Paycom Software, Inc. 10-Q

Item 1. Legal Proceedings From time to time, we are involved in various disputes, claims, suits, investigations and legal proceedings arising in the ordinary course of business. We believe that the resolution of current pending legal matters will not have a material adverse effect on our business, financial condition, results of operations or cash flows. Nonetheless, we cannot predict the outcome of these proceedings, as legal matters are subject to inherent uncertainties, and there exists the possibility that the ultimate resolution of these matters could have a material adverse effect on our business, financial condition, results of operations or cash flows. Item 1A. Ri sk Factors E xcept as set forth below, there have been no material changes from the information set forth in “Item 1A. Risk Factors” in the Form 10-K filed with the SEC on February 16, 2023. If our security measures are breached, or unauthorized access to our clients’ or their employees’ or potential employees’ sensitive data is otherwise obtained, our solution may not be perceived as being secure, clients may reduce the use of or stop using our solution, our ability to attract new clients may be harmed and we may incur significant liabilities. Our solution involves the collection, storage and transmission of clients’ and their employees’ and potential employees’ confidential and proprietary information, including personal identifying information, as well as financial and payroll data. HCM software is often targeted in cyber attacks, including computer viruses, worms, phishing attacks, malicious software programs and other information security breaches, which could result in unauthorized access to or release, gathering, monitoring, misuse, loss or destruction of our or our clients’ sensitive data or otherwise disrupt our or our clients’ business operations. If cybercriminals are able to circumvent our security measures, or if we are unable to detect an intrusion into our systems and contain such intrusion in a reasonable amount of time, our or our clients’ sensitive data may be compromised. Further, certain of our employees have access to sensitive information about our clients’ employees. While we conduct background checks of our employees and limit access to systems and data, it is possible that one or more of these individuals may circumvent these controls, resulting in a security breach. In certain limited circumstances, we utilize relationships with third parties to aid in data management and transaction processing. Certain third parties with which we do business have been subject to cyber attacks, one of which resulted in unauthorized access to data of certain Company clients and their employees as well as Company data and employee records. These third parties may be sources of cybersecurity or other technological risks in the future, including operational errors, system interruptions or breaches, unauthorized disclosure of confidential information and misuse of intellectual property. Although we have security measures in place to protect client information and prevent data loss and other security breaches, these measures could be breached as a result of third-party action, employee error, third-party or employee malfeasance or otherwise. Globally, cybersecurity attacks are increasing in number and the attackers are increasingly organized and well financed, or at times supported by state actors. In addition, geopolitical tensions or conflicts, such as Russia’s invasion of Ukraine or increasing tension with China, may create a heightened risk of cybersecurity attacks. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently, we may not be able to anticipate these techniques and implement adequate preventative or protective measures. While we currently maintain a cyber liability insurance policy, cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management’s attention from our business and operations. Any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. As we continue to enhance our solution to serve clients located outside of the United States, our business will be subject to risks associated with international operations . An element of our growth strategy is to expand our operations and client base. We have recently begun to expand our operations into markets outside of the United States. Doing business internationally involves a number of risks, including but not limited to: • multiple, conflicting and changing laws and regulations such as privacy regulations, tax laws, export and import restrictions, employment laws, regulatory requirements and other governmental approvals, permits, and licenses; • failure to obtain and maintain regulatory approvals for the use of our products in various countries; 35 • complexities and difficulties in obtaining protection and enforcing our intellectual property; • difficulties in staffing and managing foreign operations; • limits in our ability to penetrate international markets; • financial risks, such as the impact of local and regional financial crises on demand for our products and exposure to foreign currency exchange rate fluctuations; • natural disasters, political and economic instability, including wars, terrorism and political unrest, outbreak of disease, boycotts, curtailment of trade and other business restrictions; • certain expenses including, among others, expenses for travel, translation and insurance; and • regulatory and compliance risks that relate to maintaining accurate information and control over sales and activities that may fall within the purview of the U.S. Foreign Corrupt Practices Act, its books and records provisions or its anti-bribery provisions. Our expansion into international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that differ from those in the United States. Because of our inexperience with international operations, we cannot ensure that our expansion into international markets will be successful, and the impact of such expansion may adversely affect our business, operating results or financial condition. Our background check business is subject to significant governmental regulation, and changes in law or regulation, or a failure to correctly identify, interpret, comply with and reconcile the laws and regulations to which it is subject, could materially adversely affect our revenue or profitability. We offer a background screening application called Enhanced Background Checks. In the course of providing background checks, we search and report public and non-public consumer information and records, including criminal records, employment and education history, credit history, driving records and drug screening results. Consequently, we are subject to extensive, evolving and often complex laws and governmental regulations, such as the Fair Credit Reporting Act (the “FCRA”), the Drivers’ Privacy Protection Act, state consumer reporting agency laws, state licensing and registration requirements, and various other foreign, federal, state and local laws and regulations. These laws and regulations set forth restrictions and process requirements concerning what may be reported about an individual, when, to whom, and for what purposes, and how the subjects of background checks are to be treated. Compliance with these laws and regulations requires significant expense and resources, which could increase significantly as these laws and regulations evolve. Such increase in restrictions and compliance costs could negatively affect our ability to provide other services expected by our clients and adversely affect our offerings and revenue. Changes in law, regulation, or administrative enforcement and interpretations or other limitations and prohibitions related to the provision of consumer information and records could materially adversely affect our revenue and profitability. For example, numerous state and local authorities have implemented “ban the box” and “fair chance” hiring laws that limit or prohibit employers from inquiring or using a candidate’s criminal history to make employment decisions and many of these authorities have in recent years amended these laws to increase the restrictions on the use of such information. In addition, redaction of personal identifying information in criminal records (such as date of birth), and court rules or lawsuits that limit or restrict access to identifiers in criminal records, may negatively impact our ability to perform complete criminal background checks. The enactment of new restrictive legislation and the requirements, restrictions, and limitations imposed by changing interpretations and court decisions on such laws and regulations could prevent our customers from using the full functionality of our background screening application, which may reduce demand for such solution. We could face liability from of our background check services and the information we report or fail to report in our background checks, which may not be covered or fully covered by insurance. We face potential liability from individuals, classes of individuals, clients or regulatory bodies for claims based on the nature, content or accuracy of our background check services and the information we use and report. Our potential exposure to lawsuits or government investigations may increase depending in part on our clients’ compliance with these laws and regulations and applicable employment laws in their procurement and use of our background checks as part of their hiring process, which is generally outside of our control. Our potential liability includes claims of non-compliance with the FCRA, U.S. state consumer reporting agency laws or regulations, foreign regulations or applicable employment laws, as well as other claims of defamation, invasion of privacy, negligence, copyright, patent or trademark infringement. In some cases we may be subject to strict liability. We also face potential liability from our clients, and possibly third parties, in the event we fail to report information, particularly criminal records or other potentially negative information, or wrongly report such information. From time to time, we have been subject to claims and lawsuits by current and potential employees of our clients, alleging that we provided to our clients inaccurate or improper information that negatively affected the clients’ hiring decisions. Although the resolutions of these lawsuits have not had a 36 material adverse effect on us to date, the costs of such claims, including settlement amounts or punitive damages, could be material in the future, could cause adverse publicity and reputational damage, could divert the attention of our management, could subject us to equitable remedies relating to the operation of our business and provision of services and result in significant legal expenses, all of which could have a material adverse effect on our business, financial condition and results of operations and adverse publicity, and could result in the loss of existing clients and make it difficult to attract new clients. Insurance may not be adequate to cover us for all risks to which we are exposed or may not be available to cover these claims at all. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of our insurance coverage, could have a material adverse effect on our business, financial condition or results of operations. Additionally, we cannot be certain that our insurance coverage, including any applicable deductibles, copays and other policy limits, will continue to be available to us at a reasonable cost or will be adequate to cover any claims or lawsuits we may face in the future or that we will be able to renew our insurance policies on favorable terms, or at all. We may not continue to pay dividends or to pay dividends at the same rate as announced in May 2023. Our payment of dividends, as well as the rate at which we pay dividends, are solely at the discretion of our Board of Directors. Further, dividend payments, if any, are subject to our financial results and the availability of statutory surplus. These factors could result in a change to our recently adopted dividend policy.