What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-03-31 compared with 2020-03-30 · 143 added, 385 removed, 138 unchanged (79% of the section changed)

4 unchanged sentences

Risk Factors Related to Our Business

Our business has been and is likely to continue to be negatively affected by the recent COVID-19 outbreak.

The outbreak of COVID-19 in the United States, which was declared a pandemic by the World Health Organization on March 11, 2020, continues to adversely affect commercial activity and has contributed to significant declines in economic activity.

In particular, the COVID-19 pandemic has affected a number of operational factors, including:

• merchant temporary closures and failures;

• continued and/or worsening unemployment which may negatively influence consumer spending;

• third-party disruptions, including potential outages at network providers, and other suppliers;

• increased cyber and payment fraud risk.

These factors may remain prevalent for a significant period of time and may continue to adversely affect our business, results of operations and financial condition even after the COVID-19 pandemic has subsided.

The full effects of the COVID-19 pandemic on our business, results of operations, financial condition and cash flows will depend on future developments, which are highly uncertain and difficult to predict at this time, including, but not limited to, the duration and spread of the pandemic, its severity, the restrictive actions taken to contain the virus or treat its effects, its effects on our customers and how quickly and to what extent normal economic and operating conditions, operations and demand for our services can resume.

Accordingly, while the COVID-19 pandemic could have an adverse effect on our revenues and financial results for reporting periods after 2020, the ultimate effects on our operations, financial condition and cash flows cannot be determined at this time.

Unauthorized disclosure of merchant or cardholder data, whether through breach of our computer systems, computer viruses, or otherwise, could expose us to liability, protracted and costly litigation and damage our reputation.

We are responsible for data security for ourselves and for third parties with whom we partner, including by contract and under the rules and regulations established by the payment networks, such as Visa, MasterCard, Discover and American Express, as well as debit card networks.

These third parties include merchants, our distribution partners and other third-party service providers and agents.

We and other third parties collect, process, store and/or transmit sensitive data, such as names, addresses, social security numbers, credit or debit card numbers and expiration dates, driver's license numbers and bank account numbers.

We have ultimate liability to the payment networks and our bank sponsors that register us with Visa or MasterCard for our failure or the failure of third parties with whom we contract to protect this data in accordance with payment network requirements.

The loss, destruction or unauthorized modification of merchant or cardholder data by us or our contracted third parties could result in significant fines, sanctions and proceedings or actions against us by the payment networks, governmental bodies, consumers or others.

Our services include the processing, transmission and storing of sensitive business and personal information about our merchants, merchants’ customers, vendors, partners, and other third parties.

This information may include credit and debit card numbers, bank account numbers, personal identification numbers, names and addresses or other sensitive business information.

This information may also be stored by third parties to whom we outsource certain functions or other agents (“associated third parties”).

We may have responsibility to the card networks, financial institutions, and in some instances, our merchants, and/or ISOs, for our failure or the failure of our associated third parties to protect this information.

Information security risks for us and our competitors have substantially increased in recent years in part due to the proliferation of new technologies and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including hostile nation-state actors.

Examples of such information security risks are the recent Spectre and Meltdown threats which, rather than acting as viruses, were design flaws in many computers that allowed programs to steal data stored in the memory of other running programs and required patch software to correct.

The techniques used by these bad actors to obtain unauthorized access, disable or degrade service, sabotage systems or utilize payment systems in an effort to perpetrate financial fraud change frequently and are often difficult to detect.

Furthermore, threats may derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure.

For example, certain of our employees have access to sensitive data that could be used to commit identity theft or fraud.

Concerns about security increase when we transmit information electronically because such transmissions can be subject to attack, interception or loss.

Also, computer viruses can be distributed and spread rapidly over the internet and could infiltrate our systems or those of our contracted third parties.

Denial of service or other attacks could be launched against us for a variety of purposes, including interfering with our services or to create a diversion for other malicious activities.

These types of actions and attacks and others could disrupt our delivery of services or make them unavailable.

Any such actions or attacks against us or our contracted third parties could hurt our reputation, force us to incur significant expenses in remediating the resulting impacts, expose us to uninsured liability, result in the loss of our bank sponsors or our ability to participate in the payment networks, subject us to lawsuits, fines or sanctions, distract our management or increase our costs of doing business.

For example, we are presently evaluating whether the recent Spectre and Meltdown threats may require us to replace substantial portions of our current technology hardware and infrastructure in order to mitigate the risk associated with those threats.

If we are required to replace a substantial portion of our current technology hardware and infrastructure, either as a result of the Spectre and Meltdown threats or similar future threats, we would likely incur substantial capital expenditures, which may materially and adversely affect our free cash flow and results of operations as a result.

We and our contracted third parties could be subject to breaches of security by hackers, and our encryption of data and other protective measures may not prevent unauthorized access to or use of sensitive data.

A breach of a system may subject us to material losses or liability, including payment network fines, assessments and claims for unauthorized purchases with misappropriated credit, debit or card information, impersonation or other similar fraud claims.

A misuse of such data or a cybersecurity breach could harm our reputation and deter merchants from using electronic payments generally and our services specifically, thus reducing our revenue.

In addition, any such misuse or breach could cause us to incur costs to correct the breaches or failures, expose us to uninsured liability, increase our risk of regulatory scrutiny, subject us to lawsuits, and result in the imposition of material penalties and fines under state and federal laws or by the payment networks.

While we maintain insurance coverage that may, subject to

policy terms and conditions, cover certain aspects of cyber risks, our insurance coverage may be insufficient to cover all losses.

In addition, a significant cybersecurity breach of our systems or communications could result in payment networks prohibiting us from processing transactions on their networks or the loss of our bank sponsors that facilitate our participation in the payment networks, either of which could materially impede our ability to conduct business.

The confidentiality of the sensitive business information and personal consumer information that resides on our systems and our associated third parties' systems are critical to our business.

While we maintain controls and procedures to protect the sensitive data we collect, we cannot be certain that these measures will be successful or sufficient to counter all current and emerging technology threats that are designed to breach these systems in order to gain access to confidential information.

For example, although we generally require that our agreements with distribution partners or our service providers which may have access to merchant or cardholder data include confidentiality obligations that restrict these parties from using or disclosing any merchant or cardholder data except as necessary to perform their services under the applicable agreements, we cannot guarantee that these contractual measures will prevent the unauthorized use, modification, destruction or disclosure of data or allow us to seek reimbursement from the contracted party.

In addition, many of our merchants are small and medium businesses that may have limited competency regarding data security and handling requirements and may thus experience data breaches.

Any unauthorized use, modification, destruction or disclosure of data could result in protracted and costly litigation and the incurrence of significant losses.

In addition, our agreements with our bank sponsors and our third-party payment processors (as well as payment network requirements) require us to take certain protective measures to ensure the confidentiality of merchant and consumer data.

Any failure to adequately comply with these protective measures could result in fees, penalties, litigation or termination of our bank sponsor agreements or our third-party payment processor agreements.

Any significant unauthorized disclosure of sensitive data entrusted to us would cause significant damage to our reputation and impair our ability to attract new integrated technology and referral partners, and may cause parties with whom we already have such agreements to terminate them.

The techniques used to obtain unauthorized access, disable or degrade service, sabotage systems or utilize payment systems in an effort to perpetrate financial fraud change frequently and are often difficult to detect.

Threats may derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure.

Computer viruses can be distributed and spread rapidly over the internet and could infiltrate our systems or those of our associated third parties.

Additionally, denial of service or other attacks could be launched against us for a variety of purposes, including interfering with our services or to create a diversion for other malicious activities.

Our defensive measures may not prevent down-time, unauthorized access or use of sensitive data.

While we maintain insurance coverage that will cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.

Furthermore, we do not control the actions of our third-party partners and customers in their systems.

These third parties may experience security breaches and any future problems experienced by these third parties, including those resulting

from cyber attacks or other breakdowns or disruptions in services, could adversely affect our ability to conduct our business or expose us to liability.

Further, our agreements with our bank sponsors and our third-party payment processors (as well as payment network requirements) require us to take certain protective measures to ensure the confidentiality of merchant and consumer data.

Any such actions, attacks or failure to adequately comply with these protective measures could hurt our reputation, force us to incur significant expenses in remediating the resulting impacts, expose us to uninsured liability, result in the loss of our bank sponsors or our ability to participate in the payment networks, or subject us to fees, penalties, sanctions, litigation or termination of our bank sponsor agreements or our third-party payment processor agreements.

As a result of information security risks, we must continuously develop and enhance our controls, processes, and practices designed to protect our computer systems, software, data and networks from attack, damage, or unauthorized access.

1 unchanged sentence

Despite our investments in security measures, we are unable to assure that any security measures will not be subject to system or human error.

Our systems or our third-party providers’ systems may fail, which could interrupt our service, cause us to lose business, increase our costs and expose us to liability.

We depend on the efficient and uninterrupted operation of our computer systems, software, data centers and telecommunications networks, as well as the systems and services of third parties.

A system outage or data loss could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Not only could we suffer damage to our reputation in the event of a system outage or data loss, but we may also be liable to third parties.

Many of our contractual agreements with financial institutions and certain other customers require the payment of penalties if we do not meet certain operating standards.

Our systems and operations or those of our third-party providers could be exposed to damage or interruption from, among other things, fire, natural disaster, power loss, or telecommunications failure.

The payment processing industry is highly competitive and such competition is likely to increase, which may adversely influence the prices we can charge to merchants for our services and the compensation we must pay to our distribution partners, and as a result, our profit margins.

1 unchanged sentence

We primarily compete in the small to medium-size ("SMB") merchant industry.

Competition has increased recently as other providers of payment processing services have established a sizable market share in the SMB merchant acquiring industry.

Our primary competitors for SMB merchants in these markets include financial institutions and their affiliates and well-established payment processing companies that target SMB merchants directly and through third parties, including Bank of America Merchant Services, Chase Merchant Services, Elavon, Inc.

(a subsidiary of U.S.

Bancorp), Wells Fargo Merchant Services, First Data Corporation, Worldpay, Inc., Global Payments/TSYS and Square.

We also compete with many of these same entities for the assistance of distribution partners.

For example, many of our distribution partners are not exclusive to us but also have relationships with our competitors, such that we have to continually expend resources to maintain those relationships.

We compete with, financial institutions and their affiliates, independent payment processing companies, and ISOs.

We also compete with many of these same entities for production through distribution partners.

Many of our distribution partners are not exclusive to us but also have relationships with our competitors, such that we have to continually expend resources to maintain those relationships.

Our growth will depend on the continued growth of payments with credit, debit and prepaid cards ("Electronic Payments"), particularly Electronic Payments to SMB merchants, and our ability to increase our market share through successful competitive efforts to gain new merchants and distribution partners.

In addition, many financial institutions, subsidiaries of financial institutions or well-established payment-enabled technology providers with which we compete, have substantially greater capital, technological, management and marketing resources than we have.

Additionally, many financial institutions and their subsidiaries or well-established payment-enabled technology providers with which we compete, have substantially greater capital, technological, management and marketing resources than we have.

These factors may allow our competitors to offer better pricing terms to merchants and more attractive compensation to distribution partners, which could result in a loss of our potential or current merchants and distribution partners.

Competing with financial institutions is also challenging because, unlike us, they often bundle processing services with other banking products and services.

This competition may effectively limit the prices we can charge our merchants, cause us to increase the compensation

we pay to our distribution partners and require us to control costs aggressively in order to maintain acceptable profit margins.

Our current and future competitors may also develop or offer services that have price or other advantages over the services we provide.

We are also facing new, well capitalized, competition from emerging technology and non-traditional payment processing companies as well as traditional companies offering alternative electronic payments services and payment enabled software solutions.

We also face new, well capitalized, competition from emerging technology and non-traditional payment processing companies as well as traditional companies offering alternative electronic payments services and payment enabled software solutions.

If these new entrants gain a greater share of total electronic payments transactions, they could impact our ability to retain and grow our relationships with merchants and distribution partners.

Acquirers may be susceptible to the adoption by the broader merchant community of payment enabled software versus terminal based payments.

To acquire and retain a segment of our merchants, we depend in part on distribution partners that may not serve us exclusively and are subject to attrition.

We rely in significant part on the efforts of ISOs, ISVs, and referral partners to market our services to merchants seeking to establish a merchant acquiring relationship.

These distribution partners seek to introduce us, as well as our competitors, to newly established and existing SMB merchants, including retailers, restaurants and other businesses.

Generally, our agreements with distribution partners (with the exception of a portion of our integrated technology partners and bank referral partners) are not exclusive, and distribution partners retain the right to refer merchants to other merchant acquirers.

Gaining and maintaining loyalty or exclusivity can require financial concessions to maintain current distribution partners and merchants or to attract potential distribution partners and merchants from our competitors.

We have been required, and expect to be required in the future, to make concessions when renewing contracts with our distribution partners and such concessions can have a material impact on our financial condition or operating performance.

If these distribution partners switch to another merchant acquirer, cease operations or become insolvent, we will no longer receive new merchant referrals from them, and we risk losing existing merchants that were originally enrolled by them.

Additionally, our distribution partners are subject to the requirements imposed by our bank sponsors, which may result in fines to them for non-compliance and may, in some cases, result in these entities ceasing to refer merchants to us.

We cannot accurately predict the level of attrition of our distribution partners or merchants in the future, particularly those merchants we acquired as customers in the portfolio acquisitions we have completed in the past five years, which makes it difficult for us to forecast growth.

If we are unable to establish relationships with new distribution partners or merchants, or otherwise increase our transaction processing volume in order to counter the effect of this attrition, our revenues will decline.

We may experience breakdowns in our processing systems that could damage client relations and expose us to liability.

Our core business depends heavily on the reliability of our processing systems.

A system outage could have a material adverse effect on our business, financial condition, and results of operations.

Not only would we suffer damage to our reputation in the event of a system outage, but we may also be liable to third parties.

Many of our contractual agreements with clients require us to pay penalties if our systems do not meet certain operating standards.

To successfully operate our business, we must be able to protect our processing and other systems from interruption, including from events that may be beyond our control.

Events that could cause system interruptions include, but are not limited to, fire, natural disaster, unauthorized entry, power loss, telecommunications failure, computer viruses, terrorist acts, cyber-attacks and war.

Although we have taken steps to protect against data loss and system failures, there is still risk that we may lose critical data or experience system failures.

To help protect against these events, we perform the vast majority of disaster recovery operations ourselves, but we also utilize select third parties for certain operations.

To the extent we outsource our disaster recovery, we are at risk of the vendor's unresponsiveness or other failures in the event of breakdowns in our systems.

In addition, our property and business interruption insurance may not be adequate to compensate us for all losses or failures that may occur.

Governmental regulations designed to protect or limit access to or use of consumer information could adversely affect our ability to effectively provide our services to merchants.

Governmental bodies in the United States have adopted, or are considering the adoption of, laws and regulations restricting the use, collection, storage, and transfer of, and requiring safeguarding of, non-public personal information.

Our operations are subject to certain provisions of these laws.

Relevant federal privacy laws include the Gramm-Leach-Bliley Act of 1999, which applies directly to a broad range of financial institutions and indirectly, or in some instances directly, to companies that provide services to financial institutions.

These laws and regulations restrict the collection, processing, storage, use and disclosure of personal information, require notice to individuals of privacy practices and provide individuals with certain rights to prevent the use and disclosure of protected information.

These laws also impose requirements for safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines.

The Federal Trade Commission's information safeguarding rules under the Gramm-Leach-Bliley Act require us to develop, implement and maintain a written, comprehensive information security program containing safeguards that are appropriate for our size and complexity, the nature and scope of our activities and the sensitivity of any customer information at issue.

Our financial institution clients are subject to similar requirements under the guidelines issued by the federal banking regulators.

As part of their compliance with these requirements, each of our financial institution clients is expected to have a program in place for responding to unauthorized access to, or use of, customer information that could result in substantial harm or inconvenience to customers and they are also responsible for our compliance efforts as a major service provider.

In addition, regulators are proposing new laws or regulations which could require us to adopt certain cybersecurity and data handling practices.

In many jurisdictions consumers must be notified in the event of a data breach, and such notification requirements continue to increase in scope and cost.

The changing privacy laws in the United States create new individual privacy rights and impose increased obligations on companies handling personal data.

In addition, there are state laws restricting the ability to collect and utilize certain types of information such as Social Security and driver's license numbers.

Certain state laws impose similar privacy obligations as well as obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and consumer reporting agencies and businesses and governmental agencies that own data.

For example, the CCPA, which went into effect on January 1, 2020, establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches.

In connection with providing services to our merchants, we are required by regulations and contracts with our merchants and with our financial institution referral partners to provide assurances regarding the confidentiality and security of non-public consumer information.

These contracts require periodic audits by independent companies regarding our compliance with industry standards and also allow for similar audits regarding best practices established by regulatory guidelines.

The compliance standards relate to our infrastructure, components and operational procedures designed to safeguard the confidentiality and security of non-public consumer personal information shared by our merchants with it.

Our ability to maintain compliance with these standards and satisfy these audits will affect our ability to attract, grow and maintain business in the future.

If we fail to comply with the laws and regulations relating to the protection of data privacy, we could be exposed to suits for breach of contract or to governmental proceedings.

In addition, our relationships and reputation could be harmed, which could inhibit our ability to retain existing merchants and distribution partners and obtain new merchants and distribution partners.

If more restrictive privacy laws or rules are adopted by authorities in the future, our compliance costs may increase and our ability to perform due diligence on, and monitor the risk of, our current and potential merchants may decrease, which could create liability for it.

Additionally, our opportunities for growth may be curtailed by our compliance capabilities or reputational harm, and our potential liability for security breaches may increase.

Potential distribution partners and merchants may be reluctant to switch to a new merchant acquirer, which may adversely affect our growth.

Many potential distribution partners and merchants worry about potential disadvantages associated with switching merchant acquirers, such as a loss of accustomed functionality, increased costs and business disruption.

For our distribution partners, switching to us from another merchant acquirer or integrating with us may be perceived by them as a significant undertaking.

As a result, many distribution partners and merchants often resist change.

There can be no assurance that our strategies for overcoming potential reluctance to change vendors or initiate a relationship with us will be successful, and this resistance may adversely affect our growth and performance results.

Because we rely on third-party vendors to provide products and services, we could be adversely impacted if they fail to fulfill their obligations.

Our business is dependent on third-party vendors to provide us with certain products and services.

For example, we utilize First Data and TSYS to provide authorization and settlement services.

Our current amended and restated processing agreement with First Data was entered into in December 2014 and will remain in effect through December 2020 and automatically renews for successive 90-day terms thereafter unless either party provides 30-day written notice of non-renewal to the other party.

processing agreement with TSYS is effective January 1, 2019 for a three-year term and automatically renews for a successive one-year term thereafter unless either party provides written notice of non-renewal to the other party.

The failure of these vendors, such as First Data and TSYS, to perform their obligations in a timely manner could adversely affect our operations and profitability.

In addition, if we are unable to renew our existing contracts with our most significant vendors, such as First Data and TSYS, we might not be able to replace the related product or service at the same cost, which would negatively impact our profitability.

Specifically, while we believe we would be able to locate alternative vendors to provide substantially similar services at comparable rates, or otherwise replicate such services internally, it is not assured that a change will not be disruptive to our business, which could potentially lead to a material adverse impact on our revenue and profitability until resolved.

Increased merchant, referral partner or ISO attrition could cause our financial results to decline.

We experience attrition in merchant credit and debit card processing volume resulting from several factors, including business closures, transfers of merchant accounts to our competitors, unsuccessful contract renewal negotiations and account closures that we initiate for various reasons such as heightened credit risks or contract breaches by merchants.

Our referral partners are

a significant source of new business.

If a referral partner or an ISO switches to another processor, terminates our services, internalizes payment processing that we perform, merges with or is acquired by one of our competitors, or shuts down or becomes insolvent, we may no longer receive new merchant referrals from such referral partner, and we risk losing existing merchants that were originally enrolled by the referral partner or ISO.

We cannot predict the level of attrition in the future and it could increase.

Higher than expected attrition could negatively affect our results, which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Changes in card association and debit network fees or products could increase costs or otherwise limit our operations.

3 unchanged sentences

Any increase in the capital level required would further limit our use of capital for other purposes.

We are subject to extensive government regulation, and any new laws and regulations, industry standards or revisions made to existing laws, regulations or industry standards affecting the electronic payments industry may have an unfavorable impact on our business, financial condition and results of operations.

We are subject to numerous regulations that affect electronic payments including, U.S.

financial services regulations, consumer protection laws, escheat regulations, and privacy and information security regulations.

Regulation and proposed regulation of our industry has increased significantly in recent years.

Changes to statutes, regulations or industry standards, including interpretation and implementation of statutes, regulations or standards, could increase our cost of doing business or affect the competitive balance.

For example, the Trump Administration has called for changes in existing regulatory requirements, including those applicable to financial services.

We cannot predict the impact, if any, of such changes on our business.

It is likely that some policies adopted by the new administration will benefit us, while others will negatively affect it.

Until we know what changes are adopted, we will not know whether in total we benefit from, or are negatively affected by, the changes.

Failure to comply with regulations may have an adverse effect on our business, including the limitation, suspension or termination of services provided to, or by, third parties, and the imposition of penalties or fines.

Interchange fees, which are typically paid by the payment processor to the issuer in connection with electronic payments, are subject to increasingly intense legal, regulatory, and legislative scrutiny.

In particular, the Dodd-Frank Act significantly changed the United States financial regulatory system, including by regulating and limiting debit card fees charged by certain issuers, allowing merchants to set minimum dollar amounts for the acceptance of credit cards and allowing merchants to offer discounts or other incentives for different payment methods.

Rules implementing the Dodd-Frank Act also contain certain prohibitions on payment network exclusivity and merchant routing restrictions.

These restrictions could limit the number of debit transactions, and prices charged per transaction, which would negatively affect our business.

The Dodd-Frank Act also created the CFPB, which has assumed responsibility for most federal consumer protection laws, and the FSOC, which has the authority to determine whether any non-bank financial company, which may include us within the definitional scope, should be supervised by the Federal Reserve Board because it is systemically important to the United States financial system.

Any such designation would result in increased regulatory burdens on our business, which increases our risk profile and may have an adverse impact on our business, financial condition and results of operations.

We and many of our merchants are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices.

That statement and other laws, rules and or regulations, including the Telemarketing Sales Act, may directly impact the activities of certain of our merchants and, in some cases, may subject us, as the merchant's electronic processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we were deemed to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of the merchant through our services.

Various federal and state regulatory enforcement agencies, including the Federal Trade Commission and state attorneys

general, have authority to take action against non-banks that engage in unfair or deceptive practices or violate other laws, rules and regulations and to the extent we are processing payments or providing services for a merchant that may be in violation of laws, rules and regulations, we may be subject to enforcement actions and as a result may incur losses and liabilities that may impact our business.

Our business may also be subject to the Fair Credit Reporting Act (the "FCRA"), which regulates the use and reporting of consumer credit information and also imposes disclosure requirements on entities that take adverse action based on information obtained from credit reporting agencies.

We could be liable if our practices under the FCRA are not in compliance with the FCRA or regulations under it.

Separately, the Housing Assistance Tax Act of 2008 included an amendment to the Internal Revenue Code that requires the filing of yearly information returns by payment processing entities and third-party settlement organizations with respect to payments made in settlement of electronic payment transactions and third-party payment network transactions occurring in that calendar year.

Transactions that are reportable pursuant to these rules are subject to backup withholding requirements.

We could be liable for penalties if our information returns do not comply with these regulations.

These and other laws and regulations, even if not directed at us, may require us to make significant efforts to change our products and services and may require that we incur additional compliance costs and change how we price our services to merchants.

Implementing new compliance efforts may be difficult because of the complexity of new regulatory requirements and may cause us to devote significant resources to ensure compliance.

Furthermore, regulatory actions may cause changes in business practices by us and other industry participants which could affect how we market, price and distribute our products and services, which could limit our ability to grow, reduce our revenues, or increase our costs.

In addition, even an inadvertent failure to comply with laws and regulations, as well as rapidly evolving social expectations of corporate fairness, could damage our business or our reputation.

Failure to comply with the rules established by payment networks or standards established by third-party processors could result in those networks or processors imposing fines or the networks suspending or terminating our registrations through our bank sponsors.

In order to provide our merchant acquiring services, we are registered through our bank sponsors with the Visa and MasterCard networks as service providers for member institutions.

As such, we and our merchants are subject to payment network rules.

The payment networks routinely update and modify requirements applicable to merchant acquirers including rules regulating data integrity, third-party relationships (such as those with respect to bank sponsors), merchant chargeback standards and PCI DSS.

Standards governing our third-party processing agreements may also impose requirements with respect to compliance with PCI DSS.

If we do not comply with the payment network requirements or standards governing our third-party processing agreements, our transaction processing capabilities could be delayed or otherwise disrupted, and recurring non-compliance could result in fines from the payment networks or third-party processors, the payment networks suspending or terminating our registrations which allow us to process transactions on their networks, which would make it impossible for us to conduct our business on our current scale.

Under certain circumstances specified in the payment network rules or our third-party processing agreements, we may be required to submit to periodic audits, self-assessments or other assessments of our compliance with the PCI DSS.

Such activities may reveal that we have failed to comply with the PCI DSS.

In addition, even if we comply with the PCI DSS, there is no assurance that we will be protected from a security breach.

The termination of our registration with the payment networks, or any changes in payment network or issuer rules that limit our ability to provide merchant acquiring services, could have an adverse effect on our payment processing volumes, revenues and operating costs.

If an audit or self-assessment under PCI DSS identifies any deficiencies that we need to remediate, the remediation efforts may distract our management team and be expensive and time consuming.

Changes in payment network rules or standards could adversely affect our business, financial condition and results of operations.

Payment network rules are established and changed from time to time by each payment network as they may determine in their sole discretion and with or without advance notice to their participants.

The timelines imposed by the payment networks for expected compliance with new rules have historically been, and may continue to be, highly compressed, requiring us to quickly

implement changes to our systems which increases the risk of non-compliance with new standards.

The timelines imposed by the payment networks for expected compliance with new rules have historically been, and may continue to be, highly compressed, requiring us to quickly implement changes to our systems which increases the risk of non-compliance with new standards.

In addition, the payment networks could make changes to interchange or other elements of the pricing structure of the merchant acquiring industry that would have a negative impact on our results of operations.

For example, we closed approximately 1,200 merchant accounts in 2018 in order to ensure compliance with the card association subscription e-commerce criteria.

There may be a decline in the use of electronic payments as a payment mechanism for consumers or adverse developments with respect to the electronic payments industry in general which could adversely affect our business, financial condition and operating results.

Maintaining or increasing our profitability is dependent on consumers and businesses continuing to use credit, debit and prepaid cards at the same or greater rate than previously.

If consumers do not continue to use these cards for their transactions or if there is a change in the mix of payments between cash and electronic payments which is adverse to us, our business could decline and we could incur material losses.

Regulatory changes may also result in merchants seeking to charge customers additional fees for use of electronic payments.

Additionally, in recent years, increased incidents of security breaches have caused some consumers to lose confidence in the ability of retailers to protect their information.

Our business may be adversely affected by the recent coronavirus (COVID-19) outbreak.

In December 2019, a novel strain of coronavirus (COVID-19) was reported to have surfaced in Wuhan, China.

In January 2020, this coronavirus spread to other countries, including the U.S., and efforts to contain the spread of this coronavirus intensified.

In March 2020, the World Health Organization declared the COVID-19 virus outbreak a global pandemic.

The outbreak and any preventative or protective actions that governments or others may take in respect of this coronavirus may result in global business disruptions, including for the Company's customers and business partners, and in a period of business disruption, reduced customer demand and reduced operations.

Any resulting financial impact cannot be reasonably estimated at this time but may materially affect our business, financial condition, results of operations, and cash flows, despite the fact that such impacts may not be felt for a significant period of time.

Although we are diligently working to ensure that we can operate with minimal disruption, prepare to mitigate the impact of the outbreak on our employees’ health and safety, and address potential business interruptions on ourselves and our customers, the full extent to which the coronavirus could affect the global and U.S.

ecomonies and our business will depend on future developments and factors that cannot be predicted.

In order to remain competitive and to continue to increase our revenues and earnings, we must continually update our products and services, a process which could result in increased costs and the loss of revenues, earnings, merchants and distribution partners if the new products and services do not perform as intended or are not accepted in the marketplace.

2 unchanged sentences

Our future success will depend in part on our ability to develop or adapt to technological changes and the evolving needs of our resellers, merchants and the industry at large.

We are continually involved in many business and technology projects, such as CPX, MX Connect and MX Merchant.

MX Connect and MX Merchant provide resellers and merchant clients, a flexible and customizable set of business applications that help better manage critical business work functions and revenue performance using core payment processing as our leverage point.

Additionally, CPX provides AP automation solutions that offers enterprise clients a bridge for buyer to supplier payments.

These may require investment in products or services that may not directly generate revenue.

These projects carry the risks associated with any development effort, including difficulty in determining market demand and timing for delivery of new products and services, cost overruns, delays in delivery and performance problems.

In addition, new products and offerings may not perform as intended or generate the business or revenue growth expected.

2 unchanged sentences

Additionally, the market for alternative payment processing products and services is evolving, and we may develop too rapidly or not rapidly enough for us to recover the costs we have incurred in developing new products and services.

We may not be able to continue to expand our share of the existing electronic payments industry or expand into new markets, which would inhibit our ability to grow and increase our profitability.

Our future growth and profitability depend, in part, upon our continued expansion within the markets in which we currently operate, the emergence of other markets for electronic payments and our ability to penetrate these markets and our current distribution partners' merchant base.

Future growth and profitability of our business may depend upon our ability to penetrate new industries and markets for electronic payments.

Our ability to expand into new industries and markets also depends upon our ability to adapt our existing technology or to develop new technologies to meet the particular needs of each new industry or market.

We may not have adequate financial or technological resources to develop effective and secure services or distribution channels that will satisfy the demands of these new industries or markets.

Penetrating these new industries or markets may also prove to be more challenging or costly or take longer than we may anticipate.

If we fail to expand into new and existing electronic payments industries and markets, we may not be able to continue to grow our revenues and earnings.

Our acquisitions subject us to a variety of risks that could harm our business.

We review and complete selective acquisition opportunities as part of our growth strategy.

There can be no assurances that we will be able to complete suitable acquisitions for a variety of reasons, including the identification of and competition for acquisition targets, the need for regulatory approvals, the inability of the parties to agree to the structure or purchase price of the transaction and our inability to finance the transaction on commercially acceptable terms.

In addition, any potential acquisition will subject us to a variety of other risks:

we may need to allocate substantial operational, financial and management resources in integrating new businesses, technologies and products, and management may encounter difficulties in integrating the operations, personnel or systems of the acquired businesses;

acquisitions may have a material adverse effect on our business relationships with existing or future merchants or distribution partners, in particular, to the extent we consummate acquisitions that increase our sales and distribution capabilities;

we may assume substantial actual or contingent liabilities, known and unknown;

acquisitions may not meet our expectations of future financial performance;

counter-parties to the acquisition transactions may fail to perform their obligations under the applicable acquisition related documents, and/or negligently or intentionally commit misrepresentations as to the condition of the acquired business, asset, or go-forward enterprise;

we may experience delays or reductions in realizing expected synergies or benefits;

we may incur substantial unanticipated costs or encounter other problems associated with acquired businesses or devote time and capital investigating a potential acquisition and not complete the transaction;

we may be unable to achieve our intended objectives for the transaction;

we may not be able to retain the key personnel, customers and suppliers of the acquired business.

Additionally, we may be unable to maintain uniform standards, controls, procedures and policies as we attempt to integrate the acquired businesses, and this may lead to operational inefficiencies.

These factors related to our acquisition strategy, among others, could have a material adverse effect on our business, financial condition and results of operations.

Potential changes in the competitive landscape, including disintermediation from other participants in the payments value chain, could harm our business.

We expect that the competitive landscape will continue to change, including the following developments:

rapid and significant changes in technology may result in technology-led marketing that is focused on business solutions rather than pricing, new and innovative payment methods and programs that could place us at a competitive disadvantage and reduce the use of our services;

competitors, distribution partners, and other industry participants may develop products that compete with or replace our value-added products and services;

participants in the financial services, payments and technology industries may merge, create joint ventures or form other business combinations that may strengthen their existing business services or create new payment services that compete with us;

new services and technologies that we develop may be impacted by industry-wide solutions and standards related to migration to EMV chip technology, tokenization or other security-related technologies.

Failure to compete effectively against any of these competitive threats could have a material adverse effect on our business, financial condition and results of operations.

We may not be able to successfully manage our intellectual property and may be subject to infringement claims.

We rely on a combination of contractual rights and copyright, trademark, patent and trade secret laws to establish and protect our proprietary technology.

Third parties may challenge, circumvent, infringe or misappropriate our intellectual property, or such intellectual property may not be sufficient to permit us to take advantage of current market trends or otherwise to provide competitive advantages, which could result in costly redesign efforts, discontinuance of service offerings or other competitive harm.

Others, including our competitors, may independently develop similar technology, duplicate our services or design around our intellectual property and, in such cases, we could not assert our intellectual property rights against such parties.

Further, our contractual arrangements may not effectively prevent disclosure of our confidential information or provide an adequate remedy in the event of unauthorized disclosure of our confidential information.

We may have to litigate to enforce or determine the scope and enforceability of our intellectual property rights and know-how, which is expensive, could cause a diversion of resources and may not prove successful.

Also, because of the rapid pace of technological change in our industry, aspects of our business and our services rely on technologies developed or licensed by third parties, and we may not be able to obtain or continue to obtain licenses and technologies from these third parties on reasonable terms or at all.

The loss of intellectual property protection or the inability to license or otherwise use third-party intellectual property could harm our business and ability to compete.

We may also be subject to costly litigation if our services and technology are alleged to infringe upon or otherwise violate a third-party's proprietary rights.

Third parties may have, or may eventually be issued, patents that could be infringed by our products, services or technology.

Any of these third parties could make a claim of infringement against us with respect to our products, services or technology.

We may also be subject to claims by third parties for patent, copyright or trademark infringement, breach of license or violation of other third-party intellectual property rights.

Any claim from third parties may result in a limitation on our ability to use the intellectual property subject to these claims.

Additionally, in recent years, individuals and groups have been purchasing intellectual property assets for the sole purpose of making claims of infringement or other violations and attempting to extract settlements from companies like ours.

Even if we believe that intellectual property related claims are without merit, defending against such claims is time consuming and expensive and could result in the diversion of the time and attention of our management and employees.

Claims of intellectual property infringement or violation also might require us to redesign affected products or services, enter into costly settlement or license agreements, pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling certain of our products or services.

Even if we have an agreement for indemnification against such costs, the indemnifying party, if any in such circumstances, may be unable to uphold our contractual obligations.

If we cannot or do not license the infringed technology on reasonable terms or substitute similar technology from another source, our revenue and earnings could be adversely impacted.

Acquisitions create certain risks and may adversely affect our business, financial condition, or results of operations.

We have actively acquired businesses and expect to continue to make acquisitions of businesses and assets in the future.

The acquisition and integration of businesses and assets involve a number of risks.

These risks include valuation (negotiating a fair price for the business and assets), integration (managing the process of integrating the acquired business’ people, products, technology, and other assets to realize the projected value and synergies), regulatory (obtaining any applicable regulatory or other government approvals), and due diligence (identifying risks to the prospects of the business, including undisclosed or unknown liabilities or restrictions).

inability of the parties to agree to the structure or purchase price of the transaction and our inability to finance the transaction on commercially acceptable terms.

In addition, any potential acquisition can subject us to a variety of other risks:

• If we are unable to successfully integrate the benefits plans, duties and responsibilities, and other factors of interest to management of employees of the acquired business, we could lose employees to our competitors in the region, which could significantly affect our ability to operate the business and complete the integration;

• If the integration process causes any delays with the delivery of our services, or the quality of those services, we could lose customers to our competitors;

• Any acquisition may otherwise cause disruption to the acquired company’s business and operations and relationships with financial institution sponsors, customers, merchants, employees and other partners;

• Any acquisition and the related integration could divert the attention of our management from other strategic matters including possible acquisitions and alliances and planning for new product development or expansion into new markets for payments technology and software solutions;

• The costs related to the integration of an acquired company’s business and operations into ours may be greater than anticipated.

We are subject to economic and political risk, the business cycles of our merchants and distribution partners and the overall level of consumer and commercial spending, which could negatively impact our business, financial condition and results of operations.

22 unchanged sentences

economy impacts our merchant accounts, regulatory changes increase the burden we face in operating our business, or disruptions in the credit markets prevent us from using debt to finance future acquisitions, our financial condition and results of operations may be materially and adversely impacted.

A substantial portion of all of our merchants are small- and medium-sized businesses, which may increase the impact of economic fluctuations and merchant attrition on it.

We market and sell our solutions primarily to SMB merchants.

SMB merchants are typically more susceptible to the adverse effects of economic fluctuations than larger businesses.

We experience attrition in merchants and merchant charge volume in the ordinary course of business resulting from several factors, including business closures, transfers of merchants' accounts to our competitors and account closures that we initiate due to heightened credit risks relating to, or contract breaches by, a merchant.

Adverse changes in the economic environment or business failures of our SMB merchants may have a greater impact on us than on our competitors who do not focus on SMB merchants to the extent that we do.

We cannot accurately predict the level of SMB merchant attrition in the future.

If we are unable to establish accounts with new merchants or otherwise increase our payment processing volume in order to counter the effect of this attrition, our revenues will decline.

Our systems and our third-party providers' systems may fail due to factors beyond our control, which could interrupt our service, resulting in our inability to process, cause us to lose business, increase our costs and expose us to liability.

There are factors that may be beyond our control that could affect our operations and business.

We depend on the efficient and uninterrupted operation of numerous systems, including our computer network systems, software, data centers and telecommunication networks, as well as the systems and services of our bank sponsors, the payment networks, third-party providers

of processing services and other third parties.

Our systems and operations or those of our third-party providers, such as our provider of dial-up authorization services, or the payment networks themselves, could be exposed to factors that may be beyond our or their control that could affect our or their operations and business.

Such factors include, among other things, fire, natural disasters and health emergencies, including earthquakes, fires, power outages, typhoons, floods, pandemics or epidemics such as the coronavirus, power loss, telecommunications failure, unauthorized entry, computer viruses, denial-of-service attacks, international conflicts, acts of terrorism, wars and civil unrest, human error or sabotage, financial insolvency, labor disruption, international trade disputes, critical infrastructure attacks and the conditions in the domestic and global economies, generally.

Any of these events, among others, could materially and adversely affect our financial condition and operating results.

For example, the coronavirus may impact the global economy or negatively affect various aspects of our business, including our workforce and demand for our services, which could impact our ability to deliver services to our customers and make it more difficult to meet our expectations and obligations.

Our property and business interruption insurance may not be adequate to compensate us for all losses or failures that may occur.

At present, our critical operational systems, such as our payment gateway, are fully redundant, while certain of our less critical systems are not.

Therefore, certain aspects of our operations may be subject to interruption.

Also, while we have disaster recovery policies and arrangements in place, they have not been tested under actual disasters or similar events.

Defects in our systems or those of third parties, errors or delays in the processing of payment transactions, telecommunications failures or other difficulties could result in failure to process transactions, additional operating and development costs, diversion of technical and other resources, loss of revenue, merchants and distribution partners, loss of merchant and cardholder data, harm to our business or reputation, exposure to fraud losses or other liabilities and fines and other sanctions imposed by payment networks.

We rely on other service and technology providers.

We rely on financial institutions and other service and technology providers.

If they fail or discontinue providing their services or technology generally or to us specifically, our ability to provide services to merchants may be interrupted, and, as a result, our business, financial condition and results of operations could be adversely impacted.

We rely on third parties to provide or supplement bankcard processing services and for infrastructure hosting services.

We rely on various financial institutions to provide clearing services in connection with our settlement activities.

If such financial institutions should stop providing clearing services, we must find other financial institutions to provide those services.

If we are unable to find a replacement financial institution, we may no longer be able to provide processing services to certain customers, which could negatively affect our revenues, earnings and cash flows.

We also rely on third parties to provide or supplement bankcard processing services and for infrastructure hosting services.

We also rely on third parties for specific software and hardware used in providing our products and services.

12 unchanged sentences

The risk of chargebacks is typically greater with those merchants that promise future delivery of goods and services rather than delivering goods or rendering services at the time of payment.

If we or our bank sponsors are unable to collect the chargeback from the merchant's account or reserve account (if applicable), or if the merchant refuses or is financially unable (due to bankruptcy or other reasons) to reimburse the merchant's bank for the chargeback,

we may bear the loss for the amount of the refund paid to the cardholder.

Any increase in chargebacks not paid by our merchants could increase our costs and decrease our revenues.

11 unchanged sentences

The termination of our registration, or any changes in the Visa or Mastercard rules that would impair our registration, could require us to stop providing Visa and Mastercard payment processing services, which would make it impossible for us to conduct our business on its current scale.

We rely on various financial institutions to provide clearing services in connection with our settlement activities.

If we are unable to maintain clearing services with these financial institutions and are unable to find a replacement, our business may be adversely affected.

We rely on various financial institutions to provide clearing services in connection with our settlement activities.

If such financial institutions should stop providing clearing services, we must find other financial institutions to provide those services.

Our risk management policies and procedures may not be fully effective in mitigating our risk exposure in all market environments or against all types of risks.

We operate in a rapidly changing industry.

Accordingly, our risk management policies and procedures may not be fully effective to identify, monitor, manage and remediate our risks.

Some of our risk evaluation methods depend upon information provided by others and public information regarding markets, merchants or other matters that are otherwise inaccessible by us.

In some cases, that information may not be accurate, complete or up-to-date.

Additionally, our risk detection system is subject to a high degree of "false positive" risks being detected, which makes it difficult for us to identify real risks in a timely manner.

If our policies and procedures are not fully effective or we are not always successful in capturing all risks to which we are or may be exposed, we may suffer harm to our reputation or be subject to litigation or regulatory actions that materially increase our costs and subject us to reputational damage that could limit our ability to grow and cause us to lose existing merchant clients.

Legal proceedings could have a material adverse effect on our business, financial condition or results of operations.

In the ordinary course of business, we may become involved in various litigation matters, including but not limited to commercial disputes and employee claims, and from time to time may be involved in governmental or regulatory investigations or similar matters arising out of our current or future business.

Any claims asserted against us, regardless of merit or eventual outcome, could harm our reputation and have an adverse impact on our relationship with our merchants, distribution partners and other third parties and could lead to additional related claims.

Certain claims may seek injunctive relief, which could disrupt the ordinary conduct of our business and operations or increase our cost of doing business.

Our insurance or indemnities may not cover all claims that

may be asserted against us, and any claims asserted against it, regardless of merit or eventual outcome, may harm our reputation and cause us to expend resources in our defense.

Furthermore, there is no guarantee that we will be successful in defending ourselves in future litigation.

Should the ultimate judgments or settlements in any pending litigation or future litigation or investigation significantly exceed our insurance coverage, they could have a material adverse effect on our business, financial condition and results of operations.

The loss of, for example, key personnel or of our ability to attract, recruit, retain and develop qualified employees could adversely affect our business, financial condition and results of operations.

5 unchanged sentences

The market for qualified personnel is competitive, and we may not succeed in recruiting additional personnel or may fail to effectively replace current personnel who depart with qualified or effective successors.

In addition, we rely heavily on several senior key directors and executive officers, including Mr.

Thomas Priore, who is our President, Chief Executive Officer and Chairman, who helped found Priority.

Our future success will continue to depend on the diligence, skill, network of business contacts and continued service of Thomas Priore, together with members of our senior management team.

We cannot assure you that unforeseen business, medical, personal or other circumstances would not lead any such individual to terminate his relationship with us.

The loss of Thomas Priore, or any of the members of our senior management team, could have a material adverse effect on our ability to achieve our growth strategy as well as on our future financial condition and results of operations.

Failure to retain or attract key personnel could impede our ability to grow and could result in our inability to operate our business profitably.

In addition, contractual obligations related to confidentiality, assignment of intellectual property rights, and non-solicitation may be ineffective or unenforceable and departing employees may share our proprietary information with competitors in ways that could adversely impact us or seek to solicit our distribution partners or merchants or recruit our key personnel to competing businesses.

Legal, Regulatory Compliance and Tax Risks

Legal proceedings could have a material adverse effect on our business, financial condition or results of operations.

Certain claims may seek injunctive relief, which could disrupt the ordinary conduct of our business and operations or increase our cost of doing business.

Our insurance or indemnities may not cover all claims that may be asserted against us, and any claims asserted against it, regardless of merit or eventual outcome, may harm our reputation and cause us to expend resources in our defense.

Furthermore, there is no guarantee that we will be successful in defending ourselves in future litigation.

Our business is affected by laws and regulations and examinations that affect us and our industries., Regulation and proposed regulation of the payments industry has increased significantly in recent years.

Failure to comply with regulations or guidelines may result in the suspension or revocation of a license or registration, the limitation, suspension or termination of service, and

the imposition of civil and criminal penalties, including fines, or may cause customers or potential customers to be reluctant to do business with us, any of which could have an adverse effect on our financial condition.

Interchange fees are subject to intense legal, regulatory, and legislative scrutiny.

In particular, the Dodd-Frank Act limits the amount of debit card fees charged by certain issuers, allowing merchants to set minimum dollar amounts for the acceptance of credit cards and allowing merchants to offer discounts or other incentives for different payment methods.

These types of restrictions could negatively affect the number of debit transactions, which would adversely affect our business.

The Dodd-Frank Act also created the CFPB, which has assumed responsibility for enforcing federal consumer protection laws, and the FSOC, which has the authority to determine whether any non-bank financial company, which may include us within the definitional scope, should be supervised by the Federal Reserve because it is systemically important to the United States financial system.

We and many of our merchants may be subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices.

Various federal and state regulatory enforcement agencies, including the Federal Trade Commission and state attorneys general, have authority to take action against non-banks that engage in unfair or deceptive practices or violate other laws, rules and regulations and to the extent we are processing payments or providing services for a merchant that may be in violation of laws, rules and regulations, we may be subject to enforcement actions and as a result may incur losses and liabilities that may impact our business.

We could be liable if our practices under the FCRA are not in compliance with the FCRA or regulations under it.

Transactions that are reportable pursuant to these rules are subject to backup withholding requirements.

We could be liable for penalties if our information returns do not comply with these regulations.

Implementing new compliance efforts may be difficult because of the complexity of new regulatory requirements and may cause us to devote significant resources to ensure compliance.

In addition, even an inadvertent failure to comply with laws and regulations, as well as rapidly evolving social expectations of corporate fairness, could damage our business or our reputation.

We may not be able to successfully manage our intellectual property and may be subject to infringement claims.

We rely on a combination of contractual rights and copyright, trademark, patent and trade secret laws to establish and protect our proprietary technology.

We may have to litigate to enforce or

determine the scope and enforceability of our intellectual property rights and know-how, which is expensive, could cause a diversion of resources and may not prove successful.