Item 1. Business
Item 1. Business
Organizational Structure and Corporate Information
Repay Holdings Corporation was incorporated as a Delaware corporation on July 11, 2019 in connection with the closing of a transaction (the “Business Combination”) pursuant to which Thunder Bridge Acquisition Ltd., a special purpose acquisition company organized under the laws of the Cayman Islands (“Thunder Bridge”), (a) domesticated into a Delaware corporation and changed its name to “Repay Holdings Corporation” and (b) consummated the merger of a wholly owned subsidiary with and into Hawk Parent Holdings, LLC, a Delaware limited liability company (“Hawk Parent”).
Unless otherwise noted or unless the context otherwise requires, the terms “we”, “us”, “Repay” and the “Company” and similar references refer (1) before the Business Combination, to Hawk Parent and its consolidated subsidiaries and (2) from and after the Business Combination, to Repay Holdings Corporation and its consolidated subsidiaries. Unless otherwise noted or unless the context otherwise requires, “Thunder Bridge” refers to Thunder Bridge Acquisition. Ltd. prior to the consummation of the Business Combination.
We are headquartered in Atlanta, Georgia. Our legacy business was founded as M & A Ventures, LLC, a Georgia limited liability company doing business as REPAY: Realtime Electronic Payments (“REPAY LLC”), in 2006 by current executives John Morris and Shaler Alias. Hawk Parent was formed in 2016 in connection with the acquisition of a majority interest in the successor entity of REPAY LLC and its subsidiaries (the “2016 Recapitalization”) by certain investment funds sponsored by, or affiliated with, Corsair Capital LLC (“Corsair”).
Business Overview
Since a significant portion of our revenue is derived from volume-based payment processing fees on card transactions, card payment volume is a key operating metric that we use to evaluate our business. We are a leading payments technology company. We provide integrated payment processing solutions to industry-oriented vertical markets in which businesses have specific and bespoke transaction processing needs. We refer to these markets as “vertical markets” or “verticals.”
We are a payments innovator, differentiated by our proprietary, integrated payment technology platform and our ability to reduce the complexity of electronic payments for businesses. We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our clients’ needs and the embedded nature of our integrated payment solutions will drive strong growth by attracting new clients and fostering long-term client relationships.
Since a significant portion of our revenue is derived from volume-based payment processing fees, card payment volume is a key operating metric that we use to evaluate our business. We processed approximately $20.5 billion of total card payment volume in 2021. Our year-over-year card payment volume growth was approximately 35% in 2021 and 42% in 2020. As of December 31, 2021, we had over 18,000 clients. Our top 10 clients, with an average tenure of approximately four years, contributed to approximately 14% and 18% of total gross profit during the year ended December 31, 2021 and the year ended December 31, 2020, respectively.
Our leading competitive position and differentiated solutions have enabled us to realize unique advantages in fast-growing and strategically-important segments of the payments market. We provide payment processing solutions to clients primarily operating in the personal loans, automotive loans, receivables management, and business-to-business verticals. Our payment processing solutions enable consumers and businesses in these verticals to make payments using electronic payment methods, rather than cash or check, which have historically been the primary methods of payment in these verticals. We believe that a growing number of consumers and businesses prefer the convenience and efficiency of paying with cards and other electronic methods and that we are poised to benefit as these verticals continue to shift from cash and check to electronic payments. The personal loans vertical is predominately characterized by installment loans, which are typically utilized by consumers to finance everyday expenses. The automotive loans vertical predominantly includes subprime automotive loans, automotive title loans and automotive buy-here-pay-here loans and also includes near-prime and prime automotive loans. Our receivables management vertical relates to consumer loan collections, which typically enter the receivables management process due to delinquency on credit card bills or as a result of major life events, such as job loss or major medical issues. The business-to-business vertical relates to transactions occurring between a wide variety of enterprise clients, many of which operate in the manufacturing, wholesale, distribution, healthcare and education industries.
4
Our go-to-market strategy combines direct sales with integrations with key software providers in our target verticals. The integration of our technology with key software providers in the verticals that we serve, including loan management systems, dealer management systems (“DMS”) , collection management systems, and enterprise resource planning software systems, allows us to embed our omni-channel payment processing technology into our client s’ critical workflow software and ensure seamless operation of our solutions within our client s’ enterprise management systems. We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system. We have successfully integrated our technology solutions with numerous, widely-used enterprise management systems in the verticals that we serve, which makes our platform a more compelling choice for the businesses that use them. Moreover, our relationships with our partners help us to develop deep industry knowledge regarding trends in client needs. Our integrated model fosters long-term relationships with our client s, which supports our volume retention rates that we believe are above industry averages. As of December 31, 20 2 1 , we maintained approximately 2 22 integrations with various software providers.
Strategic acquisitions are another important part of our long-term strategy. Our acquisitions have enabled us to further penetrate existing vertical markets, access new strategic vertical markets, broaden our technology and solutions suite, and expand our client base. We continue to focus on identifying strategic acquisition candidates in an effort to drive accretive growth. Our growth strategy is to continue to build our company through a disciplined combination of organic and acquisitive growth.
Growth Strategies
We intend to drive future growth in the following ways:
Increase Penetration in Existing Verticals
We expect to grow meaningfully by continuing to provide innovative payment solutions and client support to our existing clients as well as new clients in the verticals that we currently serve. In addition, our business model allows us to benefit from the growth of our clients and software integration partners. As our clients’ payment volumes and transactions increase, our revenues increase as a result of the fees we charge for processing these payments. Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment. We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.
New Vertical and Geographic Expansion
We also expect that we will find attractive growth potential in certain verticals in which we currently have limited operations or do not operate. Though we offer highly customized payment solutions to our clients, our core technology platform is comprehensive and can be utilized to penetrate other strategic vertical markets. Additionally, we envision growing our geographic footprint, as new territories continue to present new business opportunities. For example, we are focused on expanding our Canadian operations, as the demand for our solutions among existing and prospective Canadian clients remains strong.
Strengthen and Extend Our Solution Portfolio through Continued Innovation.
As we further integrate our solution into our clients’ workflows, we will look to continue to innovate on our solution set and broaden our suite of services. Our acquisition of TriSource Solutions, LLC (“TriSource”) and our continued investment in our technology capabilities position us to provide value-added services that will address the evolving needs of our clients as they seek to best serve their customers. The ability to serve clients across verticals and to be integrated across various software platforms enables us to better understand the needs of clients across verticals and to scale our innovative solutions to a broad segment of the market.
Continue to Drive Operational Efficiencies
As we continue to grow, we expect to become a more significant partner to our sponsor banks, third party processors and software integration partners, which we expect will give us greater leverage as we expand our contractual relationships with them. We plan to continue to drive operating leverage in our non-technology personnel expenditures, as we believe that we can process larger payment volumes without significant increases to our personnel and operating expenses.
5
Strategic Acquisitions
From January 1, 2016 through December 31, 2021, we have successfully acquired eleven businesses. Given the large size and attractive growth trends of our current addressable market, we are primarily focused on growing our business organically. However, we may selectively pursue strategic acquisitions as opportunities arise that meet our internal requirements for the use of capital and return on investment. Some of these opportunities may include those that enable us to acquire new capabilities that may be harder to develop in-house, gain entrance into new segments of the market, enter new markets, or consolidate our existing market.
Solutions
We provide our clients with comprehensive solutions relating to the following methods of electronic payment:
•
Credit and Debit Processing — Allows our clients to accept card payments. These payments can be made using any of our payment channels, as further described below.
•
Virtual Credit Card Processing — Our virtual credit card product offering enables our clients to automate their payables transactions by sending single-use virtual credit cards to their suppliers.
•
Automated Clearing House (“ACH”) Processing — Our ACH processing capabilities allow our clients to send and accept traditional and same-day ACH transactions.
•
Enhanced ACH Processing — Provides the same functionality as our standard ACH processing capability, but with the added benefit of incremental transaction and reconciliation data.
•
Instant Funding — Our instant funding capabilities allow our clients to transfer funds directly to a consumer’s debit or prepaid card. We have created a proprietary process that decreases processing delays typically associated with traditional fund disbursements.
The above payment and funding methods are processed through our proprietary payment channels:
•
Web-based
•
Virtual Terminal — A terminal that provides virtual payment access for processing of ACH or card transactions.
• Hosted Payment Page — A client-branded terminal that enables ACH and card transaction processing.
• Online Client Portal — A consumer-facing, client-specific website that gives a client’s customer the ability to pay online and view account information anywhere, anytime. A Repay hosted website may be stand alone or integrated with any other software application.
•
Mobile Application — We provide clients the ability to accept payments via a mobile application on a customized, white-label basis.
•
Text-to-Pay — Allows a business’ customer to pay with a simple text message after receiving an SMS alert that reminds such customer when payments are due.
•
Interactive Voice Response (“IVR”) — A secure and flexible option to pay over the phone, 24 hours a day, 7 days a week, via a 1-800 number with bilingual capabilities.
•
Point of Sale (“POS”) — We provide payment acceptance at brick-and-mortar locations through POS equipment that requires a client’s customer to provide a card.
6
Sales and Distribution
Our sales effort primarily consists of two strategies: first, our direct sales representatives, who focus on each of our core verticals, and second, our software integration partners, which enable the direct salesforce to more effectively access new client opportunities and respond to inbound leads.
Direct Sales Representatives
Our sales representatives are organized by vertical market and account size. Direct sales representatives work with our clients and software integration partners to understand our clients’ desired payment solutions and then communicate those desires to our product and technology teams, who build a customized suite of products and payment channels tailored to our clients’ specific needs. We also maintain a sales support team that supports the onboarding process.
Software Integration Partners
As of December 31, 2021, we were integrated with approximately 222 software partners that are providers of our clients’ primary enterprise management systems. Our integrations ensure seamless delivery of our full suite of payment processing capabilities to our clients. These integrations are also a critical part of our marketing strategy, as many clients will prefer to award their payments business to payments processors who have worked to integrate their solutions into the client’s enterprise management systems.
Operations
We believe that we have developed an effective operations system, including our proprietary onboarding, compliance and client oversight processes, which is structured to enhance the performance of our platform and support our clients.
Client and Transaction Risk Management
We target clients that we identify as low-risk through the development of underwriting policies and transaction management procedures to manage approval of new accounts and to establish ongoing monitoring of client accounts. Effective risk management aids us in minimizing client losses, such as those relating to chargebacks or similar rejected transactions, and avoiding fraud for the mutual benefit of our clients, our sponsor banks and ourselves.
Proprietary Compliance Management System . We have developed proprietary onboarding, compliance, and client oversight processes, of which our Compliance Management System (“CMS”) is a part. Our CMS, developed in conjunction with the Third Party Payment Processors Association, is based on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.
Client Onboarding . We believe we maintain rigorous underwriting standards. Prospective clients submit applications to our credit underwriting department, which performs verification and credit-related checks on all applicants. Each client is assigned a risk profile based on sponsor bank requirements, as well as additional criteria specified by us. Our sponsor banks periodically review and approve of our underwriting policies to ensure compliance with applicable law, regulations and payment network rules. Upon approval, the ongoing risk level of a client is monitored and adjusted on a monthly basis based on additional data relating to such client.
Client Monitoring . Each client’s file is assigned one of three risk levels (low, medium or high) corresponding to several client behaviors. We review and adjust these risk levels on a monthly basis and additionally subject them to more in-depth quarterly reviews. We also engage third parties and rely on internal reporting to identify and monitor credit/fraud risk. We generate client-specific reports that compile daily and historical transactions, which may include average ticket, transaction volume, refund and chargeback levels and authorization history, which we utilize in order to identify suspicious processing activity. We review these reports on a daily basis and suspend any irregular processing activity, which is subject to review, remediation and, as appropriate, suspension of either an individual or batch of transactions or a particular client, as applicable.
Investigation and Loss Prevention . If a client exceeds the parameters established by our underwriting and/or risk management team or we determine that a client has violated the payment network rules or the terms of its service agreement with us, one of our team members will identify and document the incident. We then review the incident to determine the
7
actions taken or that we can take to reduce our exposure to loss and the exposure of our client to liability. As a part of this process, we may request additional transaction information, withhold or divert funds, verify delivery of merchandise or, in some circumstances, deactivate the client account, include the client on the Network Match List to notify our industry of the client ’s behavior or take legal action against the client .
Collateral . We require some of our clients to establish cash or non-cash collateral reserves, which may include certificates of deposit, letters of credit, rolling merchant reserves or upfront cash. This collateral is utilized in order to offset potential credit or fraud risk liability that we may incur. We attempt to hold such collateral reserves for as long as we are exposed to a loss resulting from a client’s payment processing activity.
Chargebacks . The payment networks permit the reversal of a money transfer, a chargeback, up to six months (or in rare cases, a longer time frame) after the later of the date the transaction is processed or the delivery of the product or service to the cardholder. If the client incurring the chargeback is unable to fund the refund to the card-issuing bank, we are required to do so by the rules of the payment networks and our contractual arrangements with our sponsor banks. During the year ended December 31, 2021, we believe our chargeback rate was under 1% of our payment volume.
Security, Disaster Recovery, and Back-up Systems
We adhere to industry security standards to protect the payment information that we process. We regularly update our network and apply operating system security releases and malware defenses. We use a third party vendor solution for security education materials. Every employee and contractor is required to successfully complete annual security awareness training. We routinely retain external parties to audit our systems’ compliance with current security standards as established by the Payment Card Industry Data Security Standards (“PCI DSS”), Service Organization Control ("SOC1 Type II,” “SOC2 Type II”), Health Insurance Portability and Accountability Act (“HIPAA”) and International Organization for Standardization (“ISO 27001”) and to test our systems against vulnerability to unauthorized access. We utilize third party vendors for internal and external penetration testing. Further, we use one of the most advanced commercially available technologies to encrypt the cardholder numbers and client data that we store in our databases. Additionally, we have a dedicated team responsible for continuous monitoring and security incident response. This team also develops, maintains, tests and verifies our incident response plan. Disaster recovery is built into our infrastructure through redundant hardware and software applications hosted in two distinct cloud regions. Our primary cloud region is set up to be replicated, substantially on a real time basis, by our secondary cloud region such that if our primary cloud region becomes impaired or unavailable, operations are redirected to the secondary cloud region. Our incident response team tests these systems each quarter to assess the effectiveness of our disaster recovery plan, including staff readiness and operational capability.
Third Party Processors and Sponsor Banks
We partner with institutions in the payment chain to provide authorization, settlement and funding services in connection with our clients’ transactions. These institutions include third party processors and sponsor banks, who sit between us, acting as the merchant acquirer or payment processor, and the payment networks, such as Visa, MasterCard and Discover. These processors and vendors in turn have agreements with the payment networks, which permit them to route transaction information through their networks in exchange for fees.
When we facilitate a transaction as a merchant acquirer, we utilize third party processors such as Total Systems Services, Inc. (a subsidiary of Global Payments, Inc.). Under such processing arrangements, the third-party processors and vendors receive processing fees based on a percentage of the payment volume they process.
In order for us to process and settle transactions for our clients, we have entered into sponsorship agreements with banks that are members of the payment networks. We are required to register with the payment networks through these bank partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks. Our member bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (for example, known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions. Our relationships with multiple sponsor banks give us the flexibility to shift payment volumes between them, which helps us to secure more competitive pricing for our clients and to maintain redundancy.
When we facilitate a client’s payment to its suppliers or vendors, we typically utilize the services of third party program managers, such as Wex Inc. and Comdata Inc. (a subsidiary of FleetCor Technologies, Inc.), who have arrangements with banks to operate card issuance programs. Under such arrangements, the program manager and issuing bank retain a portion of the interchange generated by each transaction. Under the applicable contractual arrangements, our clients are
8
generally required to prefund these payments. Because we are not a licensed money transmitter, we have entered into custodial agreements with banks or other financial institutions who will hold our c lient s’ funds in trust.
Competitive Conditions and Market Trends
We compete with a variety of payment processing companies that have different business models, go-to-market strategies and technical capabilities. We compete with a large number of small payments processing companies that provide integrated payments solutions and/or related hardware to clients within our existing verticals. More broadly in the overall payments industry, our payment and software solutions compete against many forms of financial services and payment systems, including Open Edge (a division of Global Payments), ACI Worldwide, Inc., Paya, Inc., Paymentus Corporation, AvidXchange, Corporate Spending Innovations (a division of Edenred), Nvoicepay (a division of FleetCor Technologies, Inc.) and Zelis. We also compete against many traditional merchant acquirers, such as financial institutions, affiliates of financial institutions and payment processing companies in the payment processing industry, including Bank of America Merchant Services, Elavon, Inc. (a subsidiary of U.S. Bancorp), Wells Fargo Merchant Services, Global Payments, Inc., WorldPay, Inc. (a subsidiary of Fidelity National Information Services, Inc.) and Total Systems Services, Inc. (a subsidiary of Global Payments, Inc.). We believe the most significant competitive factors in the markets in which we compete are: (1) economics, including fees charged to merchants and commission payouts to software integration partners; (2) product offering, including emerging technologies and development by other participants in the payments ecosystem; (3) service, including product functionality, value-added solutions and strong client support for both clients and software integration partners; and (4) reliability, including a strong reputation for quality service and trusted software integration partners. Our competitors include large and well-established companies, including banks, credit card providers, technology and ecommerce companies and traditional retailers, many of which are larger than we are, have a dominant and secure position in the markets in which they operate or offer other products and services to consumers and clients which we do not offer. Moreover, we compete against all forms of payments, including credit cards, bank transfers, and traditional payment methods, such as cash and check.
We believe there is a significant digital shift in our industry. Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment. In addition, the COVID-19 pandemic and the resulting changes in consumer behavior has led to an accelerated shift to electronic payments. We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.
We have experienced in the past, and may continue to experience, seasonal fluctuations in our volumes and revenues as a result of consumer spending patterns. Volumes and revenues during the first quarter of the calendar year tend to increase in comparison to the remaining three quarters of the calendar year on a same store basis. This increase is due to consumers’ receipt of tax refunds and the increases in repayment activity levels that follow.
Acquisitions
Our historical acquisition activity has allowed us to access new markets, acquire industry talent, broaden our product suite, and supplement organic growth. Our current acquisition strategy focuses on integrated payments companies serving attractive vertical markets and opportunities to broaden our product offerings. From January 1, 2016 through December 31, 2021, we have completed eleven acquisitions, which are described below. These acquisitions were of payment companies and are representative of the acquisitions we envision consummating in the future.
Sigma Acquisition
Effective as of January 1, 2016, we acquired substantially all of the assets of Sigma Payment Solutions, Inc. (“Sigma”). Sigma was an electronic payment solutions provider to the automotive finance industry. The transaction marked our expansion into the automotive finance space. We have benefitted greatly from Sigma’s deep integrations with automotive finance software platforms, or DMS.
PaidSuite Acquisition
On September 28, 2017, we acquired substantially all of the assets of PaidSuite, Inc. and PaidMD, LLC (collectively, “PaidSuite”). PaidSuite was an electronic payment solutions provider to the accounts receivable management industry. The transaction accelerated our growth into the accounts receivable management space via client and software integration partner relationships.
9
Paymaxx Acquisition
On December 15, 2017, we acquired substantially all of the assets of Paymaxx Pro, LLC (“Paymaxx”). The acquisition of Paymaxx has been highly complementary to our earlier acquisition of Sigma and has bolstered our position in the niche automotive finance market. As part of the acquisition, we acquired increased distribution capabilities in the form of an internal sales force and numerous DMS integrations.
TriSource Acquisition
On August 14, 2019, we acquired all of the equity interests of TriSource. Since 2012, we have used TriSource as one of our primary third-party processors for settlement solutions when we facilitate transactions as a merchant acquirer. The acquisition of TriSource has provided further control over our transaction processing ecosystem and accelerated product delivery capabilities.
APS Acquisition
On October 14, 2019, we acquired substantially all of the assets of American Payment Services of Coeur D’Alene, LLC, North American Payment Solutions LLC, and North American Payment Solutions Inc. (collectively, “APS”) . The acquisition of APS meaningfully expanded our addressable market by enabling us to access the business-to-business vertical.
Ventanex Acquisition
On February 10, 2020, we acquired all of the equity interests of CDT Technologies, LTD. d/b/a Ventanex (“Ventanex”). The acquisition of Ventanex accelerated our entry into the healthcare payments vertical.
cPayPlus Acquisition
On July 23, 2020, we acquired all of the equity interest of cPayPlus, LLC (“cPayPlus”). The acquisition of cPayPlus further expanded our business-to-business automation and payment offering to include accounts payable automation and payment solutions for both existing and prospective clients across all business lines.
CPS Acquisition
On November 2, 2020, we acquired all of the equity interests of CPS Payment Services, LLC, Media Payments, LLC, and Custom Payment Systems, LLC (collectively, “CPS”). The acquisition of CPS enhanced our business-to-business accounts payable automation offerings and introduced our solutions to new verticals including education, government, and media sectors.
BillingTree Acquisition
On June 15, 2021, we acquired all of the equity interests of BT Intermediate, LLC (together with its subsidiaries, “BillingTree”). The acquisition of BillingTree further expanded our position in the healthcare, credit union, and accounts receivable management industries and significantly enhanced our scale and our client diversification.
Kontrol Acquisition
On June 22, 2021, we acquired substantially all of the assets of Kontrol LLC (“Kontrol”). The acquisition of Kontrol grew our accounts payable automation business and enabled us to leverage our existing B2B technology infrastructure to increase our virtual card volume.
Payix Acquisition
On December 29, 2021, we acquired Payix Holdings Incorporated (together with its subsidiary, “Payix”). The acquisition of Payix expanded our position in the large and growing automotive finance market and provided further access to software integrations with leading loan management system and DMS integrations.
Government Regulation
We operate in an increasingly complex and ever evolving legal and regulatory environment. Our and our clients’ businesses are subject to a variety of federal, state and local laws and regulations, as well as the rules and standards of the payment networks that we utilize to provide our electronic payment services. While in some cases payment processors such
10
as Repay are not directly regulated by governmental agencies, because of the rules and regulations enacted at the state and federal level that affect our client s and sponsor banks, we have developed and continually evaluate and update our compliance models to keep up with the rapid evolution of the legal and regulatory regime our client s and sponsor banks face. We are also subject to legal and regulatory requirements which govern the use, storage and distribution of the information we collect from our client s and cardholders while processing transactions.
Dodd-Frank Act
The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) and its related rules and regulations have resulted in significant changes to the regulation of the financial services industry, including the electronic payment industry. Under the Dodd-Frank Act, debit interchange transaction fees that a card issuer receives and are established by a payment card network for an electronic debit transaction are regulated by the Board of Governors of the Federal Reserve System (the “Federal Reserve”). The Dodd-Frank Act and the Federal Reserve’s implementing regulations require that such interchange fees be “reasonable and proportional” to the cost incurred by the issuer in processing the transactions. Federal Reserve regulations implementing this “reasonable and proportional” requirement have capped debit interchange rates for card issuers operating in the United States with assets of $10 billion or more. In addition, the regulations contain certain prohibitions on card brand network exclusivity and merchant routing restrictions of debit card transactions. As a result of the Dodd-Frank Act, merchants are also allowed to set minimum dollar amounts (within certain parameters) for the acceptance of a credit card, and they are allowed to provide discounts or incentives to entice consumers to pay with an alternative payment method, such as cash, checks or debit cards.
The Dodd-Frank Act also created the Consumer Financial Protection Bureau (the “CFPB”), which has rulemaking authority over consumer protection laws, including the authority to regulate consumer financial products in the United States, including consumer credit, deposit, payment, and similar products. The CFPB may also have authority over us as a provider of services to regulated financial institutions in connection with consumer financial products. Any new rules or regulations implemented by the CFPB, and other similar regulatory agencies in other jurisdictions, or pursuant to the Dodd-Frank Act that are applicable to us or our clients’ businesses, or any adverse changes thereto, could increase our cost of doing business or limit our current offerings of integrated payment solutions.
Privacy and Information Security Regulations
We provide services that may be subject to various state and federal privacy laws and regulations. Relevant federal privacy laws include the Gramm-Leach-Bliley Act of 1999, which (along with its implementing regulations) restricts certain collection, processing, storage, use and disclosure of personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These rules also impose requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. Our business may also be subject to the Fair Credit Reporting Act of 1970, as amended by the Fair and Accurate Credit Transactions Act of 2003, which regulates the use and reporting of consumer credit information and imposes disclosure requirements on entities who take adverse action based on information obtained from credit reporting agencies. In addition, there are state laws governing the collection of personal information, including those restricting the ability to collect and utilize certain types of information such as Social Security and driver’s license numbers. Certain state laws impose similar privacy obligations as well as obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. For example, the California Consumer Privacy Act (“CCPA”) of 2018, which became effective January 1, 2020, imposes more stringent requirements with respect to California data privacy. The CCPA includes provisions that give California residents expanded rights to access and delete certain personal information, opt out of certain personal information sharing, and receive detailed information about how certain personal information is used.
Health Insurance Portability and Accountability Act & Health Information Technology for Economic and Clinical Health Act
HIPAA and its related rules and regulations establish policies and procedures for maintaining the privacy and security of individually identifiable health information (“Protected Health Information”). The Health Information Technology for Economic and Clinical Health Act and its related rules and regulations extended the privacy and security provisions of HIPAA to “Business Associates” of “Covered Entities” (each as defined by HIPAA).
Some of our clients are Covered Entities. In providing certain services for our Covered Entity clients, we may receive, maintain, and transmit Protected Health Information on their behalf, and we may be a Business Associate. To the extent we are a Business Associate, we are subject to HIPAA rules and regulations regarding privacy and security of Protected Health Information. In connection with certain services, we may enter into Business Associate Agreements with
11
our Covered Entity client s, requiring compliance with HIPAA rules and regulations, and defining permissible uses and disclosures of Protected Health Information.
Anti-Money Laundering and Counter-Terrorism Regulation
Our business is subject to U.S. federal anti-money laundering laws and regulations. We are also subject to certain economic and trade sanctions programs that are administered by OFAC that prohibit or restrict transactions to or from (or transactions dealing with) narcotics traffickers, terrorists, terrorist organizations, certain individuals, specified countries, their governments and, in certain circumstances, their nationals. Similar anti-money laundering, counter-terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified on lists maintained by organizations similar to OFAC in several other countries and which may impose specific data retention obligations or prohibitions on intermediaries in the payment process. We have developed and continue to enhance compliance programs and policies to monitor and address related legal and regulatory requirements and developments.
Unfair or Deceptive Acts or Practices
We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws similar in scope and subject matter thereto. In addition, laws prohibiting these activities and other laws, rules and or regulations, including the Telemarketing Sales Rule, may directly impact the activities of certain of our clients, and in some cases may subject us, as the client’s payment processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we are deemed to have aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services. Various federal and state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations. To the extent we are processing payments or providing services for a client suspected of violating such laws, rules and regulations, we may face enforcement actions and, as a result, incur losses and liabilities that may adversely affect our business.
In addition, the Dodd-Frank Act gave the CFPB broad authority to prohibit “unfair, deceptive or abusive acts or practices” (“UDAAP”) in connection with the provision of consumer financial products and services. The CFPB has extended certain UDAAP-related provisions of the Dodd-Frank Act to directly apply to payment processors.
Indirect Regulatory Requirements
Certain of our clients and our sponsor banks are financial institutions that are directly subject to various regulations and compliance obligations issued by the CFPB, the Federal Reserve, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration and other agencies responsible for regulating financial institutions, which includes state financial institution regulators. While these regulatory requirements and compliance obligations do not apply directly to us, many of these requirements materially affect the services we provide to our clients and us overall. The financial institution regulators have imposed requirements on regulated financial institutions to manage their third-party service providers. Among other things, these requirements include performing appropriate due diligence when selecting third-party service providers; evaluating the risk management, information security, and information management systems of third-party service providers; imposing contractual protections in agreements with third-party service providers (such as performance measures, audit and remediation rights, indemnification, compliance requirements, confidentiality and information security obligations, insurance requirements and limits on liability); and conducting ongoing monitoring, diligence and audit of the performance of third-party service providers. Accommodating these requirements applicable to our clients impose additional costs and risks in connection with our relationships with financial institutions. We expect to expend significant resources on an ongoing basis in an effort to assist our clients in meeting their legal requirements.
Additionally, our clients, particularly those in the personal loans, automotive loans and receivables management verticals, are subject to various federal, state and local laws and regulations that impose restrictions and requirements on their businesses. For personal lenders and automotive lenders, these laws and regulations could include limitations on interest rates and fees, maximum loan amounts and the number of simultaneous or consecutive loans, imposition of required waiting periods between loans, loan extensions and refinancing, requiring payment schedules (including maximum and minimum loan durations) or repayment plans for borrowers claiming inability to repay loans, mandating disclosures, security for loans, licensing requirements and, in certain jurisdictions, database reporting and loan utilization information. For receivables management companies, these laws and regulations could include laws and regulations (including the federal Fair Debt Collection Practices Act (“FDCPA”) and comparable state laws) regarding the time, place and manner of communications
12
with consumers regarding debt collection and prohibitions or limitations on certain debt collection practices . Lastly, some of our clients are subject to various state laws and regulations that prohibit or limit the imposition of a surcharge or convenience fee in connection with their customers use of a payment card or other form of electronic payment.
Payment Network Rules and Standards
Payment networks, such as Visa, MasterCard and American Express, establish their own rules and standards that allocate liabilities and responsibilities among the payment networks and their participants. These rules and standards, including the Payment Card Industry Data Security Standards, govern a variety of areas, including how consumers and customers may use their cards, whether (and the terms under which) convenience fees or surcharges may be imposed in connection with the use of their cards, the security features of cards, security standards for processing, data security and allocation of liability for certain acts or omissions, including liability in the event of a data breach. The payment networks may change these rules and standards from time to time as they may determine in their sole discretion and with or without advance notice to their participants. These changes may be made for any number of reasons, including as a result of changes in the regulatory environment, to maintain or attract new participants, or to serve the strategic initiatives of the networks, and may impose additional costs and expenses on or be disadvantageous to certain participants. Participants are subject to audit by the payment networks to ensure compliance with applicable rules and standards. The networks may fine, penalize or suspend the registration of participants for certain acts or omissions or the failure of the participants to comply with applicable rules and standards.
In order for us to process and settle transactions for our clients, we have entered into sponsorship agreements with banks that are members of the payment networks. We are required to register with the payment networks through these bank partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks’ rules and standards governing access to those networks. Our bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions. Payment network rules restrict us from performing funds settlement and require that merchant settlement funds be in the possession of the member bank until the merchant is funded. These restrictions place the settlement assets and liabilities under the control of the member bank.
Our sponsorship agreements give our sponsor banks substantial discretion in approving certain aspects of our business practices, including our solicitation, application and qualification procedures for clients and the terms of our agreements with clients, and provide them with the right to audit our compliance with the payment network rules and guidelines. We are also subject to network operating rules and guidelines promulgated by the National Automated Clearing House Association (“NACHA”) relating to payment transactions we process using the Automated Clearing House Network. Like the payment networks, NACHA may update its operating rules and guidelines at any time, which can require us to take more costly compliance measures or to develop more complex monitoring systems. Similarly, our ACH sponsor banks have the right to audit our compliance with NACHA’s rules and guidelines, and are given wide discretion to approve certain aspects of our business practices and terms of our agreements with ACH clients.
Other Regulation
We are subject to U.S. federal and state unclaimed or abandoned property (escheat) laws, which require us to turn over to certain government authorities the property of others we hold that has been unclaimed for a specified period of time, such as account balances that are due to a software integration partner or client following discontinuation of its relationship with us. The Housing Assistance Tax Act of 2008 requires certain merchant acquiring entities and third-party settlement organizations to provide information returns for each calendar year with respect to payments made in settlement of electronic payment transactions and third-party payment network transactions occurring in that calendar year. Reportable transactions are also subject to backup withholding requirements.
The foregoing is not an exhaustive list of the laws and regulations to which we are subject and the regulatory framework governing our business is changing continuously. See “Risk Factors — Risks Related to Our Business” in Part I, Item 1A of this Annual Report on Form 10-K.
Intellectual Property
Certain of our products and services are based on proprietary software and related payment systems solutions. We rely on a combination of copyright, trademark, and trade secret laws, as well as employee and third-party non-disclosure, confidentiality, and other contractual arrangements to establish, maintain, and enforce our intellectual property rights in our
13
technology, including with respect to our proprietary rights related to our products and services. In addition, we license technology from third parties that is integrated into some of our solutions.
We own a number of registered service marks, including REPAY® and REPAY REALTIME ELECTRONIC PAYMENTS®, and we have other pending applications. We also own a number of domain names, including www.repay.com. For additional information regarding some of the risks relating to our intellectual property see “Risk Factors — Risks Related to Our Business — We may not be able to successfully manage our intellectual property and may be subject to infringement claims.” in Part I, Item 1A of this Annual Report on Form 10-K.
Human Capital
Our employees are a critical component of our success. As of December 31, 2021, we employed approximately 552 full-time employees throughout the U.S. and Canada. We have 14 office locations in the U.S. and have a remote employee presence in 37 states. During 2021, we added 266 new employees (including 161 through acquisitions). None of our employees are represented by a labor union or covered by a collective bargaining agreement.
We strive to create and maintain a special culture at REPAY that focuses on empowerment, driving performance, collaboration, and transparency. Our strong emphasis on culture is intended to empower our employees to make decisions and develop themselves personally and professionally. Particularly in light of our acquisition strategy, one of our priorities is to maintain and enhance our culture as we grow in employee size and integrate new team members.
We participate in an annual employee engagement and feedback survey which allows all full-time employees to anonymously give us feedback on our workplace culture, employee programs, and more. In 2021, we had 90% of participants say we are a great place to work. Our employees’ feedback from the annual surveys have allowed us to be certified as a Great Place to Work® for the last five consecutive years. In 2021, we were recognized by Fortune® as a Best Workplace in Financial Services and Insurance. We take employee feedback seriously and share the results of the survey, along with an action plan of how we can continue to improve, to all employees.
Attracting, developing, and retaining top talent is a priority at REPAY and we have a dedicated human resources team that focuses on these initiatives. To ensure we stay competitive in the current talent market, we strive to make it clear to our people that we value and appreciate them. The majority of our workforce is offered flexible or fully remote work flexible schedules. We foster a culture of rewards and recognition and incentivize our people with opportunities for growth within the company. Our compensation strategy gives us competitive advantages by offering competitive salaries, bonus potential and employee ownership opportunities for a meaningful portion of our employees through equity incentive grants. New employees are welcomed through our virtual new hire onboarding experience, which consists of at-home equipment, welcome gift packages, consistent communication, and human resources orientation, and ensures our new hires have the support they need when starting with a new company. Additionally, every one of our new employees has the opportunity to meet with our CEO for a “coffee chat” within their first month of employment.
We value diverse backgrounds, perspectives, and experiences, and we are committed to providing an inclusive environment where all individuals are heard and respected. In 2021, we implemented an Employee Resource Group aimed at connecting and creating a network for women at REPAY. This group meets several times throughout the year to discuss relevant topics and connect with others at the Company. We have also partnered with diverse organizations and higher education programs, to identify a more diverse pool of qualified candidates for recruitment.
We offer a comprehensive benefits package which includes 100% coverage of employee healthcare premiums and several benefits at no cost to our employees, including life insurance, telehealth, mental health, and work-life balance resources. We perform a thorough review of our benefits package annually. In 2021, we made changes to our benefits package including offering lower insurance premiums for family coverage, offering a more generous time off policy, and implementing an Employee Stock Purchase Plan (“ESPP”). The ESPP is highly valued because it gives our employees the opportunity to become shareholders in REPAY at a discounted price. The financial future of our employees is important to us, which is why we have a generous 401(k)-employer match and performance-based bonus program. To promote personal and professional growth, we encourage our employees to pursue ongoing training and career development opportunities, and we provide tuition assistance and reimbursement for certain pre-approved continuing education programs and professional certifications.
As we continue to navigate the COVID-19 pandemic, our employees’ health and safety continue to remain a priority for us. We understand the pandemic impacted all our employees’ personal lives in different ways. Because of this, we provide flexible work schedules. We have also enhanced our employee benefits package to increase the quantity of free mental health support and telehealth options.
14
Available Information
We maintain a website at www.repay.com, through which you may access our public filings free of charge as soon as reasonably practicable after they are electronically filed with, or furnished to, the Securities and Exchange Commission (“SEC”). Information contained on our website is not a part of this Annual Report on Form 10-K and the inclusion of our website address in this report is an inactive textual reference only.