully integrate Dosh’s, Bridg's and Entertainment's businesses and employees, it could have an adverse effect on our future results and the market price of our common stock.

The success of our acquisitions of Dosh, Bridg and HSP EPI Acquisition, LLC ("Entertainment") will depend, in part, on our ability to integrate Dosh’s, Bridg’s and Entertainment's operations and to realize the anticipated benefits, including in certain instances annual net operating synergies and cost reductions from combining the businesses.

These integrations may be complex and time-consuming.

The failure to successfully integrate and manage the challenges presented by the integration processes may result in our failure to achieve some or all of the anticipated benefits of the acquisitions.

Potential difficulties that may be encountered in the integration processes, which may be enhanced as a result of our efforts to integrate both businesses concurrently, include the following:

• complexities associated with managing the larger combined company;

• integrating personnel from Dosh, Bridg and Entertainment with Cardlytics personnel;

• current and prospective employees may experience uncertainty regarding their future roles with our company, which might adversely affect our ability to retrain, recruit and motivate key personnel;

• difficulties ensuring the proper controls and policies are implemented and followed in the acquired and expanded business;

• increased cyber threats due to the expanded profile of the enlarged business as well as the challenges associated with ensuring the integrating and protecting the expanded IT footprint with security and prevention, detection and response protocols;

• potential lost sales and customers if Dosh's or Bridg's or Entertainment's partners or advertising clients, or our partners or advertising clients, decide not to do business with the combined company;

• issues associated with running a consumer-facing mobile application including proper notifications, rewards, and charges;

• potential unknown liabilities and unforeseen expenses associated with the acquisitions;

• performance shortfalls as a result of the diversion of management's attention caused by integrating the companies' operations;.

• Legal or regulatory hurdles regarding privacy or other data rights in the United States and abroad;

• Unanticipated challenges in expanding the businesses in the United States and abroad.

In addition, acquisitions are inherently risky, and our due diligence processes in connection with the acquisitions may have failed to identify significant problems, liabilities or other shortcomings or challenges of Dosh’s, Bridg's or Entertainment's businesses.

If any of these events were to occur, our ability to maintain relationships with customers, suppliers and employees or our ability to achieve the anticipated benefits of the acquisition could be adversely affected or could reduce our future earnings or otherwise adversely affect our business and financial results and, as a result, adversely affect the market price of our common stock.

The amount we will have to pay in connection with the acquisition of Bridg has not been conclusively determined, and it may be materially larger than we expect.

As part of the acquisition of Bridg, we agreed to make two earnout payments:

a First Anniversary Payment and a Second Anniversary Payment.

We have agreed to pay at least 30% of the First Anniversary Payment and the Second Anniversary Payment in cash, with the remainder to be paid in cash or our common stock, at our option.

Depending on the total amount we have to pay for the earnout payments and the price of our stock during the relevant time periods, we may be required to pay more than 30% of one or both earnout payments in cash even if we did not want to do so, due to a provision in the merger agreement that does not allow us to issue more than 19.9% of our common stock in connection with the transactions contemplated by the merger agreement.

In June 2022, we calculated the First Anniversary Payment and provided the calculation to the Stockholder Representative.

The Stockholder Representative has objected to our calculation of the amount of the First Anniversary Payment.

We are following the dispute resolution process specific to the First Anniversary Payment stated in the merger agreement.

It is possible that the final amount of the First Anniversary Payment will be materially larger than we currently expect, and it is further possible that, as a result of this process, the Second Anniversary Payment will be materially larger than we currently expect, which could adversely affect our business, results of operations and financial conditions.

We derive a material portion of our revenue from a limited number of marketers, and the loss of one or more of these marketers could adversely impact our business, results of operations and financial conditions.

Our revenue and accounts receivable are diversified among a large number of marketers segregated by both geography and industry.

During 2020, 2021 and 2022, our top five marketers accounted for 35%, 29% and 17% of our revenue, respectively, with one marketer accounting for over 10% during 2020 and 2021.

While no marketer accounted for over 10% of our revenue during 2022, we may have one or more marketer account for over 10% of our revenue in future periods.

As of December 31, 2021 and 2022, our top five marketers accounted for 19% and 18% of our accounts receivable, respectively, with no individual marketer representing over 10% as of the end of each period, respectively.

Our revenue and accounts receivable are diversified among a large number of marketers segregated by both geography and industry.

During the years ended December 31, 2023 and 2022 our top five marketers accounted for 15% of our revenue for each period, with no marketer representing over 10% during each of 2023 and 2022.

During the year ended December 31, 2021 our top five marketers accounted for 27% of our revenue, with one marketer accounting for over 10% during 2021.

As of December 31, 2023 and 2022, our top five marketers accounted for 19% and 18% of our accounts receivable, respectively, with no individual marketer representing over 10% as of the end of each period.

We do not have material long-term commitments from most of these marketers.

3 unchanged sentences

The loss of one or more of our significant marketers could adversely affect our business, results of operations and financial conditions.

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition.

COVID-19, including variants of COVID-19, has resulted, at times, in the implementation or reimplementation of significant governmental measures, including lockdowns, closures, quarantines, occupancy limits and travel bans intended to control the spread of the virus.

In response to the pandemic, our employees began working remotely in March 2020 and many are still primarily or exclusively working from home.

In addition, many of our marketers and prospective marketers, as well as our partners, are working remotely.

We have had to expend, and may be required to continue to expend, significant time, attention, and resources to respond to the COVID-19 pandemic and the associated global economic uncertainty, including to develop and implement internal policies and procedures and track changes in laws and government guidelines and restrictions.

The remote working environment may also create increased vulnerability to cybersecurity incidents, including breaches of information systems security, which could damage our reputation and commercial relationships.

To the extent that future COVID restrictions are reinstated or additional prevention and mitigation measures are implemented, or there is uncertainty about the effectiveness of these or any other measures to contain or treat COVID-19 or any of its variants, there potentially could be an adverse impact on global economic conditions, which could materially and adversely impact our operations and the operations of our marketers, partners, suppliers and others with whom we work.

While, at this time, we are working to manage and mitigate potential disruptions from the virus or any of its variants on our employees and operations, the fluid nature of the pandemic and uncertainties regarding the related economic impact are likely to result in sustained market turmoil, which may materially and adversely impact our business, results of operations and financial condition.

We cannot predict how the COVID-19 pandemic, including with respect to variants of COVID-19, will continue to develop, whether and to what extent government regulations or other restrictions may impact our operations or those of our customers, or whether or to what extent the COVID-19 pandemic or the effects thereof may have longer term unanticipated impacts on our business.

The full extent of COVID-19’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the duration, spread and intensity of future variants of the virus, the virus’ impact on capital and financial markets, the timing of an economic recovery and any new information that may emerge concerning the severity of the virus, among others.

As a result, it is not currently possible to ascertain the overall impact of COVID-19 on our business.

If, however, the pandemic continues to persist as a severe worldwide health crisis, it may harm our business, and also may have the effect of heightening many of the other risks described in this “Risk Factors” section.

We have a short operating history, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

We have a relatively short operating history, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

We have a relatively short operating history, which limits our ability to forecast our future operating results and subjects us to a number of uncertainties, including with respect to our ability to plan for and model future growth.

13 unchanged sentences

Any failure of our partners to effectively deliver and promote the online incentive programs that comprise the Cardlytics platform could materially and adversely affect our business.

We have spent the last several years and significant resources building out technology integrations with our partners to facilitate the delivery of incentive programs to our partners’ customers and measuring those customers subsequent in-store or digital spending.

We are also reliant on our network of partners to promote their digital incentive programs, increase customer awareness and leverage additional customer outreach channels like email, all of which can increase customer engagement, as well as expand our network of partners.

We have spent the last several years and significant resources building out technology integrations with our partners to facilitate the delivery of incentive programs to our partners' customers and measure those customers subsequent in-store or digital spending.

We believe that key factors in the success and effectiveness of our incentive program include the level of accessibility and prominence of the program on the partners' website and mobile applications, as well as the user interface through which a customer is presented with marketing content.

In certain cases, we have little control over the prominence of the incentive program and design of the user interface that our partners choose to use.

To the extent that our partners de-emphasize incentive programs, make incentive programs difficult to locate on their website and/or mobile applications and/or fail to provide a user interface that is appealing to partners' customers, partners' customers may be less likely to engage with the incentive programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

In addition, a failure by our partners to properly deliver or sufficiently promote marketing campaigns would reduce the efficacy of our solutions and impair our ability to attract and retain marketers and their agencies.

To the extent that our partners de-emphasize incentive programs, make incentive programs difficult to locate on their website or mobile applications or fail to provide a user interface that is appealing to partners' customers, partners' customers may be less likely to engage with the incentive programs, which could negatively impact the amount of fees that we are able to charge our marketer customers in connection with marketing campaigns, and, therefore, our revenue.

In addition, a failure by our partners to properly deliver or sufficiently promote marketing campaigns may reduce the efficacy of our solutions and impair our ability to attract and retain marketers and their agencies.

As a result, the revenue we generate from our Cardlytics platform may be adversely affected, which would materially and adversely affect our business, financial condition and results of operations.

10 unchanged sentences

Most marketers do business with us by placing insertion orders for particular marketing campaigns, either directly or through marketing agencies that act on their behalf.

We often do not have any commitment from a marketer beyond the campaign governed by a particular insertion order, and we frequently must compete to win further business from a marketer.

We often do not have any commitment from a marketer beyond the campaigns governed by a particular insertion order, and we frequently must compete to win further business from a marketer.

In most circumstances, our insertion orders may be canceled by marketers or their marketing agencies prior to the completion of all the campaigns contemplated in the insertion orders;

6 unchanged sentences

Moreover, marketers may place internal limits on the allocation of their marketing budgets to digital marketing, to particular campaigns, to a particular provider or for other reasons.

In addition, we are reliant on our FI network to have sufficient marketing inventory within the Cardlytics platform to place the full volume of advertisements contracted for by our marketers and their agencies.

In addition, we are reliant on our FI partner network to have sufficient marketing inventory within the Cardlytics platform to place the full volume of advertisements contracted for by our marketers and their agencies.

Any failure to meet these demands may hamper the growth of our business and the attractiveness of our solutions.

Our ability to retain and increase sales of our solutions and attract new marketers and their agencies may be adversely affected by competitive offerings, marketing methods that are lower priced or perceived as more effective than our solutions, or a general continued reduction or decline in spending by marketers due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic.

Larger marketers may themselves have a substantial amount of purchase data and they may also seek to augment their own purchase data with additional purchase, impression and/or demographic data acquired from third-party data providers, which may allow them to develop, individually or with partners, internal targeting and measurement capabilities.

Larger marketers may themselves have a substantial amount of purchase data and they may also seek to augment their own purchase data with additional purchase, impression or demographic data acquired from third-party data providers, which may allow them to develop, individually or with partners, internal targeting and measurement capabilities.

Because many of our agreements with our marketers or their agencies are not long-term, we may not be able to accurately predict future revenue streams, and we cannot guarantee that our current marketers will continue to use our solutions, or that we will be able to replace departing marketers with new marketers that provide us with comparable revenue.

If we are unable to retain and increase sales of our solutions to existing marketers and their agencies or attract new marketers and their agencies for any of the reasons above or for other reasons, our business, financial condition and operating results would be adversely affected.

We have a history of losses and may not achieve profitability in the future.

We have incurred net losses since inception and expect to incur net losses in the future.

We incurred net losses of $55.4 million, $128.6 million and $465.3 million in 2020, 2021 and 2022, respectively.

As of December 31, 2022, we had an accumulated deficit of $976.6 million.

We have never achieved profitability on an annual basis, and we do not know if we will be able to achieve or sustain profitability.

Although our revenue has increased substantially in recent periods, we also do not expect to maintain this rate of revenue growth.

We have a history of losses and may not achieve net income in the future.

We have incurred annual net losses since inception and expect to incur net losses in certain periods in the future.

During 2023 and 2022, our net loss was $134.7 million and $465.3 million, respectively.

We had an accumulated deficit of $1.1 billion as of December 31, 2023.

We have never achieved net income on an annual basis, and we do not know if we will be able to achieve or sustain net income.

We plan to continue to invest in our research and development and sales and marketing efforts, and we anticipate that our operating expenses will continue to increase as we scale our business and expand our operations.

We also expect our general and administrative expense to increase as a result of our growth.

Our ability to achieve and sustain profitability is based on numerous factors, many of which are beyond our control.

We may never be able to generate sufficient revenue to achieve or sustain profitability.

Our general and administrative expenses may increase as a result of our growth as well.

Our ability to achieve and sustain net income is based on numerous factors, many of which are beyond our control.

We may never be able to generate sufficient revenue to achieve or sustain net income.

We operate in an emerging industry and future demand and market acceptance for our solutions is uncertain.

6 unchanged sentences

In the future, we may face competition from online retailers, credit card companies, established enterprise software companies, advertising and marketing companies and agencies, digital publishers and mobile pay providers with access to a substantial amount of consumer purchase data.

While we may successfully partner with a wide range of companies that are to some extent currently competitive to us, these companies may become more competitive to us in the future.

While we may successfully partner with a wide range of companies that are only moderately competitive to us, these companies may become more competitive to us in the future.

As we introduce new solutions, as our existing solutions evolve and as other companies introduce new products and solutions, we are likely to face additional competition.

6 unchanged sentences

In addition, current or potential competitors may be acquired by third parties with greater available resources.

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

For all of these reasons, we may not be able to compete successfully against our current or future competitors.

2 unchanged sentences

To attract, retain and increase new marketers and partners, we will need to expand and enhance our solutions to meet changing needs, add functionality and address technological advancements.

Specifically, we are migrating to a cloud-based solution hosted by Amazon Web Services.

If we are unable to adapt our solutions to evolving trends in the marketing industry, if we are unable to properly identify and prioritize appropriate solution development projects or if we fail to develop and effectively market new solutions or enhance existing solutions to address the needs of existing and new marketers and partners, we may not be able to achieve or maintain adequate market acceptance and penetration of our solutions, and our solutions may become less competitive or obsolete.

Specifically, we have largely migrated to a cloud-based solution hosted by Amazon Web Services.

If we are unable to adapt our solutions to evolving trends in the marketing industry, if we are unable to properly identify and prioritize appropriate solution development projects or if we fail to develop and effectively market new solutions or enhance existing solutions to address the needs of existing and new marketers and partners, we may not be able to achieve or maintain adequate market acceptance and penetration of our solutions, or our solutions may become less competitive or obsolete.

In addition, new, more effective or less costly technologies may emerge that use data sources that we do not have access to, that use entirely different analytical methodologies than we do or that use other indicators of purchases by consumers.

3 unchanged sentences

• the failure of our network or software systems, or the network or software systems of our partners;

• decisions by our partners to restrict our ability to collect data from them (which decision they may make at their discretion) or to refuse to implement the mechanisms that we request to ensure compliance with our legal obligations or technical requirements;

• decisions by our partners to restrict our ability to collect data from them (which decision they may be able to make at their discretion) or to refuse to implement the mechanisms that we request to ensure compliance with our technical requirements or legal obligations;

• decisions by our partners to limit our ability to use their purchase data outside of the applicable banking channel;

• decisions by our partners’ customers to opt out of the incentive program or to use technology, such as browser settings, that reduces our ability to deliver relevant advertisements;

• decisions by our partners' customers to opt out of the incentive program or to use technology that reduces our ability to deliver relevant advertisements;

• interruptions, failures or defects in our or our partners' data collection, mining, analysis and storage systems;

7 unchanged sentences

If any of these key data providers were to withdraw or withhold their identifiers from us, our ability to provide our solutions could be adversely affected, and certain marketers may severely limit their spending on our solutions or stop spending with us entirely.

Replacements for any of these third-party identifiers may not fit the needs of certain marketers or be available in a timely manner or under economically beneficial terms, or at all.

Replacements for any of these third-party identifiers may not fit the needs of certain marketers or be available in a timely manner or under economically beneficial terms.

Defects, errors or delays in our solutions could harm our reputation, which would harm our operating results.

The technology underlying our solutions may contain material defects or errors that can adversely affect our ability to operate our business and cause significant harm to our reputation.

The technology underlying our solutions may contain material defects or errors that could adversely affect our ability to operate our business and cause significant harm to our reputation.

This risk is compounded by the complexity of the technology underlying our solutions and the large amounts of data that we leverage and process.

4 unchanged sentences

We currently contract with Amazon Web Services for our cloud-hosting solutions.

We have begun to migrate and will continue to migrate our data storage capabilities to Amazon Web Services’ cloud-hosting solution.

If we do not complete the migration, are not successful in completing a seamless migration, or fail to administer the cloud-hosting solution in a well-managed, secure and effective manner, we may experience unplanned service disruptions or unforeseen costs.

If for any reason our arrangements with our third-party data centers or other data-hosting solutions are terminated, or if we are unable to renew our agreements on commercially reasonable terms, we may be required to transfer that portion of our operations to new data center facilities or other data-hosting solutions, and we may incur significant costs and possible service interruption in connection with doing so.

Further, protection of our third-party data centers or other data-hosting solutions against damage or interruption from cyber-attacks, fire, flood, tornadoes, power loss, telecommunications or equipment failure or other disasters and events beyond our control is important to our continued success.

Any damage to, or failure of, the systems of the data centers or other data-hosting solutions that we utilize, or of our own equipment located within such data centers, could result in interruptions to the availability or functionality of our solutions.

In addition, the failure of the data centers or other data-hosting solutions that we utilize to meet our capacity requirements could result in interruptions in the availability or functionality of our solutions or impede our ability to scale our operations.

Any damage to the data centers or other data-hosting solutions that we utilize, or to our own equipment located within such data centers, that causes loss of capacity or otherwise causes interruptions in our operations could materially adversely affect our ability to quickly and effectively respond to our marketers’ or partners’ requirements, which could result in loss of their confidence, adversely impact our ability to attract new marketers and/or partners and force us to expend significant resources.

We have largely migrated our data storage capabilities to Amazon Web Services' cloud-hosting solution.

If we do not complete the migration in a seamless fashion or fail to administer the cloud-hosting solution in a well-managed, secure and effective manner, we may experience unplanned service disruptions or unforeseen costs.

If for any reason our arrangements with our data-hosting solutions are terminated, or if we are unable to renew our agreements on commercially reasonable terms, we may be required to transfer that portion of our operations to new data-hosting solutions, and we may incur significant costs and possible service interruption in connection with doing so.

Further, protection of our data-hosting solutions against damage or interruption from cyber-attacks, fire, flood, tornadoes, power loss, telecommunications or equipment failure or other disasters and events beyond our control is important to our continued success.

Any damage to, or failure of, the systems of the data-hosting solutions that we utilize could result in interruptions to the availability or functionality of our solutions.

In addition, the failure of the data-hosting solutions that we utilize to meet our capacity requirements could result in interruptions in the availability or functionality of our solutions or impede our ability to scale our operations.

Any damage to the data-hosting solutions that we utilize that causes loss of capacity or otherwise causes interruptions in our operations could materially adversely affect our ability to quickly and effectively respond to our marketers' or partners' requirements, which could result in loss of their confidence, adversely impact our ability to attract new marketers or partners and force us to expend significant resources.

The occurrence of any such events could adversely affect our business, financial condition and operating results.

3 unchanged sentences

Seasonality could have a material impact on our revenue, operating results, cash flow from operations and other key performance metrics from period to period.

Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, or our corporate culture is negatively impacted by the COVID-19 pandemic, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be harmed.

Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be harmed.

As of December 31, 2023, we had 434 full-time employees.

We intend to further expand our overall headcount and operations, with no assurance that we will be able to do so while effectively maintaining our corporate culture.

Additionally, our corporate culture may be negatively impacted by the COVID-19 pandemic.

We believe our corporate culture is one of our fundamental strengths as it enables us to attract and retain top talent and deliver superior results for our customers.

As we grow and change, integrate acquired businesses and their employees, and as the COVID-19 pandemic continues, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively.

As we grow, change and integrate acquired businesses and their employees, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively.

In turn, the failure to preserve our culture could negatively affect our ability to attract, recruit, integrate and retain employees, continue to perform at current levels and effectively execute our business strategy.

Additionally, available share count, at current market price, may limit our ability to attract and retain key talent as a part of our equity compensation.

If we are unable to attract, integrate and retain additional qualified personnel, including top technical talent, our business could be adversely affected.

Our future success depends in part on our ability to identify, attract, integrate and retain highly skilled technical, managerial, sales and other personnel, including top technical talent from the industry and top research institutions.

We face intense competition for qualified individuals from numerous other companies, including other software and technology companies, many of whom have greater financial and other resources than we do.

3 unchanged sentences

We may incur significant costs to attract and retain qualified personnel, including significant expenditures related to salaries and benefits and compensation expenses related to equity awards, and we may lose new employees to our competitors or other companies before we realize the benefit of our investment in recruiting and training them.

Additionally, available share count, at current market price, may limit our ability to attract and retain key talent as a part of our equity compensation.

Moreover, new employees may not be or become as productive as we expect, as we may face challenges in adequately or appropriately integrating them into our workforce and culture.

In addition, as we move into new geographies, we will need to attract and recruit skilled personnel in those areas.

We have little experience with recruiting in geographies outside of the U.S., and may face additional challenges in attracting, integrating and retaining international employees.

If we are unable to attract, integrate and retain suitably qualified individuals who are capable of meeting our growing technical, operational and managerial requirements, on a timely basis or at all, our business will be adversely affected.

We have little experience with recruiting in geographies outside of the U.S.

and the U.K., and may face additional challenges in attracting, integrating and retaining international employees.

We are dependent on the continued services and performance of our senior management and other key personnel, the loss of any of whom could adversely affect our business.

2 unchanged sentences

We do not maintain "key person" insurance for any member of our senior management team or any of our other key employees.

Our senior management and key personnel are all employed on an at-will basis, which means that they could terminate their employment with us at any time, for any reason and without notice.

Our U.S.-based senior management and key personnel are all employed on an at-will basis, which means that they could terminate their employment with us at any time, for any reason and without notice.

The loss of any of our key management personnel could significantly delay or prevent the achievement of our development and strategic objectives and adversely affect our business.

Further, if members of our management and other key personnel in critical functions across our organization are unable to perform their duties or have limited availability due to COVID-19, we may not be able to execute on our business strategy and/or our operations may be negatively impacted.

Our international sales and operations subject us to additional risks that can adversely affect our business, operating results and financial condition.

During each of 2020, 2021 and 2022, we derived 8% of our revenue outside the U.S., respectively.

During the years ended 2023, 2022 and 2021, we derived 5.8%, 7.8% and 7.8%, respectively, of our revenue from outside the U.S.

While substantially all of our operations are located in the U.S., we have an office in the U.K.

5 unchanged sentences

• localization of our solutions, including adaptation for local practices;

• increased management, travel, infrastructure and legal compliance costs associated with having international operations;

• fluctuations in currency exchange rates and related effect on our operating results;

• increased management, travel, infrastructure and legal and compliance costs associated with having international operations;

• fluctuations in currency exchange rates and related effects on our operating results;

• longer payment cycles and difficulties in collecting accounts receivable or satisfying revenue recognition criteria;

1 unchanged sentence

• general economic conditions in each country or region, including inflationary pressure;

• the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, including inflationary pressure;

• reduction in billings, foreign currency exchange rates, and trade with the United Kingdom;

• the global economic uncertainty and financial market conditions;

• reduction in billings associated with the U.K as well as issues related to foreign currency exchange rates and trade with the,U.K.;

• contractual and legislative restrictions or changes;

1 unchanged sentence

• compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations;

• compliance with U.S.

laws and regulations for foreign operations, including the Foreign Corrupt Practices Act, the U.K.

Bribery Act, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our software in certain foreign markets, and the risks and costs of non-compliance;

• potential changes in a specific country’s or region’s political or economic climate, including the current hostilities between Russia and Ukraine;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements;

• compliance with applicable laws and regulations for foreign operations, including the Foreign Corrupt Practices Act, the U.K.

Bribery Act, import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our products in certain foreign markets, and the risks and costs of non-compliance;

• potential changes in a specific country's or region's political or economic climate, including the current hostilities between Russia and Ukraine and conflict in the Middle East;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results, which may also result in restatements of financial statements or irregularities in financial statements;

• difficulties in repatriating or transferring funds from or converting currencies in certain countries;

4 unchanged sentences

If we do not manage our growth effectively, the quality of our solutions may suffer, and our business, financial condition and operating results may be negatively affected.

The recent growth in our business has placed, and is expected to continue to place, a significant strain on our managerial, administrative, operational and financial resources, as well as our infrastructure.

The growth in our business has placed, and is expected to continue to place, a significant strain on our managerial, administrative, operational and financial resources, as well as our infrastructure.

We rely heavily on information technology ("IT") systems to manage critical functions such as data storage, data processing, matching and retrieval, revenue recognition, budgeting, forecasting and financial reporting.

2 unchanged sentences

If we are not able to scale our IT infrastructure in a cost-effective and secure manner, our ability to offer competitive solutions will be harmed and our business, financial condition and operating results may suffer.

We must also continue to manage our employees, operations, finances, research and development and capital investments efficiently in an environment where nearly all employees are working from home.

We must also continue to manage our employees, operations, finances, research and development and capital investments efficiently in an environment where many employees are working from home.

Our productivity and the quality of our solutions may be adversely affected if we do not integrate and train our new employees quickly and effectively or if we fail to appropriately coordinate across our executive, research and development, technology, service development, analytics, finance, human resources, marketing, sales, operations and customer support teams.

7 unchanged sentences

Fluctuations in the exchange rates between the U.S.

dollar, British pound and Canadian dollar could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

dollar and British pound could result in the dollar equivalent of such revenue and expenses being lower, which could have a negative net impact on our reported operating results.

Although we may in the future decide to undertake foreign exchange hedging transactions to cover a portion of our foreign currency exchange exposure, we currently do not hedge our exposure to foreign currency exchange risks.

Our ability to use net operating losses and certain other tax attributes to offset future taxable income may be limited.

Our net operating loss ("NOL"), carryforwards could expire unused and be unavailable to offset future tax liabilities because of their limited duration or because of restrictions under U.S.

As of December 31, 2022, we had U.S.

Our net operating loss ("NOL") carry-forwards could expire unused and be unavailable to offset future tax liabilities because of their limited duration or because of restrictions under U.S.

As of December 31, 2023 and December 31, 2022, we had U.S.

federal and state NOLs of $896.0 million and $879.6 million , respectively.

Our federal NOLs generated in tax years beginning before January 1, 2018, are only permitted to be carried forward for 20 years under applicable U.S.

Our federal NOLs generated in tax years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOL carryforwards is limited to 80% of taxable income.

Our federal NOLs generated in tax years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOL carry-forwards is limited to 80% of taxable income.

It is uncertain if and to what extent various states will conform to federal law.

In addition, under Section 382 and Section 383 of the Internal Revenue Code of 1986, as amended (the "Code"), if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change tax attributes to offset its post-change taxable income or taxes may be limited.

In addition, under Section 382 and Section 383 of the Internal Revenue Code of 1986, as amended (the "Code"), if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carry-forwards and other pre-change tax attributes to offset its post-change taxable income or taxes may be limited.

We have experienced "ownership changes" under Code Section 382 in the past, and future changes in ownership of our stock, including by reason of future offerings, as well as other changes that may be outside of our control, could result in future ownership changes under Code Section 382.

If we are or become subject to limitations on our use of federal NOL carryforwards under IRC Section 382, our federal NOL carryforwards could expire unutilized or underutilized, even if we earn taxable income against which our federal NOL carryforwards could otherwise be offset.

If we are or become subject to limitations on our use of federal NOL carry-forwards under IRC Section 382, our federal NOL carry-forwards could expire unutilized or underutilized, even if we earn taxable income against which our federal NOL carry-forwards could otherwise be offset.

Similar provisions of state tax law may also apply to limit our use of accumulated state tax attributes.

In addition, at the state level, there may be periods during which the use of NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

In addition, at the state level, there may be periods during which the use of NOL carry-forwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

Changes in tax laws or regulations could materially adversely affect our company.

New tax laws or regulations could be enacted at any time, and existing tax laws or regulations could be interpreted, modified or applied in a manner that is adverse to us, which could adversely affect our business and financial condition.

For instance, the United States recently passed the Inflation Reduction Act, which provides for a minimum tax equal to 15% of the adjusted financial statement income of certain large corporations, as well as a 1% excise tax on certain share buybacks by public corporations that would be imposed on such corporations.

For instance, the Inflation Reduction Act was passed in the U.S.

in 2022, which provides for a minimum tax equal to 15% of the adjusted financial statement income of certain large corporations, as well as a 1% excise tax on certain share buybacks by public corporations, that would be imposed on such corporations.

In addition, it is uncertain if and to what extent various states will conform to federal tax legislation.

3 unchanged sentences

We may choose to expand by making acquisitions that could be material to our business, financial condition or operating results.

Our ability as an organization to successfully acquire and integrate technologies or businesses is unproven.

Acquisitions involve many risks, including the following:

6 unchanged sentences

• challenges inherent in effectively managing an increased number of employees in diverse locations;

• the potential strain on our financial and managerial controls and reporting systems and procedures;

• potential strain on our financial and managerial controls and reporting systems and procedures;

• potential known and unknown liabilities associated with an acquired company;

6 unchanged sentences

Charges to earnings resulting from our acquisitions may cause our operating results to suffer .

Under accounting principles, we have allocated the total purchase price of Dosh’s, Bridg’s and Entertainment's net tangible assets and intangible assets based on their fair values as of the date of the acquisitions, and we have recorded the excess of the purchase price over those fair values as goodwill.

Under accounting principles, we have allocated the total purchase price of Dosh's and Bridg's net tangible assets and intangible assets based on their fair values as of the date of the acquisitions, and we have recorded the excess of the purchase price over those fair values as goodwill.

Our management's estimates of fair value will be based upon assumptions that they believe to be reasonable but that are inherently uncertain.

5 unchanged sentences

Some of these costs may have to be accounted for as expenses that would negatively impact our results of operations.

During the year ended December 31, 2022 we recognized a goodwill and intangible impairment of $453.29 million.

Refer to Note 5—Goodwill and Acquired Intangibles to our condensed consolidated financial statements for additional information regarding the goodwill impairment.

We may require additional capital to support growth, and such capital might not be available on terms acceptable to us, if at all, which may in turn hamper our growth and adversely affect our business.

5 unchanged sentences

We also may not be able to obtain additional financing on terms favorable to us, if at all.

For example, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in significant disruption of global financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity.

If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth, service our indebtedness and respond to business challenges could be significantly impaired, and our business may be adversely affected.

Regulatory, legislative or self-regulatory developments regarding Internet privacy matters could adversely affect our ability to conduct our business.

Through our consumer application, users accumulate rewards that could be deemed subject to abandoned property laws and/or could be deemed to constitute stored value subject to certain legal requirements under applicable state and federal laws and regulations.

9 unchanged sentences

Our FI partners and FI partner prospects engage in highly regulated businesses, are often slow to adopt technological innovation and have rigorous standards with respect to providing third parties, like us, with access to their data.

Our operating results depend in part on expanding our FI network to maintain and enhance the scale of our solutions.

Our operating results depend in part on expanding our FI partner network to maintain and enhance the scale of our solutions.

The length of time that it takes to add an FI partner to our network, from initial evaluation to integration into our network, varies substantially from FI to FI and may take several years.

3 unchanged sentences

Because a substantial portion of our expenses are relatively fixed in the short term, our operating results will suffer if revenue falls below our expectations in a particular quarter, which could cause the price of our stock to decline.

Ultimately, if additions to our FI network are not realized in the time period expected or not realized at all, or if an FI partner terminates its agreement with us, our business, financial condition and operating results could be adversely affected.

Ultimately, if additions to our FI partner's network are not realized in the time period expected or not realized at all, or if an FI partner terminates its agreement with us, our business, financial condition and operating results could be adversely affected.

Bringing new FI partners into our network may impede our ability to accurately forecast the performance of our network.

Bringing new FI partners into our network may impede our ability to accurately predict how certain marketing campaigns will perform, and thus may impede our ability to accurately forecast the performance of our network.

Such inaccurate predictions could result in marketing campaigns underperforming, which impacts the total fees we can collect from marketers, or over performing, which may result is us paying certain Consumer Incentives to consumers without adequate compensation from the marketers.

Such inaccurate predictions could result in marketing campaigns underperforming, which impacts the total fees we can collect from marketers, or over performing, which may result in us paying certain Consumer Incentives to consumers without adequate compensation from the marketers.

The amount of time it will take us to be able to understand the impact of a new FI partner on our network is uncertain and difficult to predict.

Additionally, our understanding of the impact of any given FI is subject to change at any time, as such understanding can be impacted by factors such as changes to an FI’s business strategy, changes to an FI’s user interface, or changes in the behavior or makeup of an FI's consumer base.

Additionally, our understanding of the impact of any given FI partner is subject to change at any time, as such understanding can be impacted by factors such as changes to an FI partner's business strategy, changes to an FI partner's user interface, or changes in the behavior or makeup of an FI partner's consumer base.

If we are not able to maintain and enhance our brand, our business, financial condition and operating results may be adversely affected.

8 unchanged sentences

We may not have sufficient cash flow from our business to pay our indebtedness, and we may not have the ability to raise the funds necessary to settle for cash conversions of the Notes or to repurchase the Notes for cash upon a fundamental change, which could adversely affect our business and results of operations.

In September 2020, we issued convertible senior notes with an aggregate principal amount of $230.0 million bearing an interest rate of 1.00% due in 2025 (the "Notes").

In September 2020, we issued convertible senior notes with an aggregate principal amount of $230.0 million bearing an interest rate of 1.00% due on September 15, 2025 (the "Notes").

The interest rate is fixed at 1.00% per annum and is payable semi-annually in arrears on March 15 and September 15 of each year, beginning on March 15, 2021.

14 unchanged sentences

For example, it could:

• make us more vulnerable to adverse changes in general U.S.

and worldwide economic, industry, and

• competitive conditions and adverse changes in government regulation;

• make us more vulnerable to adverse changes in the U.S.

and worldwide economic climate;

• negatively expose us to competitive conditions and adverse changes in government regulation;

• limit our flexibility in planning for, or reacting to, changes in our business and our industry;

• place us at a disadvantage compared to our competitors who have less debt;

• limit our ability to borrow additional amounts for funding acquisitions, for working capital, and for other general corporate purposes;

• limit our ability to borrow additional amounts for working capital, funding future acquisitions, and other general corporate purposes;

• make an acquisition of our company less attractive or more difficult.

24 unchanged sentences

We can provide no assurances as to the financial stability or viability of the Option Counterparties.

The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.

The accounting method for reflecting the notes on our balance sheet, accruing interest expense for the notes and reflecting the underlying shares of our common stock in our reported diluted earnings per share may adversely affect our reported earnings and financial condition.

We expect that, under applicable accounting principles, the initial liability carrying amount of the notes will be the fair value of a similar debt instrument that does not have a conversion feature, valued using our cost of capital for straight, unconvertible debt.

We expect to reflect the difference between the net proceeds from this offering and the initial carrying amount as a debt discount for accounting purposes, which will be amortized into interest expense over the term of the notes.

As a result of this amortization, the interest expense that we expect to recognize for the notes for accounting purposes will be greater than the cash interest payments we will pay on the notes, which will result in lower reported income or higher reported loss.

The lower reported income or higher reported loss resulting from this accounting treatment could depress the trading price of our common stock and the notes.

However, in August 2020, the Financial Accounting Standards Board published an Accounting Standards Update ("ASU") 2020-06, eliminating the separate accounting for the debt and equity components as described above.

ASU 2020-06 effective for SEC-reporting entities for fiscal years beginning after December 15, 2021, including interim periods within those fiscal years.

On January 1, 2022, we adopted this standard using the modified retrospective method which allowed for a cumulative-effect adjustment to the opening balance sheet without restating prior periods.

As we did not elect the fair value option in the process, the notes, net of issuance costs, are accounted for as a single liability measured at amortized cost.

Upon adoption, we recorded a decrease in accumulated deficit of $11.2 million, an increase to the notes, net of $40.2 million and a decrease to additional paid in capital of $51.4 million.

If accounting standards change in the future and we are not permitted to use the treasury stock method, then our diluted earnings per share may decline.

For example, the Financial Accounting Standards Board’s ASU described above amends these accounting standards, effective as of the dates referred to above, to eliminate the treasury stock method for convertible instruments that can be settled in whole or in part with equity and instead require application of the “if-converted” method.

Under that method, diluted earnings per share would generally be calculated assuming that all the notes were converted solely into shares of common stock at the beginning of the reporting period, unless the result would be anti-dilutive.

The application of the if-converted method may reduce our reported diluted earnings per share.

Furthermore, if any of the conditions to the convertibility of the notes is satisfied, then we may be required under applicable accounting standards to reclassify the liability carrying value of the notes as a current, rather than a long-term, liability.

This reclassification could be required even if no noteholders convert their notes and could materially reduce our reported working capital.

Risks Related to Regulatory and Intellectual Property Matters

We and our FI partners are subject to stringent and changing privacy and data security laws, rules, contractual obligations, self-regulatory schemes, government regulation, policies and other obligations related to data privacy and security.

The actual or perceived failure by us, our customers, our partners, or other third parties upon whom we rely to comply with such obligations could lead to regulatory investigations or actions, litigation, disruptions of our business operations, loss of customers or sales, harm our reputation, result in significant expense, loss of revenue or profits, subject us to significant fines and liability or otherwise adversely affect our business.

In the ordinary course of business, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal information and other information (“Process” or “Processing”) necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.

We, our FI partners, our marketers and other third parties upon whom we rely are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally.

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers may be subject include those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

We and our FI partners are subject to stringent and evolving U.S.

and foreign privacy and data security laws, rules, contractual obligations, regulation, industry standards, policies and other obligations related to data privacy and security.

The actual or perceived failure by us, our partners, or other third parties whom we rely upon to comply with such obligations could lead to regulatory investigations or actions, litigation (including class claims), mass arbitration demands, disruptions of our business operations, or loss of customers or sales, harm our reputation, result in significant expense or loss of revenue or profits, subject us to significant fines and liability or otherwise adversely affect our business.

In the ordinary course of business, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal data and other sensitive information including proprietary and confidential business data, trade secrets, and intellectual property ("process" or "processing") necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.

We, our FI partners, our marketers and other third parties whom we rely upon are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally.

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers may be subject, include but are not limited to those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

The regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

2 unchanged sentences

A number of existing bills are pending in the U.S.

Congress that contain provisions that would regulate how companies can use cookies and other tracking technologies to collect and utilize user information.

Additionally, new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally.

Congress that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information.

Additionally, new legislation proposed or enacted in various states will continue to shape the data privacy environment nationally.

The California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the United States.

The CCPA gives California residents expanded rights to request access to and deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA also increases the privacy and security obligations on entities handling personal information, which is broadly defined under the law.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages of up to $750 per citizen, which is expected to increase data breach litigation.

The CCPA gives California residents expanded rights to request access to and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is used.

The CCPA also increases the data privacy and security obligations on entities handling personal data, which is broadly defined under the law.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages, which is expected to increase data breach litigation.

The CCPA also imposes requirements on businesses that “sell” information (which is defined broadly under the CCPA);

there is significant ambiguity regarding what constitutes a sale and many of our or our partner’s business practices may qualify.

Further the California Privacy Rights Act (“CPRA”), became effective starting on January 1, 2023, which significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Other states, such as Virginia, Colorado, Utah, and Connecticut, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels.

Further the California Privacy Rights Act ("CPRA"), which took effect on January 1, 2023, significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal data.

The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.

In the past few years, other states, including Virginia, Colorado, Utah, Iowa, Montana, Indiana, Tennessee, Oregon, Texas, Delaware, New Jersey, New Hampshire and Connecticut, have also passed comprehensive privacy laws that impose certain obligations on covered businesses, including requiring covered businesses to provide specific disclosures in privacy notices and to afford residents with certain rights concerning their personal data.

Similar laws are being considered in several other states, as well as at the federal and local levels.

These developments may further complicate compliance efforts, and may increase legal risk and compliance costs for us and the third parties upon whom we rely.

Outside of the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s GDPR (“UK GDPR”), impose strict requirements for processing personal data.

For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions;

fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater;

or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests..

For example, the European Union’s General Data Protection Regulation ("EU GDPR") and the United Kingdom’s GDPR ("U.K.

GDPR") impose strict requirements for processing personal data.

For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions, fines of up to 20 million euros or 4% of annual global revenue (whichever is greater), or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

An example of the type of international regulation to which we may be subject is the U.K.’s Privacy and Electronic Communications Regulations 2011 ("PECR"), which implements the requirements of Directive 2009/136/EC (which amended Directive 2002/58/EC), which is known as the ePrivacy Directive.

The PECR regulates various types of electronic direct marketing that use cookies and similar technologies.

The PECR also imposes sector-specific breach reporting requirements, but only as applicable to providers of particular public electronic communications services.

The PECR also imposes sector-specific breach reporting requirements, but these requirements only apply to providers of certain public electronic communications services.

Additional European Union member state laws of this type may follow.

1 unchanged sentence

Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries.

In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate.

In particular, the European Economic Area ("EEA") and the U.K.

have significantly restricted the transfer of personal data to the U.S.

and other countries whose privacy laws it believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses and UK’s International Data Transfer Agreement, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating GDPR’s cross-border data transfer limitations.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and U.K.

in compliance with law, such as the EEA standard contractual clauses and U.K.’s International Data Transfer Agreement, and the EU-U.S.

Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally compliant transfer are

too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and U.K.

to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating GDPR's cross-border data transfer limitations.

Our employees and personnel may use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations.

Governments have passed and are likely to pass additional laws regulating generative AI.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

In addition to data privacy and security laws, we are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.

We publish privacy policies, marketing materials and other statements regarding data privacy and security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresent our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty.

Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions.

Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.

Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to the services, information, technologies, systems and practices of any third parties that process personal data on our behalf.

In addition, these obligations may require us to change or business model.

1 unchanged sentence

Even if we are able to do so, such additional tools may be subject to further regulation, time consuming to develop or costly to obtain, and less effective than our current use of cookies.

Our business model materially depends on our ability to process personal data, so we are particularly exposed to the risks associated with the rapidly changing legal landscape.

For example, we may be at heighten risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model.

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including, but not limited to:

government enforcement actions (e.g.

investigations, fines, penalties, audits and inspections);

litigation (including class-action claims);

additional reporting requirements and/or oversight;

bans on processing personal data;

and orders to destroy or not use personal data.

Any of these events could have a material adverse effect on our reputation, business or financial condition, including, but not limited to:

loss of customers;

interruptions or stoppages in our business operations;

inability to process personal data or to operate in certain jurisdictions;

limited ability to develop or commercialize our products;

expenditure of time and resources to defend any claim or inquiry;

adverse publicity;

or substantial changes to our business model or operations.

If the use of matching technologies, such as cookies, pixels and device identifiers, is rejected by Internet users, restricted or otherwise subject to unfavorable terms, such as by non-governmental entities, our validation methodologies could be impacted and we may lose customers and revenue.

Our solution can be utilized by in-store and online marketers;

however, a large majority of consumer purchases continue to be made in-store.

For validation of certain of these limited online purchases, our solutions may use digital matching technologies, such as mobile advertising identifiers, pixels and cookies to match the Cardlytics IDs we have assigned to our FIs’ customers with their digital presence outside of the FI partners’ websites and mobile applications.

In most cases, the matching technologies we use relate to mobile advertising identifiers that we use in limited cases to validate that we influenced an online purchase.

If our access to matching technology data is reduced, our ability to validate certain online purchases in the current manner may be affected and thus undermine the effectiveness of our solutions.

On occasion, “third-party cookies” may be placed through an Internet browser to validate online purchases.

Internet users may easily block and/or delete cookies (e.g., through their browsers or “ad blocking” software).

The most commonly used Internet browsers allow Internet users to modify their browser settings to prevent cookies from being accepted by their browsers or are set to block third-party cookies by default.

Further, Google eliminated third-party cookies from its browser in 2022.

If more browser providers and Internet users adopt these settings or delete their cookies more frequently than they currently do, our practices related to the validation of limited online purchases could be impacted, which could result in us needing to implement other available methodologies.

Some government regulators and privacy advocates have suggested creating a “Do Not Track” standard that would allow Internet users to express a preference, independent of cookie settings in their browser, not to have website browsing recorded.

If Internet users adopt a “Do Not Track” browser setting and the standard either gets imposed by state or federal legislation or agreed upon by standard-setting groups, it may curtail or prohibit us from using non-personal data as we currently do.

This could hinder growth of marketing on the Internet generally and cause us to change our business practices and adversely affect our business, financial condition and operating results.

In addition, browser manufacturers could replace cookies with their own product and require us to negotiate and pay them for use of such product to record information about Internet users’ interactions with our marketers, which may not be available on commercially reasonable terms, or at all.

If we or the third parties which we rely upon fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including, but not limited to:

government enforcement actions (which could result in investigations, fines, penalties, audits and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal data and orders to destroy or not use personal data.

In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class action litigation and mass arbitration demands.

Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.

Any of these events could have a material adverse effect on our reputation, business or financial condition, potentially resulting in negative consequences including, but not limited to loss of customers, interruptions or stoppages in our business operations, inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity or substantial changes to our business model or operations.

Failure to protect our proprietary technology and intellectual property rights could substantially harm our business, financial condition and operating results.

2 unchanged sentences

and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.

As of the date of filing, we had eight issued patents relating to our software.

As of the date of filing, we had sixteen issued patents relating to our software.

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated or circumvented.

Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringements.

We have registered, or are registering, the “Cardlytics,” “Dosh," "Bridg" and "Entertainment" names and logos in the U.S.

We have registered, or are registering, the "Cardlytics," "Dosh," "Bridg" and "Rippl" names and logos in the U.S.

and certain other countries.

6 unchanged sentences

Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them.

Bank of America also has a right to purchase some of the source code underlying the Cardlytics platform upon the occurrence of specified events, which could compromise the proprietary nature of the Cardlytics platform and/or allow Bank of America to discontinue the use of our solutions.

Additionally, other FIs have a right to obtain the source code underlying Cardlytics Ad Server through the release of source code held in escrow upon the occurrence of specified events, which could compromise the proprietary nature of the Cardlytics platform and/or allow these FIs to discontinue the use of our solutions.

Additionally, certain FIs have a right to obtain the source code underlying Cardlytics Ad Server through the release of source code held in escrow upon the occurrence of specified events, which could compromise the proprietary nature of the Cardlytics platform and/or allow these FIs to discontinue the use of our solutions.

In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes.

3 unchanged sentences

We may be unable to determine the extent of any unauthorized use or infringement of our solutions, technologies or intellectual property rights.

From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the intellectual property rights of others or to defend against claims of infringement or invalidity.

From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, protect our trade secrets, determine the validity and scope of the intellectual property rights of others or defend against claims of infringement or invalidity.

Such legal action could result in substantial costs and diversion of resources and could negatively affect our business, financial condition and operating results.

45 unchanged sentences

sanctions or export control laws, it could result in substantial fines and penalties for us and for the individuals working for us.

Changes in export or import laws or corresponding sanctions, may delay the introduction and sale of our products in international markets, or, in some cases, prevent the export or import of our products to certain countries, regions, governments, persons or entities altogether, which could adversely affect our business, financial condition and results of operations.

Changes in export or import laws or corresponding sanctions may delay the introduction and sale of our products in international markets, or, in some cases, prevent the export or import of our products to certain countries, regions, governments, persons or entities altogether, which could adversely affect our business, financial condition and

results of operations.

We are also subject to various domestic and international anti-corruption laws, such as the U.S.

7 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways.

Since shares of our common stock were sold in our initial public offering in February 2018 at a price of $13.00 per share, our stock price has ranged from an intraday low of $3.50 to an intraday high of $161.47 through February 28, 2023.

Since shares of our common stock were sold in our initial public offering in February 2018 at a price of $13.00 per share, our stock price has ranged from an intraday low of $2.60 to an intraday high of $161.47 through March 13, 2024.

Factors that may affect the market price of our common stock include:

10 unchanged sentences

• general economic, regulatory and market conditions.

Recently, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies, including our own, due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by expected interest rate changes, inflation and the COVID-19 pandemic.

The stock markets have experienced extreme price and volume fluctuations in recent periods that have affected and continue to affect the market prices of equity securities of many companies, including our own, due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by expected interest rate changes and inflation.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

27 unchanged sentences

Natural or man-made disasters, pandemics and other similar events may significantly disrupt our business, and negatively impact our business, financial condition and operating results.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

A significant portion of our employee base, operating facilities and infrastructure are centralized in Atlanta, Georgia.

A significant public health crisis, epidemic or pandemic, or a natural disaster, such as an earthquake, fire or flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

A significant portion of our employee base, operating facilities and infrastructure are centralized in Atlanta, GA;

Menlo Park, CA and New York, NY.

Any of our facilities may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, tornadoes, hurricanes, wildfires, floods, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks and power outages, which may render it difficult or impossible for us to operate our business for some period of time.

4 unchanged sentences

In addition, the facilities of significant marketers, partners or third-party data providers may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or material adverse effects on our business.

An active trading market for our common stock may not develop or be sustained.

An active trading market for our common stock may not be sustained.

Although our common stock is listed on the Nasdaq Global Market, we cannot assure you that an active trading market for our shares will be sustained.

17 unchanged sentences

A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.

We have incurred and will continue to incur increased costs as a result of being a public company.

As a public company, we have incurred and will continue to incur significant legal, accounting and other expenses that we did not incur as a private company.

The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the Nasdaq Stock Market and other applicable securities rules and regulations impose various requirements on public companies.

We expect that compliance with these requirements will continue to increase certain of our expenses and make some activities more time-consuming than they have been in the past when we were a private company.

Such additional costs going forward could negatively affect our financial results.

Our business and operations could be negatively affected if we become subject to any securities litigation or stockholder activism.

7 unchanged sentences

Our stock price could also be subject to significant fluctuation or otherwise be adversely affected by the events, risks and uncertainties of any securities litigation and stockholder activism.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors