What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-03-22 compared with 2023-03-30 · 80 added, 197 removed, 301 unchanged (48% of the section changed)

3 unchanged sentences

Risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect our business, financial condition, and operating results.

Risk factors summary

The following is a summary of the principal risks that could adversely affect our business, operations and financial results:

Risks relating to our business and industry

• Any diminution in, elimination of, or change in the availability of tax benefits for HSAs and other CDBs, or in the use of these accounts, would materially adversely affect us.

• Failure to adequately place and safeguard our custodial assets and Client-held funds, or the failure of any of our depository or insurance company partners, could materially and adversely affect our business, financial condition and results of operations.

• Integration of our recent acquisitions may not be successful.

• A decline in interest rate levels, including an environment of negative interest rates, would reduce our ability to earn income on our HSA Assets and Client-held funds and to attract HSA contributions.

• If we are not successful in adapting to our rapidly evolving industry, our growth may be limited, and our business may be adversely affected.

• We may be unable to compete effectively against our current and future competitors.

• Developments in the rapidly changing healthcare industry could adversely affect our business.

• The COVID-19 pandemic and resulting societal and economic changes has materially impacted our business and this impact may continue.

• If our members do not continue to utilize our payment cards, our results of operations, business, and prospects would be materially adversely affected.

• Failure to maintain effective internal control over financial reporting could have a material adverse effect on our reputation, results of operations and financial condition.

Data security, technological, and intellectual property risks

• Cyber-attacks, including ransomware attacks, or other privacy or data security incidents could materially adversely impact our business.

• Fraudulent and other illegal activity involving our products and services could lead to financial and reputational damage to us and reduce the use and acceptance of our products and services.

• We rely on software licensed from third parties that may be difficult to replace or that could cause errors or failures of our technology platforms that could lead to lost customers or harm to our reputation.

• Developing and implementing new and updated applications, features, and services for our technology platforms may be more difficult than expected, may take longer and cost more than expected, or may result in the platforms not operating as expected.

• Any disruption of service at our facilities or our third-party data centers and cloud providers could interrupt or delay our customers’ access to our products and services.

• Interruption or failure of our information technology and communications systems could impair our ability to effectively deliver our products and services.

• Our technology platforms may link to or utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

• Failure to adequately protect our brands and other intellectual property rights, and infringement of the intellectual property rights of others, would negatively impact our business.

Legal and regulatory risks

• The healthcare regulatory and political framework is uncertain and evolving, and we cannot predict the effect that further healthcare reform and other changes in government programs may have on our business, financial condition, or results of operations.

• Changes in applicable federal and state laws relating to HSAs and other CDBs could materially adversely affect our business.

• We are subject to privacy regulations, including regarding the access, use, and disclosure of personally identifiable information.

If we or any of our third-party vendors experience a privacy breach, it could result in substantial financial and reputational harm, including possible criminal and civil penalties.

• Legislative, regulatory, and legal developments involving taxes could adversely affect our results of operations and cash flows.

• Changes in laws and regulations relating to interchange fees on payment card transactions could adversely affect our revenue and results of operations.

• Failure to comply with, or changes in, payment card industry, credit card association or other network rules or standards set by Visa or MasterCard, or changes in card association and debit network fees or products or interchange rates, could materially adversely affect us.

• We are subject to complex regulation, and any compliance failures or regulatory action could adversely affect our business.

• If we are unable to meet or exceed the net worth test required by the IRS, we could be unable to maintain our non-bank custodian status.

Risks relating to our service and culture

• Any failure to offer high-quality customer support services could adversely affect our relationships with our members, Clients, and Network Partners and our operating results.

• We rely on our management team and team members and our business could be harmed if we are unable to retain qualified personnel.

• If we cannot maintain our corporate culture as we grow, we could lose the innovation, teamwork, passion, and focus on execution that we believe contribute to our success.

Risks relating to our partners and service providers

• If our Network Partners choose to partner with other providers of, or otherwise reduce offering or cease to offer, our products and services, our business could be materially and adversely affected .

• A change in relationship with any of our bank identification number sponsors, or the failure by these sponsors to comply with certain banking regulations, could materially and adversely affect our business.

• Replacing our third-party vendors would be difficult and disruptive to our business.

Growth-related risks

• Our acquisition strategy may not be successful.

• We may not be able to operate, integrate, and scale our technology effectively to match our business growth.

• Failure to manage future growth effectively could have a material adverse effect on our business, financial condition, and results of operations.

• We may not accurately estimate the impact on our business of developing, introducing, and updating new and existing products and services.

• We may need to record write-downs from future impairments of identified intangible assets and goodwill.

Financing and related risks

• Our substantial debt could limit our ability to fund operations, expose us to interest rate volatility, limit our ability to raise additional capital and have a material adverse effect on our ability to fulfill our obligations under our credit agreement and indenture and to our Network Partners, Clients and members.

• The indenture and the credit agreement contain covenants that impose significant operational and financial restrictions on us, and the failure to comply with these covenants would result in an event of default under these instruments.

• We may be unable to generate or obtain sufficient capital to fund our business and growth strategy.

General risk factors

• Natural disasters, pandemics or other epidemics, acts of terrorism, acts of war, adverse economic conditions, and other unforeseen events, may cause damage or disruption to us or our customers.

• Provisions in our charter documents and under Delaware law could discourage a takeover that stockholders may consider favorable.

• The exclusive forum provision in our amended and restated certificate of incorporation could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or team members.

Risks relating to our business and industry

Any diminution in, elimination of, or change in the availability of tax benefits for HSAs and other CDBs, or in the use of these accounts, would materially adversely affect us.

Any diminution in, elimination of, or change in the availability of tax benefits for HSAs and other CDBs would materially adversely affect us.

Substantially all of our revenue is earned from tax-advantaged HSAs and other CDBs.

3 unchanged sentences

If the laws or regulations are changed to limit or eliminate the tax benefits available through these accounts, such a change would have a material adverse effect on our business.

We believe that many consumers are not familiar with, or do not fully appreciate, the tax-advantaged benefits of HSAs and other CDBs.

If our members do not fully use their HSAs or CDBs, or if employers reduce or cease to offer HSAs or other CDB programs, or if the rate of adoption of these accounts decreases, our results of operations, financial condition, business, and prospects would be materially and adversely affected .

Failure to adequately place and safeguard our custodial assets and Client-held funds, or the failure of any of our depository or insurance company partners, could materially and adversely affect our business, financial condition and results of operations.

As a non-bank custodian, we rely on our federally insured custodial depository partners and our insurance company partners to hold the vast majority of the HSA Assets that we custody.

In addition, we deposit Client-held funds with our depository partners in interest-bearing, demand deposit accounts that have a floating interest rate and no set term or duration, and for certain Clients these amounts exceed maximum federal deposit insurance levels.

Failure to adequately place and safeguard HSA cash and Client-held funds, or the failure of any of our depository or insurance company partners, could materially and adversely affect our business, financial condition and results of operations.

As a non-bank custodian, we rely on our federally insured custodial Depository Partners and our insurance company partners to hold HSA cash that we custody.

The portion of HSA cash held by our insurance company partners is increasing with the increased adoption of our Enhanced Rates program.

The HSA cash held through our insurance company partners is not federally insured, and our members bear the risk of loss with respect to either the failure of the insurance company partner holding their HSA cash or the breach by the insurance company partner of its obligations to guarantee principal or pay interest thereon.

In addition, we deposit Client-held funds with our Depository Partners in interest-bearing demand deposit accounts, and for certain Clients these amounts exceed maximum federal deposit insurance levels.

If any material adverse event were to affect one of our Depository Partners or our insurance company partners, including a significant decline in its financial condition, a decline in the quality of its service, loss of deposits, its inability to comply with applicable banking, insurance or other regulatory requirements, systems failure or its inability to return principal or pay interest thereon, our business, financial condition and results of operations could be materially and adversely affected.

The HSA Assets held through our insurance company partners are not federally insured, and our members bear the risk of loss with respect to either the failure of the insurance company partner holding their HSA Assets or the breach by the partner of its obligations to guarantee principal or pay interest thereon.

In the event of such a failure of, or breach by, one of our insurance company partners, the HSA Assets held through that partner would be at risk and no assurance can be given that our contractual arrangements with that partner would be sufficient for our members to fully recover their HSA Assets, which would in turn result in reputational harm to us and financial harm to the Company.

Certain of our arrangements with our depository and insurance company partners require that we keep a minimum amount of HSA Assets with such partner, including sufficient liquid assets.

If we fail to comply with those minimum HSA Asset requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest payable.

Such penalties or reductions, if imposed, could have a material and adverse impact on our business, financial condition and results of operations.

In addition, in the event of such a failure of, or breach by, one of our insurance company partners, the HSA cash held through that insurance company partner would be at risk and no assurance can be given that our contractual arrangements with that insurance company partner would be sufficient for our members to fully recover their HSA cash, which would in turn result in reputational and financial harm to the Company.

In addition, certain of our insurance company partners have commitments to us with respect to the interest rates paid;

1 unchanged sentence

A reduction of the interest rate payable, or a requirement that we post collateral in lieu of any such reduction, could have a material and adverse impact on our business, financial condition and results of operations.

In addition to any potential penalties payable, if we were required to change depository or insurance company partners, we cannot accurately predict the success of such change or that the terms of our agreement with the new partner would be as favorable to us as our current agreements.

Integration of our recent acquisitions may not be successful.

The success of our recent acquisitions depends in part on our ability to realize the anticipated business opportunities from combining the operations of the acquired businesses with our business in an efficient and effective manner.

Failure to adequately manage the liquidity of the custodial assets held by our Depository Partners and insurance company partners could materially and adversely affect our business, financial condition, and results of operations.

Certain of our arrangements with our depository and insurance company partners require that we keep a minimum amount of HSA cash with such partner.

If we fail to comply with those minimum HSA cash requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest payable.

Such penalties or reductions, if imposed, could have a material and adverse impact on our business, financial condition and results of operations, and we may not have sufficient capital on hand to pay such penalties.

Integration of our acquisitions may not be successful, and we may not realize the synergies anticipated from our acquisitions.

The success of our acquisitions depends in part on our ability to realize the anticipated business opportunities from combining the operations of the acquired businesses with our business in an efficient and effective manner.

Integration of our acquisitions could take longer and be more costly than anticipated, and it could result in the loss of key team members, the disruption of our ongoing business and the acquired business, tax costs or inefficiencies, or inconsistencies in standards, controls, information technology systems, procedures and policies, any of which could adversely affect our ability to maintain relationships with team members, Clients, Network Partners or other third parties, and could harm our financial performance.

We may fail to fully realize the anticipated synergies associated with successfully integrating our acquisitions.

Achievement of these anticipated synergies is based on our ability to grow revenue as a combined company, the integration of technology platforms, and realization of the targeted cost synergies expected from each acquisition .

Actual operating, technological, strategic, and revenue opportunities, if achieved at all, may be less significant than expected or may take longer or cost more to achieve than anticipated.

If we are not able to achieve these objectives and realize the synergies expected from these acquisitions within the anticipated timing or at all, our business, financial condition, and operating results may be adversely affected.

Our management team and other team members are spending significant amounts of time on integration efforts relating to the Further Acquisition.

Similar to the work completed to integrate the WageWorks Acquisition, as part of the Further Acquisition integration process we are working to migrate certain Clients and Network Partners to different technology platforms.

In addition, we may not realize the anticipated cost, revenue, and other synergies associated with successfully integrating our acquisitions.

Our management team and other team members continue to spend significant amounts of time on integration efforts relating to the Further Acquisition.

Similar to the work completed to integrate the acquisition of WageWorks, as part of the Further Acquisition integration process we are working to migrate certain Clients and Network Partners to different technology platforms.

In connection with the WageWorks technology platform migrations, we experienced the following challenges, all of which could also occur in connection with the Further technology platform migration:

3 unchanged sentences

• we faced challenges in integrating the back-office systems and people associated with these technology platforms.

A decline in interest rate levels, including an environment of negative interest rates, would reduce our ability to earn income on our HSA Assets and Client-held funds and to attract HSA contributions.

A decline in interest rate levels would reduce our ability to earn income on our HSA Assets and Client-held funds and to attract HSA contributions.

We partner with our depository and insurance company partners to hold our HSA Assets and other Client-held funds.

1 unchanged sentence

A decline in prevailing interest rates has in the past and may again in the future negatively affect our business by reducing the yield we realize on our HSA Assets and other Client-held funds.

A negative interest rate environment would also reduce the yield we realize on our HSA Assets and other Client-held funds.

In addition, if we do not offer competitive interest rates on HSA Assets, our members may choose another HSA custodian.

Similarly, if the value of the invested HSA Assets we hold declines, whether due to market conditions or other factors, our fees, which are based on a percentage of the asset values, would be adversely affected.

Any such scenario could materially and adversely affect our business and results of operations.

A decline in the value of invested HSA Assets would adversely affect our results of operations.

If the value of the invested HSA Assets our members hold declines, whether due to market conditions or other factors, our fees, which are based on a percentage of the asset values, would be adversely affected, which would in turn negatively impact our results of operations.

If we are not successful in adapting to our rapidly evolving industry, our growth may be limited, and our business may be adversely affected.

4 unchanged sentences

These projects carry risks, such as cost overruns, delays in delivery, performance problems, and lack of acceptance by our Clients, Network Partners and members.

Any diminution in the use of HSAs or other CDBs would materially adversely affect us.

We believe that many consumers are not familiar with, or do not fully appreciate, the tax-advantaged benefits of HSAs and other CDBs.

Our success depends on the willingness of consumers to increase their use of HSAs and other CDBs, our ability to increase engagement, and our ability to demonstrate the value of our services to our existing and potential Clients, Network Partners and members.

If our existing Clients, Network Partners and members do not recognize or acknowledge the benefits of our services or we do not drive engagement, then the market for our services might develop more slowly than we expect, which could adversely affect our operating results.

In addition, we have limited insight into industry or broader trends that might develop and affect our business.

As such, we might make errors in predicting and reacting to relevant business, legal, and regulatory trends, which could harm our business.

If any of these events occur, it could materially adversely affect our business, financial condition or results of operations.

If our members do not fully use their HSAs or CDBs, if employers reduce or cease to offer HSAs or other CDB programs, if the rate of adoption of these accounts decreases, if existing Clients, Network Partners and members do not recognize or acknowledge the benefits of our services or we do not drive engagement, then the market for our services might decline or develop more slowly than we expect, which could adversely affect our operating results.

We may be unable to compete effectively against our current and future competitors.

6 unchanged sentences

This risk would be compounded if legal requirements or administrative rules are interpreted in a way that makes compliance more onerous for us than for our competitors.

Some of our competitors also offer reduced fee or no-fee HSAs, which has enabled them to increase market share in our market, has led to the loss of certain Client and Network Partners, and in some circumstances has caused us to reduce our fees.

If one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively.

Our competitors have and may continue to establish or strengthen cooperative relationships with our current or future Network Partners or other strategic partners, thereby limiting our ability to promote our solution with these parties.

We have seen an increase in Network Partners that have decided to offer HSAs or other CDBs directly to their customers, and a continuation of this trend would significantly reduce our channel partner opportunities.

Well-known retail mutual fund companies, such as Fidelity Investments, have entered the HSA and CDB business and gained significant market share.

7 unchanged sentences

Developments in the rapidly changing healthcare industry could adversely affect our business.

Substantially all of our revenue is derived from healthcare-related saving and spending by consumers, which could be affected by changes affecting the broader healthcare industry, including decreased spending in the industry

General reductions in expenditures by healthcare industry participants could result from, among other things:

6 unchanged sentences

However, the timing and impact of developments in the healthcare industry are difficult to predict.

We cannot assure you that the demand for our products and services will continue to exist at current levels or that we will have adequate technical, financial, and marketing resources to react to changes in the healthcare industry.

The COVID-19 pandemic and resulting societal and economic changes has materially impacted our business and this impact may continue.

Our business has been adversely affected by the COVID-19 pandemic, and we may continue to be adversely affected by the societal and economic changes arising out of the pandemic.

For example, we saw a significant decline in the use of commuter benefits during the outbreak, and the "work from home" trend, or hybrid work environments, may continue indefinitely, which would further delay, or materially negate, the recovery of use of these commuter benefits.

We also saw an increase in regulatory changes related to our products due to government responses to the COVID-19 pandemic, and we may see additional regulatory changes in the future related to new developments with COVID-19.

For example, the National Emergency Concerning COVID-19, which tolled certain deadlines related to COBRA and other CDBs, resulted in increased complexity in administering these programs and decreased usage of these products by our members.

This national emergency is expected to expire on May 11, 2023, and so we now must use resources to reverse the processes and systems established to address the national emergency, which requires team member time and resources, which could have otherwise been focused on more important areas of our business and strategy.

Outbreaks of new COVID-19 variants or other future pandemics may result in us being unable to meet our service level commitments to our Clients and Network Partners as a result of disruptions to our workforce and disruptions to third-party contractors that we rely on to provide our services.

The extent to which the COVID-19 pandemic and the societal and economic changes arising out of the pandemic will continue to negatively impact our business remains highly uncertain and, as a result, may continue to have a material and adverse impact on our business and financial results.

There is no assurance that the demand for our products and services will continue to exist at current levels or that we will have adequate technical, financial, and marketing resources to react to changes in the healthcare industry.

If our members do not continue to utilize our payment cards, our results of operations, business, and prospects would be materially adversely affected.

2 unchanged sentences

For example, the COVID-19 pandemic had a materially adverse impact on the interchange fees generated due to decreased usage of our payment cards in our commuter product and in healthcare spending.

We have continued to see decreased usage of our payment cards in our commuter product as a result of societal changes arising out of the COVID-19 pandemic.

If our customers do not use these payment cards at the rate we expect, if they elect to withdraw funds using a non-revenue generating mechanism such as direct reimbursement, if the impacts of societal changes arising out of the COVID-19 pandemic continue, or if other alternatives to these payment cards develop, our results of operations, business, and prospects would be materially adversely affected.

1 unchanged sentence

Effective internal control over financial reporting is necessary for us to provide reliable financial reports, prevent fraud and operate successfully as a public company.

During the fiscal year ended January 31, 2023, the Company remediated several material weaknesses at the WageWorks subsidiary level and implemented several new controls as part of the remediation efforts.

Any failure to execute on our new controls and continue to maintain effective internal controls, to timely implement any necessary additional improvement to our internal controls or to effect

remediation of any future material weakness or significant deficiency could, among other things, result in losses from fraud or error, harm our reputation or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our reputation, results of operations, or financial condition.

A ny failure to execute on our internal controls and continue to maintain effective internal controls, to timely implement any necessary additional improvement to our internal controls or to effect remediation of any future material weakness or significant deficiency could, among other things, result in losses from fraud or error, harm our reputation or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our reputation, results of operations, or financial condition.

Management reviews and updates our systems of internal controls and procedures, as appropriate.

4 unchanged sentences

Our proprietary technology platforms enable the exchange of, and access to, sensitive information, and, as a result, we are frequently the target of cyber-attacks or other privacy or data security incidents.

As one of the largest providers of HSAs and other CDBs, we are an even more attractive target for cyber-attacks, including ransomware attacks, which means we must continue to secure and monitor each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture.

In addition, recent geopolitical events, including the war between Russia and Ukraine, may result in an increase in cyber-attacks.

As one of the largest providers of HSAs and other CDBs, we are an attractive target for cyber-attacks, including ransomware attacks, which means we must continue to secure and monitor each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture.

In addition, geopolitical events, including the war between Russia and Ukraine, have resulted in, and may continue to result in, an increase in cyber-attacks.

Substantially all of our workforce works remotely.

3 unchanged sentences

Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers and other malfeasance.

Such security breaches could compromise our networks and result in the information stored or transmitted there to be accessed, publicly disclosed, lost, or stolen.

Such access, disclosure, or other loss of information could result in legal claims or proceedings leading to liability, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position.

A major breach of our network security and systems could have serious negative consequences for our business, including possible fines, penalties and damages, reduced demand for our services, an unwillingness of members, Clients, Network Partners and other data owners to provide us with their payment information, an unwillingness of members and other data owners to provide us with personal information, and harm to our reputation and brand.

Security breaches could result in the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines and other liabilities, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our members, Clients and Network Partners, damage our reputation, and cause a loss of confidence in our products and services.

If third parties improperly obtain and use the personal information of our members, we may be required to expend significant resources to resolve these problems.

Such security breaches could compromise our networks, or those of third-party service providers on which we rely, and result in the information stored or transmitted there to be accessed, modified or used in an unauthorized manner, publicly disclosed, lost, or stolen.

Such access, use, disclosure, or other loss of information could result in regulatory scrutiny, legal claims or proceedings leading to liability, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our Clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position.

Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties and other liabilities, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our members, Clients and Network Partners.

Such breaches could damage our reputation, and cause a loss of confidence in our products and services, reducing demand and resulting in an unwillingness of members, Clients, Network Partners and other data owners to provide us with their payment information or personal information, and otherwise harm our brand.

Furthermore, if third parties improperly obtain and use the personal information of our members, we may be required to expend significant resources to resolve these problems.

While we have security measures in place, we have experienced data privacy incidents in the past, including several incidents in 2018.

As a result, or if our security measures are breached again or unauthorized access to data is otherwise obtained as a result of third-party action, team member error or otherwise, our reputation could be significantly damaged, our business may suffer and we could incur substantial liability, which could result in loss of sales, Clients and Network Partners.

Because techniques used to obtain unauthorized access to or sabotage systems change frequently and are generally not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Any or all of these issues could negatively impact our ability to attract new, or increase engagement by, members, Clients and Network Partners, and subject us to third-party lawsuits, regulatory fines, contractual liability, and other action or liability, thereby harming our operating results.

Because techniques used to obtain unauthorized access to or sabotage systems change frequently and such novel techniques may not be identified until they are launched against a target, we may be unable to anticipate, or to implement adequate preventative measures to address, these techniques.

Fraudulent and other illegal activity involving our products and services could lead to financial and reputational damage to us and reduce the use and acceptance of our products and services.

Criminals are using increasingly sophisticated methods to capture personal information in order to engage in illegal activities such as counterfeiting and identity theft.

Even if we can secure our systems against these activities, we

are vulnerable through third parties.

Even if we can secure our systems against these activities, we are vulnerable through third parties.

We rely upon third parties for certain services, such as some transaction processing services and data feeds, which subjects us to risks related to the vulnerabilities of those third parties.

4 unchanged sentences

We rely on certain cloud-based software licensed from third parties to run our business.

This software may experience outages, may not continue to be available to us on commercially reasonable terms and any loss of the right to use any of this software could result in, among others, delays in producing our financial statements, risks to our security environment, or the provisioning of our products and services until equivalent technology is either developed by us, or, if available, identified, obtained, and integrated, which would likely take a significant amount of time and harm our business.

This software may experience outages, may not continue to be available to us on commercially reasonable terms and any loss of the right to use any of this software could result in, among others, delays in producing our financial statements, risks to our security environment, or the provisioning of our products and services until equivalent technology is either developed by us, or, if available, identified, obtained, and integrated into our systems and processes, which would likely take a significant amount of time and harm our business.

In addition, we have service level agreements with certain of our Clients and Network Partners for which the availability of this software is critical.

4 unchanged sentences

In addition, potential Clients and Network Partners are increasingly seeking a bundled solution, encompassing a wide range of features.

Accordingly, we are continuing to develop new and updated applications, features, and services, and maintain existing applications, features, and services.

If we are unable to do so on a timely basis or if we are unable to implement new applications, features and services that enhance our members’ and Clients' experience without disruption to our existing applications, features and services, or if we encounter technical obstacles that result in the technology not operating properly, we may lose potential and existing Clients and Network Partners.

We are currently investing in a significant modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy and platform infrastructure, while maintaining existing applications, features, and services.

If we are unable to do so on a timely basis or if we are unable to implement this modernization without disruption to our existing applications, features and services, or if we encounter technical obstacles that result in the technology not operating properly, we may lose potential and existing Clients and Network Partners.

We rely on a combination of internal development, strategic relationships, licensing, and acquisitions to develop our content offerings, products and services.

1 unchanged sentence

• cost more than expected;

• take longer than originally expected;

• take longer than originally expected to develop or implement;

• require more testing than originally anticipated;

2 unchanged sentences

• require the acquisition of additional personnel and other resources.

The revenue opportunities earned from these efforts may fail to justify the amounts spent.

The revenue opportunities earned from these efforts may fail to justify the effort or resources spent.

In addition, material performance problems, defects or errors in our existing or new software may occur in the future, which may harm our operating results.

Any disruption of service at our facilities or our third-party data centers and cloud service providers could interrupt or delay our customers’ access to our products and services.

New products and services, including those incorporating or utilizing AI and machine learning may raise technological, security, legal and other risks and challenges related to, among other items, the use of personal information in such AI systems, flaws in our models or training datasets that may result in biased or inaccurate results or other unanticipated outcomes, ethical considerations regarding AI, potential infringement of third-party intellectual property rights, and our ability to safely deploy and implement governance and controls for AI systems.

Realization of these risks could negatively impact our reputation, the demand for our products and services, our financial condition and results of operations, and otherwise draw adverse regulatory scrutiny.

Any disruption of service at our facilities, our third-party data centers, or our cloud service providers could interrupt or delay our customers’ access to our products and services.

The ability of our team members, members, Network Partners, and Clients to access our technology platforms is critical to our business.

9 unchanged sentences

• actions or events caused by or related to third parties.

We attempt to mitigate these risks through various business continuity efforts, including redundant infrastructure, 24/7/365 system activity monitoring, backup and recovery procedures, use of a secure storage facility for backup media, separate test systems, and change management and system security measures, but our precautions may not protect against all potential problems.

We attempt to mitigate these risks through various business continuity efforts, including redundant infrastructure, 24/7/365 system activity monitoring, backup and recovery procedures, use of a secure storage facility for backup media, separate production and test systems, and change management and system security measures, but our precautions may not protect against all potential problems.

Our data recovery centers are equipped with physical space, power, storage and networking infrastructure and Internet connectivity to support our technology platforms in the event of the interruption of services at our data centers.

1 unchanged sentence

Disruptions at our data centers could cause disruptions to our technology platforms and data loss or corruption.

We have experienced interruptions and delays in service and availability for data centers, and bandwidth and other technology issues in the past.

We have experienced interruptions and delays in service and availability for data centers, and bandwidth and other

technology issues in the past.

Frequent or persistent system failures that result in the unavailability of our technology platforms or slower response times could reduce our members', Clients' and Network Partners' ability to access our technology platforms, impair the delivery of our products and services, and harm the perception of our platforms as reliable, trustworthy, and consistent.

1 unchanged sentence

This could damage our reputation, subject us to potential liability or costs related to defending against claims or cause our members, Clients and Network Partners to cease doing business with us, any of which could negatively impact our financial results.

Interruption or failure of our information technology and communications systems could impair our ability to effectively deliver our products and services.

Our business depends on the continuing operation of our technology infrastructure and systems.

Any damage to or failure of our systems could result in interruptions in our ability to deliver our products and services.

Interruptions in our service could negatively impact our financial results, and our reputation could be damaged if our systems are viewed as unreliable.

Our systems and operations are vulnerable to damage or interruption from earthquakes, terrorist attacks, floods, fires, power loss, break-ins, hardware or software failures, failures from third-party vendors who support our systems and operations, telecommunications failures, computer viruses or other attempts to harm our systems, and similar events.

Any unscheduled interruption in our service could negatively impact our financial results.

In addition, our insurance policies provide only limited coverage for service interruptions and may not adequately compensate us for any losses that may occur due to any failures or interruptions in our systems.

Our technology platforms may link to or utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

5 unchanged sentences

Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Failure to adequately protect our brands and other intellectual property rights, and infringement of the intellectual property rights of others, would negatively impact our business.

We believe that our brands are critical to the success of our business, and we utilize trademark registration and other means to protect these brands.

Our business would be harmed if we were unable to protect our brands against infringement and the value of our brands was to decrease as a result.

We rely on a combination of trademark and copyright laws, trade secret protection, and confidentiality and license agreements to protect the intellectual property rights related to our products and services such as our technology platforms, applications and the content on our website.

We also rely on intellectual property licensed from third

We may unknowingly violate the intellectual property or other proprietary rights of others and, thus, may be subject to claims by third parties.

If so, we may be required to devote significant time and resources to defending against these claims or to protecting and enforcing our own rights.

As a result of any such dispute, we may have to:

• develop non-infringing technology;

• pay damages;

• enter into royalty or licensing agreements;

• cease providing certain products or services;

• take other actions to resolve the claims.

Additionally, we have largely relied, and expect to continue to rely, on copyright, trade secret, and trademark laws, as well as generally relying on confidentiality procedures and agreements with our team members, consultants, customers, and vendors, to control access to, and distribution of, technology, software, documentation, and other confidential information.

Despite these precautions, it may be possible for a third party to copy or otherwise obtain, use, or distribute our technology without authorization, particularly in foreign jurisdictions where some of our intellectual property rights may not be protected by intellectual property laws.

If this were to occur, we could lose revenue as a result of competition from products infringing or misappropriating our technology and intellectual property and we may be required to initiate litigation to protect our proprietary rights and market position.

copyright, trademark, and trade secret laws offer us only limited protection and the laws of some foreign countries do not protect proprietary rights to the same extent.

Accordingly, defense of our intellectual property and proprietary technology may become an increasingly important issue as we continue to expand our operations.

Policing unauthorized use of our intellectual property and technology is difficult and the steps we take may not prevent misappropriation of the intellectual property or technology on which we rely.

If competitors are able to use our intellectual property or technology without recourse, our ability to compete would be harmed and our business would be materially and adversely affected.

We may elect to initiate litigation in the future to enforce or protect our proprietary rights or to determine the validity and scope of the rights of others.

The loss of our intellectual property or the inability to secure or enforce our intellectual property rights or to defend successfully against an infringement action could harm our business, results of operations, financial condition, and prospects.

Legal and regulatory risks

12 unchanged sentences

We are subject to privacy regulations, including regarding the access, use, and disclosure of personally identifiable information.

If we or any of our third-party vendors experience a privacy breach, it could result in substantial financial and reputational harm, including possible criminal and civil penalties.

State and federal laws and regulations govern the collection, dissemination, access, and use of personally identifiable information, including HIPAA and HITECH, which govern the treatment of protected health information,

and the Gramm-Leach Bliley Act, which governs the treatment of nonpublic personal information.

In the provision of services to our customers, we and our third-party vendors collect, access, use, maintain, and transmit personally identifiable information in ways that are subject to many of these laws and regulations.

Although we have implemented measures to comply with these privacy laws, rules, and regulations, we have experienced data privacy incidents.

Any further unauthorized disclosure of personally identifiable information experienced by us or our third-party vendors could result in substantial financial and reputational harm, including possible criminal and civil penalties.

In many cases, we are subject to HIPAA and other privacy regulations because we are a business associate providing services to covered entities;

as a result, the covered entities direct HIPAA compliance matters in the event of a security breach, which complicates our ability to address harm caused by the breach.

In addition, our increased offering of CDBs means we now obtain substantially more HIPAA data.

Additionally, as we have in connection with prior security incidents, we may be required to report breaches to partners, regulators, state attorney generals, and impacted individuals depending on the severity of the breach, our role, legal requirements, and contractual obligations.

Privacy regulation has become a priority issue in many states, and as such the regulatory environment is continually changing.

For example, the CPRA became effective on January 1, 2023.

The CPRA requires companies, such as ours, that process information on California residents to make new disclosures to consumers about their data collection, use, and sharing practices, and allows consumers to opt out of certain data sharing with third parties and provides a new cause of action for data breaches.

We expect further privacy requirements to be applicable to us as a result of additional recently passed, and likely upcoming, state privacy laws, which will expand consumers’ rights with respect to their personal information.

The Federal government is also considering legislative and regulatory proposals concerning data protection.

Continued compliance with current and potential new privacy laws, rules, and regulations and meeting consumer expectations with respect to the control of personal data in a rapidly changing technology environment could result in higher compliance and technology costs for us, as well as costly penalties in the event we are deemed to not be in compliance with such laws, rules, and regulations.

If we or any of our third-party service providers experience a privacy breach, it could result in substantial financial and reputational harm, including possible criminal and civil penalties.

State and federal laws and regulations govern the collection, dissemination, access, and use of personally identifiable information, including HIPAA and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which govern protected health information, and the Gramm-Leach-Bliley Act, which governs nonpublic personal information.

In the provision of services, we and our third-party service providers collect, access, use, maintain, and transmit personally identifiable information in ways that are subject to these laws and regulations.

Although we have implemented measures to comply with these privacy and data protection laws and regulations, we have experienced data privacy incidents in the past, though none have materially impacted our operations or financial condition.

Any further unauthorized disclosure of personally identifiable information

experienced by us or our third-party service providers that process such information on our behalf could result in substantial financial and reputational harm to us, including possible criminal and civil penalties.

In situations where we are subject to HIPAA and HITECH, in which we are a business associate providing services to covered entities, the covered entities direct HIPAA compliance matters in the event of a security breach, which complicates our ability to address harm caused by the breach.

Additionally, as we have in connection with prior security incidents, we may be required to notify impacted individuals, plan sponsors, and regulatory authorities depending on the severity of the breach, our role, legal requirements, and contractual obligations.

Privacy and data protection regulation have become priority issues in many states, and as such the regulatory environment is continually changing.

For example, the CCPA provides a private right of action for data breaches.

Additional privacy requirements are expected as new state and federal privacy laws are enacted.

Continued compliance with current and potential new privacy and data protection laws and regulations, and meeting expectations with respect to the control of personal data in a rapidly changing technology environment, could result in higher compliance and technology costs for us, as well as costly penalties in the event we are deemed to not be in compliance with such laws and regulations.

Legislative, regulatory, and legal developments involving taxes could adversely affect our results of operations and cash flows.

15 unchanged sentences

Failure to comply with, or changes in, payment card industry, credit card association or other network rules or standards set by Visa or MasterCard, or changes in card association and debit network fees or products or interchange rates, could materially adversely affect us.

We, and the banks that issue our prepaid debit cards, are subject to Payment Card Industry Data Security Standards and Visa and MasterCard association rules that could subject us to a variety of fines or penalties that may be levied by the card associations or networks for acts or omissions by us or businesses that work with us,

including card processors.

Failure to comply with these rules and standards could result in significant fines, other penalties, or the termination of our interchange revenue agreements.

6 unchanged sentences

state banking laws;

state third-party administrator laws, and the Patient Protection and Affordable Care Act.

state third-party administrator laws;

the Patient Protection and Affordable Care Act;

and developing regulation regimes for the use of AI.

Our subsidiary HealthEquity Advisors, LLC is an SEC-registered investment adviser that provides automated web-only investment advisory services.

4 unchanged sentences

Our subsidiary HealthEquity Trust Company is a non-depository trust company and subject to regulation and supervision by the Wyoming Division of Banking.

As we continue to innovate and improve our products and services by leveraging automated decision making, machine learning and AI, our business model may be affected by global trends and laws that regulate the use of these developing technologies.

Such laws or regulations may restrict or impose burdensome and costly requirements on our ability to use AI and machine learning and also may impact our ability to use certain data for developing our products and services.

Compliance with regulatory requirements requires resources and takes significant time and effort.

13 unchanged sentences

Increased customer demand for these services, without a corresponding increase in revenue, could increase costs and adversely affect our operating results.

In addition, as substantially all of our team members in our support and customer education

areas now work remotely, it is more difficult to train and manage these team members, which could adversely affect the service we provide.

In addition, as substantially all of our team members in our support and customer education areas now work remotely, it is more difficult to train and manage these team members, which could adversely affect the service we provide.

Our sales process is highly dependent on the reputation of our products, services, and business and on positive recommendations from our existing customers.

Further, we use third-party vendors for certain call centers and COBRA claims and transaction processing, including certain offshore vendors for member chat service, which vendors may not provide the same quality of support services for our Clients and members.

Further, we use third-party service providers for certain call centers

and COBRA claims and transaction processing, including certain offshore service providers for member chat service, which service providers may not provide the same quality of support services for our Clients and members.

Any failure to maintain high-quality education and technical support, or a market perception that we do not maintain high-quality education support, could adversely affect our reputation, our ability to sell our products and services to existing and prospective customers and our business and operating results.

10 unchanged sentences

Our success also depends on our ability to attract, retain, and motivate additional skilled management personnel and other team members.

For example, competition for qualified personnel in our field is intense due to the limited number of individuals who possess the skills and experience required by our industry, particularly in technology-related fields where we have recently experienced significant turnover.

For example, competition for qualified personnel in our field is intense due to the limited number of individuals who possess the skills and experience required by our industry.

New hires require significant training and, in most cases, take significant time before they achieve full productivity.

16 unchanged sentences

A BIN sponsor is a bank or credit union that provides the BIN that allows a prepaid card program to run on one of the major card brand networks (e.g., VISA, MasterCard, Discover or American Express).

Our BIN sponsors enable us to link the payment cards that we offer our members to the VISA and Mastercard networks, thereby allowing our members to use our payment cards to pay for expenses with a “swipe” of the card.

Our BIN sponsors enable us to link the payment cards that we offer our members to the VISA and Mastercard networks, thereby

allowing our members to use our payment cards to pay for expenses with a “swipe” of the card.

If any material adverse event were to affect our BIN sponsors, including a significant decline in the financial condition of any of our BIN sponsors, a decline in the quality of service provided by our BIN sponsors, the inability of our BIN sponsors to comply with applicable banking and financial service regulatory requirements or industry standards, systems failure or the inability of our BIN sponsors to pay us fees, our business, financial condition, and results of operations could be materially and adversely affected because we may be forced to reduce the availability of, or eliminate entirely, our payment card offering, which would materially impact our interchange revenue.

1 unchanged sentence

If we were required to change BIN sponsors, we could not accurately predict the success of such change or that the terms of our agreement with a new BIN sponsor would be as favorable to us, especially in light of the regulatory scrutiny of the payment card industry, which has rendered the market for BIN sponsor services less competitive.

Replacing our third-party vendors would be difficult and disruptive to our business.

We have entered into contracts with third-party vendors to provide critical services relating to our business, including the redesign of our technology platforms, fraud management and other customer verification services, transaction processing and settlement, telephony services, call centers and card production.

In addition, WageWorks uses third-party vendors for its COBRA transaction processing and also uses one of our competitors for card processing and other services.

In the past, certain of these service providers have failed to maintain adequate levels of support, did not provide high quality service to us and our members, increased the fees they charge us, discontinued their lines of business, terminated our contractual arrangements or ceased or reduce operations, and as a result, we suffered additional costs and were required to pursue new third-party relationships, which resulted in reputational harm, material disruption of our operations and our ability to provide our products and services, missed service-level agreements with Clients and Network Partners, and diverted management’s time and resources, and these events and consequences could happen with our current vendors moving forward.

Transitioning to a new vendor often takes a significant amount of time and resources and, if we are unable to complete a transition to a new provider on a timely basis, or at all, we could be forced to temporarily or permanently discontinue certain services, such as our payment card services, which could disrupt services to our customers and adversely affect our business, financial condition, and results of operations.

Replacing our third-party service providers would be difficult and disruptive to our business.

We have entered into contracts with third-party service providers to provide critical services relating to our business, including the redesign of our technology platforms, fraud management and other customer verification services, transaction processing and settlement, telephony services, call centers and card production.

Transitioning to a new service provider often takes a significant amount of time and resources and, if we are unable to complete a transition to a new provider on a timely basis, or at all, we could be forced to temporarily or permanently discontinue certain services, such as our payment card services, which could disrupt services to our customers and adversely affect our business, financial condition, and results of operations.

We may also be unable to establish comparable new third-party relationships on as favorable terms or at all, which could materially and adversely affect our business, financial condition, and results of operations.

7 unchanged sentences

Certain of our past acquisitions also resulted in dilutive issuances of equity securities and the incurrence of additional debt, and future acquisitions could result in additional dilutive issuances of equity securities or the incurrence of additional debt, which could adversely affect our business, results of operations, or financial condition.

We may not be able to operate, integrate, and scale our technology effectively to match our business growth.

Our ability to continue to provide our products and services to a growing number of customers, as well as to enhance our existing products and services, attract new customers and strategic partners, offer new products and services, and continue the integration of acquired businesses into our business, is dependent on our information technology systems.

If we are unable to manage the technology associated with our business effectively, we could experience increased costs, reductions in system availability, and customer loss.

We are currently investing in a significant modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy, and platform infrastructure.

If we are unsuccessful in implementing these upgrades to our technology platforms, we may be unable to adequately meet the needs of our customers and/or implement technology-based innovation in response to a rapidly changing market, which could harm our reputation and adversely impact our business, financial condition, and results of operations.

Failure to manage future growth effectively could have a material adverse effect on our business, financial condition, and results of operations.

24 unchanged sentences

Our substantial debt could limit our ability to fund operations, expose us to interest rate volatility, limit our ability to raise additional capital and have a material adverse effect on our ability to fulfill our obligations under our Credit Agreement and Indenture and to our Network Partners, Clients and members.

We are party to a credit agreement (the "Credit Agreement") among the Company, as borrower, each lender from time to time party thereto, JPMorgan Chase Bank, N.A., as administrative agent and the Swing Line Lender (as defined in the Credit Agreement), and each L/C Issuer (as defined therein) party thereto.

Our Credit Agreement consists of (i) a five-year senior secured term loan A facility in the aggregate principal amount of $350 million (the "Term Loan Facility") and (ii) a five-year senior secured revolving credit facility (the “Revolving Credit Facility” and, together with the Term Loan Facility, the “Credit Facilities”), in an aggregate principal amount of up to $1 billion.

We are party to a credit agreement (the "Credit Agreement"), which consists of (i) a five-year senior secured term loan A facility in the aggregate principal amount of $350 million (the "Term Loan Facility") and (ii) a five-year senior secured revolving credit facility (the “Revolving Credit Facility” and, together with the Term Loan Facility, the “Credit Facilities”), in an aggregate principal amount of up to $1 billion.

We have also issued $600 million of 4.50% unsecured Senior Notes due 2029 (the "Notes").

2 unchanged sentences

The substantial debt we have outstanding, combined with our other financial obligations and contractual commitments, has important consequences, including the following:

• our level of debt may make it more difficult for us to satisfy our obligations with respect to our debt, and any failure to comply with the obligations under any of our debt instruments, including restrictive covenants, could result in an event of default under the Credit Agreement or the Indenture and the agreements governing such other debt;

• we will be required to use a substantial portion of our cash flow from operations to pay principal and interest on our debt, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, strategic acquisitions, investments and alliances and other general corporate requirements;

could result in an event of default under the Credit Agreement or the Indenture and the agreements governing such other debt;

• we use a portion of our cash flow from operations to pay principal and interest on our debt, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, strategic acquisitions, investments and alliances and other general corporate requirements;

• our interest expense has increased substantially, and could continue to increase, if interest rates continue to increase, because any outstanding borrowings under our Credit Facilities are based on variable interest rates;

• the interest rate on our Revolving Credit Facility is based on LIBOR, and although the Credit Agreement provides an alternative mechanism for determining the applicable interest rate when LIBOR is no longer available, the interest rates we pay may be adversely affected as a result of potential disruptions in connection with the LIBOR phase-out;

• the interest rate on our Revolving Credit Facility will depend on the level of our specified financial ratios, and therefore could increase if such specified financial ratios increase;

26 unchanged sentences

Additionally, our Credit Agreement contains a cross-default provision, which generally causes a default or event of default under the Credit Agreement upon a qualifying default or event of default under any other debt instrument (including under the Indenture) and the Indenture contains a cross-acceleration provision.

If we are unable to repay outstanding borrowings when due, the lenders under our Credit Facilities will also have the right to proceed against the collateral granted to them to secure the debt.

unable to repay outstanding borrowings when due, the lenders under our Credit Facilities will also have the right to proceed against the collateral granted to them to secure the debt.

If lenders under the Credit Facilities accelerate the debt thereunder, then the obligations under the Notes would be accelerated.

1 unchanged sentence

If not cured or waived, such acceleration could have a material adverse effect on our business and our prospects.

We may be unable to generate or obtain sufficient capital to fund our business and growth strategy.

To fund our expanding business and growth strategy, we must have sufficient working capital to continue to make significant investments in our service offerings, advertising, technology, and other activities.

As a result, in addition to the cash flow from operations we generate from our business, we may need additional equity or debt financing to provide the funds required for these endeavors.

If such financing is not available on satisfactory terms or at all, we may be unable to operate or expand our business in the manner and at the rate desired.

For example, the Credit Agreement may make it more challenging to incur additional debt, as it includes prohibitions against incurring additional debt without approval from our existing lenders, and other lenders may not be willing to take on the risk of adding to our existing leverage.

In addition, debt financing increases expenses, may contain additional covenants that restrict the operation of our business and must be repaid regardless of operating results.

Equity financing, or debt financing that is convertible into equity, could result in additional dilution to our existing stockholders, and any new securities we issue could have rights, preferences, and privileges superior to those associated with our common stock.

Our inability to generate or obtain the financial resources needed to fund our business and growth strategies may require us to delay, scale back or eliminate some or all of our operations or the expansion of our business, which may have a material adverse effect on our business, operating results, financial condition, and prospects.

General risk factors

Natural disasters, pandemics or other epidemics, acts of terrorism, acts of war, adverse economic conditions, and other unforeseen events, may cause damage or disruption to us or our customers.

Natural disasters, pandemics or other epidemics, acts of war (including the current war between Russia and Ukraine), terrorist attacks, the escalation of military activity in response to such attacks, adverse economic conditions (including the recent increase in inflation and its impact on our labor and third-party vendor costs), or otherwise may have negative and significant effects, such as imposition of increased security measures, changes in applicable laws, market disruptions, increased costs to operate our business, reduced economic activity among our clients, and job losses, which could in turn have a material adverse effect on our business, financial condition, and results of operations.

For example, the recent COVID-19 pandemic resulted in significant disruptions to our business, operations and products, and the societal changes arising out of the COVID-19 pandemic may have long-term impacts on certain of our products, such as our commuter product .

Provisions in our charter documents and under Delaware law could discourage a takeover that stockholders may consider favorable.

8 unchanged sentences

Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could adversely affect our business and financial condition.

Unresolved staff comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors