What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-03-09 compared with 2025-03-03 · 121 added, 119 removed, 844 unchanged (22% of the section changed)

6 unchanged sentences

Our legacy business was founded as M & A Ventures, LLC, a Georgia limited liability company doing business as REPAY:

Realtime Electronic Payments (“REPAY LLC”), in 2006 by current executives John Morris and Shaler Alias.

Hawk Parent was formed in 2016 in connection with the acquisition of a majority interest in the successor entity of REPAY LLC and its subsidiaries by certain investment funds sponsored by, or affiliated with, Corsair Capital LLC.

Realtime Electronic Payments (“REPAY LLC”), in 2006.

Hawk Parent was formed in 2016 in connection with the acquisition of a majority interest in the successor entity of REPAY LLC and its subsidiaries.

Business Overview

4 unchanged sentences

We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our clients’ needs, our deep knowledge of our vertical markets and the embedded nature of our integrated payment solutions will drive solid growth by attracting new clients and fostering long-term client relationships.

Our top 10 clients, with an average tenure of approximately seven years, contributed approximately 20% and 18% of total gross profit during the year ended December 31, 2024 and 2023, respectively.

Our top 10 clients, with an average tenure of approximately seven years, contributed approximately 19% and 20% of total gross profit during the years ended December 31, 2025 and 2024, respectively.

Our leading competitive position and differentiated solutions have enabled us to realize unique advantages in growing and strategically important segments of the payments market.

4 unchanged sentences

The automotive loans vertical includes a diversified client base across the entire credit spectrum.

Our receivables management vertical relates to consumer loan collections, which typically enter the receivables management process due to delinquency on credit card bills or as a result of major life events, such as job loss or major medical issues.

Our receivables management vertical relates to consumer debt collections, which typically enter the receivables management process due to delinquency on credit card bills or as a result of major life events, such as job loss or major medical issues.

The business-to-business vertical relates to transactions occurring between a wide variety of enterprise clients, many of which operate in the automotive, field services, healthcare, homeowner association (“HOA”) management, hospitality and media industries, as well as educational institutions and governments and municipalities.

1 unchanged sentence

The integration of our technology with key software providers in the verticals that we serve, including loan management systems, dealer management systems (“DMS”), collection management systems, and enterprise resource planning software systems, allows us to embed our omni-channel payment processing technology into our clients’ critical workflow software and ensure seamless operation of our solutions within our clients’ enterprise management systems.

We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities

or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system.

We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider

that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system.

We have successfully integrated our technology solutions with numerous, widely-used enterprise management systems in the verticals that we serve, which makes our platform a more compelling choice for the businesses that use them.

28 unchanged sentences

As we further integrate our solution into our clients’ workflows, we will look to continue to innovate on our solution set and broaden our suite of services.

Our continued investment in our technology capabilities (including our RCS platform) positions us to provide value-added services and emerging payment solutions that will address the evolving needs of our clients as they seek to best serve their customers.

as they seek to best serve their customers.

The ability to serve clients across verticals and to be integrated across various software platforms enables us to better understand the needs of clients across verticals and to scale our innovative solutions to a broad segment of the market.

1 unchanged sentence

As we continue to grow, we expect to become a more significant partner to our sponsor banks, third party processors and other key vendor relationships, which we expect will give us greater leverage as we expand our contractual relationships with them.

We plan to continue to drive operating leverage in our personnel expenditures, as we believe that, in general, we can process larger payment volumes without significant increases to our personnel and operating expenses.

We plan to continue to drive operating leverage in our personnel expenditures through increased automation and process improvements, as we believe that, in general, we can process larger payment volumes without significant increases to our personnel and operating expenses.

Strategic Acquisitions

43 unchanged sentences

We have developed proprietary onboarding, compliance, and client oversight processes, of which our Compliance Management System (“CMS”) is a part.

Our CMS, developed in conjunction

with the Third Party Payment Processors Association, focuses on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.

Our CMS, originally developed in

conjunction with the Third Party Payment Processors Association, focuses on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.

Client Onboarding .

20 unchanged sentences

If the client incurring the chargeback is unable to fund the refund to the card-issuing bank, we are required to do so by the rules of the payment networks and our contractual arrangements with our sponsor banks.

During the year ended December 31, 2024, our chargeback rate was under 1% of our payment volume.

During the year ended December 31, 2025, our chargeback rate was less than 1% of our payment volume.

Security, Disaster Recovery, and Back-up Systems

We adhere to industry security standards to protect the payment information that we process.

We regularly scan and update our network, systems and application code and malware defenses.

We use a third party vendor solution for security education materials.

Every employee and contractor is required to successfully complete annual security awareness training.

We routinely retain external parties to audit our systems’ compliance with current security standards as established by the Payment Card Industry Data Security Standards (“PCI DSS”), Service Organization Control ("SOC1 Type II,” “SOC2 Type II”), Health Insurance Portability and Accountability Act (“HIPAA”) and International Organization for Standardization (“ISO 27001”) and to test our systems against vulnerability to unauthorized access.

We utilize third party vendors for internal and external penetration testing.

Further, we use one of the most advanced commercially available technologies to encrypt the cardholder numbers and client data that we store in our databases.

Additionally, we have a dedicated team responsible for continuous monitoring and security incident response.

This team also develops, maintains, tests and verifies our incident response plan.

Disaster recovery is built into our primary payment gateway through redundant hardware and software applications hosted in two distinct cloud regions.

Our primary cloud region for the payment gateway infrastructure is set up to be replicated, substantially on a real time basis, by our secondary cloud region such that if our primary cloud region becomes impaired or unavailable, operations are redirected to the secondary cloud region.

Our incident response team tests these systems each quarter to assess the effectiveness of our disaster recovery plan, including staff readiness and operational capability.

We maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of the payment information and other sensitive data that we process.

Our security controls are aligned with recognized industry standards and include administrative, technical and physical safeguards.

We regularly scan, patch, update and monitor our networks, systems, applications, and malware defenses to address evolving security threats.

All employees and contractors are required to complete security awareness training at the time of hire and at least annually thereafter.

We routinely engage independent third parties to audit our compliance with applicable security and regulatory frameworks, including the Payment Card Industry Data Security Standard (“PCI DSS”), Service Organization Control reports (“SOC1 Type II,” “SOC2 Type II”), and the Health Insurance Portability and Accountability Act (“HIPAA”), where applicable.

In addition, we engage independent third-party firms to conduct internal and external penetration testing to identify security vulnerabilities and assess risks of unauthorized access.

Identified findings are evaluated and remediated based on risk severity and business impact.

Sensitive cardholder and client data stored in our databases is protected using industry-standard encryption technologies, and access to such data is restricted based on job responsibilities and the principle of least privilege.

We employ centralized logging, monitoring and alerting mechanisms to detect and respond to anomalous or unauthorized activity.

Our third-party risk management practices include risk-based assessments of vendors that may access, process or store sensitive data on our behalf.

We maintain a dedicated security team responsible for continuous security monitoring and incident response.

This team develops, maintains, tests and validates our incident response plan, which is designed to support timely detection, containment, investigation, remediation and recovery from security incidents, including coordination with internal stakeholders and external parties, as appropriate.

Disaster recovery and business continuity capabilities are built into our primary payment gateway through redundant hardware, software and data storage hosted across two geographically distinct cloud regions.

Our primary cloud region is configured for near-real-time replication to a secondary region, enabling operations to be redirected in the event of a system failure, outage or degradation.

Disaster recovery procedures are tested at least annually to assess system effectiveness, staff readiness and operational resilience.

We perform regular backups of critical systems and data and maintain documented restoration procedures.

Backup restoration testing is performed quarterly to validate data integrity, recovery processes and system availability.

While we believe our security, disaster recovery and backup systems are designed to reduce the risk of security incidents, service disruptions and data loss, no system can provide absolute assurance.

We continue to evaluate and enhance our controls in response to changes in technology, the threat landscape, regulatory requirements and business operations.

Third Party Processors and Sponsor Banks

16 unchanged sentences

We compete with a variety of payment processing companies that have different business models, go-to-market strategies and technical capabilities.

In our Consumer Payments segment, our primary competitors include ACI Worldwide, Paymentus, PayNearMe, PayScout and TabaPay.

In our Consumer Payments segment, our primary competitors include ACI Worldwide, Payliace, Paymentus, PayNearMe, PayScout and TabaPay.

We also compete in our Consumer Payments segment against many traditional merchant acquirers, such as financial institutions, affiliates of financial institutions and payment processing companies, including Bank of America Merchant Services, Elavon (a subsidiary of U.S.

1 unchanged sentence

In our Business Payments segment, our primary competitors include AvidXchange, Edenred Pay (a division of Edenred), Corpay, Paya (a division of Nuvei Corporation) and Fortis.

We believe the most significant competitive factors in the markets in which we compete are:

the most significant competitive factors in the markets in which we compete are:

(1) economics, including fees charged to merchants and commission payouts to software integration partners;

5 unchanged sentences

We believe there is a significant digital shift in our industry.

Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment.

In addition, the COVID-19 pandemic and the resulting changes in consumer behavior has led to an accelerated shift to electronic payments.

We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.

Many of the vertical markets in which we compete are continuing to shift from legacy payment methods — primarily cash and check — to electronic forms of payment.

We expect to benefit from this trend as our clients increasingly adopt and expand the use of electronic payment solutions in which we specialize.

We have experienced in the past, and may continue to experience, seasonal fluctuations in our revenues as a result of consumer spending patterns.

Revenues during the first quarter of the calendar year tend to increase in comparison to the

remaining three quarters of the calendar year on a same store basis.

Revenues during the first quarter of the calendar year tend to increase in comparison to the remaining three quarters of the calendar year on a same store basis.

This increase is due to consumers’ receipt of tax refunds and the increases in repayment activity levels that follow.

57 unchanged sentences

The Dodd-Frank Act and the Federal Reserve’s implementing regulations require that such interchange fees be “reasonable and proportional” to the cost incurred by the issuer in processing the transactions.

Federal Reserve regulations implementing this “reasonable and proportional” requirement have capped debit interchange rates for card issuers operating in the United States with assets of $10 billion or more.

Reserve regulations implementing this “reasonable and proportional” requirement have capped debit interchange rates for card issuers operating in the United States with assets of $10 billion or more.

In addition, the regulations contain certain prohibitions on card brand network exclusivity and merchant routing restrictions of debit card transactions.

3 unchanged sentences

Any new rules or regulations implemented by the CFPB, and other similar regulatory agencies in other jurisdictions, or pursuant to the Dodd-Frank Act that are applicable to us or our clients’ businesses, or any adverse changes thereto, could increase our cost of doing business or limit our current offerings of integrated payment solutions.

For example, the CFPB announced in June 2024 that the “Small Dollar Lending Rule” will become effective on March 30, 2025, though current uncertainty about the CFPB’s funding and activity may impact its implementation.

This rule generally prohibits certain lenders from attempting to withdraw

money from a borrower’s account after two consecutive failed attempts and requires certain lenders to provide specific written notice to consumers before making certain payment attempts.

The scope, priorities and level of activity of the CFPB may vary over time due to legal, funding, policy and administrative factors.

In addition, state attorneys general may have authority to enforce certain consumer protection provisions, including those under the Dodd-Frank Act, independent of federal regulatory activity.

Privacy and Information Security Regulations

20 unchanged sentences

federal anti-money laundering laws and regulations.

We are also subject to certain economic and trade sanctions programs that are administered by Office of Foreign Assets Control (“OFAC”) that prohibit or restrict transactions to or from (or transactions dealing with) narcotics traffickers, terrorists, terrorist organizations, certain individuals, specified countries, their governments and, in certain circumstances, their nationals.

individuals, specified countries, their governments and, in certain circumstances, their nationals.

Similar anti-money laundering, counter-terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified on lists maintained by organizations similar to OFAC in several other countries and which may impose specific data retention obligations or prohibitions on intermediaries in the payment process.

3 unchanged sentences

In addition, laws prohibiting these activities and other laws, rules and or regulations, including the Telemarketing Sales Rule, may directly impact the activities of certain of our clients, and in some cases may subject us, as the client’s payment processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we are deemed to have aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

Various federal and

state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations.

Various federal and state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations.

To the extent we are processing payments or providing services for a client suspected of violating such laws, rules and regulations, we may face enforcement actions and, as a result, incur losses and liabilities that may adversely affect our business.

14 unchanged sentences

For receivables management companies, these laws and regulations could include laws and regulations (including the federal Fair Debt Collection Practices Act (“FDCPA”) and comparable state laws) regarding the time, place and manner of communications with consumers regarding debt collection and prohibitions or limitations on certain debt collection practices.

Lastly, some of our clients are subject to various state laws and regulations that prohibit or limit the imposition of a surcharge or convenience fee in connection with their customers use of a payment card or other form of electronic payment.

Lastly, some of our clients are subject to various state laws and regulations that prohibit or restrict the imposition of a surcharge or convenience fee in connection with their customers’ use of a payment card or other form of electronic payment.

Payment Network Rules and Standards

Payment networks, such as Visa, MasterCard, Discover and American Express, establish their own rules and standards that allocate liabilities and responsibilities among the payment networks and their participants.

These rules and standards, including the Payment Card Industry Data Security Standards, govern a variety of areas, including how consumers and customers may use their cards, whether (and the terms under which) convenience fees or surcharges may be imposed in connection with the use of their cards, the security features of cards, security standards for processing, data security and allocation of liability for certain acts or omissions, including liability in the event of a data breach.

connection with the use of their cards, the security features of cards, security standards for processing, data security and allocation of liability for certain acts or omissions, including liability in the event of a data breach.

The payment networks may change these rules and standards from time to time as they may determine in their sole discretion and with or without advance notice to their participants.

4 unchanged sentences

We are required to register with the payment networks through these bank partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks’ rules and standards governing access to those networks.

Our bank partners sponsor our adherence to the rules and standards of the

payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions.

Our bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions.

Payment network rules restrict us from performing funds settlement and require that merchant settlement funds be in the possession of the member bank until the merchant is funded.

30 unchanged sentences

In 2025, 88% of participants responded that REPAY is a great place to work.

Our employees’ feedback from the annual surveys have allowed us to be certified as a Great Place to Work® for the last eight consecutive years.

Our employees’ feedback from the annual surveys have allowed us to be certified as a Great Place to Work® for the last nine consecutive years.

We take employee feedback seriously and share the results of the survey, along with an action plan of how we can continue to improve, with all employees.

41 unchanged sentences

They also may be able to offer and provide services and solutions that we do not offer.

In addition, certain clients, particularly larger enterprises, may seek to develop or bring in-house certain payment processing capabilities or otherwise reduce their reliance on third-party payment service providers.

If such efforts are successful, we could experience reduced transaction volumes, pricing pressure or the loss of client relationships.

There are also a large number of small providers of processing services, including emerging technology and non-traditional payment processing companies, that provide various ranges of services to our existing and potential clients.

15 unchanged sentences

A systems breach may subject us to material losses or liability, including payment network fines, assessments and claims for unauthorized purchases with misappropriated credit, debit or card information, impersonation or other similar fraud claims.

A misuse of such data or a

cybersecurity breach (including a ransomware attack) could harm our reputation and deter clients from using electronic payments generally and our services specifically, thus reducing our revenue.

A misuse of such data or a cybersecurity breach (including a ransomware attack) could harm our reputation and deter clients from using electronic payments generally and our services specifically, thus reducing our revenue.

In addition, any such misuse or breach could cause us to incur costs to correct the breaches or failures, expose us to uninsured liability, increase our risk of regulatory scrutiny, subject us to lawsuits and result in the imposition of material penalties and fines under state and federal laws or by the payment networks or limitations on our ability to process payment transactions on such payment networks.

4 unchanged sentences

Any human error, fraud, malice, accidental technological failure or attacks against us or our contracted third parties could hurt our reputation, force us to incur significant expenses in remediating the resulting impacts, expose us to uninsured liability, result in the loss of our sponsor bank relationships or our ability to participate in the payment networks, subject us to lawsuits, fines or sanctions, distract our management, increase our costs of doing business and/or materially impede our ability to conduct business.

Although we generally require that our agreements with our software integration partners or service providers include confidentiality obligations that restrict these parties from using or disclosing any client or consumer data except as necessary to perform their services under the applicable agreements, we cannot guarantee that these contractual measures will prevent the unauthorized use, modification, destruction or disclosure of data or allow us to seek reimbursement from the contracted party.

Although we generally require that our agreements with our software integration partners or service providers include confidentiality obligations, we cannot guarantee that these contractual measures will prevent the unauthorized use, modification, destruction or disclosure of data or allow us to seek reimbursement from the contracted party.

In addition, many of our clients are small and medium-sized businesses that may have limited competency regarding data security and handling requirements and may thus experience data breaches.

3 unchanged sentences

Further, certain of our sponsor banks have experienced, and could in the future experience, cybersecurity incidents that could disrupt our operations, expose us to liability and protracted and costly litigation and damage our reputation.

Security breaches may be subject to scrutiny from governmental agencies such as the CFPB, the FTC and the U.S.

Department of Health and Human Services Office for Civil Rights.

Security breaches may be subject to scrutiny from governmental agencies such as the FTC, the U.S.

Department of Health and Human Services Office for Civil Rights, state attorneys general and the CFPB.

See “Risks Related to Regulation” below.

4 unchanged sentences

Federal Reserve launched its FedNow Service that enables individuals and businesses to send instant payments through their depositary institution accounts.

To remain competitive, we continually pursue initiatives to develop new products and services to compete with these new market entrants.

These projects carry risks, such as difficulty in determining market demand and timing for delivery, cost overruns, delays in delivery, performance problems and lack of client acceptance, and some projects may require investment in non-revenue generating products or services that our software integration partners and clients expect to be included in our offerings.

In addition, advances in automation, data analytics and artificial intelligence are increasingly being incorporated into payment processing, risk management, compliance and customer support workflows across the industry.

To remain competitive, we continually pursue initiatives to develop new products and services and to enhance existing solutions.

These projects carry risks, such as difficulty in determining market demand and timing for delivery, cost overruns, delays in delivery, data quality challenges and integration complexity, performance problems and lack of client acceptance, and some projects may require investment in non-revenue generating products or services that our software integration partners and clients expect to be included in our offerings.

In addition, new products and offerings may not perform as intended or generate the business or revenue growth expected.

The continued growth and development of our payment processing services and solutions will depend on our ability to anticipate and adapt to changes in consumer and business behavior.

Any failure to timely integrate emerging payment methods into our software, to anticipate consumer or business behavior changes or to contract with processing partners that support such emerging payment technologies could cause us to lose traction among our clients or referral sources, including industry associations, resulting in a corresponding loss of revenue, if those methods become popular among end-users of their services.

The continued growth and development of our payment processing services and solutions will depend on our ability to anticipate and adapt to changes in consumer and business behavior, client expectations and technology adoption.

to timely integrate emerging payment methods into our software, to anticipate consumer or business behavior changes or to contract with processing partners that support such emerging payment technologies could cause us to lose traction among our clients or referral sources, including industry associations, resulting in a corresponding loss of revenue, if those methods become popular among end-users of their services.

Our products and services are designed to process complex transactions and provide reports and other information on those transactions, all at very high volumes and processing speeds.

Our technology offerings must also integrate with a variety of network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our

products and services to adapt to changes and innovation in these technologies.

Our technology offerings must also integrate with a variety of network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our products and services to adapt to changes and innovation in these technologies.

Any failure to deliver an effective, reliable and secure service or any performance issue that arises with a new product or service could result in significant processing or reporting errors or other losses.

2 unchanged sentences

For example, we rely on our software integration partners to integrate our services and products into the software platforms being used by our clients.

Our future success will depend in part on our ability to develop or adapt to technological changes and evolving industry standards.

Our future success will depend in part on our ability to develop or adapt to technological changes and evolving industry standards (including those related to automation and artificial intelligence).

If we are unable to develop, adapt to or access technological changes or evolving industry standards on a timely and cost-effective basis, our business, financial condition and results of operations could be materially adversely affected.

47 unchanged sentences

While we maintain relationships with multiple sponsor banks for flexibility in the processing of payment volume and in the pricing of our clients’ solutions, the loss of or termination of a relationship with a sponsor bank or a significant decrease in the amount of payment volume that a sponsor bank processes for us could reduce such flexibility and negatively affect our business.

To the extent the number of our sponsor banks decreases, we will become increasingly reliant on our remaining sponsor banks, which would materially adversely affect our business should our relationship with any of such remaining banks be terminated or otherwise disrupted.

To the extent the number of our sponsor banks decreases, we will become increasingly reliant on our remaining sponsor banks, which would materially adversely affect

our business should our relationship with any of such remaining banks be terminated or otherwise disrupted.

Furthermore, our agreements with our sponsor banks provide the sponsor banks with substantial discretion in approving certain elements of our business practices, including our solicitation, application and underwriting procedures for clients.

3 unchanged sentences

Generally, our agreements with software integration partners are not exclusive and these partners retain the right to refer potential clients to other payment processors.

In addition, our agreements with

software integration partners do not generally prohibit these partners from providing payment processing solutions to clients (including by acquiring a competing payment processing business).

In addition, our agreements with software integration partners do not generally prohibit these partners from providing payment processing solutions to clients (including by acquiring a competing payment processing business).

We may need to provide financial concessions to maintain or enhance relationships with current software integration partners or to attract potential software integration partners from our competitors.

26 unchanged sentences

If we are unable to defend any such claim successfully, we could be required to restructure our anti-fraud processes in ways that could harm our business and to pay substantial fines.

Even if we are able to

defend a claim successfully, the litigation could damage our reputation, consume substantial amounts of our management’s time and attention, and require us to change our client service and operations in ways that could increase our costs and decrease the effectiveness of our anti-fraud program.

Even if we are able to defend a claim successfully, the litigation could damage our reputation, consume substantial amounts of our management’s time and attention, and require us to change our client service and operations in ways that could increase our costs and decrease the effectiveness of our anti-fraud program.

In addition, if a client has filed for bankruptcy protection, then our normal processes may be limited by applicable bankruptcy laws.

24 unchanged sentences

We also rely on third parties for specific software and hardware used in providing our products and services.

The termination by our service or technology providers of their arrangements with us or their failure to perform their services efficiently and

effectively may adversely affect our relationships with our clients and, if we cannot find alternate providers quickly, may cause those clients to terminate their relationships with us.

The termination by our service or technology providers of their arrangements with us or their failure to perform their services efficiently and effectively may adversely affect our relationships with our clients and, if we cannot find alternate providers quickly, may cause those clients to terminate their relationships with us.

Our third-party processors and third-party program managers, which provide us with front-end authorization services, card issuance program services and certain other services, compete with us or may compete with us in the future in the vertical markets that we serve.

6 unchanged sentences

The electronic payment industry depends heavily on the overall level of consumer and commercial spending.

We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits, including natural disasters and health emergencies, including earthquakes, fires, power outages, typhoons, floods, pandemics or epidemics (such as the COVID-19 pandemic) and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars and critical infrastructure attacks.

We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits, including natural disasters and health emergencies, including earthquakes, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars and critical infrastructure attacks.

A sustained deterioration in general economic conditions, particularly in the United States, continued uncertainty for an extended period of time, persistent inflation or increases in interest rates, could adversely affect our financial performance by reducing the number or aggregate volume of transactions made using electronic payments.

35 unchanged sentences

We may have to litigate to enforce or determine the scope and enforceability of our intellectual property rights and know-how, which is expensive, could cause a diversion of resources and may not prove successful.

Also, because of the rapid pace of technological change in our industry, aspects of our business and our services rely on technologies developed or licensed by third parties, and we may not be able to obtain or retain licenses and technologies from these third parties on reasonable terms or at all.

Also, because of the rapid pace of technological change in our industry, aspects of our business and our services rely on technologies developed or licensed by

third parties, and we may not be able to obtain or retain licenses and technologies from these third parties on reasonable terms or at all.

The loss of intellectual property protection or the inability to license or otherwise use third-party intellectual property could harm our business and ability to compete.

4 unchanged sentences

Any claim from third parties may result in a limitation on our ability to use the intellectual property subject to these claims.

Additionally, in recent years, individuals and groups have been purchasing intellectual property assets for the sole purpose of making claims of infringement or other violations and attempting to extract settlements

from companies like us.

Even if we believe that intellectual property related claims are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees.

4 unchanged sentences

We depend on the ability and experience of a number of our key personnel who have substantial experience with our operations, the rapidly changing payment processing industry and the vertical markets in which we offer our products and services.

Many of our key personnel have worked for us for a significant amount of time or were recruited by us specifically due to their experience.

Our success depends in part upon the reputation and influence within the industry of our senior managers who have, over the years, developed long standing and favorable relationships with our software integration partners, vendors, card associations, sponsor banks and other payment processing and service providers.

It is possible that the loss of the services of senior executives or key managers could have a material adverse effect on our business, financial condition and results of operations.

In addition, contractual obligations related to confidentiality assignment of intellectual property rights, non-solicitation and non-competition may be ineffective or unenforceable, and departing employees may share our proprietary information with competitors or seek to solicit our software integration partners or clients or recruit our key personnel to competing businesses in ways that could adversely impact us.

Our success depends in part on the continued service and expertise of our senior management and other key personnel, many of whom have developed significant institutional knowledge and industry experience.

Our senior leaders and other key employees have developed important relationships with the card networks and our sponsor banks, key clients, software integration partners and other payment processing and service providers, and the loss of one or more of these individuals could disrupt our operations, strategic initiatives or client relationships.

From time to time, we have experienced, and may continue to experience, turnover in key management or other critical roles, and there can be no assurance that we will be able to retain or replace such personnel with individuals possessing comparable experience, expertise or industry relationships on a timely basis, or at all.

Further, in order for us to continue to successfully compete and grow, we must attract, recruit, develop and retain personnel who will provide us with the expertise we need.

10 unchanged sentences

Furthermore, there is no guarantee that we will be successful in defending pending or future litigation or similar matters under various laws.

Any judgments or settlements in any pending or future claims, litigation or investigations could have a material adverse effect on our business, financial condition and results of operations.

Any judgments or settlements in any

pending or future claims, litigation or investigations could have a material adverse effect on our business, financial condition and results of operations.

We may not be able to successfully execute our growth strategies.

30 unchanged sentences

In addition, our clients include credit unions, banks and non-bank lenders who utilize our payment technology solutions in exchange for processing fees.

We do not believe we have been materially and adversely impacted by the financial institution failures that began with the closure of Silicon Valley Bank in March 2023.

While we continue to monitor developments in the banking sector, we cannot guarantee that there will not be similar issues with any of the financial institutions with whom we maintain relationships.

The failure of or any other adverse development impacting one or more of our financial institution relationships (or rumors or concerns about such events) could adversely affect our liquidity, our ability to process transactions for our clients or our client relationships.

Similarly, our clients could be adversely affected by any bank failure or other adverse event involving their financial institution relationships, which could result in a decrease in the amount of payment volume we receive from these clients.

Periods of actual or perceived stress in the banking or broader financial services sector—whether resulting from liquidity concerns, changes in regulatory expectations, macroeconomic conditions or other factors—could adversely affect the financial institutions with which we do business or the terms on which they provide services to us.

Any failure of, or material adverse development affecting, one or more of our sponsor banks or other financial institution counterparties, or market concerns regarding their financial condition, could impair our liquidity, disrupt our ability to process transactions for clients, or negatively affect our relationships with clients and partner.

Similarly, adverse developments affecting the financial institutions on which our clients rely could negatively impact our clients’ operations or financial condition, which in turn could reduce payment volumes processed through our platform or otherwise adversely affect our business, financial condition or results of operations.

Risks Related to Regulation

1 unchanged sentence

We and the clients we serve are subject to numerous federal and state regulations that affect the electronic payments industry.

Regulation of our industry has increased significantly in recent years and is constantly evolving.

The regulatory environment applicable to our business and our clients’ businesses is complex, fragmented and subject to change, and regulatory priorities, interpretations and enforcement approaches may vary over time due to legal, policy, funding and administrative factors.

Changes to statutes, regulations or industry standards, including interpretation and implementation of statutes, regulations or standards, could increase our cost of doing business or affect the competitive balance.

12 unchanged sentences

The interpretation of these laws and regulations, as well as evolving payment network rules, continue to change, which can create uncertainty.

These developments could negatively affect the willingness of some of our clients to accept credit or debit card or other electronic payment or result in less favorable terms to us in exchange for our clients to absorb those fees and costs, all of which would negatively affect our business.

These developments could negatively affect

the willingness of some of our clients to accept credit or debit card or other electronic payment or result in less favorable terms to us in exchange for our clients to absorb those fees and costs, all of which would negatively affect our business.

Laws and regulations, even if not directed at us, may require us to take significant efforts to change our services and solutions and may require that we incur additional compliance costs and change how we price our products and services to our clients and software integration partners.

2 unchanged sentences

In addition, even an inadvertent failure to comply with laws and regulations or evolving public perceptions of our business could damage our business or our reputation.

anti-money laundering, counter-terrorist financing, restrictions on foreign assets, banking and lending, and import and export restrictions.

Depending on how our products and services evolve, we may be subject to a variety of additional laws and regulations, including those governing money transmission, gift cards and other prepaid access instruments, electronic funds transfers, anti-money laundering, counter-terrorist financing, restrictions on foreign assets, banking and lending, and import and export restrictions.

Our efforts to comply with these laws and regulations could be costly and result in diversion of management time and effort and may still not guarantee compliance.

6 unchanged sentences

Such clients are also subject to negative public perceptions that their consumer lending activities constitute predatory or abusive lending to consumers, and concerns raised by consumer advocacy groups and government officials may lead to efforts to further regulate the industry in which many of our clients operate.

Similarly, our clients in the receivables management industry are typically subject to federal and state rules and regulations that establish specific requirements and procedures that debt collectors must follow when collecting consumer accounts.

The CFPB and the FTC have devoted substantial attention to debt collection activities, and, as a result, the CFPB and the FTC have brought multiple investigations and enforcement actions against debt collectors for violations of the FDCPA and other applicable laws.

Continued regulatory scrutiny by the CFPB and the FTC over debt collection practices may result in additional investigations and enforcement actions against our clients in the receivables management industry.

The FDCPA also provides for private rights of action against debt collectors, and permits debtors to recover actual damages, statutory damages and attorneys’ fees and costs for violations of its terms.

Similarly, our clients in the receivables management industry are subject to a complex and evolving framework of federal and state laws and regulations that govern debt collection practices.

These requirements are enforced by multiple regulatory authorities and, in some cases, through private litigation, and regulatory priorities, interpretations and enforcement approaches may vary over time.

Increased scrutiny of debt collection practices—whether through rulemaking, guidance, supervisory activity or enforcement actions—could result in investigations, penalties or required changes to our clients’ business practices.

In addition, the FDCPA and comparable state laws provide for private rights of action against debt collectors, including the potential for actual damages, statutory damages and attorneys’ fees and costs.

The combination of these factors could materially adversely affect the business of our clients and may force our consumer lender or receivables management clients to change their business models.

8 unchanged sentences

We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws that are similar in scope and subject matter.

payment processor or provider of payment settlement services, to investigations, fees, fines and disgorgement of funds if we are found to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

In addition, provisions of the Dodd-Frank Act that prohibit unfair, deceptive or abusive acts or practices, the Telemarketing Sales Act and other laws, rules and/or regulations, may directly impact the activities of certain of our clients, and in some cases may subject us, as the electronic payment processor or provider of payment settlement services, to investigations, fees, fines and disgorgement of funds if we are found to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services.

Various federal and state regulatory enforcement agencies, including the FTC and state attorneys general have authority to take action against non-banks that engage in UDAAP, or violate other laws, rules and regulations.

17 unchanged sentences

Our operations are subject to extensive tax liabilities, including federal and state and transactional taxes such as excise, sales/use, payroll, franchise, withholding and ad valorem taxes.

Changes in tax laws or their judicial or administrative interpretations could decrease the amount of revenues we receive, the value of any tax loss carryforwards and tax credits recorded on our balance sheet and the amount of our cash flow, and may have a material adverse impact on our business, financial condition and results of operations.

financial condition and results of operations.

Some of our tax liabilities are subject to periodic audits by the applicable taxing authority which could increase our tax liabilities.

5 unchanged sentences

If we cannot provide reliable financial reports or prevent fraud, our reputation and operating results would be harmed.

As part of our ongoing monitoring of internal control, we have discovered

in the past and may discover in the future material weaknesses or significant deficiencies in internal control that require remediation.

As part of our ongoing monitoring of internal control, we have discovered in the past and may discover in the future material weaknesses or significant deficiencies in internal control that require remediation.

A “material weakness” is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

10 unchanged sentences

Additionally, on July 8, 2024, we issued $287.5 million in aggregate principal amount of our 2.875% convertible senior notes due 2029 (the “2029 Notes”).

Our ability to service our obligations under our indebtedness, including the 2026 Notes, the 2029 Notes and any indebtedness we may incur under the Second Amended Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

On August 22, 2025, we repurchased $73.5 million of the 2026 Notes.

On or about February 2, 2026, we used borrowings from the Second Amended Credit Agreement, together with some of our cash hand, to satisfy the remaining obligations under the 2026 Notes.

Our ability to service our obligations under our indebtedness, including the 2029 Notes and any indebtedness we have incurred or may further incur under the Second Amended Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

If we are unable to generate the necessary cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive.

Our indebtedness under the Second Amended Credit Agreement bears interest at a variable rate, primarily based on the Secured Overnight Financing Rate (“SOFR”), and, as a result, our interest expense may increase if market interest rates rise, which could adversely affect our cash flows and results of operations.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time.

12 unchanged sentences

The breach of any of these covenants or restrictions could result in a default, which could result in the acceleration of our debt.

In the event of an acceleration of our indebtedness, we could be forced to apply all available cash

flows to repay such debt, which would reduce or eliminate distributions to us, which could also force us into bankruptcy or liquidation.

We may not have the ability to raise the funds necessary to settle conversions of the 2026 Notes or the 2029 Notes, or to repurchase the 2026 Notes or the 2029 Notes upon a fundamental change, and our future debt may contain, limitations on our ability to pay cash upon conversion or repurchase of the 2026 Notes and the 2029 Notes.

Holders of the 2026 Notes and the 2029 Notes (together “Notes”) have the right to require us to repurchase their Notes upon the occurrence of a fundamental change at a repurchase price equal to 100% of their principal amount, plus accrued and unpaid interest, if any.

Upon conversion of the 2026 Notes, unless we elect to cause to be delivered solely shares of our Class A common stock to settle such conversion, we will be required to make cash payments in respect of the 2026 Notes being converted.

In addition, upon conversion of the 2029 Notes, we will be required to make cash payments up to the aggregate principal amount of the 2029 Notes being converted and in respect of the remainder, if any, of our conversion obligation, we may elect to make cash payments or deliver shares of our Class A common stock, or a combination, to settle such conversion.

In the event of an acceleration of our indebtedness, we could be forced to apply all available cash flows to repay such debt, which would reduce or eliminate distributions to us, which could also force us into bankruptcy or liquidation.

We may not have the ability to raise the funds necessary to settle conversions of the 2029 Notes, or to repurchase the 2029 Notes upon a fundamental change, and our future debt may contain, limitations on our ability to pay cash upon conversion or repurchase of the 2029 Notes.

Holders of the 2029 Notes have the right to require us to repurchase their 2029 Notes upon the occurrence of a fundamental change at a repurchase price equal to 100% of their principal amount, plus accrued and unpaid interest, if any.

Upon conversion of the 2029 Notes, we will be required to make cash payments up to the aggregate principal amount of the 2029 Notes being converted and in respect of the remainder, if any, of our conversion obligation, we may elect to make cash payments or deliver shares of our Class A common stock, or a combination, to settle such conversion.

However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the 2029 Notes surrendered therefor or to pay cash with respect to the 2029 Notes being converted.

In addition, our ability to repurchase the 2029 Notes or to pay cash upon conversion of the 2029 Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

Our failure to repurchase the Notes at a time when the repurchase is required by the indenture governing the 2026 Notes and the indenture governing the 2029 Notes (together the “indentures”) or to pay any cash payable on future conversions of the Notes as required by the indentures, would constitute a default under the indentures.

A default under the indentures, or the fundamental change itself, could also lead to a default under our Second Amended Credit Agreement and other agreements governing our existing or future indebtedness.

Our failure to repurchase the 2029 Notes at a time when the repurchase is required by the indenture governing the 2029 Notes (the “indenture”) or to pay any cash payable on future conversions of the 2029 Notes as required by the indenture, would constitute a default under the indenture.

A default under the indenture, or the fundamental change itself, could also lead to a default under our Second Amended Credit Agreement and other agreements governing our existing or future indebtedness.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness, repurchase, make interest payments on or make cash payments upon conversion of the 2029 Notes.

The conditional conversion feature of the 2026 Notes and the 2029 Notes, if triggered, may adversely affect our financial condition and operating results.

In the event the conditional conversion feature of the 2026 Notes is triggered, holders of the 2026 Notes will be entitled to convert their 2026 Notes at any time during specified periods at their option.

If one or more holders elect to convert their 2026 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock, we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders do not elect to convert their 2026 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2026 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The conditional conversion feature of the 2029 Notes, if triggered, may adversely affect our financial condition and operating results.

In the event the conditional conversion feature of the 2029 Notes is triggered, holders of the 2029 Notes will be entitled to convert their 2029 Notes at any time during specified periods at their option.

1 unchanged sentence

In addition, even if holders do not elect to convert their 2029 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2029 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

Provisions in the indentures could delay or prevent an otherwise beneficial takeover of the Company

Certain provisions of the Notes and the indentures could make a third party attempt to acquire us more difficult or expensive.

For example, if a takeover constitutes a fundamental change, then we will be required to make an offer to the holders of the Notes to repurchase for cash all or part of their outstanding Notes.

Provisions in the indenture could delay or prevent an otherwise beneficial takeover of the Company

Certain provisions of the 2029 Notes and the indenture could make a third party attempt to acquire us more difficult or expensive.

For example, if a takeover constitutes a fundamental change, then we will be required to make an offer to the

holders of the 2029 Notes to repurchase for cash all or part of their outstanding 2029 Notes.

In addition, if a takeover constitutes a make-whole fundamental change, then we may be required to increase the conversion rate temporarily.

1 unchanged sentence

Risks Related to Our Ownership Structure

We are a holding company and our only material asset is our interest in Hawk Parent, and we are accordingly dependent upon distributions made by our subsidiaries to pay taxes, make payments under the Tax Receivable Agreement, meet our financial obligations under the 2026 Notes or the 2029 Notes and pay dividends.

We are a holding company with no material assets other than our ownership of limited liability company interests of Hawk Parent (the “Post-Merger Repay Units” and holders of such Post-Merger Repay Units other than the Company, the “Repay Unitholders”) and our managing member interest in Hawk Parent, and we have no independent means of generating revenue or cash flow.

24 unchanged sentences

We will have no obligation to distribute such cash (or other available cash other than any declared dividend) to our stockholders.

To the extent that we do not distribute such excess cash as dividends on Class A common stock or otherwise undertake ameliorative actions between Post-Merger Repay Units and shares of Class A common stock and instead, for example, hold such cash balances, Repay Unitholders that hold interests in Hawk Parent pre-Business Combination may benefit from any value attributable to such cash balances as a result of their ownership of Class A common stock following an exchange of their Post-Merger Repay Units, notwithstanding that such holders may previously have participated as holders of Post-Merger Repay Units in distributions by Hawk Parent that resulted in such excess cash balances being held by us.

from any value attributable to such cash balances as a result of their ownership of Class A common stock following an exchange of their Post-Merger Repay Units, notwithstanding that such holders may previously have participated as holders of Post-Merger Repay Units in distributions by Hawk Parent that resulted in such excess cash balances being held by us.

Dividends on our common stock, if any, will be paid at the discretion of our board of directors, which will consider, among other things, our business, operating results, financial condition, current and expected cash needs, plans for expansion and any legal or contractual limitations on our ability to pay such dividends.

19 unchanged sentences

However, a challenge to any tax benefits initially claimed by us may not arise for a number of years following the initial time of such payment or, even if challenged early, such excess cash payment may be greater than the amount of future cash payments that we might otherwise be required to make under the terms of the Tax Receivable Agreement and, as a result, there might not be future cash payments from which to net against.

As a result, in certain circumstances, we could make payments under the Tax Receivable Agreement in excess of our actual income or franchise tax savings, which could materially impair our financial condition.

control of us occur (as described in the Tax Receivable Agreement) or (iv) we are more than three months late in making of a payment due under the Tax Receivable Agreement (unless we in good faith determine that we have insufficient funds to make such payment), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Repay Unitholders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income.

result, in certain circumstances, we could make payments under the Tax Receivable Agreement in excess of our actual income or franchise tax savings, which could materially impair our financial condition.

Moreover, the Tax Receivable Agreement provides that, in the event that (i) we exercise our early termination rights under the Tax Receivable Agreement, (ii) we become bankrupt or undergo a similar insolvency event, (iii) certain changes of control of us occur (as described in the Tax Receivable Agreement) or (iv) we are more than three months late in making of a payment due under the Tax Receivable Agreement (unless we in good faith determine that we have insufficient funds to make such payment), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Repay Unitholders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income.

The lump-sum payment to the Repay Unitholders could be substantial and could exceed the actual tax benefits that we realize subsequent to such payment because such payment would be calculated assuming, among other things, that we would be able to use the assumed potential tax benefits in future years, and that tax rates applicable to us would be the same as they were in the year of the termination.

6 unchanged sentences

Future issuances or sales of substantial amounts of our Class A common stock in the public market, or the perception that such issuances or sales may occur, could cause the market price for our Class A common stock to decline.

Hawk Parent has outstanding an aggregate of 5,379,543 Post-Merger Repay Units as of February 25, 2024.

Hawk Parent has outstanding an aggregate of 5,285,883 Post-Merger Repay Units as of March 4, 2026.

Pursuant to the Exchange Agreement, Repay Unitholders have the right to elect to exchange such Post-Merger Repay Units into shares of our Class A common stock on a one-for-one basis, subject to the terms of the Exchange Agreement.

4 unchanged sentences

These factors could also make it more difficult for us to raise additional funds through offerings of our shares of Class A common stock or other securities at a time and at a price that we deem appropriate.

We also have outstanding $220 million aggregate principal amount of our 2026 Notes and $287.5 million aggregate principal amount of our 2029 Notes which are convertible into shares of our Class A common stock in certain circumstances.

We also have outstanding $287.5 million aggregate principal amount of our 2029 Notes which are convertible into shares of our Class A common stock in certain circumstances.

Investors will incur further dilution upon the conversion of any of our convertible senior notes if we elect to deliver shares of Class A common stock upon such conversion.

3 unchanged sentences

For example, the closing price per share of our Class A common stock on The Nasdaq Capital Market ranged from a low of $3.00 to a high of $7.70 during the period from January 2, 2025 to December 31, 2025.

This volatility could be the result of changes in our volumes, revenue, earnings and margins or general market and economic factors.

This volatility could be the result of changes in our volumes, revenue,

earnings and margins or general market and economic factors.

If our future operating results or margins are below the expectations of stock market analysts or our investors, our stock price will likely decline.

19 unchanged sentences

• the ability of our board of directors to amend our bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquirer to amend our bylaws to facilitate an unsolicited takeover attempt;

• advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which could preclude stockholders from bringing matters before annual or special meetings of stockholders and delay changes in our board of directors and also may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us.

and also may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us.

In addition, as a Delaware corporation, we are generally subject to provisions of Delaware law, including the DGCL.

21 unchanged sentences

Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually.

As part of these policies and procedures, we maintain a Security Incident Response Plan (the “SIRP”) that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business.

During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.

3 unchanged sentences

We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards.

Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

Our systems include third party logging, intrusion detection and prevention systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

Third Parties

19 unchanged sentences

We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business.

The Security and Privacy Steering Committee’s responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices.

The Security and Privacy Steering Committee’s responsibilities include oversight of policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices.

The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer).

The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department.

department, our finance department and various units within our technology department.

Our CTO also currently serves as a member of the Security and Privacy Steering Committee.

4 unchanged sentences

Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school.

He also maintains a Certificate Information Systems

Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2).

He also maintains an Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2).

Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years.

7 unchanged sentences

East Moline, Illinois

Tempe, Arizona

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business