What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-03-03 compared with 2024-02-29 · 130 added, 112 removed, 833 unchanged (23% of the section changed)

7 unchanged sentences

Realtime Electronic Payments (“REPAY LLC”), in 2006 by current executives John Morris and Shaler Alias.

Hawk Parent was formed in 2016 in connection with the acquisition of a majority interest in the successor entity of REPAY LLC and its subsidiaries by certain investment funds sponsored by, or affiliated with, Corsair Capital LLC (“Corsair”).

Business Overview

3 unchanged sentences

We are a payments innovator, differentiated by our proprietary, integrated payment technology platform and our ability to reduce the complexity of electronic payments for businesses.

We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our clients’ needs, our deep knowledge of our vertical markets and the embedded nature of our integrated payment solutions will drive strong growth by attracting new clients and fostering long-term client relationships.

Since a significant portion of our revenue is derived from volume-based payment processing fees, card payment volume is a key operating metric that we use to evaluate our business.

We processed approximately $25.7 billion of total card payment volume in 2023.

Our top 10 clients, with an average tenure of approximately seven years, contributed approximately 18% and 15% of total gross profit during the year ended December 31, 2023 and the year ended December 31, 2022, respectively.

Our leading competitive position and differentiated solutions have enabled us to realize unique advantages in fast-growing and strategically important segments of the payments market.

We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our clients’ needs, our deep knowledge of our vertical markets and the embedded nature of our integrated payment solutions will drive solid growth by attracting new clients and fostering long-term client relationships.

Our top 10 clients, with an average tenure of approximately seven years, contributed approximately 20% and 18% of total gross profit during the year ended December 31, 2024 and 2023, respectively.

Our leading competitive position and differentiated solutions have enabled us to realize unique advantages in growing and strategically important segments of the payments market.

We provide payment processing solutions to clients primarily operating in the personal loans, automotive loans, receivables management, and business-to-business verticals.

4 unchanged sentences

Our receivables management vertical relates to consumer loan collections, which typically enter the receivables management process due to delinquency on credit card bills or as a result of major life events, such as job loss or major medical issues.

The business-to-business vertical relates to transactions occurring between a wide variety of enterprise clients, many of which operate in the automotive, field services, healthcare, homeowner association (“HOA”) management and hospitality industries, as well as educational institutions and governments and municipalities.

The business-to-business vertical relates to transactions occurring between a wide variety of enterprise clients, many of which operate in the automotive, field services, healthcare, homeowner association (“HOA”) management, hospitality and media industries, as well as educational institutions and governments and municipalities.

Our go-to-market strategy combines direct sales with integrations with key software providers in our target verticals.

systems, allows us to embed our omni-channel payment processing technology into our clients’ critical workflow software and ensure seamless operation of our solutions within our clients’ enterprise management systems.

We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system.

The integration of our technology with key software providers in the verticals that we serve, including loan management systems, dealer management systems (“DMS”), collection management systems, and enterprise resource planning software systems, allows us to embed our omni-channel payment processing technology into our clients’ critical workflow software and ensure seamless operation of our solutions within our clients’ enterprise management systems.

We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities

or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system.

We have successfully integrated our technology solutions with numerous, widely-used enterprise management systems in the verticals that we serve, which makes our platform a more compelling choice for the businesses that use them.

7 unchanged sentences

Our Consumer Payments segment provides payment processing solutions (including debit and credit card processing, Automated Clearing House (“ACH”) processing and other electronic payment acceptance solutions, as well as our loan disbursement product) that enable our clients to collect payments and disburse funds to consumers and includes our clearing and settlement solutions (“RCS”) offering.

RCS is our proprietary clearing and settlement platform through which we market customizable payment processing programs to other ISOs and payment facilitators.

RCS is our proprietary clearing and settlement platform through which we market customizable payment processing programs to other independent sales organization (“ISOs”) and payment facilitators.

The strategic vertical markets served by our Consumer Payments segment primarily include personal loans, automotive loans, receivables management, credit unions, mortgage servicing, consumer healthcare and diversified retail.

Our Consumer Payments segment also previously included our Blue Cow Software business (“BCS”), which was sold on February 15, 2023.

Our Consumer Payments segment represented approximately 83% of our total revenue after any intersegment eliminations for the year ended December 31, 2024.

1 unchanged sentence

Our Business Payments segment provides payment processing solutions (including accounts payable automation, debit and credit card processing, virtual credit card processing, ACH processing and other electronic payment acceptance solutions) that enable our clients to collect or send payments to other businesses.

The strategic vertical markets served within our Business Payments segment primarily include retail automotive, education, field services, governments and municipalities, healthcare, HOA management and hospitality.

Our Business Payments segment represented approximately 17% of our total revenue after any intersegment eliminations for the year ended December 31, 2024.

2 unchanged sentences

Increase Penetration in Existing Verticals

We expect to grow meaningfully by continuing to provide innovative payment solutions and client support to our existing clients as well as new clients in the verticals that we currently serve.

We expect to grow by continuing to provide innovative payment solutions and client support to our existing clients as well as new clients in the verticals that we currently serve.

For new clients, we intend to continue to focus a significant portion of our sales efforts on large enterprise clients.

58 unchanged sentences

We have developed proprietary onboarding, compliance, and client oversight processes, of which our Compliance Management System (“CMS”) is a part.

Our CMS, developed in conjunction with the Third Party Payment Processors Association, focuses on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.

Our CMS, developed in conjunction

with the Third Party Payment Processors Association, focuses on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.

Client Onboarding .

20 unchanged sentences

If the client incurring the chargeback is unable to fund the refund to the card-issuing bank, we are required to do so by the rules of the payment networks and our contractual arrangements with our sponsor banks.

During the year ended December 31, 2023, we believe our chargeback rate was under 1% of our payment volume.

During the year ended December 31, 2024, our chargeback rate was under 1% of our payment volume.

Security, Disaster Recovery, and Back-up Systems

7 unchanged sentences

Additionally, we have a dedicated team responsible for continuous monitoring and security incident response.

This team also develops, maintains, tests and verifies our incident

response plan.

This team also develops, maintains, tests and verifies our incident response plan.

Disaster recovery is built into our primary payment gateway through redundant hardware and software applications hosted in two distinct cloud regions.

22 unchanged sentences

Bancorp), Wells Fargo Merchant Services, Global Payments, WorldPay and Fiserv.

In our Business Payments segment, our primary competitors include AvidXchange, Edenred Pay (a division of Edenred), Corpay (a division of FleetCor Technologies), Paya (a division of Nuvei Corporation) and Fortis.

In our Business Payments segment, our primary competitors include AvidXchange, Edenred Pay (a division of Edenred), Corpay, Paya (a division of Nuvei Corporation) and Fortis.

We believe the most significant competitive factors in the markets in which we compete are:

7 unchanged sentences

Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment.

the COVID-19 pandemic and the resulting changes in consumer behavior has led to an accelerated shift to electronic payments.

In addition, the COVID-19 pandemic and the resulting changes in consumer behavior has led to an accelerated shift to electronic payments.

We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.

We have experienced in the past, and may continue to experience, seasonal fluctuations in our volumes and revenues as a result of consumer spending patterns.

Volumes and revenues during the first quarter of the calendar year tend to increase in comparison to the remaining three quarters of the calendar year on a same store basis.

We have experienced in the past, and may continue to experience, seasonal fluctuations in our revenues as a result of consumer spending patterns.

Revenues during the first quarter of the calendar year tend to increase in comparison to the

remaining three quarters of the calendar year on a same store basis.

This increase is due to consumers’ receipt of tax refunds and the increases in repayment activity levels that follow.

We have also experienced in the past, and may continue to experience, cyclical fluctuations in our revenues as a result of our clients that focus on political advertising within our media vertical.

Revenues from these clients is cyclical because it is connected to U.S.

election advertising spending which tends to increase significantly during periods which include congressional mid-term elections and presidential elections.

Our historical acquisition activity has allowed us to access new markets, expand our presence in existing markets, acquire industry talent, broaden our product suite, and supplement organic growth.

56 unchanged sentences

As a result of the Dodd-Frank Act, merchants are also allowed to set minimum dollar amounts (within certain parameters) for the acceptance of a credit card, and they are allowed to provide discounts or incentives to entice consumers to pay with an alternative payment method, such as cash, checks or debit cards.

The Dodd-Frank Act also created the Consumer Financial Protection Bureau (the “CFPB”), which has rulemaking authority over consumer protection laws, including the authority to regulate consumer financial products in the United States, including consumer credit, deposit, payment, and similar products.

The Dodd-Frank Act also created the Consumer Financial Protection Bureau (the “CFPB”), which was vested with rulemaking authority over consumer protection laws, including the authority to regulate consumer financial products in the United States, including consumer credit, deposit, payment, and similar products.

The CFPB may also have authority over us as a provider of services to regulated financial institutions in connection with consumer financial products.

Any new rules or regulations implemented by the CFPB, and other similar regulatory agencies in other jurisdictions, or pursuant to the Dodd-Frank Act that

are applicable to us or our clients’ businesses, or any adverse changes thereto, could increase our cost of doing business or limit our current offerings of integrated payment solutions.

Any new rules or regulations implemented by the CFPB, and other similar regulatory agencies in other jurisdictions, or pursuant to the Dodd-Frank Act that are applicable to us or our clients’ businesses, or any adverse changes thereto, could increase our cost of doing business or limit our current offerings of integrated payment solutions.

For example, the CFPB announced in June 2024 that the “Small Dollar Lending Rule” will become effective on March 30, 2025, though current uncertainty about the CFPB’s funding and activity may impact its implementation.

This rule generally prohibits certain lenders from attempting to withdraw

money from a borrower’s account after two consecutive failed attempts and requires certain lenders to provide specific written notice to consumers before making certain payment attempts.

Privacy and Information Security Regulations

7 unchanged sentences

In addition, various states have recently enacted laws concerning privacy, data protection and information security.

For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect on January 1, 2020 and was amended by the California Privacy Rights Act of 2020 (the “CRPA”), for which most provisions were effective on January 1, 2023, requires companies that process personal information of California residents to make certain disclosures to consumers about data practices, grants consumers specific access rights to their data, allows consumers to opt out of certain data sharing activities and creates a private right of action for data breaches.

The CPRA also establishes a privacy enforcement agency known as the California Privacy Protection Agency.

At least 12 other states have enacted similar laws and regulations, and other states are expected to enact new similar laws and regulations in the near future.

These laws commonly require businesses to disclose their data collection and usage practices, provide consumers with access to their personal data, and offer mechanisms to limit certain data processing activities.

Additionally, many of these laws impose obligations for safeguarding personal information and establish enforcement mechanisms, including penalties for non-compliance.

As state regulations vary and are frequently updated, we are required to continually monitor and adapt to these legal requirements to ensure compliance across the jurisdictions in which we operate.

Health Insurance Portability and Accountability Act & Health Information Technology for Economic and Clinical Health Act

13 unchanged sentences

We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws similar in scope and subject matter thereto.

investigations, fees, fines and disgorgement of funds if we are deemed to have aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

Various federal and state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations.

In addition, laws prohibiting these activities and other laws, rules and or regulations, including the Telemarketing Sales Rule, may directly impact the activities of certain of our clients, and in some cases may subject us, as the client’s payment processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we are deemed to have aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

Various federal and

state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations.

To the extent we are processing payments or providing services for a client suspected of violating such laws, rules and regulations, we may face enforcement actions and, as a result, incur losses and liabilities that may adversely affect our business.

In addition, the Dodd-Frank Act gave the CFPB broad authority to prohibit “unfair, deceptive or abusive acts or practices” (“UDAAP”) in connection with the provision of consumer financial products and services.

The CFPB has extended certain UDAAP-related provisions of the Dodd-Frank Act to directly apply to payment processors.

The CFPB has previously extended certain UDAAP-related provisions of the Dodd-Frank Act to directly apply to payment processors.

Indirect Regulatory Requirements

20 unchanged sentences

In order for us to process and settle transactions for our clients, we have entered into sponsorship agreements with banks that are members of the payment networks.

We are required to register with the payment networks through these bank

partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks’ rules and standards governing access to those networks.

Our bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions.

We are required to register with the payment networks through these bank partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks’ rules and standards governing access to those networks.

Our bank partners sponsor our adherence to the rules and standards of the

payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions.

Payment network rules restrict us from performing funds settlement and require that merchant settlement funds be in the possession of the member bank until the merchant is funded.

9 unchanged sentences

Reportable transactions are also subject to backup withholding requirements.

We are also subject to the Telephone Consumer Protection Act (“TCPA”) and various state laws to the extent we place telephone calls and text messages to or on behalf of our customers.

The TCPA imposes restrictions on, among other things, the use of automated telephone dialing systems, prerecorded voice messages and unsolicited faxes.

The foregoing is not an exhaustive list of the laws and regulations to which we are subject and the regulatory framework governing our business is changing continuously.

10 unchanged sentences

As of December 31, 2024, we employed approximately 465 full-time employees throughout the U.S.

We have 7 office locations with an employee presence and have a remote employee presence in 33 states.

We have 5 office locations with an employee presence and have a remote employee presence throughout the U.S.

None of our employees are represented by a labor union or covered by a collective bargaining agreement.

1 unchanged sentence

Our strong emphasis on culture is intended to empower our employees to make decisions and develop themselves personally and professionally.

One of our priorities is to maintain and enhance our culture as we grow and integrate new team members.

One of our priorities is to maintain and enhance our culture as we grow and bring on new team members.

We participate in an annual employee engagement and feedback survey which allows all full-time employees to anonymously give us feedback on our workplace culture, employee programs, and more.

In 2024, 82% of participants responded that REPAY is a great place to work.

Our employees’ feedback from the annual surveys have allowed us to be

certified as a Great Place to Work® for the last seven consecutive years.

Our employees’ feedback from the annual surveys have allowed us to be certified as a Great Place to Work® for the last eight consecutive years.

We take employee feedback seriously and share the results of the survey, along with an action plan of how we can continue to improve, with all employees.

3 unchanged sentences

New employees are welcomed through our new hire onboarding experience, which consists of a comprehensive equipment package, welcome gift packages, an onboarding plan with consistent communication, human resources orientation, and formalized 30-60-90 day check-ins with their manager, ensures our new hires have the support they need.

Additionally, new hire spotlights are socialized in our monthly newsletters to ensure new team members are introduced to the Company and receive a warm welcome and every one of our new employees has the opportunity to meet with our CEO for a “coffee chat” within their first month of employment.

Additionally, new hire spotlights are socialized in companywide channels to ensure new team members are introduced to the Company and receive a warm welcome and every one of our new employees has the opportunity to meet with our CEO for a “coffee chat” within their first month of employment.

REPAY’s leadership empowers each team member to make a difference and stretch to their fullest potential.

2 unchanged sentences

We also believe it is important to celebrate exceptional employees so we provide multiple opportunities for performance-based awards and peer-to-peer recognition.

We value diverse backgrounds, perspectives and experiences, and we are committed to providing an inclusive environment where all individuals are respected.

We continue to develop formal career pathing, allowing us to create a roadmap for an individual’s career progression within the organization.

3 unchanged sentences

Throughout the year, we provide multiple ways for team members to volunteer and positively impact the surrounding communities.

We value diverse backgrounds, perspectives and experiences, and we are committed to providing an inclusive environment where all individuals are heard and respected.

We maintain an Employee Resource Group aimed at connecting and creating a network for women at REPAY.

This group meets several times throughout the year to discuss relevant topics and connect with others at the Company.

We have also partnered with diverse organizations and higher education programs to identify a more diverse pool of qualified candidates for recruitment.

Our diversity and inclusion initiatives are periodically reviewed and discussed at the board level.

We offer a comprehensive benefits package, which goes into effect on a person’s first day of employment, including 100% coverage of employee healthcare premiums and several benefits at no cost to our employees, including life insurance, telehealth, mental health and work-life balance resources.

We offer a comprehensive benefits package, which goes into effect on a person’s first day of employment, including 100% coverage of employee healthcare premiums and several benefits at no cost to our employees, including health insurance, life insurance, short-term disability insurance, telehealth, mental health and work-life balance resources.

We perform a thorough review of our benefits package annually.

80 unchanged sentences

If consumers and businesses in our primary vertical markets do not increase their use of cards as payment methods for their transactions or if the mix of payment methods changes in a way that is adverse to us, such developments may have a material adverse effect on our business, financial condition and results of operations.

Regulatory changes may also result in our clients seeking to charge their own clients additional fees for use of credit or debit cards which may result in such clients using other payment methods.

Additionally, in recent years, increased incidents of security breaches have caused some consumers to lose confidence in the ability of businesses to protect their information, causing certain consumers to discontinue use of electronic payment methods.

Security breaches could result in financial institutions canceling large numbers of credit and debit cards, or consumers or businesses electing to cancel their cards following such incidents.

Industry consolidation within our vertical markets can adversely affect our growth or results.

Our focus on specific vertical markets exposes us to various risks associated with changes or disruptions within these sectors.

For example, the consolidation or merger of businesses within the vertical markets we primarily serve reduces the number of potential clients and may limit our market opportunities.

If key clients in these vertical markets merge or consolidate at an accelerated pace, we may face a decrease in demand, loss of business relationships or pricing pressures.

These events may have a material and adverse impact on our results of operations.

Potential clients or software integration partners may be reluctant to switch to, or develop a relationship with, a new payment processor, which may adversely affect our growth.

4 unchanged sentences

As part of our sales efforts, we invest considerable time and expense evaluating the specific organizational needs of potential clients and educating these potential clients about the technical capabilities and value of our solutions.

Because large enterprises tend to have more consumers impacted by a change in payment processing providers, they often evaluate our solutions and our technology platform at multiple levels within their organization, each of which often have specific requirements, and typically involve their senior management.

Large enterprises often have more consumers impacted by a change in payment processing providers, which leads these potential clients to evaluate our solutions and our technology platform at multiple levels within their organization.

These evaluations often involve their senior management and require specific and stringent requirements.

In connection with these evaluations, large enterprise clients may demand that we implement enhanced cybersecurity measures, privacy protocols or other compliance initiatives tailored to their needs or their industry regulations, which could increase our costs.

As a result, our sales efforts to large enterprises span over considerable time and require greater expense with long and unpredictable sales cycles, which may cause our results of operations to fluctuate.

6 unchanged sentences

To provide our merchant acquiring services, we are registered through our sponsor banks with the Visa and MasterCard networks as a service provider for member institutions.

As such, we, our sponsor banks and many of our

clients are subject to complex and evolving payment network rules.

The payment networks routinely update and modify requirements applicable to merchant acquirers, including rules regulating data integrity, third-party relationships (such as those with respect to sponsor banks and independent sales organization (“ISOs”)), merchant chargeback standards and PCI DSS.

As such, we, our sponsor banks and many of our clients are subject to complex and evolving payment network rules.

The rules of the card networks are set by their boards, which may be influenced by card issuers, some of which offer competing transaction processing services.

38 unchanged sentences

In a fraudulent card-not-present transaction, even if the merchant receives authorization for the transaction, the merchant may be liable for any loss arising from the transaction.

In addition, consumers may dispute repayments on a loan by claiming it was unlawful under applicable law.

In addition, consumers may dispute repayments on a loan or other obligation by claiming it was unlawful under applicable law.

Business fraud occurs when a business or organization, rather than a cardholder, opens a fraudulent merchant account and conducts fraudulent transactions or when a business, rather than a consumer (though sometimes working together with a consumer engaged in fraudulent activities), knowingly uses a stolen or counterfeit card or card number to record a false sales transaction, intentionally fails to deliver the merchandise or services sold in an otherwise valid transaction, or provides services in violation of applicable law.

6 unchanged sentences

We have established systems and procedures to detect and reduce the impact of business fraud, but these measures may not be effective, and incidents of fraud could increase in the future.

During the year ended December 31, 2023, we believe our chargeback rate was less than 1% of payment volume.

During the year ended December 31, 2024, our chargeback rate was less than 1% of payment volume.

Any increase in chargebacks not paid by our clients could have a material adverse effect on our business, financial condition and results of operations.

44 unchanged sentences

We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits, including natural disasters and health emergencies, including earthquakes, fires, power outages, typhoons, floods, pandemics or epidemics (such as the COVID-19 pandemic) and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars and critical infrastructure attacks.

A sustained deterioration in general economic conditions, particularly in the United States, continued uncertainty for an extended period of time, persistent inflation or further increases in interest rates, could adversely affect our financial performance by reducing the number or aggregate volume of transactions made using electronic payments.

Our consumer finance and mortgage clients may be disproportionately impacted by further increased interest rates or a general economic downturn, which could result in a decrease to our revenue and profits.

A sustained deterioration in general economic conditions, particularly in the United States, continued uncertainty for an extended period of time, persistent inflation or increases in interest rates, could adversely affect our financial performance by reducing the number or aggregate volume of transactions made using electronic payments.

Our consumer finance and mortgage clients may be disproportionately impacted by increased interest rates or a general economic downturn, which could result in a decrease to our revenue and profits.

If our consumer finance or mortgage clients make fewer or smaller loans (or their borrowers fail to make required payments), or consumers and businesses spend less money through electronic payments, we will have fewer transactions to process at lower dollar amounts, resulting in lower revenue.

Smaller tax refunds to consumers, due to the absence of additional stimulus or similar impacts or otherwise, could also negatively impact our results of operations.

and international markets are experiencing uncertain and volatile economic conditions, including from the impacts of sustained inflation, recession concerns and supply chain disruptions.

and international markets are continuing to experience uncertain and volatile economic conditions, including from the impacts of sustained inflation, recession concerns and threat of increased tariffs or other protectionist trade policies.

These conditions make it extremely difficult for us to accurately forecast and plan future business activities.

8 unchanged sentences

If our policies and procedures are not fully effective or we are not always successful in capturing all risks to which we are or may be exposed, we may suffer harm to our reputation or be subject to litigation or regulatory actions that materially increase our costs and limit our ability to grow and may cause us to lose existing clients.

Certain payment funding methods expose us to the credit and/or operating risk of our clients.

When we process certain types of transactions (including ACH payments and our Instant Funding solutions) for certain clients, we occasionally transfer funds from our settlement account to the intended destination account before we receive funds from a client’s source account.

The vast majority of these occurrences are resolved quickly through normal processes.

However, if they are not resolved and we are then unable to reverse the transaction that sent funds to the intended destination, a shortfall in our settlement account will be created.

Although we have legal recourse against our clients for the amount of the shortfall, timing of recovery may be delayed by litigation or the amount of any recovery may be less than the shortfall.

In either case, we would have to fund the shortfall in our settlement account from our corporate funds.

We may not be able to continue to expand our share in our existing vertical markets or continue to expand into new vertical markets, which would inhibit our ability to grow and increase our profitability.

16 unchanged sentences

The loss of intellectual property protection or the inability to license or otherwise use third-party intellectual property could harm our business and ability to compete.

We regularly engage third parties for offshore development activities, which may heighten all of the risks noted above.

We are also subject to costly litigation if our services and technology are alleged to infringe upon or otherwise violate a third party’s proprietary rights.

2 unchanged sentences

Any claim from third parties may result in a limitation on our ability to use the intellectual property subject to these claims.

Additionally, in recent years, individuals and groups have been purchasing intellectual property assets for the sole purpose of making claims of infringement or other violations and attempting to extract settlements from companies like us.

from companies like us.

Even if we believe that intellectual property related claims are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees.

21 unchanged sentences

Any judgments or settlements in any pending or future claims, litigation or investigations could have a material adverse effect on our business, financial condition and results of operations.

We may not be able to successfully execute our strategy of growth through acquisitions.

A significant part of our growth strategy is to enter into new vertical markets through platform acquisitions of vertically-focused integrated payment and software solutions providers, to expand within our existing vertical markets through selective tuck-in acquisitions and to otherwise increase our presence in the payments processing market.

We may not be able to successfully execute our growth strategies.

If we are unable to execute on our growth strategies, our business, financial condition and results of operations may be adversely affected.

An important part of our growth strategy is to enter into new vertical markets through platform acquisitions of vertically-focused integrated payment and software solutions providers, to expand within our existing vertical markets through selective tuck-in acquisitions and to otherwise increase our presence in the payments processing market.

However, we have not completed an acquisition in over three years.

Although we expect to continue to execute our acquisition strategy:

6 unchanged sentences

• we may not be able to generate cash necessary to execute our acquisition strategy.

The occurrence of any of these factors could adversely affect our growth strategy.

The occurrence of any of these factors could continue to adversely affect our growth strategy.

Our acquisitions subject us to a variety of risks that could harm our business and the anticipated benefits from our acquisitions may not be realized on the expected timeline or at all.

17 unchanged sentences

In addition, our clients include credit unions, banks and non-bank lenders who utilize our payment technology solutions in exchange for processing fees.

Since March 2023, Silicon Valley Bank, Signature Bank and First Republic Bank were each closed by their applicable regulators and the FDIC was appointed as receiver.

We did not use Silicon Valley Bank, Signature Bank or First Republic Bank for any of our depository or investment accounts nor did we have any payment processing relationships with these particular financial institutions.

However, we cannot guarantee that there will not be similar issues with any of the financial institutions with whom we maintain relationships.

We do not believe we have been materially and adversely impacted by the financial institution failures that began with the closure of Silicon Valley Bank in March 2023.

While we continue to monitor developments in the banking sector, we cannot guarantee that there will not be similar issues with any of the financial institutions with whom we maintain relationships.

The failure of or any other adverse development impacting one or more of our financial institution relationships (or rumors or concerns about such events) could adversely affect our liquidity, our ability to process transactions for our clients or our client relationships.

Similarly, our clients could be adversely affected by any bank failure or other adverse event involving

their financial institution relationships, which could result in a decrease in the amount of payment volume we receive from these clients.

Similarly, our clients could be adversely affected by any bank failure or other adverse event involving their financial institution relationships, which could result in a decrease in the amount of payment volume we receive from these clients.

Risks Related to Regulation

14 unchanged sentences

Many of our clients desire to impose a convenience fee or a surcharge in connection with their customers’ use of a credit or debit card or other form of electronic payment.

Various state laws and regulations impose prohibitions or other limitations on those types of fees or charges, and interpretation of those state laws and regulations is constantly evolving.

State laws and regulations (as well as any related modifications or changes in interpretation in the payment network rules related to those fees and costs) could negatively the willingness of some of our clients to accept credit or debit card or other electronic payment or result in less favorable terms to us in exchange for our clients to absorb those fees and costs, all of which would negatively affect our business.

Recent federal actions aimed at addressing so-called “junk fees” have heightened regulatory scrutiny in this area, further complicating compliance with various state laws and regulations that impose prohibitions or other limitations on those types of fees or charges.

The interpretation of these laws and regulations, as well as evolving payment network rules, continue to change, which can create uncertainty.

These developments could negatively affect the willingness of some of our clients to accept credit or debit card or other electronic payment or result in less favorable terms to us in exchange for our clients to absorb those fees and costs, all of which would negatively affect our business.

Laws and regulations, even if not directed at us, may require us to take significant efforts to change our services and solutions and may require that we incur additional compliance costs and change how we price our products and services to our clients and software integration partners.

2 unchanged sentences

In addition, even an inadvertent failure to comply with laws and regulations or evolving public perceptions of our business could damage our business or our reputation.

Depending on how our products and services evolve, we may be subject to a variety of additional laws and regulations, including those governing money transmission, gift cards and other prepaid access instruments, electronic funds transfers, anti-money laundering, counter-terrorist financing, restrictions on foreign assets, gambling, banking and lending, and import and export restrictions.

anti-money laundering, counter-terrorist financing, restrictions on foreign assets, banking and lending, and import and export restrictions.

Our efforts to comply with these laws and regulations could be costly and result in diversion of management time and effort and may still not guarantee compliance.

In addition, to the extent we decide to offer our products and services in additional jurisdictions (for example, our expansion into Canada), we may incur additional compliance-related costs with respect to operating in such jurisdictions.

required to further revise or expand our compliance management system, including the procedures we use to verify the identity of our clients and their end customers and to monitor transactions.

Additionally, as our products and services evolve, and as regulators continue to increase their scrutiny of compliance with these obligations, we may be subject to a variety of additional laws and regulations, or we may be required to further revise or expand our compliance management system, including the procedures we use to verify the identity of our clients and their end customers and to monitor transactions.

If we are found to be in violation of any such legal or regulatory requirements, we may be subject to monetary fines or other penalties, such as a cease and desist order, or we may be required to alter the nature or packaging of our services and solutions, any of which could adversely affect our business or operating results.

2 unchanged sentences

The regulatory environment that these clients operate in is very complex because applicable regulations are often enacted by multiple agencies in the state and federal governments.

For example, the CFPB previously proposed new rules applicable to such loans that could have an adverse effect on our clients’ businesses, and numerous state laws impose similar requirements.

Such clients are also subject to negative public perceptions that their consumer lending activities constitute predatory or abusive lending to consumers, and concerns raised by consumer advocacy groups and government officials may lead to efforts to further regulate the industry in which many of our clients operate.

Similarly, our clients in the receivables management industry are typically subject to federal and state rules and regulations that establish specific requirements and procedures that debt collectors must follow when collecting consumer accounts.

The CFPB and the FTC devote substantial attention to debt collection activities, and, as a result, the CFPB and the FTC have brought multiple investigations and enforcement actions against debt collectors for violations of the FDCPA and other applicable laws.

The CFPB and the FTC have devoted substantial attention to debt collection activities, and, as a result, the CFPB and the FTC have brought multiple investigations and enforcement actions against debt collectors for violations of the FDCPA and other applicable laws.

Continued regulatory scrutiny by the CFPB and the FTC over debt collection practices may result in additional investigations and enforcement actions against our clients in the receivables management industry.

The FDCPA also provides for private rights of action against debt collectors, and permits debtors to recover actual damages, statutory damages and attorneys’ fees and costs for violations of its terms.

The combination of these factors, and in particular any changes implemented at the CFPB under the Biden administration, could materially adversely affect the business of our clients and may force our consumer lender or receivables management clients to change their business models.

The combination of these factors could materially adversely affect the business of our clients and may force our consumer lender or receivables management clients to change their business models.

As a result, we may need to be nimble and quickly respond to the evolving needs of the vertical markets that we serve.

7 unchanged sentences

We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws that are similar in scope and subject matter.

In addition, provisions of the Dodd-Frank Act that prohibit unfair, deceptive or abusive acts or practices, the Telemarketing Sales Act and other laws, rules and/or regulations, may directly impact the activities of certain of our clients, and in some cases may subject us, as the electronic payment processor or provider of payment settlement services, to investigations, fees, fines and disgorgement of funds if we are found to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

payment processor or provider of payment settlement services, to investigations, fees, fines and disgorgement of funds if we are found to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

Various federal and state regulatory enforcement agencies, including the FTC and state attorneys general have authority to take action against non-banks that engage in UDAAP, or violate other laws, rules and regulations.

To the extent we are processing payments or providing products and services for a client suspected of

violating such laws, rules and regulations, we may face enforcement actions and incur losses and liabilities that may adversely affect our business.

To the extent we are processing payments or providing products and services for a client suspected of violating such laws, rules and regulations, we may face enforcement actions and incur losses and liabilities that may adversely affect our business.

Governmental regulations designed to protect or limit access to or use of consumer information could adversely affect our ability to effectively provide our products and services.

23 unchanged sentences

If we cannot provide reliable financial reports or prevent fraud, our reputation and operating results would be harmed.

As part of our ongoing monitoring of internal control, we have discovered in the past and may discover in the future material weaknesses or significant deficiencies in internal control that require remediation.

As part of our ongoing monitoring of internal control, we have discovered

in the past and may discover in the future material weaknesses or significant deficiencies in internal control that require remediation.

A “material weakness” is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

6 unchanged sentences

Our level of indebtedness could adversely affect our ability to meet our obligations under our indebtedness, react to changes in the economy or our industry and to raise additional capital to fund operations.

On December 29, 2021, we increased our existing senior secured credit facilities to a $185.0 million revolving credit facility pursuant to an amendment to the revolving credit agreement with Truist Bank and certain other lenders (as amended, the “Amended Credit Agreement”).

On July 10, 2024, we increased our existing senior secured credit facilities to a $250.0 million revolving credit facility pursuant to an amendment to the revolving credit agreement with Truist Bank and certain other lenders (the “Second Amended Credit Agreement”).

On January 19, 2021, we issued $440.0 million in aggregate principal amount of our 0.00% convertible senior notes due 2026 (the “2026 Notes”).

Our ability to service our obligations under our indebtedness, including the 2026 Notes and any indebtedness we may incur under the Amended Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

On July 8, 2024, we repurchased $220.0 million of the 2026 Notes.

Additionally, on July 8, 2024, we issued $287.5 million in aggregate principal amount of our 2.875% convertible senior notes due 2029 (the “2029 Notes”).

Our ability to service our obligations under our indebtedness, including the 2026 Notes, the 2029 Notes and any indebtedness we may incur under the Second Amended Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

If we are unable to generate the necessary cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive.

3 unchanged sentences

Future operating flexibility is limited by the restrictive covenants in the Amended Credit Agreement, and we may be unable to comply with all covenants in the future.

The Amended Credit Agreement imposes restrictions that could impede our ability to enter into certain corporate transactions, as well as increases our vulnerability to adverse economic and industry conditions, by limiting our flexibility in planning for, and reacting to, changes in our business and industry.

The Second Amended Credit Agreement imposes restrictions that could impede our ability to enter into certain corporate transactions, as well as increases our vulnerability to adverse economic and industry conditions, by limiting our flexibility in planning for, and reacting to, changes in our business and industry.

These restrictions will limit our ability to, among other things:

3 unchanged sentences

• merge or consolidate with other companies or transfer all or substantially all of our assets.

In addition, the Amended Credit Agreement contains certain negative covenants that restrict the incurrence of indebtedness unless certain incurrence-based financial covenant requirements are met.

In addition, the Second Amended Credit Agreement contains certain negative covenants that restrict the incurrence of indebtedness unless certain incurrence-based financial covenant requirements are met.

The restrictions may prevent us from taking actions that we believe would be in the best interests of the business and may make it difficult for us to successfully execute our business strategy or effectively compete with companies that are not similarly restricted.

1 unchanged sentence

The breach of any of these covenants or restrictions could result in a default, which could result in the acceleration of our debt.

In the event of an acceleration of our indebtedness, we could be forced to apply all available cash flows to repay such debt, which would reduce or eliminate distributions to us, which could also force us into bankruptcy or liquidation.

We may not have the ability to raise the funds necessary to settle conversions of the 2026 Notes, or to repurchase the 2026 Notes upon a fundamental change, and our future debt may contain, limitations on our ability to pay cash upon conversion or repurchase of the 2026 Notes.

Holders of the 2026 Notes have the right to require us to repurchase their 2026 Notes upon the occurrence of a fundamental change at a repurchase price equal to 100% of their principal amount, plus accrued and unpaid interest, if any.

In addition, upon conversion of the 2026 Notes, unless we elect to cause to be delivered solely shares of our Class A common stock to settle such conversion, we will be required to make cash payments in respect of the 2026 Notes being converted.

In the event of an acceleration of our indebtedness, we could be forced to apply all available cash

flows to repay such debt, which would reduce or eliminate distributions to us, which could also force us into bankruptcy or liquidation.

We may not have the ability to raise the funds necessary to settle conversions of the 2026 Notes or the 2029 Notes, or to repurchase the 2026 Notes or the 2029 Notes upon a fundamental change, and our future debt may contain, limitations on our ability to pay cash upon conversion or repurchase of the 2026 Notes and the 2029 Notes.

Holders of the 2026 Notes and the 2029 Notes (together “Notes”) have the right to require us to repurchase their Notes upon the occurrence of a fundamental change at a repurchase price equal to 100% of their principal amount, plus accrued and unpaid interest, if any.

Upon conversion of the 2026 Notes, unless we elect to cause to be delivered solely shares of our Class A common stock to settle such conversion, we will be required to make cash payments in respect of the 2026 Notes being converted.

In addition, upon conversion of the 2029 Notes, we will be required to make cash payments up to the aggregate principal amount of the 2029 Notes being converted and in respect of the remainder, if any, of our conversion obligation, we may elect to make cash payments or deliver shares of our Class A common stock, or a combination, to settle such conversion.

However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the Notes surrendered therefor or to pay cash with respect to the Notes being converted.

In addition, our ability to repurchase the Notes or to pay cash upon conversion of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

Our failure to repurchase the 2026 Notes at a time when the repurchase is required by the indenture governing the 2026 Notes (the “indenture”) or to pay any cash payable on future conversions of the 2026 Notes as required by the indenture, would constitute a default under the indenture.

A default under the indenture, or the fundamental change itself, could also lead to a default under our Amended Credit Agreement and other agreements governing our existing or future indebtedness.

Our failure to repurchase the Notes at a time when the repurchase is required by the indenture governing the 2026 Notes and the indenture governing the 2029 Notes (together the “indentures”) or to pay any cash payable on future conversions of the Notes as required by the indentures, would constitute a default under the indentures.

A default under the indentures, or the fundamental change itself, could also lead to a default under our Second Amended Credit Agreement and other agreements governing our existing or future indebtedness.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness, repurchase, make interest payments on or make cash payments upon conversion of the Notes.

The conditional conversion feature of the 2026 Notes, if triggered, may adversely affect our financial condition and operating results.

The conditional conversion feature of the 2026 Notes and the 2029 Notes, if triggered, may adversely affect our financial condition and operating results.

In the event the conditional conversion feature of the 2026 Notes is triggered, holders of the 2026 Notes will be entitled to convert their 2026 Notes at any time during specified periods at their option.

1 unchanged sentence

In addition, even if holders do not elect to convert their 2026 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2026 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

Provisions in the indenture could delay or prevent an otherwise beneficial takeover of the Company

Certain provisions of the 2026 Notes and the indenture could make a third party attempt to acquire us more difficult or expensive.

In the event the conditional conversion feature of the 2029 Notes is triggered, holders of the 2029 Notes will be entitled to convert their 2029 Notes at any time during specified periods at their option.

If one or more holders elect to convert their notes, we would be required to settle any converted principal amount of such notes through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders do not elect to convert their notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

Provisions in the indentures could delay or prevent an otherwise beneficial takeover of the Company

Certain provisions of the Notes and the indentures could make a third party attempt to acquire us more difficult or expensive.

For example, if a takeover constitutes a fundamental change, then we will be required to make an offer to the holders of the Notes to repurchase for cash all or part of their outstanding Notes.

2 unchanged sentences

Risks Related to Our Ownership Structure

We are a holding company and our only material asset is our interest in Hawk Parent, and we are accordingly dependent upon distributions made by our subsidiaries to pay taxes, make payments under the Tax Receivable Agreement, meet our financial obligations under the 2026 Notes and pay dividends.

We are a holding company with no material assets other than our ownership of limited liability company interests of Hawk Parent (the “Post-Merger Repay Units” and holders of such Post-Merger Repay Units other than the Company, the “Repay Unitholders”) and our managing member interest in Hawk Parent, and we have no independent means of generating revenue or cash flow.

33 unchanged sentences

These exchanges are expected to result in increases in our allocable share of the tax basis of the tangible and intangible assets of Hawk Parent.

These increases in tax basis may increase (for tax

purposes) depreciation and amortization deductions and therefore reduce the amount of income or franchise tax that we would otherwise be required to pay in the future had such exchanges never occurred.

These increases in tax basis may increase (for tax purposes) depreciation and amortization deductions and therefore reduce the amount of income or franchise tax that we would otherwise be required to pay in the future had such exchanges never occurred.

In connection with the Business Combination, we entered into the Tax Receivable Agreement, which generally provides for the payment to the Repay Unitholders by us of 100% of certain tax benefits, if any, that we realize (or in certain cases are deemed to realize) (a portion of which will be paid in turn to certain service providers on behalf of them in respect of certain transaction expenses) as a result of these increases in tax basis and certain other tax attributes of Hawk Parent and tax benefits related to entering into the Tax Receivable Agreement, including tax benefits attributable to payments under the Tax Receivable Agreement.

11 unchanged sentences

As a result, in certain circumstances, we could make payments under the Tax Receivable Agreement in excess of our actual income or franchise tax savings, which could materially impair our financial condition.

Moreover, the Tax Receivable Agreement provides that, in the event that (i) we exercise our early termination rights under the Tax Receivable Agreement, (ii) we become bankrupt or undergo a similar insolvency event, (iii) certain changes of control of us occur (as described in the Tax Receivable Agreement) or (iv) we are more than three months late in making of a payment due under the Tax Receivable Agreement (unless we in good faith determine that we have insufficient funds to make such payment), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Repay Unitholders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income.

control of us occur (as described in the Tax Receivable Agreement) or (iv) we are more than three months late in making of a payment due under the Tax Receivable Agreement (unless we in good faith determine that we have insufficient funds to make such payment), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Repay Unitholders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income.

The lump-sum payment to the Repay Unitholders could be substantial and could exceed the actual tax benefits that we realize subsequent to such payment because such payment would be calculated assuming, among other things, that we would be able to use the assumed potential tax benefits in future years, and that tax rates applicable to us would be the same as they were in the year of the termination.

1 unchanged sentence

Furthermore, our obligations to make payments under the Tax Receivable Agreement could also have the effect of delaying, deferring or preventing certain mergers, asset sales, other forms of business combinations or other changes of control.

Conversely, our executives and directors who are TRA beneficiaries could be incentivized to take actions, including asset sales or restructuring activities, in order to trigger TRA payments sooner.

We may need to incur additional indebtedness to finance payments under the Tax Receivable Agreement to the extent our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement as a result of timing discrepancies or otherwise.

9 unchanged sentences

These factors could also make it more difficult for us to raise additional funds through offerings of our shares of Class A common stock or other securities at a time and at a price that we deem appropriate.

We also have outstanding $440.0 million aggregate principal amount of our 2026 Notes which are convertible into shares of our Class A common stock in certain circumstances.

Investors will incur further dilution upon the conversion of any of our 2026 Notes if we elect to deliver shares of Class A common stock upon such conversion.

We also have outstanding $220 million aggregate principal amount of our 2026 Notes and $287.5 million aggregate principal amount of our 2029 Notes which are convertible into shares of our Class A common stock in certain circumstances.

Investors will incur further dilution upon the conversion of any of our convertible senior notes if we elect to deliver shares of Class A common stock upon such conversion.

In the future, we may also issue additional securities in connection with investments, acquisitions or capital raising activities, which could constitute a material portion of our then-outstanding shares of our Class A common stock and may result in additional dilution to investors or adversely impact the price of our Class A common stock.

20 unchanged sentences

• the right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

• the requirement that directors may only be removed from the board of directors for cause (until our 2024 annual meeting of stockholders, at which time this provision will terminate);

• a prohibition on stockholder action by written consent (except in limited circumstances), which forces stockholder action to be taken at an annual or special meeting of stockholders and could delay the ability of stockholders to force consideration of a stockholder proposal or to take action, including the removal of directors;

6 unchanged sentences

Our certificate of incorporation designates a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.

Our certificate of incorporation provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or if such court does not have subject matter jurisdiction, any other court located in the State of Delaware with subject matter jurisdiction, will be the sole and exclusive forum for (i) any derivative action or proceeding brought on behalf of us, (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our current or former directors, officers, other employees or stockholders to us or our stockholders, (iii) any action asserting a claim against us or our officers or directors arising pursuant to any provision of the DGCL or our certificate of incorporation or bylaws or as to which the DGCL confers jurisdiction on the Court of Chancery of the State of Delaware, or (iv) any action

asserting a claim against us or any of our directors or officers governed by the internal affairs doctrine of the law of the State of Delaware.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities will be deemed to have notice of and consented to this provision.

3 unchanged sentences

CYBERSECURITY.

We recognize the importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us.

We recognize the critical importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us.

Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews.

1 unchanged sentence

Our Chief Information Security Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), has day-to-day responsibility for our cybersecurity programs.

Due to the critical risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

Given the significant risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

Risk Management and Strategy

Risk Identification and Assessment

We have adopted processes and procedures, including those described below to identify cybersecurity risks and events.

Our CISO maintains a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk.

We employ structured processes and procedures to identify and assess cybersecurity risks and events.

Our CISO oversees a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk.

The cybersecurity risk assessment receives input from cross-functional teams across our organization.

4 unchanged sentences

As part of these policies and procedures, we maintain a Security Incident Response Plan (the “SIRP”) that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business.

We have implemented hiring, onboarding and termination procedures that are designed to ensure our employees and contractors assist us in meeting our cybersecurity compliance objectives.

During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.

Employee and contractor compliance is bolstered by hiring, onboarding and termination procedures that are designed to align with cybersecurity objectives.

All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis.

We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.

We have implemented a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards.

We utilize a combination of third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards.

Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

Third Parties

We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards.

We also rely on these third party firms for educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

These firms also provide educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors.

25 unchanged sentences

Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school.

He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2).

He also maintains a Certificate Information Systems

Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2).

Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years.

5 unchanged sentences

Additional Facilities:

Atlanta, Georgia

Bettendorf, IA

The Colony, Texas

East Moline, Illinois

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business