MITEK SYSTEMS INC
For the period ended Sep 30, 2024. Filed Dec 16, 2024.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2024 · Filed Dec 16, 2024
MITK$17.24+1.8%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2023-09-30; filed 2024-03-19.
0000950123-24-002926
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2024-09-30; filed 2024-12-16.
0000807863-24-000142
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 232 previous paragraphs and 177 current paragraphs.
114 unchanged; 34 reworded; 25 added; 83 removed; 1 previous and 4 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (25)
Current report
•The loss of one or more of our key customers could slow our revenue growth or cause our revenues to decline.
Current report
Risks Related to Privacy, Artificial Intelligence, and Cybersecurity
Current report
•Recent and proposed laws regarding the use of facial recognition technology and the processing of biometric data could increase compliance costs or otherwise make it harder for us to conduct our business, require us to change our business practices, lead to regulatory investigations or actions, and have a material adverse effect on demand for certain of our products.
Current report
•Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.
Current report
•Security breaches or cyberattacks could expose us to significant liability, cause our business and reputation to suffer and harm our competitive position.
Current report
As part of our operating history and growth strategy, we have acquired other businesses, such as ID R&D and HooYu, and in the future, we may continue to seek to acquire other businesses. We can provide no assurance that we will be able to identify and acquire targeted businesses or obtain financing for such acquisitions on satisfactory terms. The process of integrating acquired businesses into our operations may result in unforeseen difficulties and may require a disproportionate amount of resources and management attention. If integration of our acquired businesses is not successful, we may not realize the potential benefits of an acquisition or suffer other adverse effects.
Current report
The loss of one or more of our key customers could slow our revenue growth or cause our revenues to decline.
Current report
A substantial portion of our total revenues in any given period may come from a relatively small number of customers. For the twelve months ended September 30, 2024, the Company derived revenue of $29.6 million from one customer, with such customer accounting for 17% of the Company’s total revenue. For the twelve months ended September 30, 2023, the Company derived revenue of $27.7 million from the same single customer, with such customer accounting for 16% of the Company's total revenue. For the twelve months ended September 30, 2022, the Company derived revenue of $25.0 million from the same single customer, with such customer accounting for 17% of the Company’s total revenue. We expect that we will continue to depend upon a relatively small number of customers for a significant portion of our total revenues for the foreseeable future. The loss of any of our significant customers or groups of customers for any reason, or a change of relationship with any of our key customers may cause a significant decrease in our total revenues. Additionally, mergers or consolidations among our customers could reduce the number of our customers and could adversely affect our revenues and sales. In particular, if our customers are acquired by entities that are not also our customers, that do not use our solutions or that have more favorable contract terms and choose to discontinue, reduce or change the terms of their use of our solutions, our business and operating results could be materially and adversely affected.
Current report
Risks Related to Privacy, Artificial Intelligence, and Cybersecurity
Current report
Recent and proposed laws regarding the use of facial recognition technology and the processing of biometric data could increase compliance costs or otherwise make it harder for us to conduct our business, require us to change our business practices, lead to regulatory investigations or actions, and have a material adverse effect on demand for certain of our products.
Current report
Some of our solutions require the storage and transmission of proprietary and confidential information of our clients and their employees, including biometric data. Several jurisdictions have imposed legal and compliance requirements on biometric data that are more stringent than requirements on other classifications of personal data. For example, under GDPR, biometric data is considered “sensitive data” which requires special attention and technical and organizational measures to protect the biometric data against breaches of confidentiality, integrity, and availability. The processing of biometric data for such purposes is prohibited unless one of a very limited and specific set of conditions is satisfied (such as explicit consent of the data subject). Effective compliance in this area (including in the context of use of certain of our products) can be highly challenging, and we are reliant on our customers to ensure that such a condition is satisfied when they use our products to identify someone. We may be unable to provide certain of our products in certain jurisdictions, in particular in Europe where provision of such technologies in compliance with the GDPR is highly challenging.
Current report
Similarly, in the United States., the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric identifiers and information, requires informed consent before collection, imposes fines for non-compliance, and grants residents a private right of action over improper collection and mishandling of biometric data. BIPA provides for substantial penalties and statutory damages and have generated significant class action activity; the cost of litigating and settling any claims that we have violated the BIPA or similar laws could be significant. Several other states have passed or are considering passing similar laws, such as the Texas Collection and Use of Biometric Information (“CUBI”) Act and the Washington Biometric Data Act. Similarly, Québec's Act respecting the protection of personal data in the private sector (“Law 25” formerly known as “Bill 64”) introduces substantial changes to the privacy landscape in Quebec, enhancing protection for personal data and introducing new obligations for transparency and accountability in data processing activities, including those involving biometric data.
Current report
Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.
Current report
AI, automated decision making, and ML technologies are increasingly subject to regulatory scrutiny and oversight, for example, under the comprehensive legal framework governing the use of artificial intelligence adopted by the European Parliament in the European Union (the “EU AI Act”). The EU AI Act imposes onerous obligations related to the development, deployment and use of AI/ML-related systems. In particular, the EU AI Act is likely to designate certain AI technologies, including technologies used in an employment-related context (such as in relation to recruitment, placement of targeted job advertisements, and decision-making concerning promotion, termination and task allocation), as ‘high risk’ and subject to numerous onerous compliance obligations, including various transparency, conformity and risk assessment, monitoring and human oversight requirements. As our products and services develop, they mall fall within one or more of these categories. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. The EU AI Act has a phased implementation process and is likely to be fully effective by Spring 2026. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors / competences. Additionally, several United States jurisdictions have enacted measures related to the use of AI in products and services for their potentially discriminatory effects. For example, New York City passed a law to regulate the use of automated employment decision tools by employers and employment agencies. Certain of these laws may be materially unfavorable to our interests and/or inconsistent with our existing operations, policies, practices or plans (or may be interpreted as such). We expect other jurisdictions will adopt similar laws.
Current report
Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI (including generative AI) and ML technologies in our products and services. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.
Current report
Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.
Current report
Furthermore, any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/machine learning platform could be leaked or disclosed to others, including if sensitive information is used to train the third party’s AI/machine learning model. Additionally, where such a model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model.
Current report
Given that AI, automated decision making and ML technologies are core to our business, any increased regulation over these technologies, including the EU AI Act, could make it harder for us to conduct our business, significantly complicate our compliance efforts, increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers, increase our cost of doing business, impede or prevent our growth plans (including into Europe), require us to change our business operations at significant cost (such as retaining or rebuilding our AI/ML models), and reduce demand for our products.
Current report
While we endeavor to implement policies, procedures, and systems designed to achieve compliance with these regulatory requirements, we cannot assure you that these policies, procedures, or systems will be adequate or that we or our personnel will not violate these policies and procedures or applicable laws and regulations. Violations of these laws or regulations may harm our reputation and deter government agencies and other existing or potential customers or partners from purchasing our solutions. Furthermore, non-compliance with applicable laws or regulations could result in fines, damages, criminal sanctions against us, our officers, or our employees, restrictions on the conduct of our business, and damage to our reputation.
Current report
Security breaches or cyberattacks could expose us to significant liability, cause our business and reputation to suffer and harm our competitive position.
Current report
We rely on information technology networks and systems, some of which are owned and operated by third parties, to collect, process, transmit, and store electronic information on behalf of our customers. We also depend on our information technology infrastructure for a variety of functions, including worldwide financial reporting, procurement, invoicing, and email communications. These systems are susceptible to outages due hacking and cyberattacks.
Current report
We have implemented security measures and controls intended to protect our information technology infrastructure, data centers and other systems and data against cyber-attacks. Despite our implementation of security measures and controls, our systems and those of third parties upon whom we rely are vulnerable to attack from numerous threat actors, including sophisticated nation-state and nation-state-supported actors. Threat actors have and may in the future be able to compromise our security measures or otherwise exploit vulnerabilities in our systems, including vulnerabilities that may have been introduced through the actions of our employees or contractors or defects in the design or manufacture of our products and systems or the products and systems that we procure from third parties. Our systems, and those of our third-party providers, have and could in the future become subject to cyber-attacks, including using computer viruses, credential harvesting, dedicated denial of services attacks, malware, social engineering, and other means for obtaining unauthorized access to, or disrupting the operation of, our systems and those of our third-party providers.
Current report
In addition, threat actors are also increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks created through AI. These attacks could be crafted with an AI tool to directly attack IT systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions.
Current report
The number and scale of cyberattacks have continued to increase and the methods and techniques used by threat actors, including sophisticated “supply-chain” attacks, continue to evolve at a rapid pace. As a result, we may be unable to identify current attacks, anticipate future attacks or implement adequate security measures. We may also experience security breaches that may remain undetected for an extended period and, therefore, have a greater impact on our systems, our products, the proprietary data contained therein, our customers and ultimately, our business. Cyberattacks on our systems and “supply-chain” attacks on systems of third parties upon whom we rely, and any related operational disruptions, unauthorized access, or misappropriation of information (including personally identifiable information or personal data), could create costly litigation, significant financial liability, and a loss of confidence in our ability to serve customers and cause current or potential customers to choose another provider, all of which could have a material adverse effect on our business, financial condition, reputation, and results of operations.
Removed paragraphs (83)
Previous report
•We face risks related to the storage of our customers’ and their end users’ confidential and proprietary information. Our products may not provide absolute security. We may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents.
Previous report
•Compliance with changing regulations concerning corporate governance and public disclosure may result in additional expenses.
Previous report
•We have a history of losses and we may not be able to maintain profitability in the future.
Previous report
•From time-to-time our Board explores and considers strategic alternatives, including financings, strategic alliances, acquisitions, or the possible sale of our company. Our Board may not be able to identify or complete any suitable strategic alternatives, and announcements regarding any such strategic alternatives could have an impact on our operations or stock price.
Previous report
•Future sales of our common stock by our insiders may cause our stock price to decline.
Previous report
•Our corporate documents and the Delaware General Corporation Law (the “DGCL”) contain provisions that could discourage, delay, or prevent a change in control of our company, prevent attempts to replace or remove current management, and reduce the market price of our stock.
Previous report
•Our restated certificate of incorporation and third amended and restated bylaws provide for indemnification of officers and directors at our expense and limits their liability, which may result in a major cost to us and hurt the interests of our stockholders because corporate resources may be expended for the benefit of officers and/or directors.
Previous report
•The market price of our common stock has been volatile and your investment in our stock could suffer a decline in value.
Previous report
•Because we do not intend to pay cash dividends, our stockholders will benefit from an investment in our common stock only if our stock price appreciates in value.
Previous report
•As a result of our failure to timely file this Annual Report on Form 10-K for year ended September 30, 2023, and our Quarterly Report on Form 10-Q for the quarter ended December 31, 2023, we are currently ineligible to file new short form registration statements on Form S-3 or to have resale registration statements declared effective in a timely manner, which may impair our ability to raise capital on terms favorable to us, in a timely manner or at all.
Previous report
•If financial or industry analysts do not publish research or reports about our business, or if they issue negative or misleading evaluations of our stock, our stock price and trading volume could decline.
Previous report
On July 7, 2018, United Services Automobile Association (“USAA”) filed a lawsuit against Wells Fargo Bank, N.A. (“Wells Fargo”) in the Eastern District of Texas alleging that Wells Fargo’s remote deposit capture systems (which in part utilize technology provided by the Company to Wells Fargo through a partner) infringe four USAA owned patents related to mobile deposits (the “First Wells Lawsuit”). On August 17, 2018, USAA filed a second lawsuit (the “Second Wells Lawsuit” and together with the First Wells Lawsuit, the “Wells Lawsuits”) against Wells Fargo in the Eastern District of Texas asserting that an additional five patents owned by USAA were infringed by Wells Fargo’s remote deposit capture system. In neither lawsuit was the Company named in the Complaint as an infringer and at no time did USAA allege specifically that the Company’s products by themselves infringed any of the asserted patents. Subsequently, on November 6, 2019, a jury in the First Wells Lawsuit found that Wells Fargo willfully infringed at least one of the Subject Patents (as defined below) and awarded USAA $200 million in damages. In the Second Wells Lawsuit, USAA dropped two of the patents from the litigation, and the judge in the case found that one of the remaining three patents was invalid. On January 10, 2020, a jury in the Second Wells Lawsuit found that Wells Fargo willfully infringed at least one of the patents at issue in that case and awarded USAA $102 million in damages. No Mitek product was accused of infringing either of the two patents in question in the Second Wells Lawsuit as the litigation involved broad banking processes and not the Company’s specific mobile deposit features. USAA and Wells Fargo subsequently reached a settlement, and on April 1, 2021, the Court granted the parties’ joint motion and stipulation of dismissal of the Wells Lawsuits with prejudice.
Previous report
Wells Fargo filed petitions for Inter Partes Review (“IPR”) with the Patent Trial and Appeal Board (“PTAB”) challenging the validity of the four patents in the First Wells Lawsuit. Three of those four petitions were instituted, while one (relating to U.S. Patent No. 9,818,090 (“the ‘090 Patent”)) was denied institution. On November 24, 2020, and January 26, 2021, the PTAB issued final written decisions determining that Wells Fargo had not demonstrated by a preponderance of the evidence that any claims of the U.S. Patent Nos. 8,977,571 (“the ‘571 Patent”), 8,699,779 (“the ‘779 Patent”), or 9,336,517 (“the ‘517 Patent”) were unpatentable.
Previous report
On September 30, 2020, USAA filed suit against PNC Bank (the “First PNC Lawsuit”) in the Eastern District of Texas alleging infringement of U.S. Patent Nos. 10,482,432 (“the ‘432 Patent”) and 10,621,559. These two patents are continuations of an asserted patent in the Second Wells Lawsuit and relate to similar subject matter. On October 19, 2020, PNC Bank’s integration partner, NCR Corporation, sent an indemnification demand to the Company requesting indemnification from all claims related to the First PNC Lawsuit. The complaint against PNC Bank does not claim that any Company product infringes any of the asserted patents. At this time, the Company does not believe it is obligated to indemnify NCR Corporation or end-users of NCR Corporation resulting from the patent infringement allegations by USAA. On December 4, 2020, USAA filed an amended complaint against PNC Bank also asserting two patents at issue in the First Wells Lawsuit—the ’779 Patent and the ’571 Patent. On February 2, 2021, NCR Corporation sent a second indemnification demand to the Company requesting indemnification of the claims described in the amended complaint. On March 31, 2021, USAA filed another suit against PNC Bank in the Eastern District of Texas alleging infringement of two patents from the Second Wells Lawsuit, U.S. Patent Nos. 10,013,605 (“the ‘605 Patent”) and 10,013,681 (“the ‘681 Patent”) (the “Second PNC Lawsuit”). On July 7, 2021, USAA filed a third lawsuit against PNC Bank (the “Third PNC Lawsuit” and together with the First PNC Lawsuit and the Second PNC Lawsuit, the “PNC Lawsuits”) asserting infringement of U.S. Patents 10,769,598; 10,402,638; and 9,224,136. A jury trial was held in May 2022 on the consolidated First PNC Lawsuit and Second PNC Lawsuit. The jury found that PNC willfully infringed at least one patent claim and awarded USAA $218 million in damages. The Court denied PNC Bank’s equitable defenses and entered a Final Judgment in the consolidated First PNC Lawsuit and Second PNC Lawsuit on August 19, 2022. A jury trial was held in September 2022 on the Third PNC Lawsuit. The jury found that PNC infringed at least one patent claim and awarded USAA $4.3 million in damages. The Court entered a Final Judgment in the Third PNC Lawsuit on February 16, 2023.
Previous report
In April, May, and June 2020, the Company filed petitions for IPR with the PTAB of the U.S. Patent & Trademark Office challenging the validity of the Subject Patents. On November 6 and 17, 2020, the PTAB decided to exercise its discretion and deny institution of the four petitions due to the alleged relationship between the Company and Wells Fargo, who previously filed petitions for IPR on the Subject Patents. The PTAB did not address the merits of the Company’s petitions or the prior art cited in those petitions. The Company continues to believe that the prior art cited in the petitions renders all the claims of the Subject Patents invalid. On each of December 6, 2020, December 17, 2020, and February 23, 2021, the Company filed requests for rehearing and Precedential Opinion Panel (“POP”) review of the four denied IPR petitions. The Patent Office denied the requests for rehearing and for POP review.
Previous report
In September 2020, the Company filed an additional two petitions for IPR with the U.S. Patent & Trademark Office challenging the validity of the ‘681 Patent and the ‘605 Patent—two of the patents at issue in the Second Wells Lawsuit. In March 2021, the PTAB decided not to institute the two petitions.
Previous report
On July 7, July 14, and July 21 2021, PNC Bank filed six additional petitions for IPR with the U.S. Patent & Trademark Office challenging the validity of the ’779 Patent, the ’571 Patent, the ‘559 Patent, and the ‘432 Patent. On August 27, 2021, PNC filed two additional petitions for IPR challenging the validity of the ‘681 Patent and the ‘605 Patent. In October and November of 2021, PNC Bank filed four more petitions for IPR challenging the validity of the ‘638 Patent, the ‘136 Patent, and the ‘598 Patent. The Patent Office denied institution with respect to the petitions challenging the ‘432 Patent, the ‘605 Patent, the ‘681 Patent, and the ‘638 Patent, but instituted inter partes review on the petitions relating to the ‘779 Patent, the ‘571 Patent, the ‘559 Patent, and the ‘598 Patent—finding a reasonable likelihood that at least one challenged patent claim was invalid. The U.S. Patent & Trademark Office issued a final written decision in each of the IPRs challenging the ‘779 Patent, the ‘571 Patent, and the ‘559 Patent and found all challenged claims of each patent unpatentable. USAA filed requests for rehearing and requests for POP review. The requests for POP review and for rehearing were denied in March 2023.
Previous report
On August 16, 2021, USAA filed suit against BBVA USA (“BBVA”) in the Eastern District of Texas alleging infringement of the same patents at issue in the PNC Lawsuits. While the Company’s IPR petitions were mentioned in the complaint, the Company was not named as a defendant or mentioned in connection with any alleged infringement. BBVA then sent the Company an indemnification demand on September 7, 2021. For the same reasons discussed above in connection with PNC Bank and PNC Lawsuits, the Company does not believe it is obligated to indemnify BBVA. On June 6, 2022, the Court granted the parties’ request to administratively close the case and stay all deadlines in view of the pending appeal in the PNC Lawsuits.
Previous report
In October and November of 2022, Truist filed a petition for IPR with the U.S. Patent & Trademark Office challenging the validity of the ’090 Patent, the ’432 Patent, and the ’753 Patent. The Patent Office instituted the petitions directed to the ’090 and ’753 Patents, but denied institution of the petition directed to the ’432 Patent. In view of the settlement between USAA and Truist, the IPRs were withdrawn.
Previous report
We face risks related to the storage of our customers’ and their end users’ confidential and proprietary information. Our products may not provide absolute security. We may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents.
Previous report
Our products are designed to maintain the confidentiality and security of our customers’ and their end users’ confidential and proprietary information that is stored on our systems, which may include sensitive financial data and personally identifiable information about consumers. However, any accidental or willful security breaches or other unauthorized access to this data could expose us to liability for the loss of such information, time-consuming and expensive litigation, and other possible liabilities as well as negative publicity.
Previous report
We devote significant resources to addressing security vulnerabilities in our products, systems and processes, however our maintenance and regular upgrades of our products, systems and processes, which are designed to protect the security of our products and the confidentiality, integrity and availability of information belonging to us and our clients, may not provide absolute security. Techniques used to obtain unauthorized access or to sabotage systems change frequently, are increasingly sophisticated, and generally are difficult to recognize and react to. We may be unable to anticipate these techniques or implement adequate preventative or reactionary measures.
Previous report
As cyber-attacks become more sophisticated, the need to develop our infrastructure to secure our business and customer data can lead to increased cybersecurity protection costs. Such costs may include making organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants. These efforts come at the potential cost of revenues and human resources that could be utilized to continue to enhance our product offerings.
Previous report
A successful penetration or circumvention of the security of our products could cause serious negative consequences, including significant disruption of our operations, misappropriation of our confidential information or that of our clients, or damage to our systems or those of our clients and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our clients, loss of confidence in our security measures, client dissatisfaction, significant litigation exposure, and harm to our reputation, all of which could have a material adverse effect on us. We may not have adequate insurance coverages for a cybersecurity breach or may realize increased insurance premiums as a result of a security breach.
Previous report
If an actual or perceived breach of security occurs, client perception of the effectiveness of our security measures could be harmed and could result in the loss of clients. Actual or anticipated attacks and risks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third party experts and consultants.
Previous report
Compliance with changing regulations concerning corporate governance and public disclosure may result in additional expenses.
Previous report
Our business is subject to laws, rules, regulations, and standards relating to corporate governance and public disclosure, including the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), Sarbanes-Oxley, and various other new regulations promulgated by the SEC and rules promulgated by the national securities exchanges.
Previous report
The Dodd-Frank Act, enacted in July 2010, expands federal regulation of corporate governance matters and imposes requirements on publicly-held companies, including us, to, among other things, provide stockholders with a periodic advisory vote on executive compensation and also adds compensation committee reforms and enhanced pay-for-performance disclosures. While some provisions of the Dodd-Frank Act were effective upon enactment, and others have been implemented upon the SEC’s adoption of related rules and regulations, the Dodd-Frank Act is not yet fully implemented and the scope and timing of the adoption of additional rules and regulations thereunder is uncertain and accordingly, the cost of compliance with the Dodd-Frank Act is also uncertain. In addition, Sarbanes-Oxley specifically requires, among other things, that we maintain effective internal control over financial reporting and disclosure of controls and procedures. In particular, we must perform system and process evaluation and testing of our internal control over financial reporting to allow management to report on the effectiveness of our internal control over financial reporting, as required by Section 404 of Sarbanes-Oxley Act (“Section 404”). Our independent registered public accounting firm is required to attest to our internal control over financial reporting. Our testing, or the subsequent testing by our independent registered public accounting firm may reveal deficiencies in our internal control over financial reporting that are deemed to be material weaknesses. Our compliance with Section 404 requires that we incur substantial accounting expenses and expend significant management efforts. We currently have limited internal audit capabilities and will need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge. Moreover, if we are not able to comply with the requirements of Section 404, or if we or our independent registered public accounting firm, if applicable, identifies deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, the market price of our stock could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources.
Previous report
These and other new or changed laws, rules, regulations and standards are, or will be, subject to varying interpretations in many cases due to their lack of specificity. As a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies, which could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. Our efforts to comply with evolving laws, regulations and standards are likely to continue to result in increased general and administrative expenses and a diversion of management time and attention from revenue-generating activities to compliance activities. Further, compliance with new and existing laws, rules, regulations and standards may make it more difficult and expensive for us to maintain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. Members of our board of directors (the “Board”) and our principal executive officer and principal financial officer could face an increased risk of personal liability in connection with the performance of their duties. As a result, we may have difficulty attracting and retaining qualified directors and executive officers, which could harm our business. We continually evaluate and monitor regulatory developments and cannot estimate the timing or magnitude of additional costs we may incur as a result.
Previous report
We have a history of losses and we may not be able to maintain profitability in the future.
Previous report
Although we generated net income for the twelve months ended September 30, 2022, 2021, and 2020, operations resulted in a net loss of $0.7 million and $11.8 million for the twelve months ended September 30, 2019, 2018, respectively. We may continue to incur significant losses for the foreseeable future which may limit our ability to fund our operations and we may not generate income from operations in the future. As of September 30, 2023, September 30, 2022, and September 30, 2021, we had an accumulated deficit of $9 million, $17 million, and $6 million, respectively. Our future profitability depends upon many factors, including several that are beyond our control. These factors include, without limitation:
Previous report
•the failure to gain market acceptance of our new and existing products;
Previous report
•the failure to successfully and cost effectively develop, introduce and market new products, services and product enhancements in a timely manner; and
Previous report
In addition, we incur significant legal, accounting, and other expenses related to being a public company. As a result of these expenditures, we will have to generate and sustain increased revenue to achieve and maintain future profitability.
Showing the first 40 of 83 passages. Open the source sections for the rest.
Reworded paragraphs (34)
Previous wording
•If the patents we own or license, or our other intellectual property rights, do not adequately protect our technologies, we may lose market share to our competitors and be unable to operate our business profitably.
Current wording
•If the patents we own or license, or our other intellectual property rights, do not adequately protect our technologies, brands or other intellectual property, we may lose market share to our competitors and be unable to operate our business profitably.
Previous wording
•Entry into new lines of business, and our offering of new products and services, resulting from our acquisitions may result in exposure to new risks.
Current wording
•Entry into new lines of business, and our offering of new products and services may result in exposure to new risks.
Previous wording
•We may be unable to successfully integrate our business with the respective businesses of ID R&D, and HooYu and realize the anticipated benefits of the acquisitions.
Current wording
•We may be unable to successfully integrate our business with the respective businesses of ID R&D and HooYu or future acquisitions and realize the anticipated benefits of the acquisitions.
Previous wording
•Evolving domestic and international data privacy regulations may restrict our ability, and that of our customers, to solicit, collect, process, disclose and use personal information or may increase the costs of doing so, which could harm our business.
Current wording
•Evolving domestic and international data privacy and Artificial Intelligence laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.
Previous wording
The following risk factors and other information included in this Form 10-K should be carefully considered. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we presently deem less significant may also impair our business operations. If any of the following risks actually occur, our business, financial condition, results of operations, cash flows, projected results, and future prospects could be materially and adversely affected. In these circumstances, the market price of our common stock could decline, and you could lose all or part of your investment or interest.
Current wording
The following risk factors and other information included in this Form 10-K should be carefully considered. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we presently deem less significant may also impair our business operations. If any of the following risks actually occur, our business, financial condition, results of operations, cash flows, projected results, and future prospects could be materially and adversely affected. In these circumstances, the market price of our common stock could decline, and an investor could lose all or part of their investment or interest.
Previous wording
Over the last few years, the use of checks has started to decline. Advances in technologies have enabled the development of check alternatives like Zelle and Venmo, which have caused certain changes in consumer behavior. As check alternatives become more widely accepted by consumers, the use of checks could continue to decline, which could have a negative effect on our business. In addition, as the mobile banking market matures, the growth of active mobile banking users is slowing, which may negatively impact our ability to grow our business.
Current wording
The use of checks has declined in recent years as a result of advances in technologies that have enabled the development of check alternatives like Zelle and Venmo, which have caused certain changes in consumer behavior. Though we are developing and offering new technologies, many of our current product offerings center around solutions involving the use of checks by banking customers. As check alternatives become more widely accepted by consumers, the use of checks could continue to decline, which could have a negative effect on our business. In addition, as the mobile banking market matures, the growth of active mobile banking users is slowing, which may negatively impact our ability to grow our business, which therefore could adversely affect our financial condition and results of operations.
Previous wording
While neither the Wells Lawsuits nor the PNC Lawsuits name the Company as a defendant, given (among other factors) the Company’s prior history of litigation with USAA and the continued use of the Company’s products by its customers, on November 1, 2019, the Company filed a complaint in the U.S. District Court for the Northern District of California seeking declaratory judgment that its products do not infringe the ’779 Patent, the ’571 Patent, the ’517 Patent, and the ’090 Patent (collectively, the “Subject Patents”). On January 15, 2020, USAA filed motions requesting the dismissal of the declaratory judgement of the Subject Patents and transfer of the case to the Eastern District of Texas, both of which the Company opposed. On April 21, 2020, the Court in the Northern District of California transferred the Company’s declaratory judgement action to the Eastern District of Texas and did not rule on USAA’s motion to dismiss. On April 28, 2021, the Court in the Eastern District of Texas granted USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds. The Court’s ruling did not address the merits of the Company’s claim of non-infringement. The Company appealed the ruling on the motion to dismiss and the decision to transfer the declaratory judgment action from California to Texas to the U.S. Court of Appeals for the Federal Circuit. The Federal Circuit heard oral argument on the Company’s appeal on April 4, 2022 and on May 20 2022, issued an opinion vacating and remanding the district court’s order granting USAA’s motion to dismiss. On August 1, 2022, the parties submitted additional briefing to the district court in light of Federal Circuit’s opinion. The court held another hearing on USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds, and once again granted USAA’s motion to dismiss on February 23, 2023. The Company timely filed a notice of appeal to the U.S. Court of Appeals for the Federal Circuit. The appeal is fully briefed, and the Company is awaiting oral argument. The Company continues to believe that its products do not infringe the Subject Patents and will vigorously defend the right of its end-users to use its technology.
Current wording
Since 2018, United Services Automobile Association (“USAA”) has filed suit against various parties alleging patent infringement concerning four USAA-owned patents related to mobile deposits, including Wells Fargo Bank, N.A. (“Wells Fargo”) and PNC Bank. While these lawsuits do not name the Company as a defendant, given (among other factors) the Company’s prior history of litigation with USAA and the continued use of the Company’s products by its customers, on November 1, 2019, the Company filed a complaint in the U.S. District Court for the Northern District of California seeking declaratory judgment that its products do not infringe certain patents held by USAA (collectively, the “Subject Patents”). On January 15, 2020, USAA filed motions requesting the dismissal of the declaratory judgement of the Subject Patents and transfer of the case to the Eastern District of Texas, both of which the Company opposed. On April 21, 2020, the Court in the Northern District of California transferred the Company’s declaratory judgement action to the Eastern District of Texas and did not rule on USAA’s motion to dismiss. On April 28, 2021, the Court in the Eastern District of Texas granted USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds. The Court’s ruling did not address the merits of the Company’s claim of non-infringement. The Company appealed the ruling on the motion to dismiss and the decision to transfer the declaratory judgment action from California to Texas to the U.S. Court of Appeals for the Federal Circuit. The Federal Circuit heard oral argument on the Company’s appeal on April 4, 2022 and on May 20 2022, issued an opinion vacating and remanding the district court’s order granting USAA’s motion to dismiss. On August 1, 2022, the parties submitted additional briefing to the district court in light of Federal Circuit’s opinion. The court held another hearing on USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds, and once again granted USAA’s motion to dismiss on February 23, 2023. The Company timely filed a notice of appeal to the U.S. Court of Appeals for the Federal Circuit. The appeal is fully briefed, and the Company is awaiting oral argument. The Company continues to believe that its products do not infringe the Subject Patents and will vigorously defend the right of its end-users to use its technology.
Previous wording
On July 29, 2022, USAA filed another patent infringement lawsuit against Truist Bank (“Truist”) in the Eastern District of Texas. The lawsuit alleges infringement of the ’090 Patent, the ’432 Patent, and the U.S. Patent No. 11,182,753 (“the ’753 Patent”). The Company was not named as a defendant or mentioned in connection with any alleged infringement. On October 5, 2022, Truist’s integration partner, NCR Corporation, sent an indemnification demand to the Company requesting indemnification from all claims related to the lawsuit. For the same reasons discussed above in connection with the PNC Lawsuits, the Company does not believe it is obligated to indemnify NCR Corporation or end-users of NCR Corporation resulting from the patent infringement allegations by USAA. On October 7, 2022, Truist filed a motion to transfer venue to the Western District of North Carolina. The motion was denied on April 8, 2023. On December 30, 2022, Truist filed a motion for leave to file counterclaims against USAA alleging patent infringement of U.S. Patent Nos. 7,336,813; 7,519,214; 8,136,721; and 9,760,797, which was granted on April 8, 2023. On March 13, 2023, USAA moved for leave to file a First Amended Complaint, adding an additional allegation of patent infringement of U.S. Patent No. 11,544,944 (“the ’944 Patent”). On April 4, 2023, Truist sent another indemnification demand to the Company requesting indemnification related to the lawsuit. On May 3, 2023, USAA moved for leave to file a Second Amended Complaint, adding an additional allegation of patent infringement of U.S. Patent No. 11,625,770 (“the ’770 Patent”). On May 30, 2023, Truist sent another indemnification demand to the Company requesting indemnification related to the Second Amended Complaint. On October 6, 2023, the parties filed a Notice of Settlement and Joint Motion and Stipulation of Dismissal. All claims and causes of actions between the parties were dismissed with prejudice on October 10, 2023 in view of the settlement.
Current wording
On July 29, 2022, USAA filed another patent infringement lawsuit against Truist Bank (“Truist”) in the Eastern District of Texas. The lawsuit alleges infringement of the ’090 Patent, the ’432 Patent, and the U.S. Patent No. 11,182,753 (“the ’753 Patent”). The Company was not named as a defendant or mentioned in connection with any alleged infringement. On October 5, 2022, Truist’s integration partner, NCR Corporation, sent an indemnification demand to the Company requesting indemnification from all claims related to the lawsuit. For the same reasons discussed above in connection with the PNC Lawsuits, the Company does not believe it is obligated to indemnify NCR Corporation or end-users of NCR Corporation resulting from the patent infringement allegations by USAA. On October 7, 2022, Truist filed a motion to transfer venue to the Western District of North Carolina. The motion was denied on April 8, 2023. On December 30, 2022, Truist filed a motion for leave to file counterclaims against USAA alleging patent infringement of U.S. Patent Nos. 7,336,813; 7,519,214; 8,136,721; and 9,760,797, which was granted on April 8, 2023. On March 13,
Previous wording
If the patents we own or license, or our other intellectual property rights, do not adequately protect our technologies, we may lose market share to our competitors and be unable to operate our business profitably.
Current wording
If the patents we own or license, or our other intellectual property rights, do not adequately protect our technologies, brands or other intellectual property, we may lose market share to our competitors and be unable to operate our business profitably.
Previous wording
Our success depends significantly on our ability to protect our rights to the technologies used in our products, including Mobile Deposit®. We rely on trademark, trade secret, copyright, and patent law, as well as a combination of non-disclosure, confidentiality, and other contractual arrangements to protect our technology and rights. However, these legal protections afford only limited protection and may not adequately protect our rights or permit us to gain or maintain any competitive advantage.
Current wording
Our success depends significantly on our ability to protect our rights to the technologies used in our products, including Mobile Deposit®. We rely on trademark, trade secret, copyright, and patent law, as well as a combination of non-disclosure, confidentiality, and other contractual arrangements to protect our technology and rights in and to our intellectual property. However, these legal protections afford limited protection and may not adequately protect our rights or permit us to gain or maintain any competitive advantage.
Previous wording
We also rely on unpatented proprietary technology. We cannot assure you that we can meaningfully protect all our rights in our unpatented proprietary technology or that others will not independently develop substantially equivalent proprietary technology or otherwise gain access to our unpatented proprietary technology. We seek to protect our know-how and other unpatented proprietary technology with confidentiality agreements and intellectual property assignment agreements with our employees, consultants, partners, and customers. However, such agreements may not be enforceable or may not provide meaningful protection for our proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements or in the event that our competitors discover or independently develop similar or identical designs or other proprietary information.
Current wording
We also rely on unpatented proprietary technology. We cannot assert that we can meaningfully protect all our rights in our unpatented proprietary technology or that others will not independently develop substantially equivalent proprietary technology or otherwise gain access to our unpatented proprietary technology. We seek to protect our know-how and other unpatented proprietary technology with confidentiality agreements and intellectual property assignment agreements with our employees, consultants, partners, and customers. However, such agreements may not be enforceable or may not provide meaningful protection for our proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements or in the event that our competitors discover or independently develop similar or identical designs or other proprietary information.
Previous wording
In addition, we rely on the use of registered and common law trademarks with respect to the brand names of some of our products. Common law trademarks provide less protection than registered trademarks. Loss of rights in our trademarks could adversely affect our business, financial condition, and results of operations.
Current wording
In addition, we rely on the use of registered and unregistered common law trademarks with respect to the brand names of some of our products. Common law trademarks provide less protection than registered trademarks. Loss of rights in or infringement of our trademarks could adversely affect our business, financial condition, and results of operations.
Previous wording
Our ability to compete effectively with our mobile imaging software products depends upon our ability to meet changing market conditions and develop enhancements to our products on a timely basis in order to maintain our competitive advantage. The markets for products incorporating mobile imaging software technology and products are characterized by rapid advancements in technology and changes in user preferences. Our continued growth will ultimately depend upon our ability to develop additional technologies and attract strategic alliances for related or separate products. There can be no assurance that we will be successful in developing and marketing product enhancements and additional technologies, that we will not experience difficulties that could delay or prevent the successful development, introduction and marketing of these products, or that our new products and product enhancements will adequately meet the requirements of the marketplace, will be of acceptable quality, or will achieve market acceptance.
Current wording
Our ability to compete effectively depends upon our ability to meet changing market conditions and develop enhancements to our products on a timely basis in order to maintain our competitive advantage. The markets for products incorporating mobile imaging and voice software technology and products are characterized by rapid advancements in technology and changes in user preferences. Our continued growth will ultimately depend upon our ability to develop additional technologies and attract strategic alliances for related or separate products. There can be no assurance that we will be successful in developing and marketing product enhancements and additional technologies, that we will not experience difficulties that could delay or prevent the successful development, introduction and marketing of these products, or that our new products and product enhancements will adequately meet the requirements of the marketplace, will be of acceptable quality, or will achieve market acceptance.
Previous wording
The long sales cycle and the implementation cycles for our software and services may cause operating results to vary significantly from period to period. The sales cycle for our products can be six months or more and varies substantially from customer to customer. Because we sell complex and deeply integrated solutions, it can take many months of customer education to secure sales and implement our product. Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer.
Current wording
The long sales cycle and the implementation cycles for our software and services may cause operating results to vary significantly from period to period. The sales cycle for our products can be six months or more and varies substantially from customer to customer. Because we sell complex and deeply integrated solutions, the sale of our software and services may require a significant commitment of capital and other resources and it can take many months of customer education to secure sales and implement our product. Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer.
Previous wording
Historically, a significant portion of our sales have resulted from shipments during the last few weeks of the quarter from orders received in the final month of the applicable quarter. We do, however, base our expense levels, in significant part, on our expectations of future revenue. As a result, we expect our expense levels to be relatively fixed in the short term. Any concentration of sales at the end of the quarter may limit our ability to plan or adjust operating expenses. Therefore, if anticipated shipments in any quarter do not occur or are delayed, expenditure levels could be disproportionately high as a percentage of sales, and our operating results for that quarter would be adversely affected. As a result, we believe that period-to-period comparisons of our results of operations are not and will not necessarily be meaningful, and you should not rely upon them as an indication of future performance. If our operating results for a quarter are below the expectations of public market analysts and investors, it could have a material adverse effect on the price of our common stock.
Current wording
Historically, a significant portion of our sales have resulted from orders during the last few weeks of the quarter from orders received in the final month of the applicable quarter. We do, however, base our expense levels, in significant part, on our expectations of future revenue. As a result, we expect our expense levels to be relatively fixed in the short term. Any concentration of sales at the end of the quarter may limit our ability to plan or adjust operating expenses. Therefore, if anticipated orders in any quarter do not occur or are delayed, expenditure levels could be disproportionately high as a percentage of sales, and our operating results for that quarter would be adversely affected. As a result, we believe that period-to-period comparisons of our results of operations are not and will not necessarily be meaningful, and an investor should not rely upon them as an indication of future performance. If our operating results for a quarter are below the expectations of public market analysts and investors, it could have a material adverse effect on the price of our common stock.
Previous wording
Entry into new lines of business, and our offering of new products and services, resulting from our acquisitions may result in exposure to new risks.
Current wording
Entry into new lines of business, and our offering of new products and services may result in exposure to new risks.
Previous wording
Unpredictable and unstable changes in economic conditions, including a recession, inflation, increased government intervention, or measures taken in response to a global pandemic like COVID-19, or other changes, may adversely affect our general business strategy. In particular an economic downturn affecting small and medium sized businesses could significantly affect our business as many of our existing and target customers are in the small and medium sized business sector and these businesses are more likely to be significantly affected by economic downturns than larger, more established businesses. Additionally, these customers often have limited discretionary funds, which they may choose to spend on items other than our products and services, causing our revenue to decline.
Current wording
Unpredictable and unstable changes in macroeconomic conditions both domestically and internationally, including a recession, inflation, changes in interest rates, changes to government policies, or other adverse market changes, may adversely affect our general business strategy. Any general weakening of, and related declining corporate confidence in, the global economy or the curtailment in corporate spending could cause current or potential customers to reduce or eliminate their information technology budgets and spending, which could cause customers to delay, decrease or cancel purchases of our products and services; cause customers not to pay us; or to delay payment for previously purchased products and services. In particular an economic downturn affecting small and medium sized businesses could significantly affect our business as many of our existing and target customers are in the small and medium sized business sector and these businesses are more likely to be significantly affected by economic downturns than larger, more established businesses. Additionally, these customers often have limited discretionary funds, which they may choose to spend on items other than our products and services, causing our revenue to decline.
Previous wording
We currently anticipate that our available capital resources and operating cash flows will be sufficient to meet our expected working capital and capital expenditure requirements for at least the next 12 months. However, such resources may not be sufficient to fund the long-term growth of our business. If we determine that it is necessary to raise additional funds, we may choose to do so through public or private equity or debt financings, a bank line of credit, strategic collaborations, licensing, or other arrangements. We cannot be sure that any additional funding, if needed, will be available on terms favorable to us, if at all. Furthermore, any additional equity or equity-related financing may be dilutive to our stockholders, new equity securities may have rights, preferences or privileges senior to those of existing holders of our shares of common stock, and debt or equity financing, if available, may subject us to restrictive covenants and significant interest costs. If we obtain funding through a strategic collaboration or licensing arrangement, we may be required to relinquish our rights to certain of our technologies, products or marketing territories. If we are unable to obtain the financing necessary to support our operations, we may be required to defer, reduce or eliminate certain planned expenditures or significantly curtail our operations.
Current wording
We currently anticipate that our available capital resources and operating cash flows will be sufficient to meet our expected working capital and capital expenditure requirements for at least the next 12 months and the foreseeable future. However, such resources may not be sufficient to fund the long-term growth of our business. If we determine that it is necessary to raise additional funds, we may choose to do so through public or private equity or debt financings, a bank line of credit, strategic collaborations, licensing, or other arrangements. We cannot be sure that any additional funding, if needed, will be available on terms favorable to us, if at all. Furthermore, any additional equity or equity-related financing may be dilutive to our stockholders, new equity securities may have rights, preferences or privileges senior to those of existing holders of our shares of common stock, and debt or equity financing, if available, may subject us to restrictive covenants and significant interest costs. If we obtain funding through a strategic collaboration or licensing arrangement, we may be required to relinquish our rights to certain of our technologies, products or marketing territories. If we are unable to obtain the financing necessary to support our operations, we may be required to defer, reduce or eliminate certain planned expenditures or significantly curtail our operations.
Previous wording
We expect to incur additional expenses in connection with the integration of the business, policies, procedures, operations, technologies, and systems of ID R&D, a New York corporation and HooYu Ltd. There are a number of systems and functions that are being integrated into our larger organization, including, but not limited to, management information, accounting and finance, billing, payroll and benefits, and regulatory compliance. In addition, the acquisitions of non-public entities such as ID R&D and HooYu, are particularly challenging because their prior practices may not meet the requirements of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) and/or accounting principles generally accepted in the U.S. (“GAAP”). While we have assumed that a certain level of expenses would be incurred to integrate this business, there are a number of factors beyond our control that could affect the total amount or the timing of all of the expected integration expenses. Moreover, many of the expenses that will be incurred, by their nature, are difficult to estimate accurately at the present time.
Current wording
In May 2021, Mitek acquired ID R&D, Inc., an award-winning provider of AI-based voice and face biometrics and liveness detection, and in March 2022, we acquired HooYu Ltd., a leading KYC technology provider in the United Kingdom. We expect to incur additional expenses in connection with the integration of the business, policies, procedures, operations, technologies, and systems of ID R&D and HooYu Ltd. There are a number of systems and functions that are being integrated into our larger organization, including, but not limited to, management information, accounting and finance, billing, payroll and benefits, and regulatory compliance. In addition, the acquisitions of non-public entities such as ID R&D and HooYu, are particularly challenging because their prior practices may not meet the requirements of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) and/or accounting principles generally accepted in the U.S. (“GAAP”). While we have assumed that a certain level of expenses would be incurred to integrate this business, there are a number of factors beyond our control that could affect the total amount or the timing of all of the expected integration expenses. Moreover, many of the expenses that will be incurred, by their nature, are difficult to estimate accurately at the present time.
Previous wording
We may be unable to successfully integrate our business with the respective businesses of ID R&D, and HooYu and realize the anticipated benefits of the acquisitions.
Current wording
We may be unable to successfully integrate our business with the respective businesses of ID R&D and HooYu or future acquisitions and realize the anticipated benefits of the acquisitions.
Previous wording
Our management will be required to continue to devote significant attention and resources to integrating our business practices and operations with that of ID R&D and HooYu. In particular, the acquisitions of ID R&D and HooYu involve the combination of companies that previously operated independently in different countries. Potential difficulties we may encounter as part of the integration process include, but are not limited to, the following:
Current wording
Our management continues to devote significant attention and resources to integrating our business practices and operations with that of ID R&D and HooYu. In particular, the acquisitions of ID R&D and HooYu involved the combination of companies that previously operated independently in different countries. Potential difficulties we may encounter as part of the integration process include, but are not limited to, the following:
Previous wording
•lack of familiarity with, and unexpected changes in, foreign laws and legal standards, including employment laws and privacy laws, which may vary widely across the countries in which we sell our products;
Current wording
•lack of familiarity with, and unexpected changes in, foreign laws and legal standards, including employment laws, Artificial Intelligence, and privacy laws, which may vary widely across the countries in which we sell our products;
Previous wording
•compliance with differing and changing local laws and regulations in multiple international locations, including regional data privacy laws, as well as compliance with U.S. laws and regulations where applicable in these international locations; and
Current wording
•compliance with differing and changing local laws and regulations in multiple domestic and international jurisdictions, including Artificial Intelligence and data privacy laws, as well as compliance with U.S. laws and regulations where applicable in these jurisdictions; and
Previous wording
The FCPA and other anti-corruption laws and regulations (“Anti-Corruption Laws”) prohibit corrupt payments by our employees, vendors, or agents. From time to time, we may receive inquiries from authorities in the U.S. and elsewhere about our business activities outside of the U.S. and our compliance with Anti-Corruption Laws. While we have implemented policies, training, and internal controls designed to reduce the risk of corrupt payments, our employees, vendors, or agents may violate our policies. Our acquisitions of ID Checker, ICAR, A2iA, ID R&D, and HooYu may significantly increase our exposure to potential liability under Anti-Corruption Laws. ID Checker, ICAR, A2iA, ID R&D, and HooYu were not historically subject to the FCPA, Sarbanes-Oxley, or other laws, to which we are subject, and we may become subject to liability if in the past, ID Checker’s, ICAR’s, A2iA’s, ID R&D’s, and HooYu’s operations did not comply with such laws.
Current wording
The FCPA and other anti-corruption laws and regulations (“Anti-Corruption Laws”) prohibit corrupt payments by our employees, vendors, or agents. From time to time, we may receive inquiries from authorities in the U.S. and elsewhere about our business activities outside of the U.S. and our compliance with Anti-Corruption Laws. While we have implemented policies, training, and internal controls designed to reduce the risk of corrupt payments, our employees, vendors, or agents may violate our policies. Our acquisitions of ID R&D, and HooYu may significantly increase our exposure to potential liability under Anti-Corruption Laws. ID R&D, and HooYu were not historically subject to the FCPA, the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”), or other laws, to which we are subject, and we may become subject to liability if in the past, ID R&D’s, and HooYu’s operations did not comply with such laws.
Previous wording
The transfer of personal data from the European Union (“EU”) to the U.S. has become a significant area of potential operational and compliance risk. In 2020, the Court of Justice of the European Union (“CJEU”) and the Swiss Federal Data Protection and Information Commissioner invalidated the U.S.-EU and U.S.-Swiss Privacy Shield frameworks, respectively. Privacy Shield was a mechanism for companies to transfer data from EU member states or Switzerland to the U.S. In its decision, the CJEU also indicated that individual EU member states could determine whether Standard Contractual Clauses (“SCCs”) (another “adequate” option for data transfers) are sufficient to securely transfer data out of the EU. A number of local country data protection authorities in the EU subsequently determined that SCCs were invalid for data transfers to the U.S. The EU Data Protection Board subsequently published updated SCCs to address some of the issues presented in the CJEU decision. Those new SCCs were required to be in place by December 27, 2022, and required significant effort for companies to review and revise their EU-U.S. data transfer agreements. Because of the legal challenges presented by these court and data protection authority decisions, there is uncertainty regarding the legal basis for data transfers to the U.S., which could lead to interruption of such transfers. The complex nature and shifting laws related to EU/UK/Switzerland to U.S. data transfers could cause operational interruptions, liabilities and reputational harm. These and other requirements could increase the cost of compliance for us and our customers, restrict our and our customers’ ability to store and process data, negatively impact our ability to offer our solutions in certain locations and limit our customers’ ability to deploy our solutions globally. These consequences may be more significant in countries with legislation that requires data to remain localized “in country,” as this could require us or our customers to establish data storage in other jurisdictions or apply local operational processes that are difficult and costly to integrate with global processes.
Current wording
The transfer of personal data from the European Union (“EU”) to the U.S. has become a significant area of potential operational and compliance risk. In 2023, the Data Privacy Framework was introduced as a new mechanism for companies to transfer data from EU member states, the United Kingdom, or Switzerland to the U.S after its predecessor, the Data Privacy Shield, was invalidated. The EU, the United Kingdom, and Switzerland also allow the use of Standard Contractual Clauses (SCCs), but some decisions have indicated that Compliance with new transfer frameworks require significant effort for companies to review and revise their procedures and current EU-U.S. data transfer agreements. NYOB and its founder Max Schrems, the parties responsible for initiating actions to invalidate the previous Frameworks, have indicated it will bring similar challenges against the Data Privacy Framework. Because of the legal challenges presented by these court and data protection authority decisions, there is continuing uncertainty regarding the legal basis for data transfers to the U.S., which could lead to interruption of such transfers. The complex nature and shifting laws related to EU/UK/Switzerland to U.S. data transfers could cause operational interruptions, liabilities and reputational harm. These and other requirements could increase the cost of compliance for us and our customers, restrict our and our customers’ ability to store and process data, negatively impact our ability to offer our solutions in certain locations and limit our customers’ ability to deploy our solutions globally. These consequences may be more significant in countries with legislation that requires data to remain localized “in country,” as this could require us or our customers to establish data storage in other jurisdictions or apply local operational processes that are difficult and costly to integrate with global processes.
Previous wording
Our business is generally conducted in U.S. dollars. However, we earn revenues, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar. Because our consolidated financial statements are presented in U.S. dollars, we must translate revenues and expenses into U.S. dollars at the average exchange rate during each reporting period, as well as assets and liabilities into U.S. dollars at exchange rates in effect at the end of each reporting period. The costs of operating in The Netherlands, Spain, France, and other European markets are subject to the effects of exchange fluctuations of the Euro and British pound sterling against the U.S. dollar. Therefore, increases or decreases in the value of the U.S. dollar against other major currencies will affect our net revenues, net income (loss), and the value of balance sheet items denoted in foreign currencies, and can adversely affect our operating results.
Current wording
Our business is generally conducted in U.S. dollars. However, we earn revenues, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar. Because our consolidated financial statements are presented in U.S. dollars, we must translate revenues and expenses into U.S. dollars at the average exchange rate during each reporting period, as well as assets and liabilities into U.S. dollars at exchange rates in effect at the end of each reporting period. The costs of operating in The United Kingdom, France, the Netherlands, Spain and other European markets are subject to the effects of exchange fluctuations of the Euro and British pound sterling against the U.S. dollar. Therefore, increases or decreases in the value of the U.S. dollar against other major currencies will affect our net revenues, net income (loss), and the value of balance sheet items denoted in foreign currencies, and can adversely affect our operating results.
Previous wording
Evolving domestic and international data privacy regulations may restrict our ability, and that of our customers, to solicit, collect, process, disclose and use personal information or may increase the costs of doing so, which could harm our business.
Current wording
Evolving domestic and international data privacy and Artificial Intelligence laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.
Previous wording
Federal, state and foreign governments and supervising authorities have enacted, and may in the future enact, laws and regulations concerning the solicitation, collection, processing, disclosure or use of consumers' personal information, including sensitive information such as biometric data. Evolving regulations regarding personal data and personal information, in the European Union and elsewhere, especially relating to classification of IP addresses, machine identification, household data, location data, biometric data, and other information, may limit or inhibit our ability to operate or expand our business. Such laws and regulations require or may in the future require us or our customers to implement privacy and security policies and practices; permit individuals to access, correct or delete personal information stored or maintained by us or our customers; inform individuals of security incidents that affect their personal information; and, in some cases, obtain consent to use personal information for specified purposes. Other proposed legislation could, if enacted, impose additional requirements and prohibit the use of specific technologies, such as those that track individuals' activities on web pages or record when individuals click on a link contained in an email message, or those relating to collection and use of biometric identifiers, and systems reliant on such technologies. Such laws and regulations could restrict our customers' ability to collect and use web browsing data and personal information, or utilize biometrics-derived information, which may reduce our customers' demand for our solutions. The laws in this area are complex and developing rapidly.
Current wording
Federal, state and foreign governments and supervising authorities have enacted, and may in the future enact, laws and regulations concerning the solicitation, collection, processing, disclosure, transfer and use of personal information. Such laws and regulations require or may in the future require us or our customers to implement additional and revise existing privacy and security policies and practices; permit individuals to access, correct or delete personal information stored or maintained by us or our customers; inform individuals of security breaches that affect their personal information; and, in some cases, obtain consent to use certain personal information for certain purposes. Other proposed laws and regulations could, if enacted, impose additional requirements and prohibit the use of specific technologies, such as those that track individuals' activities on web pages or record when individuals click on a link contained in an email message and systems reliant on such technologies. Such laws and regulations could restrict our and our customers' ability to collect and use web browsing data and personal information, which may reduce our customers' demand for our solutions. The laws in this area are complex and developing rapidly.
Previous wording
In the United States, many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. Further, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provides such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The California Privacy Rights Act (the “CPRA”) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA was in full effect as of January 1, 2023. Similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023. Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee and Texas have adopted privacy laws, which take effect from July 1, 2024 through 2026. Additional U.S. states have enacted, or are considering, similar data privacy laws. We cannot fully predict the impact of these state laws, including the California Legislation, on our business or operations, but it may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We expect that new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts.
Current wording
In the United States, many states have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all states require businesses to provide notice to customers whose personal information has been disclosed as a result of a data breach. The laws are not identical, and compliance in the event of a widespread data breach is costly, as we must ensure our compliance with each individual state law. Further, states have continued adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provides such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The California Privacy Rights Act (the “CPRA”) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA was in full effect as of January 1, 2023. Similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023. Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island have adopted privacy laws, which take effect at different dates through 2026. Additional U.S. states have enacted, or are considering, similar data privacy laws. We cannot fully predict the impact of these state laws on our business or operations, but it may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We expect that new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each othe…
Excerpt shortened here; the source contains the full paragraph.
Previous wording
Further, a change in a majority of the Board may, under certain circumstances, result in a change of control under certain employment agreements we have with our executive management and our 2002 Stock Option Plan, 2010 Stock Option Plan, Amended and Restated 2012 Incentive Plan, Amended and Restated 2020 Incentive Plan, Director Restricted Stock Unit Plan, and any equity based awards issued thereunder. Pursuant to the agreements and awards, certain payments and vesting provisions may be triggered following a change of control, conditioned upon a qualifying termination that occurs within 12 months of any such change of control.
Current wording
Further, a change in a majority of the Board may, under certain circumstances, result in a change of control under certain employment agreements we have with our executive management and our equity plans and award agreements, and any equity based awards issued thereunder. Pursuant to the agreements and awards, certain payments and vesting provisions may be triggered following a change of control, conditioned upon a qualifying termination that occurs within 12 months of any such change of control.
Previous wording
We have in the past and may in the future fail to comply with the Nasdaq listing requirements, including the continued listing requirement to timely file all required periodic financial reports with the SEC. As of the date of the filing of this Form 10-K, we have not yet filed our Form 10-Q for the quarterly period ended December 31, 2023. If our common stock ceases to be listed for trading on Nasdaq for any reason, it may harm our stock price, increase the volatility of our stock price, decrease the level of trading activity and make it more difficult for investors to buy or sell shares of our common stock. Our failure to maintain listing on Nasdaq may constitute an event of default under our outstanding indebtedness, including our convertible notes due 2026, and any future indebtedness, which would accelerate the maturity date of such debt or trigger other obligations. In addition, certain institutional investors that are not permitted to own securities of non-listed companies may be required to sell their shares adversely affecting the market price of our common stock. If we are not listed on Nasdaq, we will be limited in our ability to raise additional capital we may need.
Current wording
We have in the past and may in the future fail to comply with the Nasdaq listing requirements, including the continued listing requirement to timely file all required periodic financial reports with the SEC. For example, on August 11, 2022, we were notified by Nasdaq that we were not in compliance with Nasdaq Listing Rule 5250(c)(1), which requires that a listed company timely file all required periodic financial reports with the SEC as a result of our failure to file our Quarterly Report on Form 10-Q for the period ended June 30, 2022. We have received similar deficiency letters from Nasdaq over the past couple years as the Company was responding to various accounting matters, as previously disclosed. If our common stock ceases to be listed for trading on Nasdaq for any reason, it may harm our stock price, increase the volatility of our stock price, decrease the level of trading activity and make it more difficult for investors to buy or sell shares of our common stock. Our failure to maintain listing on Nasdaq may constitute an event of default under our outstanding indebtedness, including our convertible notes due 2026, and any future indebtedness, which would accelerate the maturity date of such debt or trigger other obligations. In addition, certain institutional investors that are not permitted to own securities of non-listed companies may be required to sell their shares adversely affecting the market price of our common stock. If we are not listed on Nasdaq, we will be limited in our ability to raise additional capital we may need.
Previous wording
Our common stock will continue to trade on the Nasdaq Capital Market under the symbol “MITK” until the Panel issues its decision following the hearing and through the expiration of any additional extension period granted by the Panel. The Panel has discretion to grant an exception for up to 180 days after the Nasdaq Staff’s initial delisting decision. There can be no assurance that the Panel will grant our request for a stay pending the hearing process or any further extension following the hearing or continued listing. We have developed a detailed plan to present to the Panel in an effort to regain compliance with the Listing Rule and obtain an extended stay. If our common stock ceases to be listed for trading on Nasdaq, we expect that our common stock would be traded on the over-the-counter market.
Current wording
While we have regained compliance with Nasdaq, if our common stock ceases to be listed for trading on Nasdaq, we expect that our common stock would be traded on the over-the-counter market, and that the value and liquidity of our stockholders’ investments would be materially impacted.
Previous wording
We are highly dependent on the key members of our management team and other key technical personnel. If we were to lose the services of one or more of our key personnel, or if we fail to attract and retain additional qualified personnel, it could materially and adversely affect our business. Furthermore, recruiting and retaining qualified highly skilled engineers involved in the ongoing development required to refine our technologies and introduce future products is critical to our success. We may be unable to attract, assimilate, and retain qualified personnel on acceptable terms given the competition within the high technology industry. We do not have any employment agreements providing for a specific term of employment with any member of our senior management. We do not maintain “key man” insurance policies on any of our officers or employees. We have granted and plan to grant restricted stock units or other forms of equity awards as a method of attracting and retaining employees, motivating performance and aligning the interests of employees with those of our stockholders. As of September 30, 2023, we had 1,425,042 shares of common stock available for issuance pursuant to future grants of equity awards under our existing equity compensation plans, which may limit our ability to provide equity incentive awards to existing and future employees. If we are unable to adopt, implement and maintain equity compensation arrangements that provide sufficient incentives, we may be unable to retain our existing employees and attract additional qualified candidates. If we are unable to retain our existing employees, including qualified technical personnel, and attract additional qualified candidates, our business and results of operations could be adversely affected.
Current wording
We are highly dependent on the key members of our management team and other key technical personnel. If we were to lose the services of one or more of our key personnel, or if we fail to attract and retain additional qualified personnel, it could materially and adversely affect our business. Furthermore, recruiting and retaining qualified highly skilled engineers involved in the ongoing development required to refine our technologies and introduce future products is critical to our success. We may be unable to attract, assimilate, and retain qualified personnel on acceptable terms given the competition within the high technology industry. We do not have any employment agreements providing for a specific term of employment with any member of our senior management. We do not maintain “key man” insurance policies on any of our officers or employees. We have granted and plan to grant restricted stock units or other forms of equity awards as a method of attracting and retaining employees, motivating performance and aligning the interests of employees with those of our stockholders. As of September 30, 2024, we had 4,671,484 shares of common stock available for issuance pursuant to future grants of equity awards under our existing equity compensation plans, which may limit our ability to provide equity incentive awards to existing and future employees. If we are unable to adopt, implement and maintain equity compensation arrangements that provide sufficient incentives, we may be unable to retain our existing employees and attract additional qualified candidates. If we are unable to retain our existing employees, including qualified technical personnel, and attract additional qualified candidates, our business and results of operations could be adversely affected.
Previous wording
Our business operations are subject to interruption by natural disasters and other catastrophic events, such as fire, floods, earthquakes, power loss, telecommunications failure, cyberattack, war or terrorist attack, or epidemic or pandemic. To the extent such events impact our facilities or off-premises infrastructure, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our software development, lengthy interruptions in our services, breaches of data security and loss of critical data, all of which could have an adverse effect on our future operating results.
Current wording
Our business operations are subject to interruption by natural disasters and other catastrophic events, such as fire, floods, earthquakes, climate change, power loss, telecommunications failure, cyberattack, war or terrorist attack, or epidemic or pandemic. To the extent such events impact our facilities or off-premises infrastructure, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our software development, lengthy interruptions in our services, breaches of data security and loss of critical data, all of which could have an adverse effect on our future operating results.
Rearranged current paragraphs (4)
Current report — wording carried from elsewhere
Risks Associated With Our Business and Operations
Current report — wording carried from elsewhere
2023, USAA moved for leave to file a First Amended Complaint, adding an additional allegation of patent infringement of U.S. Patent No. 11,544,944 (“the ’944 Patent”). On April 4, 2023, Truist sent another indemnification demand to the Company requesting indemnification related to the lawsuit. On May 3, 2023, USAA moved for leave to file a Second Amended Complaint, adding an additional allegation of patent infringement of U.S. Patent No. 11,625,770 (“the ’770 Patent”). On May 30, 2023, Truist sent another indemnification demand to the Company requesting indemnification related to the Second Amended Complaint. On October 6, 2023, the parties filed a Notice of Settlement and Joint Motion and Stipulation of Dismissal. All claims and causes of action between the parties were dismissed with prejudice on October 10, 2023 in view of the settlement.
Current report — wording carried from elsewhere
We may not be able to maintain our listing on The Nasdaq Stock Market LLC (“Nasdaq”), or trading on the Nasdaq Capital Market may otherwise be halted or suspended, which may negatively impact the price of our common stock. If our common stock is delisted from Nasdaq, our business, financial condition, results of operations and share price could be adversely affected, and the liquidity of our common stock could be impaired.
Current report — wording carried from elsewhere
Risks Related to Regulation and Compliance
Rearranged previous paragraphs (1)
Previous report — wording carried elsewhere
•changes in the demand for our products and services;