What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-18 compared with 2025-02-19 · 72 added, 51 removed, 428 unchanged (22% of the section changed)

17 unchanged sentences

● We are required to comply with The Family Educational Rights and Privacy Act, or FERPA, and failure to do so could harm our reputation and negatively affect our business.

● Capacity constraints, system disruptions, or security breaches in our online computer networks and phone systems could have a material adverse effect on our ability to attract and retain students.

● Capacity constraints, system disruptions, or security breaches in our online computer networks and phone systems could have a material adverse effect on our university partners’ ability to attract and retain students, which may negatively impact our business.

● We may have difficulty integrating future acquisitions, which would reduce the anticipated benefits of those transactions.

5 unchanged sentences

● A university partner institution may lose eligibility to participate in the Title IV programs if its student loan default rates are too high.

● A finding by ED or other regulators that we or our university partner institutions misrepresented the nature of our partner institutions’ educational programs could materially and adversely affect our business.

● A finding by ED or other regulators that we or our university partner institutions misrepresented the nature of our university partner institutions’ educational programs could materially and adversely affect our business.

● A reduction in funding or new restrictions on eligibility for the Federal Pell Grant Program, or the elimination of subsidized Stafford loans, could make college less affordable for certain students at our university partner institutions, which could negatively impact our university partner institutions’ enrollments, and thus our revenue and results of operations.

70 unchanged sentences

● d amage to our reputation, or to the reputations of our university partners or other adverse effects as a result of negative publicity in the media, in industry or governmental reports, or otherwise, affecting us or other companies in the post-secondary education sector;

● p rice reductions by competitors that we are unwilling or unable to match;

● competitors with lower p riced programs;

● a decline in the overall growth of enrollment in post-secondary institutions;

● a decrease in or perceived low student passage rates for professional licenses and other examinations necessary for students to work in their chosen fields post-graduation;

● an inability of our university partners’ to recruit, train and retain quality faculty members;

● a decline in the acceptance of online education;

12 unchanged sentences

Should our actions or failure to act impair or render our information technology less effective, this could have a material adverse effect on our business, financial condition, results of operations and cash flows.

In addition, our university partners have in the past, and will in the future, create additional programs to meet the needs of current and prospective students or the employers of their graduates.

Even if our university partners are able to develop acceptable new programs that meet market demands, establishing or modifying such programs requires us and our university partners to make investments, incur market expenses and allocate extensive resources.

If we and our university partners are unable to do so in a cost-effective manner or are unable to otherwise effectively manage the operations of such programs, our business, financial condition and results of operations could be adversely affected.

A decline in the overall growth of enrollment in post-secondary institutions, or in the number of students seeking degrees online, could cause our university partner institutions to experience lower enrollment, which could negatively impact our future growth.

19 unchanged sentences

Artificial intelligence is an emerging area of technology that has and may further impact various aspects of our business operations and that of our university partners, and we may not be successful in our artificial intelligence initiatives, which could adversely affect our business, financial condition and/or operating results.

We have made, and expect to continue making, investments in the integration of artificial intelligence (“AI”) into our platforms, products, and services.

However, AI presents various risks, challenges, and potential unintended consequences that could disrupt our ability to effectively integrate and leverage these technologies.

We have made, and expect to continue making, investments in the integration of AI into our platforms, products, and services.

While we expect our use of AI to help grow our business and benefit our university partners, the use of AI presents various risks, challenges, and potential unintended consequences that could disrupt our ability to effectively integrate and leverage these technologies and it is not certain that we will realize our desired or anticipated benefits.

The process of refining and expanding AI-driven offerings may involve significant costs, and there can be no assurance that our efforts will ultimately succeed.

2 unchanged sentences

These changes could impose unexpected costs or operational disruptions, and the full scope and impact of such regulatory developments remain uncertain.

AI technologies also carry the risk of generating content that is factually incorrect or infringing on third-party intellectual property rights.

AI technologies also carry the risk of generating content that is or is alleged to be deficient, biased, factually incorrect or infringing on third-party intellectual property rights, which may in turn make us subject to private lawsuits, regulatory scrutiny, or reputational harm.

Furthermore, the use of AI may result in incidents that compromise the confidentiality of data, including personal data.

If we suffer adverse consequences due to any of these factors, it could in turn have a material adverse effect on our reputation, financial performance, and operations.

We are subject to laws and regulations as a result of our collection and use of personal information, and any violations of such laws or regulations, or any breach, theft, or loss of such information, could adversely affect our reputation and operations.

We are subject to rapidly changing laws and regulations relating to privacy and data security as a result of our collection and use of personal information, and any failure to comply with such laws or regulations could lead to government enforcement actions or private litigation or adversely affect our reputation and operations.

Possession and use of personal information in our operations subjects us to risks and costs that could harm our business.

We collect, use, and retain large amounts of personal information regarding our primary university partner’s applicants and students, including social security numbers, tax return information, personal and family financial data, and credit card numbers.

We also collect and maintain personal information of our employees in the ordinary course of our business.

We also collect and maintain personal information of our employees in the ordinary course of

our business.

Our services can be accessed globally through the Internet.

2 unchanged sentences

Such privacy laws could impose conditions that limit the way we market and provide our services.

Our computer networks and the networks of certain of our vendors that hold and manage confidential information on our behalf may be vulnerable to unauthorized access, employee theft or misuse, computer hackers, computer viruses, and other security threats.

Confidential information may also inadvertently become available to third parties when we integrate systems or migrate data to our servers in connection with periodic hardware or software upgrades.

Due to the sensitive nature of the personal information stored on our servers, our networks may be targeted by hackers seeking to access this data.

A user who circumvents security measures could misappropriate sensitive information or cause interruptions or malfunctions in our operations.

Although we use security and business controls to limit access and use of personal information, a third party may be able to circumvent those security and business

controls, which could result in a breach of student or employee data and privacy.

In addition, errors in the storage, use, or transmission of personal information could result in a breach of privacy for current or prospective students or employees.

Possession and use of personal information in our operations also subjects us to legislative and regulatory burdens that could require us to implement certain policies and procedures, such as the procedures we adopted to comply with the Red Flags Rule that was promulgated by the FTC under the federal Fair Credit Reporting Act and that requires the establishment of guidelines and policies regarding identity theft related to student credit accounts, and could require us to make certain notifications of data breaches and restrict our use of personal information.

Possession and use of personal information in our operations subjects us to legislative and regulatory burdens that could require us to implement certain policies and procedures, such as the procedures we adopted to comply with the Red Flags Rule that was promulgated by the FTC under the federal Fair Credit Reporting Act and that requires the establishment of guidelines and policies regarding identity theft related to student credit accounts, and could require us to make certain notifications of data breaches and restrict our use of personal information.

Similarly, California passed the California Consumer Privacy Act (CCPA) in 2018 (which went into effect in 2020), and there are similar bills that have been passed or are pending in a number of other states, as well.

5 unchanged sentences

Moreover, ED has published extensive requirements for the protection of student data and has indicated such requirements may be strengthened in the future.

Additionally, university personnel or students, or our employees or independent contractors, could use our online learning platform to store or process regulated personal information without our knowledge.

In addition, we may in the future be subject to litigation under state and federal privacy and data security laws and regulations by governmental authorities and private litigants, including class actions, any of which could have a material adverse effect on our business.

We face risks of cyber and other security incidents, which can impact our business, result in harm to our operations, and require costly remediation measures.

We and our university partners face an ever-increasing number of cybersecurity threats from a broad range of threat actors.

These threats can result in security incidents, including hacking and data breaches, which may be caused by intentional or unintentional actions by our employees, contractors, consultants, students or other third parties, including cyber-attacks by malicious threat actors.

Security incidents may take the form of unauthorized activity and access, phishing or spoofing, malicious penetration, system viruses, malicious code, malware, ransomware, denial of service attacks and other organized cyber-attacks that seek to exploit vulnerabilities and threaten the confidentiality, integrity and availability of information.

We have in the past, and may in the future, be subject to such cyber-security incidents.

Incidents may occur as a single instance, or may occur over an extended period of time without detection.

Confidential information may also inadvertently become available to third parties when we integrate systems or migrate data to our servers in connection with periodic hardware or software upgrades.

Due to the sensitive nature of the personal information stored on our servers, our networks may be targeted by hackers seeking to access this data.

A user who circumvents security measures could misappropriate sensitive information or cause interruptions or malfunctions in our operations.

Although we use security and business controls to limit access and use of personal information, a third party may be able to circumvent those security and business controls, which could result in a breach of student or employee data and privacy.

In addition, errors in the storage, use, or transmission of personal information could result in a breach of privacy for current or prospective students or employees.

The increased use of mobile devices by our employees, and the employees and students of our university partners, increases the risk of Information Technology (“IT”) threats and vulnerabilities, such as those involving unsecure networks, as well as unintentional disclosure of personal information, such as through the theft of a mobile device, which can lead to a security incident and/or data breach.

Additionally, personnel or students of our university partners, or our employees or independent contractors, could use our online learning platform to store or process regulated personal information without our knowledge.

In the event that our systems experience a data security incident, or an individual or entity accesses information without, or in excess of, proper authorization, we could be subject to data security incident notification laws, which may require prompt remediation and notification to individuals.

If we are unaware of the data and information stored on our systems, we may be unable to appropriately comply with all legal obligations, and we may be exposed to governmental enforcement or prosecution actions, private litigation, fines and penalties or adverse publicity that could harm our reputation and business.

If we are unaware of the data and information stored on our systems,

we may be unable to appropriately comply with all legal obligations, and we may be exposed to governmental enforcement or prosecution actions, private litigation, fines and penalties or adverse publicity that could harm our reputation and business.

As a result, we may be required to expend significant resources to protect against the threat of these security breaches or to alleviate problems caused by these breaches.

A major breach, theft, or loss of personal information regarding our university partner’s students and their families or our employees that is held by us or our vendors, or a violation of laws or regulations relating to the same, could have a material adverse effect on our reputation and result in further regulation and oversight by federal and state authorities and increased costs of compliance.

A major breach, theft, or loss of personal information regarding our university partners’ students and their families or our employees that is held by us or our vendors, or a violation of laws or regulations relating to the same, could have a material adverse effect on our reputation and result in further regulation and oversight by federal and state authorities and increased costs of compliance.

We are required to comply with The Family Educational Rights and Privacy Act, or FERPA, and failure to do so could harm our reputation and negatively affect our business.

9 unchanged sentences

Individual, sustained, or repeated occurrences could significantly damage the reputation of our technology and services and result in a loss of potential or existing students of our university partner institutions.

Additionally, our operations are vulnerable to interruption or malfunction due to events beyond our control, including natural disasters and network and

telecommunications failures.

Additionally, our operations are vulnerable to interruption or malfunction due to events beyond our control, including natural disasters and network and telecommunications failures.

Our computer networks may also be vulnerable to unauthorized access, computer hackers, computer viruses, malicious code, organized cyber-attacks and other security problems.

30 unchanged sentences

ED and other regulators have increased the frequency and severity of their enforcement actions against post-secondary schools, including our primary university partner.

In some cases, these enforcement actions have resulted in material sanctions, loss of Title IV eligibility, or closure in

In some cases, these enforcement actions have resulted in material sanctions, loss of Title IV eligibility, or closure in schools.

We cannot predict with certainty how all of these regulatory requirements will be applied, or whether we will be able to comply with all of the applicable requirements in the future.

Rulemaking by ED could materially and adversely affect our business.

Rulemaking by ED and Congressional legislation could materially and adversely affect our business.

Over the past few years, ED has regularly promulgated new regulations and guidance that impact our university partners and our business directly.

2 unchanged sentences

New or amended regulations in the future, particularly regulations focused on third-party service providers, could further negatively impact our business.

On July 4, 2025, President Trump signed the OBBBA, which makes a variety of changes to federal student aid programs, including loan limits, accountability measures for programs based on low earning outcomes, loan repayment, Pell Grant eligibility, and regulatory changes.

As one example, OBBBA creates the “Do No Harm” accountability framework, effective July 2026, that institutions must satisfy at the program level in order for students to continue to receive Federal Direct Loans for such programs.

Under this framework, OBBBA requires that an undergraduate program become ineligible for Federal Direct Loans if, in two out of three consecutive years, the median earnings of a cohort of program completers are less than the median earnings of working adults aged 25-34 with only a high school diploma, either in the state where the institution is located or, if fewer than 50% of students at the institution reside in the institution’s state, the national average.

OBBBA requires that a graduate or professional program become ineligible for Federal Direct Loans if, in two out of three consecutive years, the median earnings of a cohort of program completers are

less than the median earnings of working adults aged 25–34 with only a bachelor’s degree.

Both the undergraduate and graduate/professional accountability provisions apply to the cohort of students who completed the program four years prior, are working, are not enrolled at any institution, and who received Federal Direct Loan funds for enrollment in the program.

If a cohort is less than 30 students, the Secretary of Education may aggregate additional years of programmatic data.

Based on data provided by the ED for students that graduated in 2015-2016, all of the programs that we provide services to our university partners passed this metric except GCU’s Masters in Mental and Social Health programs.

GCU is currently analyzing the data related to these programs and it appears that most universities that provide these programs online to working adult students fail this metric.

To the extent that these or any other programs offered by our university partners pursuant to our services agreements fail these metrics, then this would have an adverse effect on our university partners and thus an adverse effect on our business.

We cannot predict with certainty how all of these regulatory requirements under the OBBBA will be applied or what their ultimate impact on our business will be.

Recently published regulations could materially and adversely affect our business.

In addition to other regulations discussed elsewhere (such as the new Gainful Employment regulations), on July 1, 2024 new regulations became effective covering the areas of financial responsibility, administrative capability, certification standards and procedures, and ability to benefit.

In addition to other regulations discussed elsewhere (such as those related to the OBBBA), on July 1, 2024 new regulations became effective covering the areas of financial responsibility, administrative capability, certification standards and procedures, and ability to benefit.

Financial Responsibility :

85 unchanged sentences

For example , GCU, calculated its composite score with respect to its fiscal years ending June 30, 2025 and 2024.

As of June 30, 2024 and 2023, GCU’s composite score per GCU’s audited financial statements was 1.9 and 1.8, respectively, using the proprietary school calculation.

As of June 30, 2025 and 2024, GCU’s composite score per GCU’s audited financial statements was 1.9 for both years, using the proprietary school calculation.

If GCU’s future composite scores do not exceed 1.5, ED could impose sanctions.

24 unchanged sentences

Also, if ED determines that an institution (including its contractors) has engaged in substantial misrepresentation, ED may revoke an institution’s program participation agreement, impose limitations on the institution’s participation in Title IV programs, deny applications from the institution for approval of new programs or locations or other matters, or initiate proceedings to fine the institution or limit, suspend, or terminate its eligibility to participate in Title IV programs.

For example, in October 2023, ED imposed a fine of $37 million on GCU (which GCU is appealing) related to alleged misrepresentation by GCU regarding the costs of certain doctorate programs.

Similar rules apply under state laws or are incorporated in institutional accreditation standards.

The FTC applies similar rules prohibiting any unfair or deceptive marketing practices to the education sector and has pursued litigation against us and GCU related in part to these matters.

See Part I, Item 3 – Legal Proceedings – FTC Complaint .

If ED or another regulator determines that statements made by us or on our university partners’ behalf are in violation of the regulations, we could be subject to sanctions, legal actions, and other liability, which could have a material adverse effect on our business.

22 unchanged sentences

State regulatory requirements for online education have historically varied among the states.

To address this issue and to meet new ED requirements many schools have applied and have been approved to be approved institutional participants in the State Authorization Reciprocity Agreement (“SARA”).

To address this issue and to meet new ED requirements many schools have applied and have been approved to be approved institutional participants in SARA.

SARA is an agreement among member states, districts and territories that establishes comparable national standards for interstate offering of post-secondary distance education courses and programs.

1 unchanged sentence

SARA is overseen by a national council (NC-SARA) and administered by four regional education compacts.

GCU, for example, is a member of SARA in Arizona (AZ-SARA), which is

administered by the Western Interstate Commission for Higher Education (referred to as W-SARA).

There is a yearly renewal for participating in NC-SARA and AZ-SARA and institutions must agree to meet certain requirements to participate.

All states other than California are members of SARA.

GCU, for example, is a member of SARA in Arizona (AZ-SARA), which is administered by the Western Interstate Commission for Higher Education (referred to as W-SARA).

There is a yearly renewal for participating in NC-SARA and AZ-SARA and

institutions must agree to meet certain requirements to participate.

As of December 31, 2025, all states other than California are members of SARA.

Any state that does not participate in SARA may impose regulatory requirements on out-of-state post-secondary institutions operating within its boundaries, such as those having a physical facility or conducting certain academic activities within the state.

3 unchanged sentences

Laws, regulations, or interpretations related to doing business over the Internet could also increase our cost of doing business and affect our ability to recruit students in particular states, which could, in turn, negatively affect enrollments and revenues and have a material adverse effect on our business.

As discussed, ED has started a new negotiated rulemaking addressing state authorization which implicates SARA.

While no regulations have been published, any regulation could have a material adverse effect on our business.

ED initiated a negotiated rulemaking process addressing state authorization which could have implicated SARA but published a notice in December 2024 terminating that negotiated rulemaking process.

ED may revisit state authorization requirements through future rulemaking or other guidance, and any such changes could have a material adverse effect on our business.

Additionally, regulatory agencies may sometimes disagree with the way we have interpreted or applied these requirements.

11 unchanged sentences

or be subject to fines, injunctions, or other penalties, any of which could have a material adverse effect on their business, prospects, financial condition, and results of operations.

In addition, our largest university partner, GCU, has been subject to additional scrutiny.

In October 2021, the FTC issued a public statement indicating that it would coordinate efforts with ED and the VA to investigate for-profit universities, a category that at that time included GCU due to ED’s 2019 decision that GCU did not satisfy ED’s definition of a non-profit entity and, as a result, that ED would continue to treat GCU as a proprietary institution for purposes of its continued participation in Title IV programs.

In the period following the FTC’s statement, ED, the VA and the FTC initiated multiple actions against GCU, including audits, compliance reviews, civil investigative demands, fines and lawsuits, and the FTC has initiated civil investigative demands and a lawsuit against us, that allege, among other things, misrepresentations made in connection with marketing activities, including statements made related to GCU’s non-profit status.

See “– Regulation of Our University Partners - Coordinated action by federal agencies.” These actions, taken as

a whole, appear to be coordinated in the manner described in the 2021 FTC statement.

These actions, or any future actions by ED, FTC or any other federal or state government agencies or accrediting bodies with oversight over us or GCU, if ultimately resolved adversely to us or GCU, could result in monetary penalties and liabilities, further impact GCU’s non-profit status, and/or cause reputational harm.

At this time, we cannot predict what changes those could be or what effect any of those outcomes could have on our business.

Claims and lawsuits, and other regulatory actions, brought or taken against us or our university partners, even if they are without merit, may also result in adverse publicity, negatively affect the market price of our stock, adversely affect student enrollments, and reduce the willingness of third parties to do business with us.

9 unchanged sentences

● Be jointly and severally liable with the institution to the Secretary for any violation by the servicer of any statutory provision of or applicable to Title IV of the HEA, any regulatory provision prescribed under that statutory authority, and any applicable special arrangement, agreement, or limitation entered into under the authority of statutes applicable to Title IV of the HEA.

ED has emphasized increased oversight of third-party servicers and has reiterated that institutions participating in Title IV programs remain responsible for the acts and omissions of their third-party service providers.

As a result, ED audits, program reviews, investigations, and enforcement actions involving our university partners may also examine our activities, contractual arrangements, and compliance controls, which could require us to devote additional resources to compliance efforts or result in contractual, financial, or reputational impacts.

ED has indicated that it may revisit the scope of third-party servicer requirements through future rulemaking or guidance, which could expand compliance obligations and increase our costs.

We are also subject to a number of data security and privacy regulations given our role as a third-party servicer and these standards are evolving.

2 unchanged sentences

Congress may impact general public perception of the industry in a negative manner resulting in a material and adverse impact on our business.

The process of re-authorization of the HEA began in 2014 and is ongoing.

Congressional hearings began in 2013 and will continue to be scheduled by the U.S.

The Higher Education Act has not been comprehensively reauthorized since 2008, and Congress has periodically considered proposals to reauthorize and amend the statute.

Congressional hearings will continue to be scheduled by the U.S.

Senate Committee on Health, Education, Labor and Pensions, the U.S.

5 unchanged sentences

The increased scrutiny and results-based accountability initiatives in the education sector, as well as ongoing policy differences in Congress regarding spending levels, could lead to significant changes in connection with the reauthorization of the HEA or otherwise.

These changes may place additional regulatory burdens on postsecondary schools generally, and specific initiatives may be targeted at or have an impact upon companies like us that provide services to institutions of higher education.

These changes may place additional regulatory burdens on postsecondary

schools generally, and specific initiatives may be targeted at or have an impact upon companies like us that provide services to institutions of higher education.

The adoption of any laws or regulations that limit our ability to provide our bundled services to our university partners could compromise our ability to drive revenue through their programs or make our platform less attractive to them.

10 unchanged sentences

Other General Risks

Our success depends upon our ability to recruit and retain key personnel.

Our success depends upon our ability and our university partners’ ability to recruit and retain key personnel.

Our success to date has largely depended on, and will continue to depend on, the skills, efforts, and motivation of our executive officers, who generally have significant experience with our business and the education industry, and we may have difficulties in locating and hiring qualified personnel and in retaining such personnel once hired.

1 unchanged sentence

The loss of the services of any of our key personnel, many of whom are not party to employment agreements with us, or our failure to attract and retain other qualified and experienced personnel on acceptable terms, could cause our business to suffer.

In addition, our university partners heavily rely on their ability to attract and retain qualified faculty members to effectively educate their students.

If our university partners fail to retain sufficient numbers of qualified faculty members, fail to adequately train new faculty members, or allow relations with faculty members to deteriorate, they may be required to reduce the number or scope of classes available to students, which could in turn have a material adverse impact on our business.

A failure of our information systems to properly store, process and report relevant data may reduce our management’s effectiveness, interfere with our regulatory compliance and increase our operating expenses.

5 unchanged sentences

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

We are required to perform system and process evaluation and testing of our internal control over financial reporting to allow management to report on the effectiveness of our internal control over financial reporting in our Form 10-K filing for that year, as required by Section 404 of the Sarbanes-Oxley Act.

This may require us to incur substantial additional

professional fees and internal costs to further expand our accounting and finance functions and expend significant management efforts.

We are required to perform system and process evaluation and testing of our internal control over financial reporting to

allow management to report on the effectiveness of our internal control over financial reporting in our Form 10-K filing for that year, as required by Section 404 of the Sarbanes-Oxley Act.

This may require us to incur substantial additional professional fees and internal costs to further expand our accounting and finance functions and expend significant management efforts.

If we are not able to comply with the requirements of Section 404 of the Sarbanes-Oxley Act in a timely manner, or if we are unable to maintain proper and effective internal controls, we may not be able to produce timely and accurate financial statements.

21 unchanged sentences

We currently intend to retain our future earnings, if any, to fund the development and growth of our business or to repurchase shares of our common stock.

In addition, the terms of our prior credit facility limited, and the terms of any future debt agreements are likely to similarly limit, our ability to pay dividends.

In addition, the terms of our prior credit facility limited, and the terms of any future debt agreements are likely to similarly limit, our ability to pay

As a result, capital appreciation, if any, of our common stock will be your sole source of gain for the foreseeable future.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors