What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-08-25 compared with 2024-08-26 · 40 added, 31 removed, 176 unchanged (29% of the section changed)

4 unchanged sentences

Our business relies upon receiving, processing, storing, and transmitting sensitive information relating to our operations, associates, and clients.

If we fail to maintain a sufficient digital security infrastructure, address security vulnerabilities and new threats, or deploy adequate technologies to secure our systems against attack, we may be subject to security breaches that compromise confidential information, adversely affect our ability to operate our business, damage our reputation and business, adversely affect our results of operations and financial condition, and expose us to liability.

If we fail to maintain a sufficient digital security infrastructure, address security vulnerabilities and new threats, or deploy adequate technologies to secure our systems against attack, we may be subject to security breaches that compromise confidential information, including valuable intellectual property, proprietary information, trade secrets, know-how, or source code, which could lead to their theft, misuse, unauthorized disclosure, or misappropriation.

Such incidents could adversely affect our ability to operate our business, damage our reputation and business, adversely affect our results of operations and financial condition, and expose us to liability.

We rely on third parties for various business purposes, and these third parties face similar security risks.

4 unchanged sentences

Computer networks and the internet are vulnerable to disruptive problems such as denial of service attacks or other cyber-attacks carried out by cyber criminals or state-sponsored actors.

We anticipate that unauthorized parties will continue to attempt to obtain access to confidential information or to destroy data, often through the introduction of computer viruses, ransomware or malware, cyber-attacks, and other means, which are constantly evolving and at times difficult to detect.

Those same parties may also attempt to fraudulently induce associates, clients, vendors, or other users of our systems through phishing schemes or other social engineering methods to disclose sensitive information to gain access to our data or that of our clients or their customer/members.

We are continually subject to attempts by unauthorized parties to access confidential information or to destroy data, often through the introduction of computer viruses, ransomware or malware, and cyber-attacks.

The use of artificial intelligence increasingly enabling their sophistication and accelerating their evolution, including through automated phishing and the rapid development of new malware, which continue to evolve and can be difficult to detect.

Those same parties may also attempt to fraudulently induce associates, clients, vendors, or other authorized users of our systems through phishing schemes or other social

engineering methods to disclose sensitive information to gain access to our data or that of our clients or their accountholders.

Any such coordinated attacks, if successful, can lead to data loss and exfiltration, disruption to systems and services, and damage to our reputation as a secure financial technology company.

We are also subject to the risk that our associates may intercept and transmit unauthorized confidential or proprietary information or that corporate-owned computers used by associates are stolen, or client data media is lost in shipment.

We are also subject to the risk that our associates may, unintentionally or with malicious intent, intercept and transmit unauthorized confidential or proprietary information or that corporate-owned computers used by associates are stolen, or client data media is lost in shipment.

An interception, misuse, or mishandling of personal, confidential, or proprietary information being sent to or received from a client or third party could result in legal liability, remediation costs, regulatory action, and reputational harm, any of which could adversely affect our results of operations and financial condition.

Like other financial institution service providers, we frequently face third-party attempts to discover and exploit system weaknesses or to circumvent our security measures.

We anticipate that attempts to attack our systems, services, and infrastructure, and those of our clients, third-party service providers and other vendors, may grow in

frequency and sophistication.

Like other financial institution service providers, we continually face third-party attempts to discover and exploit system weaknesses or to circumvent our security measures.

We anticipate that attempts to attack our systems, services, and infrastructure, and those of our clients, third-party service providers and other vendors, will grow in frequency and sophistication.

We cannot be certain that our security controls and infrastructure will be adequate to continue to protect our systems and data and our efforts may not be sufficient to combat all current and future technological risks and threats.

These risks are further heightened by the fact that a significant portion of our associates and contractors work remotely outside of Company-controlled facilities using networks and devices that are not physically controlled by the Company, potentially limiting the effectiveness of our security controls.

Advances in computer capabilities, new discoveries in the field of cryptography, the use of artificial intelligence, or other events or developments may render our security measures inadequate.

4 unchanged sentences

In the event of a security breach, we may need to spend substantial additional capital and resources alleviating problems caused by such breach.

Under state, federal, and foreign laws requiring consumer notification of security breaches, the costs to remediate security breaches can be substantial.

Under state, federal, and foreign laws, including those requiring consumer notification of security breaches, the costs to remediate security breaches can be substantial.

Addressing security problems may result in interruptions, delays, or cessation of service to users, any of which could harm our business.

2 unchanged sentences

If we fail to adequately invest in and support our technological infrastructure and processing capacity, we may not be able to support our clients’ processing needs and may be more susceptible to interruptions and delays in services.

Damage or destruction that interrupts our outsourcing operations could cause delays and failures in processing which could hurt our relationship with clients, damage our reputation, expose us to damage claims, and cause us to incur substantial additional expense to relocate operations and repair or replace damaged equipment.

Damage or destruction that interrupts our outsourcing operations could cause delays and failures in processing which could hurt our relationship with clients, damage our reputation, expose us to damage claims, and cause us to incur substantial additional expenses to relocate operations and repair or replace damaged equipment.

Events that could cause operational failures include, but are not limited to, hardware and software defects, breakdowns or malfunctions, cybersecurity incidents, human error, power losses, disruptions in telecommunications services, computer viruses or other malware, or other events.

2 unchanged sentences

Our back-up systems and procedures may prove insufficient or otherwise fail to prevent disruption, such as a prolonged interruption of our transaction processing services.

If an interruption extends for more than several hours, we may experience data loss or a reduction in revenues by reason of such interruption.

Any significant interruption of service could reduce revenue, have a negative impact on our reputation, result in damage claims, lead our present and potential clients to choose other service providers, and lead to increased regulatory scrutiny of the critical services we provide to financial institutions, with resulting increases in compliance burdens and costs.

Implementing modifications and upgrades to our technological infrastructure subject us to inherent costs and risks associated with changing systems, policies, procedures, and monitoring tools.

If an interruption extends for more than several hours, we may experience data loss or a reduction in revenues due to such interruption.

Any significant interruption of service could reduce revenue, have a negative impact on our reputation and the reputation of our clients, result in damage claims, lead our present and potential clients to choose other service providers, and lead to increased regulatory scrutiny of the critical services we provide to financial institutions, with resulting increases in compliance burdens and costs.

Implementing modifications and upgrades to our technological infrastructure subjects us to inherent costs and risks associated with changing systems, policies, procedures, and monitoring tools.

Failures associated with payment transactions could result in financial loss.

10 unchanged sentences

We also rely on third-party service providers to provide part, or all, of certain services we deliver to clients.

As we continue to move more computing, storage, and processing services out of our data centers and facilities and into third-party hosting environments, our reliance on

these providers and their systems will increase.

As we continue to move more computing, storage, and processing services out of our data centers and facilities and into third-party hosting environments, our reliance on these providers and their systems will increase.

This reliance is further concentrated as we use certain third-party vendors to provide large portions of our hosting needs.

6 unchanged sentences

Certain of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations.

If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, our clients could be negatively impacted, and it could have a material adverse effect on our business.

If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products timely and cost-effectively, our clients could be negatively impacted, and it could have a material adverse effect on our business.

We operate in a competitive business environment and our business will be adversely affected if we fail to compete effectively.

8 unchanged sentences

Renewal time presents our clients with the opportunity to consider other providers or to renegotiate their contracts with us, including reducing the services we provide or negotiating the prices paid for our services.

Certain of our renewals have resulted in price compression between the former and renegotiated contracts.

If that trend accelerates or becomes more pronounced, it could negatively impact our results of operations.

If we are not successful in achieving high renewal rates upon favorable terms, revenues and profit margins will suffer.

6 unchanged sentences

If we are unable to develop or acquire new products and services to address the needs of our clients, or if we fail to sell the new or enhanced products and services in which we have invested, we may incur unanticipated expenses or fail to achieve anticipated revenues, as well as lose prospective sales.

The use of emerging technologies like artificial intelligence, machine learning, and generative artificial intelligence could lead to unintended consequences and result in reputational harm and increased litigation.

We continue to evaluate emerging technologies like artificial intelligence, machine learning, and generative artificial intelligence for incorporation into our business to augment our products and services.

Such technologies present unique business opportunities along with ever-changing legal and regulatory risks.

The increasing adoption of artificial intelligence (AI), machine learning (ML), and generative artificial intelligence into our products introduces significant and evolving risks that could lead to unintended consequences, result in reputational harm, and increased litigation.

Our business currently utilizes AI and ML and we continue to evaluate and expand their use, including generative AI, to augment our products and services.

While these technologies offer distinct business opportunities, they also bring evolving legal, regulatory, and operational risks.

Both state and federal regulations relating to these emerging technologies are quickly and constantly evolving and may require significant resources to modify and maintain business practices to comply with U.S.

laws, the nature of which cannot be determined at this time.

From an operational standpoint, AI algorithms and training methodologies may create accuracy issues, unintended biases, factual errors, misrepresentations, offensive language, inappropriate statements, or other unexpected outcomes that could undermine product and service quality or lead to errors in our decision-making and solution development.

Ineffective or inadequate AI development, testing, evaluation, deployment, content labeling, or governance may impair public acceptance or cause harm, resulting in offerings not working as intended, and we also face explainability risk from our potential inability to interpret or justify AI model decisions, which may lead to concerns about trust, regulatory compliance, and accountability.

Additionally, the use of AI tools by associates—whether authorized or not—for internal functions or business operations may result in unintended or unreliable outputs, which could negatively impact the quality, accuracy, or consistency of work product and decision-making.

Our failure to accurately identify and address our responsibilities and liabilities in this new environment could negatively affect any solutions we develop incorporating such technology and could subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

These same risks apply to our third-party service providers who are implementing these tools into the

products or services they provide to us.

These same risks apply to our third-party service providers who are implementing these tools into the products or services they provide to us.

Any failures to manage and mitigate these risks by these third-party service providers may negatively affect the products and services we provide our clients.

15 unchanged sentences

We are routinely subject to the examination process with such regulators, which includes the identification of areas where we can improve our practices to better comply with the applicable regulations and guidelines.

If regulators identify significant issues, or if we fail to meet supervisory remediation expectations, we could be subject to regulatory actions that could harm our client relationships and reputation.

If regulators

identify significant issues, or if we fail to meet supervisory remediation expectations, we could be subject to regulatory actions that could harm our client relationships and reputation.

Failure by third parties, with whom we contract or partner, to comply with regulations or guidelines could also harm our relationships and reputation.

5 unchanged sentences

Our failure to provide compliant solutions could result in significant fines or consumer liability on our clients, for which we may bear ultimate liability.

Compliance with new and existing privacy laws, regulations, and rules may adversely impact our expenses, development, and strategy.

Compliance with new and existing data privacy and cybersecurity laws, regulations, and rules may adversely impact our expenses, development, and strategy.

We are subject to complex laws, rules, and regulations related to data privacy and cybersecurity.

2 unchanged sentences

Regulatory agencies, Congress, state legislatures, and foreign regulatory and governmental bodies are considering numerous regulatory and statutory proposals to protect the interests of consumers and to require compliance with standards and policies that have not been defined.

The number of state privacy and cybersecurity laws and regulations has grown tremendously over the past several years, creating an increasingly complex patchwork of data privacy and security requirements.

This includes industry-specific rules such as those enacted by the New York Department of Financial Services that require covered financial institutions to have a cybersecurity program along with other compliance requirements as well as comprehensive consumer data privacy rules such as the California Consumer Privacy Act, the Iowa Consumer Data Protection Act, and the Virginia Consumer Data Protection Act.

Though several privacy concepts are common across the laws, each state requires compliance with standards and policies that are not cohesive with other laws and are often further amended by regulatory action.

The unique data protection regulations issued by multiple agencies have created a fragmented series of

requirements that makes it increasingly complex to comply with all the mandates in an efficient manner and may increase costs to deliver affected products and services as those requirements are established.

The number of state privacy and cybersecurity laws and regulations has grown tremendously over the past several years, resulting in an increasingly complex and fragmented regulatory landscape.

These laws often include industry-specific requirements and board consumer data protection obligations.

While many of these frameworks share common principles each jurisdiction imposes unique compliance standards, definitions, and obligations that may not align with one another.

This lack of uniformity, combined with frequent legislative updates and regulatory amendments, creates ongoing challenges for organizations seeking to maintain consistent and compliant data governance practices across multiple jurisdictions.

Further, the FTC and state attorneys general may interpret federal and state consumer protection laws as imposing standards for the collection, use, dissemination, and security of data.

In addition, compliance with these laws and regulations may require changes to our technology and our internal processes and procedures, including the way that we handle, process, and store data, which could divert company resources and negatively impact growth opportunities.

13 unchanged sentences

We derive most of our revenue from products and services we provide to the financial services industry.

If the general economic environment worsens, including if inflation or interest rates continue to increase or remain at higher than recent historical levels, or if conditions or regulatory requirements within the financial services industry change, such as if financial institutions are required to increase reserve amounts or become subject to new regulatory assessments, clients may be less willing or able to pay the cost of our products and services, and we could face a reduction in demand from current and potential clients for our products and services, which could have a material adverse effect on our business, results of operations, and financial condition.

If the general economic environment worsens, including if inflation or interest rates continue to increase or remain at higher than recent historical levels, or if conditions or regulatory requirements within the financial services industry change—such as if financial institutions are required to increase reserve amounts, become subject to new regulatory assessments, or if tariffs or other trade restrictions are imposed or increased—clients may be less willing or able to pay the cost of our products and services, and we could face a reduction in demand from current and potential clients for our products and services, which could have a material adverse effect on our business, results of operations, and financial condition.

In addition, a growing portion of our revenue is derived from transaction processing fees, which depend heavily on levels of consumer and business spending.

49 unchanged sentences

We do not have employment agreements with any of our executive officers.

Further, we continue to face a competitive market for hiring and retaining skilled associates.

We continue to face a competitive market for hiring and retaining skilled associates.

Difficulties in hiring and retaining skilled associates may restrict our ability to adequately support our business needs and/or result in increased personnel costs.

There is no assurance that we will be able to attract and retain the personnel necessary to maintain the Company’s strategic direction.

These challenges are further compounded by the fact that a substantial portion of our workforce operate in hybrid or fully remote arrangements, which introduces additional complexities related to employee engagement, collaboration, training, and the preservation of corporate culture.

As we navigate these dynamics, there is no assurance that we will be able to attract and retain the personnel necessary to maintain the Company’s strategic direction.

Unfavorable resolution of tax contingencies or unfavorable future tax law changes could adversely affect our tax expense.

7 unchanged sentences

An impairment of a significant portion of our goodwill or intangible assets could have a material negative effect on our operating results.

An increase in interest rates could increase our borrowing costs.

Changes in interest rates could increase our borrowing costs or result in decreased interest income.

Although our debt borrowing levels have historically been low, we may require additional or increased borrowings in the future under existing or new debt facilities to support operations, finance acquisitions, or fund stock repurchases.

1 unchanged sentence

Increases in interest rates on variable-rate debt would increase our interest expense, which could negatively impact our results of operations.

Conversely, if interest rates substantially decrease, we would collect less interest income on settlement accounts.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors