What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-26 compared with 2023-02-14 · 71 added, 104 removed, 655 unchanged (21% of the section changed)

28 unchanged sentences

• We have incurred debt which could have a negative impact on our financing options and liquidity position, which could in turn adversely affect our business.

Risks Related to the Coronavirus (COVID-19) Pandemic

• The effect of the COVID-19 pandemic on our operations, and the operations of our customers, partners and suppliers, has had and could have a material adverse effect on our business, financial condition, cash flows and results of operations, and the extent to which the pandemic will have a continued impact remains uncertain.

Risks Related to our Intellectual Property and Security Vulnerabilities

4 unchanged sentences

• We collect, store, process, transmit and use personally identifiable information and other data, which subjects us to governmental regulation and other legal obligations related to privacy, information security and data protection in many jurisdictions.

Any cybersecurity breaches or our actual or perceived failure to comply with such legal obligations by us, or by our third-party service providers or partners, could harm our business.

• Cybersecurity breaches and improper access to or disclosure of data or confidential information we maintain, or hacking or phishing attacks on our systems, could expose us to liability, protracted and costly litigation and damage our reputation.

Any cybersecurity breaches or our actual or perceived failure to comply with such legal obligations by us, or by our third-party service providers or partners, could harm our business and subject us to regulatory scrutiny.

• Failure to protect our intellectual property could substantially harm our business and operating results.

21 unchanged sentences

• If we fail to maintain an effective system of internal control over financial reporting, we may not be able to report our financial results accurately or in a timely fashion, and we may not be able to prevent fraud;

in such case, our stockholders could lose confidence in our financial reporting, which would harm our business and could negatively impact the price of our stock.

in such case, our stockholders

could lose confidence in our financial reporting, which would harm our business and could negatively impact the price of our stock.

Risks Related to Industry Dynamics and Competition

38 unchanged sentences

customer service;

availability of additional platform features, such as

workplace tools and ability to engage with additional platform features;

availability of additional platform features, such as workplace tools and ability to engage with additional platform features;

the global nature of a company’s interfaces and marketing efforts, including local content, languages, currencies, and payment methods;

88 unchanged sentences

If we do not effectively expand, train, manage changes to, and retain our sales force, we may be unable to add new customers or increase sales to our existing customers, and our revenue growth and business could be adversely affected.

Customers in our Enterprise sales channel provided approximately 39%, 37% and 38% of our revenues in 2022, 2021 and 2020, respectively.

These customers have unique content, licensing and workflow needs and we have a dedicated sales, service and research team to provide a number of enhancements to those customers’ creative workflows including non-standard licensing rights, multi-seat access, multi-brand licensing packages and content licensed for use-cases outside of those available for license on our e-commerce platform.

Our Content and Data, Distribution, and Services enterprise customers have unique content, licensing and workflow needs and we have a dedicated sales, service and research team to provide a number of enhancements to those customers’ creative workflows including non-standard licensing rights, multi-seat access, multi-brand licensing packages and content licensed for use-cases outside of those available for license on our e-commerce platform.

We have been optimizing our sales team and refining the manner in which our products and services are sold through this channel.

4 unchanged sentences

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining sufficient numbers of qualified sales personnel to support our growth.

Our growth creates additional challenges and risks with respect to attracting, integrating and retaining qualified employees, particularly enterprise sales leadership and sales personnel.

Our growth creates additional challenges and risks with respect to attracting, integrating and retaining qualified employees, particularly sales leadership and sales personnel.

In addition, we expect that, if we continue to grow, a large percentage of our sales force at any time will be new to the company and our offerings.

11 unchanged sentences

Further, as we have a limited history of operations at our current scale and under our current strategy, our ability to forecast our future operating results and plan for and model future growth is more limited than that of companies with longer operating histories and is subject to a number of uncertainties.

In addition, we have encountered and expect to continue to

encounter risks and uncertainties frequently experienced by growing companies in rapidly changing markets.

If our assumptions regarding these risks and uncertainties are incorrect or change, or if we do not execute on our strategy and manage these risks and uncertainties successfully, our operating results could differ materially from our expectations and those of securities analysts and investors, our business could suffer and the trading price of our common stock could decline.

In addition, we have encountered and expect to continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly changing markets.

If our assumptions

regarding these risks and uncertainties are incorrect or change, or if we do not execute on our strategy and manage these risks and uncertainties successfully, our operating results could differ materially from our expectations and those of securities analysts and investors, our business could suffer and the trading price of our common stock could decline.

If we do not successfully make, integrate and maintain acquisitions and investments, our business could be adversely impacted.

24 unchanged sentences

The loss of any key engineering, product development, marketing or sales personnel and our inability to implement a succession plan or find suitable replacements for any of these individuals could disrupt our operations and have an adverse effect on our business.

Our continued and future success is also dependent, in part, on our ability to identify, attract, retain and motivate highly skilled technical, managerial, product development, marketing, content operations and customer service personnel and to preserve the key aspects of our corporate culture.

preserve the key aspects of our corporate culture.

Competition for qualified personnel is intense in our industry and we may be unsuccessful in offering competitive compensation packages to attract and retain personnel.

12 unchanged sentences

The Dynamex decision and Assembly Bill 5 altered the analysis of whether an individual, who is classified by a hiring entity as an independent contractor in California, has been properly classified as an independent contractor.

Under the new test, an individual is considered an employee under the California Wage Orders unless the hiring entity establishes three criteria:

(i) the worker is free from the control and direction of the hiring entity in connection with the performance of the work, both under the contract for the performance of such work and in fact;

(ii) the worker performs work that is outside the usual course of the hiring entity’s business;

and (iii) the worker is customarily engaged in an independently established trade, occupation, or business of the same nature as the work performed for the hiring entity.

Assembly Bill 5 is subject to ongoing scrutiny and amendments.

In addition, independent workers have been the subject of widespread national discussion and it is possible that other jurisdictions may enact laws similar to Assembly Bill 5 or that otherwise impact our business and our relationships with independent third parties.

4 unchanged sentences

The non-payment or late payments of amounts due to us from certain customers may negatively impact our financial condition.

Our revenue generated through sales to enterprise customers represented approximately 39% of our total revenue for the year ended December 31, 2022 and approximately 37% of our total revenue for the year ended December 31, 2021.

A portion of these customers typically purchase our products on payment terms, and therefore we assume a credit risk for non-payment in the ordinary course of business.

A portion of our enterprise customers typically purchase our products on payment terms, and therefore we assume a credit risk for non-payment in the ordinary course of business.

Further, in certain jurisdictions, we contract with third-party resellers that may collect payment from customers and remit such payment to us.

8 unchanged sentences

For certain payment methods, including credit and debit cards, we pay interchange and other fees, which may increase over time and raise our operating costs and lower profitability.

We rely on third parties to provide payment processing services, including the processing of credit cards and debit cards, and it could disrupt our business if these companies became unwilling or unable to provide these services to us,

including if they were to suffer a cyberattack or security incident.

We are also subject to payment card association operating rules, certification requirements and rules governing electronic funds transfers, which could change or be reinterpreted to make it difficult or impossible for us to comply.

We are also subject to payment card association operating rules, certification requirements and rules governing electronic funds transfers, and data security standards, which could change or be reinterpreted to make it difficult or impossible for us to comply.

If we fail to comply with these rules or requirements, we may be subject to fines and higher transaction fees and lose our ability to accept credit and debit card payments from consumers or facilitate other types of online payments.

30 unchanged sentences

Our ability to meet expenses and debt service obligations will depend on our future performance, which could be affected by financial, business, economic and other factors.

In addition, a breach of any of the covenants in our outstanding debt agreements or our inability to comply with the required financial ratios could result in a default under our debt instruments, including the Credit Facility.

In addition, a breach of any of the covenants in our outstanding debt

agreements or our inability to comply with the required financial ratios could result in a default under our debt instruments, including the Credit Facility.

If an event of default occurs, our creditors could elect to declare all borrowings outstanding, together with accrued and unpaid interest, to be immediately due and payable and/or require us to apply all of our available cash to repay borrowings.

If we are not able to pay our debt service obligations we may be required to refinance all or part of our debt, sell assets, borrow more money or raise additional equity capital.

Risks Related to the Coronavirus (COVID-19) Pandemic

The effect of the COVID-19 pandemic on our operations, and the operations of our customers, partners and suppliers, has had and could have a material adverse effect on our business, financial condition, cash flows and results of operations, and the extent to which the pandemic will have a continued impact remains uncertain.

In December 2019, a novel coronavirus disease (“COVID-19”) was initially reported and on March 11, 2020, the World Health Organization characterized COVID-19 as a pandemic.

COVID-19 has had a widespread and detrimental effect on the global economy as a result of the continued fluctuation in the number of cases and affected countries and actions by public health and governmental authorities, businesses, other organizations and individuals to address the outbreak, including travel bans and restrictions, quarantines, shelter in place, stay at home or total lock-down orders and business limitations and shutdowns.

Despite the developments of vaccines, the duration and severity of COVID-19 and possible mutations and the degree of its impact on our business is uncertain and difficult to predict.

The continued spread of the outbreak could result in one or more of the following conditions that could have a material adverse impact on our business operations and financial condition:

decreased business spending by our customers and prospective customers;

reduced demand for our products, lower renewal rates by our customers;

increased customer losses/churn and turnover of talent;

increased challenges in or cost of acquiring new customers and talent;

reduction in the amount of content uploaded by our contributors and/or reduction in the number of contributors on our site because of reduced royalties earned by our contributors;

inability of our Custom contributors and editorial photographers to complete assignments because of travel and in-person event restrictions;

increased competition;

increased risk in collectability of accounts receivable;

reduced productivity due to remote work arrangements;

lost productivity due to illness and/or illness of family members;

inability to hire key roles;

adverse effects on our strategic partners’ businesses;

impairment charges;

extreme currency exchange-rate fluctuations;

inability to recover costs from insurance carriers;

business continuity concerns for us and our third-party vendors;

inability of counterparties to perform under their agreements with us;

increased risk of vulnerability to cybersecurity attacks or breaches resulting from a greater number of our employees working remotely for extended periods of time;

and challenges with Internet infrastructure due to high loads.

If we are not able to respond to and manage the potential impact of such events effectively, our business could be harmed.

As we generally recognize revenue from our customers as content is downloaded, the impact to our reported revenue resulting from recent and near-term changes in our sales activity due to COVID-19 may not be fully apparent until future periods.

Our efforts to help mitigate the negative impact of the outbreak on our business may not be effective, and we may be affected by a protracted economic downturn.

Furthermore, while many governmental authorities around the world have and continue to enact legislation to address the impact of COVID-19, including measures intended to mitigate some of the more severe anticipated economic effects of the virus, we may not benefit from such legislation or such legislation may prove to be ineffective in addressing COVID-19’s impact on our and our customer’s businesses and operations.

Even after the COVID-19 outbreak has subsided, we may continue to experience impacts to our business as a result of the coronavirus’ global economic impact and any recession that has occurred or may occur in the future.

Further, as the COVID-19 situation is unprecedented and continuously evolving, COVID-19 may also affect our operating and financial results in a manner that is not presently known to us or in a manner that we currently do not consider to present significant risks to our operations.

In addition, the overall uncertainty regarding the economic impact of the COVID-19 pandemic and the impact on our revenue growth, could impact our cash flows from operations and liquidity.

To the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

Material changes to our cash flows, liquidity and the volatility of the stock market and our stock price

could impact our capital allocation strategy, including our quarterly dividend program and our outstanding authorization under our stock repurchase program.

Risks Related to our Intellectual Property and Security Vulnerabilities

19 unchanged sentences

Even a disruption as brief as a few minutes could have a negative impact on our marketplace activities and could result in a loss of revenue.

To date we have not had any material disruptions.

Because some of the causes of system interruptions may be outside of our control, we may not be able to remedy such interruptions in a timely manner, or at all.

In addition, we have entered into service level agreements with some of our larger customers and strategic partners.

In addition, we have entered into service level agreements with some of our larger

customers and strategic partners.

Technological interruptions could result in a breach of such agreements and subject us to considerable penalties and could cause our customers to believe our service is unreliable, causing harm to our business, reputation and financial condition.

50 unchanged sentences

If we or our third-party service providers or partners were to experience a cybersecurity incident, data breach or disruption, unauthorized access or failure of systems compromising our customers’, contributors’ or employees’ data, or if one of our third-party service providers or partners were to access our customers’ personal data without authorization, our brand and reputation could be adversely affected, use of our products could decrease, we could experience business interruption and we could be exposed to a risk of loss, litigation and regulatory proceedings.

Depending on the nature of the information compromised in a cybersecurity incident, data breach or disruption or unauthorized access or failure of systems compromising our customers’, contributors’ or employees’ data, we may also have obligations to notify customers, contributors, employees or governmental bodies about the incident and we may need to provide some form of remedy and compensation for the individuals affected.

Depending on the nature of the information compromised in a cybersecurity incident, data breach or disruption or unauthorized access or failure of systems compromising our customers’, contributors’ or employees’ data, we may also have obligations to notify customers, contributors, employees or governmental bodies about the incident and we may need to provide some form of mitigation and relief for the individuals affected.

In addition, ongoing rulemaking and the potential for changes to cybersecurity disclosure rules may subject us to enhanced or uncertain requirements.

8 unchanged sentences

in January 2020, we became subject to the GDPR as incorporated into U.K.

In December 2020, the Brexit Trade and Cooperation Agreement (“TCA”) established a four- to six-month grace period during which transfers of personal data from the E.U.

can continue without additional safeguards, provided that the U.K.

maintains its pre-TCA data protection laws.

The exit creates uncertainty with regard to the regulation of data protection in the U.K.

In particular, it is unclear how data transfers to and from the U.K.

will be regulated after the grace period expires and whether or not the U.K.

will receive an adequacy decision from the European Commission permitting cross-border data transfer prior to leaving the E.U.

Additionally, although we are making use of the E.U.

5 unchanged sentences

The CJEU went on to state that, if the competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer unless the data exporter has already done so itself.

To fill the gap left by the invalidation of the Privacy Shield, the U.S.

and EU agreed on a legal framework in October 2022 for transferring personal information from the EU to the U.S.

Data Privacy Framework”).

In July 2023, the European Commission issued an adequacy decision on the EU-U.S.

Data Privacy Framework which replaced the Privacy Shield.

An entity seeking to transfer personal information under the EU-U.S.

Data Privacy Framework must first self-certify to the U.S.

Department of Commerce that it complies with the EU-U.S.

Data Privacy Framework Principles.

The protections afford transfers of personal information under the EU-U.S.

Data Privacy Framework was also extended to transfers between the U.S.

in October 2023.

We rely on a mixture of mechanisms to transfer personal data from our E.U.

5 unchanged sentences

For example, in Brazil, the General Data Privacy Law, which was signed into law in August 2018 and was subject to enforcement beginning in August 2021, imposes detailed rules for the collection, use, processing and storage of personal data.

Similarly, in India, a committee formed by the Indian government issued a report and draft data protection bill in July 2018, which was updated in December 2019 by the Ministry of Electronics and Information Technology and remains subject to continuing joint parliamentary review.

Similarly, data privacy laws have been enacted in a number of jurisdictions, including, but not limited to, the European Union, Illinois and California, which regulate the collection of certain biometric data regarding individuals, including their facial images, and the use of such data, including in facial recognition systems.

Similarly, on August 9, 2023, India passed a data protection law that will establish how entities can handle personal data and the rights individuals have over their personal data.

Further, data privacy laws have been enacted in a number of jurisdictions, including, but not limited to, the European Union, Illinois and California, which regulate the collection of certain biometric data regarding individuals, including their facial images, and the use of such data, including in facial recognition systems.

Private and class plaintiffs have successfully asserted claims in settled litigation relating to the processing and storage of photographs under biometric privacy laws.

5 unchanged sentences

For example, in June 2018, the State of California enacted the CCPA, which came into effect on January 1, 2020.

The CCPA requires, among other things, companies that collect personal information about California residents to make new disclosures to those residents about their data collection, use and sharing practices, allows residents to opt out of certain data sharing with third parties, and provides a new cause of action for data breaches.

However, the California Privacy Rights Act (“CPRA”), certified by the California Secretary of State to appear as a ballot initiative, was passed by Californians during the November 3, 2020 election.

The CPRA, which will come into effect on January 1, 2023 (with a look back to January 2022), amends and expands the CCPA to add additional disclosure obligations (including an obligation to disclose retention periods or criteria for

categories of personal information), grant consumers additional rights (including rights to correct their data, limit the use and disclosure of sensitive personal information, and opt out of the sharing of personal information for certain targeted behavioral advertising purposes), and establishes a privacy enforcement agency known as the California Privacy Protection Agency (“CPPA”).

The CCPA requires, among other things, companies that collect personal information about California residents to make new disclosures to those residents about their data collection, use and sharing practices, allows residents to exercise certain rights regarding their personal information (including the right to opt out of certain data sharing with third parties), and provides a private right of action for data breaches.

In addition, the California Privacy Rights Act (“CPRA”), which came into effect on January 1, 2023

(with a look back to January 2022), amends and expands the CCPA to add additional disclosure obligations (including an obligation to disclose retention periods or criteria for categories of personal information), grant consumers additional rights (including rights to correct their data, limit the use and disclosure of sensitive personal information, and opt out of the sharing of personal information for certain targeted behavioral advertising purposes), and establishes a privacy enforcement agency known as the California Privacy Protection Agency (“CPPA”).

The CPPA will serve as California’s chief privacy regulator, which will likely result in greater regulatory activity and enforcement in the privacy area.

Other states have also considered or are considering privacy laws similar to the CCPA.

Additional comprehensive data privacy laws have become effective in Colorado, Utah, Virginia and Connecticut, and in 2024, data privacy laws in Florida, Oregon, Montana and Texas will take effect creating an evolving climate for data privacy compliance obligations and risks.

Five other states (Delaware, Iowa, New Jersey, Tennessee and Indiana) have similar comprehensive data privacy laws set to become effective by 2026.

Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data.

7 unchanged sentences

The expenditure this would require, as well as costs of ongoing compliance, could harm our financial condition.

Cybersecurity breaches and improper access to or disclosure of data or confidential information we maintain, or hacking or phishing attacks on our systems, could expose us to liability, protracted and costly litigation and damage our reputation.

As a global technology business, we and our third-party service providers collect and maintain confidential information and personal data about our employees, customers, contributors and other third parties, in connection with marketplace-related processes on our websites and, in particular, in connection with processing and remitting payments to and from our customers and contributors, and we are therefore exposed to security and fraud-related risks, which are likely to become more challenging as we expand our operations.

7 unchanged sentences

Although cybersecurity and the continued development and enhancement of the processes, practices and controls that are designed to protect our systems, computers, software, data and networks from attack, damage, disruption or unauthorized access are a high priority for us, because the techniques used to attack, damage, disrupt or obtain unauthorized access are constantly evolving in sophisticated ways to avoid detection and often are not recognized until launched against a target, our efforts may not be enough to anticipate or prevent a party from circumventing our security measures, or the security measures of our third-party service providers, and accessing and misusing the confidential or personal information of our employees, customers and contributors and / or our networks.

If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures could be harmed and we could lose users and customers.

If an actual or perceived breach of our security occurs, the market perception

of the effectiveness of our security measures could be harmed and we could lose users and customers.

We may also be required to expend significant capital and other resources to protect against such cybersecurity incidents to alleviate problems caused by such incidents.

While we continually work to safeguard our internal network systems and validate the security of our third-party providers, to mitigate these potential risks, including through information security policies and employee awareness and training, there is no assurance that such actions will be sufficient to prevent cyber-attacks or cybersecurity breaches.

SEC rulemaking undertakes to expand security incident reporting requirements and may subject us to additional and uncertain requirements in the event of an actual or perceived security incident.

Any actual or perceived breach or the perceived threat of an attack or breach, could cause our customers, contributors and other third parties to cease doing business with us, or subject us to lawsuits, regulatory fines, criminal penalties, statutory damages, and other costs, including for provision of breach notices and credit monitoring to our customers, and other action or liability, and could lead to business interruption, any of which could harm our reputation, business, financial condition, results of operations and stock price.

2 unchanged sentences

We rely on trademark, copyright and patent law, trade secret protection, and non-disclosure agreements and other contractual restrictions to protect our proprietary rights.

We have registered “Shutterstock,” “Shutterstock Editorial,” “Asset Assurance,” “Offset,” “Bigstock,” “Rex Features,” “PremiumBeat,” “TurboSquid,” “PicMonkey,” “Pattern89,” “Shotzr,” “Pond5,” “Splash News,” “Shutterstock Studios” and “Shutterstock Editor” and associated logos and other marks as trademarks in the United States and other jurisdictions and we are the registered owner of the shutterstock.com, bigstock.com, offset.com, premiumbeat.com, rexfeatures.com, turbosquid.com, picmonkey.com, pond5.com and splashnews.com internet domain names and various other related domain names.

We have registered “Shutterstock,” “Shutterstock Editorial,” “Asset Assurance,” “Offset,” “Bigstock,” “Rex Features,” “PremiumBeat,” “TurboSquid,” “PicMonkey,” “Pattern89,” “Shotzr,” “Pond5,” “Splash News,” “Shutterstock Studios,” “Shutterstock Editor,” “Shutterstock.AI” and “Creative Flow,” and associated logos and other marks as trademarks in the United States and other jurisdictions and we are the registered owner of the shutterstock.com, bigstock.com, offset.com, premiumbeat.com, rexfeatures.com, turbosquid.com, picmonkey.com, pond5.com, splashnews.com and giphy.com internet domain names and various other related domain names.

Effective intellectual property protection for our trademarks and domain names may not be available or practical in every country in which we operate or intend to operate.

16 unchanged sentences

Catastrophic events or other interruptions or failures of our information technology systems could hurt our ability to effectively provide our products and services, which could harm our reputation and brand and adversely affect our business and operating results.

Our third-party service providers, including cloud service providers could be disrupted by fire, flood, power loss, telecommunications failure, earthquakes, acts of war or terrorism, acts of God, malware (including viruses and malicious software), physical or electronic break-ins and other similar events or disruptions.

Our third-party service providers, including cloud service providers could be disrupted by fire, flood, power loss, telecommunications failure, earthquakes, pandemics, acts of war or terrorism, acts of God, malware (including viruses and malicious software), physical or electronic break-ins and other similar events or disruptions.

Our principal executive offices are located in New York City, a region that has experienced acts of terrorism in the past.

85 unchanged sentences

Fiscal authorities in many foreign jurisdictions have increased their scrutiny of the potential taxation of e-commerce businesses.

On October 8, 2021, the OECD announced that over 130 countries had reached a two-pillar agreement to address tax challenges presented by the digitalization of the global economy.

The OECD, with the support of the G20, initiated the BEPS project in July 2013 in response to concerns that changes are needed to international tax laws to address situations where multinationals may pay little or no tax in certain jurisdictions by shifting profits away from jurisdictions where the activities creating those profits may take place.

In November 2015, “final reports” were approved for adoption by the G20 finance ministers.

The final reports provide the basis for international standards for corporate taxation that are designed to prevent, among other things, the artificial shifting of income to tax havens and low-tax jurisdictions, hybrid mismatch arrangements, the erosion of the tax base through interest deductions on intercompany debt and the artificial avoidance of permanent establishments (i.e., tax nexus with a jurisdiction).

Legislation to adopt and implement these standards has been enacted or is currently under consideration in a number of jurisdictions.

In May 2019, the OECD published a “Programme of Work,” divided into two pillars, which is designed to address the tax challenges created by an increasing digitalized economy.

Pillar One would require the largest and most profitable multinational enterprises to allocate a portion of their profits to markets where they derive revenue, regardless of whether they maintain a physical presence in those markets.

Initially, the profit allocation rule would apply only to multinational enterprises with more than €20 billion in global annual revenues and a profit margin above 10%.

The revenue threshold would be reduced to €10 billion beginning seven years after the effective date of Pillar One.

The revenue threshold is expected to be reduced to €10 billion beginning seven years after the effective date of Pillar One.

Participating countries are expected to implement Pillar One by entering into a multilateral convention.

Since various jurisdictions have already enacted or are considering enacting digital services taxes, which could lead to inconsistent and potentially overlapping tax regimes as a result of the profit allocation rule under Pillar One, the multilateral convention would require the removal of existing digital services taxes and prohibit the introduction of new digital services taxes.

Until the convention is adopted, however, countries that had previously enacted a digital services tax, may continue to impose their tax.

The continued imposition of digital services taxes may have a material effect on our financial condition and results of operations.

Pillar Two would subject multinational enterprises with annual revenue of more than €750 million to a global minimum income tax at a rate of 15%.

1 unchanged sentence

income tax law, disparities exist between the U.S.

minimum income tax under GILTI and the proposed Pillar Two framework.

To assist in the implementation of Pillar Two, the OECD published detailed model legislation on December 20, 2021, and related

commentary on March 14, 2022.

The participating countries are expected to implement the OECD’s two-pillar agreement by entering into a multilateral convention and enacting domestic legislation by 2024.

Such legislation could increase our global effective tax rate and have a material effect on our financial position and results of operations.

To prevent double taxation as a result of the profit allocation rule, the multilateral convention would require the removal of all existing digital services taxes and prohibit the introduction of new digital services taxes.

Until the convention is adopted, however, countries that had previously enacted a digital services tax, may continue to impose their tax.

The continued imposition of digital services taxes may have a material effect on our financial condition and results of operations.

minimum income tax under the global intangible low-taxed income (“GILTI”) rules and the proposed Pillar Two framework.

To assist in the implementation of Pillar Two, the OECD published the Global Anti-Base Erosion Model Rules, a detailed model legislation in December 2021, and related commentary in March 2022.

The OECD has released additional administrative guidance on the global minimum income tax in February, July and December of 2023.

Under the European Union’s minimum tax directive, unanimously agreed by the member states in 2022, each member state is required to adopt domestic legislation implementing the minimum tax rules effective for periods beginning on or after December 31, 2023, with the “under-taxed profit rule” to take effect for periods beginning on or after December 31, 2024.

Legislatures in multiple countries outside of the European Union have also drafted and/or enacted legislation to implement the OECD’s minimum income tax proposal.

Given the OECD’s continued release of guidance regarding Pillar Two, that only certain jurisdictions have currently enacted laws to give effect to Pillar Two, and that jurisdictions may interpret such laws in different manners, the overall implementation of Pillar Two (and in particular, the adoption of the “under-taxed profit rule” by certain countries in which we and our affiliates do business) remain uncertain and subject to change, possibly on a retroactive basis, and could increase our global effective tax rate and have a material effect on our financial position and results of operations.

We may be exposed to greater than anticipated withholding, sales, use, value added and other non-income tax liabilities, including as a result of future changes in laws or regulations, which could harm our financial condition and results of operations.

7 unchanged sentences

We continue to evaluate the impact, if any, of the imposition of sales tax on customer demand for our products and results of operations.

Recent legislation, including legislation relating to the U.S.

Supreme Court decision in South Dakota v.

Wayfair, Inc.

, has, and will continue to, significantly increase the effort, resources and costs associated with the collection and compliance burden for sales tax.

Recent legislation has, and will continue to, significantly increase the effort, resources and costs associated with the collection and compliance burden for sales tax.

The prospective taxation by multiple jurisdictions of e-commerce businesses could also subject us to exposure to withholding, sales, use, value added and other non-income taxes on our past and future transactions in jurisdictions in which we currently are, or in the future may be, required to report taxable transactions.

45 unchanged sentences

Purchases of shares of our common stock pursuant to our share repurchase program may affect the value of our common stock and diminish our cash reserves, and there can be no assurance that our share repurchase program will enhance stockholder value.

Pursuant to our share repurchase program which was publicly announced in November 2015, we were authorized to repurchase up to $100 million of our outstanding common stock.

In February 2017, our Board authorized us to repurchase up to an additional $100 million of our outstanding common stock.

As of December 31, 2022, there was no remaining authorization for purchases under the share repurchase program.

Pursuant to our share repurchase program which was publicly announced in June 2023, we were authorized to repurchase up to $100 million of our outstanding common stock.

As of December 31, 2023, there was $71.8 million remaining authorization for purchases under the share repurchase program.

Our board may authorize additional purchases at any time.

3 unchanged sentences

Additionally, repurchases under our share repurchase program have diminished and would continue to diminish our cash reserves, which could impact our ability to pursue possible strategic opportunities and acquisitions and could result in lower overall returns on our cash balances.

Further, under the Inflation Reduction Act of 2022, a 1% excise tax is imposed on the fair market value of certain net stock purchases, which could increase the cost of repurchasing shares of our common stock.

Further, under the Inflation Reduction Act of 2022, a 1% excise tax is imposed on the fair market value of certain stock repurchases at the time of such repurchases, which could increase the cost of repurchasing shares of our common stock.

However, for the purposes of calculating excise tax, repurchasing corporations are permitted to net the fair market value of certain new stock issuances against the fair market value of stock repurchases during the same taxable year.

In addition, certain exceptions apply to the excise tax.

There can be no assurance that any share repurchases will enhance stockholder value, as the market price of our common stock may nevertheless decline.

7 unchanged sentences

All shares of our common stock are freely transferable without restriction or registration under the Securities Act, except for shares held by our “affiliates,” which remain subject to the restrictions set forth in Rule 144 under the Securities Act.

We filed registration statements on Form S-8 under the Securities Act covering shares of common stock issuable pursuant to options and shares reserved for future issuance under our 2022 Omnibus Equity Incentive Plan and our 2012 Omnibus Equity Incentive Plan.

Incentive Plan.

Shares issued pursuant to such options and plans can be freely sold in the public market upon issuance and vesting, subject to the terms of the award agreements delivered under such plans, unless they are held by “affiliates,” as that term is defined in Rule 144 of the Securities Act.

25 unchanged sentences

For example, we have continued to upgrade our financial and business processing applications to accommodate the increased volume of products and transactions resulting from our growth to date.

If we experience delays or difficulties in implementing these systems, or if we otherwise do not effectively manage our growth, we may not be able to execute on our business plan, respond to competitive pressures, take advantage of market opportunities, or satisfy customer requirements, among other things.

we experience delays or difficulties in implementing these systems, or if we otherwise do not effectively manage our growth, we may not be able to execute on our business plan, respond to competitive pressures, take advantage of market opportunities, or satisfy customer requirements, among other things.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure, including the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, the Dodd-Frank Act and related regulations implemented by the SEC and the stock exchanges are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time-consuming.

8 unchanged sentences

Before that amendment, Section 162(m) provided an exception for “performance-based compensation” that met certain requirements.

The TCJA eliminated the exception for

performance-based compensation, other than for certain arrangements in place before November 2, 2017, and expanded the group of employees covered by the limitation under Section 162(m).

The TCJA eliminated the exception for performance-based compensation, other than for certain arrangements in place before November 2, 2017, and expanded the group of employees covered by the limitation under Section 162(m).

The American Rescue Plan Act, enacted on March 11, 2021, further expanded the group of covered employees to include an additional five most highly compensated employees, effective for taxable years beginning after December 31, 2026.

9 unchanged sentences

Furthermore, if we cannot provide reliable financial reports or prevent fraud, our business and results of operations could be harmed and investors could lose confidence in our reported financial information.

Unresolved Staff Comments.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors