PERDOCEO EDUCATION Corp

Previous wording

As a provider of postsecondary education and a participant in federal and state programs providing financial assistance to students, we are subject to extensive laws and regulation at both the federal and state levels and as well as by accrediting agencies. These requirements cover virtually all aspects of our business.

Current wording

As a provider of postsecondary education and a participant in federal and state programs providing financial assistance to students, we are subject to extensive laws and regulation at both the federal and state levels as well as by accrediting agencies. These requirements cover virtually all aspects of our business.

Previous wording

In particular, the Higher Education Act authorizes Title IV Programs and subjects participants to extensive regulation by the Department, state education authorizing agencies, and accrediting agencies. Our institutions’ participation in education assistance programs administered by the Departments of Defense and Veterans Affairs also subjects us to oversight by those agencies. In addition, other federal agencies such as the Consumer Financial Protection Bureau(“CFPB”) and the Federal Trade Commission(“FTC”) and various state agencies and state attorneys general enforce a broad range of consumer protection and other laws applicable to activities of postsecondary educational institutions, such as recruiting, marketing, the protection of personal information, student financing and payment servicing.

Current wording

In particular, the Higher Education Act authorizes Title IV Programs and subjects participants to extensive regulations by the Department, state education authorizing agencies, and accrediting agencies. Our institutions’ participation in education assistance programs administered by the Departments of Defense and Veterans Affairs also subjects us to oversight by those agencies. In addition, other federal agencies such as the Consumer Financial Protection Bureau (“CFPB”) and the Federal Trade Commission (“FTC”) and various state agencies and state attorneys general enforce a broad range of consumer protection and other laws applicable to activities of postsecondary educational institutions, such as recruiting, marketing, the protection of personal information, student financing and payment servicing.

Previous wording

Because of these regulatory requirements, we are subject to compliance reviews and audits, as well as claims of noncompliance and lawsuits by government agencies based on claims by students, current and former employees and other third parties. These matters often require the expenditure of substantial time and resources to address and may damage our reputation, even if such actions are eventually determined to be without merit. For example, the Department has broad powers to request information and review records of an institution participating in Title IV Programs. These requests can be open-ended and do not necessarily relate to any specific allegations of wrongdoing or assert any compliance failures of any kind. We received such a request in December 2021. Due process safeguards and protections for institutions subjected to this type of information request are limited to the Department’s interpretation of the boundaries of its authority over institutions participating in Title IV programs.

Current wording

Because of these regulatory requirements, we are subject to compliance reviews and audits, as well as claims of noncompliance and lawsuits by government agencies based on claims by students, current and former employees and other third parties. These matters often require the expenditure of substantial time and resources to address and, additionally, they may damage our reputation, even if such actions are eventually determined to be without merit. For example, the Department has broad powers to request information and review records of an institution participating in Title IV Programs. These requests can be open-ended and do not necessarily relate to any specific allegations of wrongdoing or assert any compliance failures of any kind. We received such a request from the Department in December 2021. The inquiry was subsequently closed in January 2025 without any findings. Due process safeguards and protections for institutions subjected to this type of information request are limited to the Department’s interpretation of the boundaries of its authority over institutions participating in Title IV programs.

Previous wording

The Department, under direction from the current administration, has taken an ever-expanding view on its authority over the administration of Title IV programs, institutions and loans, including overruling or ignoring a number of historical limiting precedents and due process safeguards. The Department has partnered with advocacy groups critical of the for-profit education sector in numerous aspects of its agenda, which have lobbied for targeting the sector and our schools. The President has appointed and the Department has hired a number of individuals that are critical of for-profit education into senior level positions within the Department. In addition to the above factors, recent and future rulemaking, the absence of transparency from the Department, and the administration’s stated ambition to discharge a maximum amount of student loans has created a challenging and, in some cases, uncertain regulatory environment for the sector and could lead the Department to take actions to limit, suspend, or terminate institutions, including ours, with little or no warning or due process protections.

Current wording

The Department, under the Biden Administration, took an ever-expanding view on its authority over the administration of Title IV programs, institutions and loans, including overruling or ignoring a number of historical precedents and due process safeguards. The Department partnered with advocacy groups critical of the for-profit education sector in numerous aspects of its agenda, which have lobbied for targeting the sector and our schools. The postsecondary education regulatory environment may change in the future as a result of the U.S. federal election in November 2024. The new Presidential Administration and new Congress may act to change or eliminate currently effective ED regulations and final ED regulations that have been promulgated but are not yet effective.

Previous wording

On October 10, 2023, the Department published final regulations for the GE rule. The GE rule includes an eligibility framework that imposes additional requirements on for-profit sector programs, including our schools. The regulation uses two key metrics: Debt-to-Earnings (“D/E”) and Earnings Premium (“EP”) metrics to determine whether a program prepares students for gainful employment. The D/E metrics measure student debt at a program level against a measure of earnings. The EP metric measures student earnings at a program level against working individuals with a high school diploma or equivalent. GE programs that fail either the D/E or the EP metric in two of three consecutive years will lose Title IV eligibility. Programs offered by both AIUS and CTU are subject to the GE Rule and could lose Title IV eligibility if their programs fail to pass the D/E rates and/or the EP measures. The rule also requires our institutions to warn current and prospective students if a program fails any metric in any year. The issuance of required GE warnings could deter prospective students from enrolling at our institutions and current students from continuing in their programs.

Current wording

On October 10, 2023, the Biden Administration published final regulations for the GE rule. The GE rule includes a Title IV eligibility framework that imposes additional requirements on for-profit sector programs, including our schools. The regulation uses two key metrics: Debt-to-Earnings (“D/E”) and Earnings Premium (“EP”) metrics to determine whether a program prepares students for gainful employment. The D/E metrics measure student debt at a program level against a measure of earnings. The EP metric measures student earnings at a program level against working individuals with a high school diploma or equivalent. GE programs that fail either the D/E or the EP metric in two of three consecutive years will lose Title IV eligibility. Programs offered by AIUS, CTU and USAHS are subject to the GE Rule and could lose Title IV eligibility if their programs fail to pass the D/E rates and/or the EP measures. The rule also requires our institutions to warn current and prospective students if a program fails any metric in any year. The issuance of required GE warnings could deter prospective students from enrolling at our institutions and current students from continuing in their programs. Significantly, the 2023 GE rule is retroactive in its measurements as it evaluates data from previous student cohorts for the purpose of determining a program’s future Title IV eligibility. It is unclear the impact that state and federal mandated business closures experienced during the COVID pandemic and its resulting economic effects may have on our metrics, as data from this time period is applicable to the metrics.

Previous wording

Additionally, we may not know at the time of receipt that funding used by a student was derived from a federal program. In addition, if the institution violates the 90-10 Rule for two consecutive fiscal years and becomes ineligible to participate in Title IV Programs, but continues to disburse Title IV Program funds, the Department would require the repayment of all Title IV Program funds received by it after the effective date of the loss of eligibility. The Department also noted in its regulatory publication adopting the new rule that one of its expectations for this revised rule was to push students away from for-profit schools and into taxpayer subsidized community colleges and so we expect interpretations, guidance, and enforcement to generally be adverse to institutional compliance.

Current wording

Additionally, we may not know at the time of receipt that funding used by a student was derived from a federal program. In addition, if the institution violates the 90-10 Rule for two consecutive fiscal years and becomes ineligible to participate in Title IV Programs, but continues to disburse Title IV Program funds, the Department would require the repayment of all Title IV Program funds received by it after the effective date of the loss of eligibility. The Department also noted in its publication of the new rule that its expectation was to encourage a shift in enrollment away from for-profit schools and toward taxpayer subsidized community colleges. As such, we expect unfavorable treatment from the Department in its interpretations, guidance, and enforcement with regard to institutional compliance.

Previous wording

Several factors such as the increase in Title IV Program aid availability, including year-round Pell Grant funds, and budget-related reductions in state grant programs, workforce training programs, and other alternative funding sources have adversely affected our institutions' 90-10 Rule percentages in recent years, and we expect this negative impact to continue. Additionally, the lack of visibility into potential federal fund sources students may be using, the timing of the identification of the federal fund sources applicable to the 90-10 Rule, the lack of clarity regarding the definition of federal funds and those funds counting in the “10” as well as some of the technical aspects of the calculation methodology under the 90-10 Rule, and interest levels and variability in the timing of receipts of future cash payments made for allowable non-Title IV programs offered by our institutions, all make it difficult to predict future compliance with the 90-10 Rule. We have implemented various measures intended to reduce the percentage of our institutions’ cash basis revenue attributable to designated federal funding sources, including efforts to diversify the sources of our revenue. However, these measures may not be adequate to prevent our institutions' 90-10 Rule percentages from exceeding 90%, and may not be sufficient to allow our institutions to serve degree-seeking prospective students at the same rates as we have historically, or may require limiting the type or volume of new students we enroll or programs we offer. We may be required to modify our business operations, including reducing our investments in prospective student outreach and recruitment, in order to preserve our existing students’ ability to continue benefitting from financial assistance for their education pursuant to Title IV Programs. For example, in 2023, we materially reduced prospective student enrollment, marketing and outreach processes at AIUS during the year to limit the volume of new federal funding that the institution would receive to preserve available funding for existing students. Any necessary business changes could materially impact our revenue, operating costs and opportunities for growth. Furthermore, these business changes could make more difficult our ability to comply with other important regulatory requirements.

Current wording

Several factors have adversely impacted our 90-10 percentages in recent years, including increases in Title IV Program aid availability including year-round Pell Grant funds and budget reductions for state grant programs, workforce training programs, and other funding programs. We expect this negative trend to continue. Additionally, the lack of visibility into federal fund sources that students utilize, the timing of the identification of the federal fund sources applicable to the 90-10 Rule, the lack of clarity regarding the definition of federal funds which funds count in the “10”, as well as other technical aspects of the calculation methodology, and interest levels and variability in the timing of receipts of future cash payments made for allowable non-Title IV programs offered by our institutions, all make it difficult to predict future compliance with the 90-10 Rule. We have implemented various measures intended to reduce the percentage of our institutions’ cash basis revenue attributable to designated federal funding sources, including efforts to diversify the sources of our revenue. However, these measures may not be adequate to prevent our compliance with the 90-10 Rule and may not be sufficient to allow our institutions to serve degree-seeking prospective students at the same rates as we have historically, or may require limiting the type or volume of new students we enroll or programs we offer. We may be required to modify our business operations, including reducing our investments in prospective student outreach and recruitment, in order to preserve our existing students’ ability to continue benefitting from financial assistance for their education pursuant to Title IV Programs. For example, in 2023, we materially reduced prospective student enrollment, marketing and outreach processes at AIUS during the year to limit the volume of new federal funding that the institution would receive to preserve available funding for existing students. Any necessary business changes could materially impact our revenue, operating costs and opportunities for growth. Furthermore, these business changes could make more difficult our ability to comply with other important regulatory requirements.

Previous wording

The ability of our institutions to comply with the 90-10 Rule will depend upon the composition of our future student population and their personal circumstances, as well as on regulatory changes and other factors outside of our control, including any increases or reductions in federally funded education assistance.

Current wording

The ability of our institutions to comply with the 90-10 Rule will depend upon the composition of our future student population and their personal circumstances, as well as on regulatory changes and other factors outside of our control, including those cited above.

Previous wording

The Department may attempt to impose additional sanctions on institutions that fail the 90-10 Rule, but there is only limited precedent available to determine their legality or predict what those additional sanctions might be. For example, the new Financial Responsibility rule imposes a mandatory trigger for institutions that fail one year of the 90-10 Rule. The financial protection required would be a minimum of 10 percent of the previous year’s Title IV funds. This protection would remain in place until the institution passes the 90-10 Rule for two consecutive years. The Department could specify a wide range of additional conditions as part of the provisional certification and the institutions' continued participation in Title IV Programs. These conditions may include, but are not limited to: restrictions on the total amount of Title IV Program funds that may be distributed to students attending the institutions; restrictions on programmatic, enrollment, and geographic expansion; requirements to obtain and post letters of credit; and additional reporting requirements to include additional interim financial or enrollment reporting.

Current wording

While the Department may attempt to impose additional sanctions on institutions that fail the 90-10 Rule, but there is only limited precedent available to determine their legality or predict what those additional sanctions might be. For example, the new financial responsibility rule, discussed further below, imposes a mandatory trigger for failure to comply with one year of the 90-10 Rule. It would require a minimum financial protection of 10 percent of the previous year’s Title IV funds. This protection would remain in place until the institution passes the 90-10 Rule for two consecutive years. The Department has discretion to impose a wide range of additional conditions as part of its provisional certification and the institutions' continued participation in Title IV Programs. These conditions may include, but are not limited to: restrictions on the total amount of Title IV Program funds that may be distributed to students attending the institutions; restrictions on programmatic, enrollment, and geographic expansion; requirements to obtain and post letters of credit; and additional reporting requirements to include additional interim financial or enrollment reporting.

Previous wording

The extensive regulatory requirements applicable to our business may change, in particular as a result of the scrutiny of the for-profit postsecondary education sector and efforts of the current administration, which could require us to make substantial changes to our business, reduce our profitability and make compliance more difficult.

Current wording

The extensive regulatory requirements applicable to our business may change, in particular as a result of the scrutiny of the for-profit postsecondary education sector which could require us to make substantial changes to our business, reduce our profitability and make compliance more difficult.

Previous wording

The regulations, standards and policies of our regulators change frequently and are subject to interpretation, and interpretations may change over time or due to changes in presidential administrations. In particular, the Department promulgated a number of new regulations that become effective on July 1, 2024, including the Financial Value Transparency and Gainful Employment Rule, and revised Financial Responsibility, Administrative Capability, and Certification rules. In addition, the Department has announced and is in the process of promulgating a substantial number of new regulations that impact our business, including but not limited to updates to accreditation, state authorization, and distance education regulations discussed in a separate risk factor below.

Current wording

The regulations, standards and policies of our regulators change frequently and are subject to interpretation, and interpretations may change over time or due to changes in presidential administrations. In particular, the Department under the Biden Administration promulgated a number of new regulations that depending on the date of publication became effective or will be effective on July 1, 2023, 2024 and 2026, including the Financial Value Transparency and Gainful Employment Rule, and revised financial responsibility, administrative capability, 90-10, distance education and certification rules. We have been operating with dramatic shifts in regulatory approaches across different presidential administrations, resulting in a significant number of regulations being adopted, subsequently rescinded or revised, then re-adopted. While President Trump’s previous priorities are apparent by actions taken in his first term, we have limited information on the priorities for private postsecondary education for his second term. We anticipate a number of regulatory changes may be forthcoming.

Previous wording

The Higher Education Act guides the federal government’s support of postsecondary education. The U.S. Congress is required to periodically reauthorize the Higher Education Act and other laws governing Title IV Programs and annually determines the funding level for each Title IV Program. The Higher Education Act was last reauthorized by the U.S. Congress in 2008. When the Higher Education Act is reauthorized, existing programs and participation requirements are subject to change. Additionally, funding for student financial assistance programs may be impacted during appropriations and budget actions. See Item 1, “Business—Student Financial Aid and Related Federal Regulation—Legislative Action and Recent Department Regulatory Initiatives,”for more information about the reauthorization of the Higher Education Act. In recent years, Congress, the Department, states, accrediting agencies, the CFPB, the FTC, state attorneys general, consumer advocacy groups, and the media have scrutinized the for-profit postsecondary education sector. See Item 1, “Business—Student Financial Aid and Related Federal Regulation—Scrutiny of the For-Profit Postsecondary Education Sector,”for more information about the focus on our industry. This scrutiny and efforts of the current administration led to significant regulatory changes. The Department has enacted and is continuing to pursue significant rulemaking initiatives that are likely to negatively impact our business. See Item 1, “Business—Student Financial Aid and Related Federal Regulation—Legislative Action and Recent Department Regulatory Initiatives,”for an overview of regulatory initiatives by the Department. Ongoing efforts by activists to change state authorization regulations, State Authorization Reciprocity Agreement ("SARA") reciprocity rules, and state-by-state standards could increase regulatory burdens on our business. See Item 1, “Business - Accreditation, State Regulation and Other Compliance Matters - State Regulation,”for more information about state regulation and SARA.

Current wording

The Higher Education Act guides the federal government’s support of postsecondary education. The U.S. Congress is required to periodically reauthorize the Higher Education Act and other laws governing Title IV Programs and annually determines the funding level for each Title IV Program. Congress last reauthorized the Higher Education Act in 2008. The reauthorization of the Higher Education Act results in a change in the requirements for existing programs and its participation in Title IV programs. Additionally, funding for student financial assistance programs may be impacted during appropriations and budget actions. See Item 1,“Business—Student Financial Aid and Related Federal Regulation—Legislative Action and Recent Department Regulatory Initiatives,” for more information about the reauthorization of the Higher Education Act. In recent years, Congress, the Department, states, accrediting agencies, the CFPB, the FTC, state attorneys general, consumer advocacy groups, and the media have scrutinized the for-profit postsecondary education sector. See Item 1,“Business - Student Financial Aid and Related Federal Regulation - Scrutiny of the For-Profit Postsecondary Education Sector,”for more information about the focus on our industry. This scrutiny and efforts of the Biden Administration led to significant regulatory changes designed to target and limit for-profit postsecondary education. See Item 1,“Business - Student Financial Aid and Related Federal Regulation - Legislative Action and Recent Department Regulatory Initiatives,” for an overview of regulatory initiatives by the Department. Ongoing efforts by activists to change state authorization regulations, State Authorization Reciprocity Agreement ("SARA") reciprocity rules, and state-by-state standards could increase regulatory burdens on our business. See Item 1,“Business - Accreditation, State Regulation and Other Compliance Matters - State Regulation,” for more information about state regulation and SARA.

Previous wording

Many states and professional associations require professional programs to be accredited. While programmatic accreditation is not a sufficient basis to qualify for institutional Title IV Program certification, programmatic accreditation may be a prerequisite for or improve employment opportunities of program graduates in their chosen field. Those of our programs that do not have such programmatic accreditation, where available, or fail to maintain such accreditation, may experience adverse publicity, declining enrollments, litigation or other claims from students or suffer other adverse impacts, which could result in it being impractical for us to continue offering such programs.

Current wording

Many states and professional associations require professional programs to be accredited. While programmatic accreditation is not a sufficient basis to qualify for institutional Title IV Program certification, programmatic accreditation may be a prerequisite for or improve employment opportunities of program graduates in their chosen field. Those of our programs that do not have such programmatic accreditation, where available, or fail to maintain such accreditation, particularly in programs in the health sciences field, may experience adverse publicity, declining enrollments, litigation or other claims from students or suffer other adverse impacts, which could result in it being impractical for us to continue offering such programs.

Previous wording

The Department requires institutions that participate in Title IV Programs to refer to the Department’s Office of the Inspector General credible information about fraud or other illegal conduct involving Title IV programs. If the systems and processes that our institutions have established to detect and prevent fraud are inadequate, the Department may find that our institutions do not satisfy the Department’s administrative capability requirements, which could have the adverse effects described in the risk factor captioned “A failure to demonstrate "financial responsibility" or "administrative capability" or meet new "certification" requirements would have negative impacts on our operations.” In addition, our ability to participate in Title IV Programs is conditioned on maintaining accreditation by an accrediting agency that is recognized by the Department. Any significant failure to adequately detect fraudulent activity related to student enrollment and financial aid could cause us to fail to meet accreditors’ standards. Furthermore, accrediting agencies that evaluate institutions offering online programs, must require such institutions to have processes through which the institution establishes that a student who registers for such a program is the same student who participates in and receives credit for the program. Failure to meet the requirements of our institutions’ accrediting agencies could result in the loss of accreditation of one or more of our institutions, which could result in their loss of eligibility to participate in Title IV Programs.

Current wording

The Department requires institutions that participate in Title IV Programs to refer to the Department’s Office of the Inspector General ("OIG") credible information about fraud or other illegal conduct involving Title IV programs. If the systems and processes that our institutions have established to detect and prevent fraud are inadequate, the Department may find that our institutions do not satisfy the Department’s administrative capability requirements, which could have the adverse effects described in the risk factor captioned“A failure to demonstrate "financial responsibility" or "administrative capability" or meet new "certification" requirements would have negative impacts on our operations.” In addition, our ability to participate in Title IV Programs is conditioned on maintaining accreditation by an accrediting agency that is recognized by the Department. Any significant failure to adequately detect fraudulent activity related to student enrollment and financial aid could cause us to fail to meet accreditors’ standards. Furthermore, accrediting agencies that evaluate institutions offering online programs, must require such institutions to have processes through which the institution establishes that a student who registers for such a program is the same student who participates in and receives credit for the program. Failure to meet the requirements of our institutions’ accrediting agencies could result in the loss of accreditation of one or more of our institutions, which could result in their loss of eligibility to participate in Title IV Programs.

Previous wording

Our agreements with multiple state attorneys general and the FTC may lead to unexpected impacts on our student enrollments or higher than anticipated expenses, a failure to comply may lead to additional enforcement actions and continued scrutiny may result in additional costs or new enforcement actions.

Current wording

Our agreement with the FTC may lead to unexpected impacts on our student enrollments or higher than anticipated expenses, a failure to comply may lead to additional enforcement actions and continued scrutiny may result in additional costs or new enforcement actions.

Previous wording

As discussed above, states and other regulatory bodies have increased their focus on the for-profit postsecondary education sector. This includes increased activity by state attorneys general and the FTC in their review of the sector. In recent years, we entered into various agreements with state attorneys general and the FTC to bring closure to inquiries by them. See Item 1, “Business – Accreditation, State Regulation and Other Compliance Matters – Other Compliance Matters”for information about these agreements. These agreements could ultimately result in negative impacts on our business, any one of which could be material.

Current wording

As discussed above, states and other regulatory bodies have increased their focus on the for-profit postsecondary education sector. In 2019, we entered into an agreement with the FTC to bring closure to inquiries by them. See Item 1,“Business – Accreditation, State Regulation and Other Compliance Matters – Other Compliance Matters” for information about this agreement. This agreement may ultimately result in negative impacts on our business, any one of which may be material.

Previous wording

Pursuant to the agreement with the FTC, we agreed to various operating provisions including the operation of a system to monitor lead aggregators and generators involving a compliance review by, or on behalf of, the Company of the various sources a prospective student interacts with prior to the Company’s purchase and use of the prospective student lead. The compliance costs related to these agreements may be greater than anticipated and may have a negative impact on our ability to compete effectively and maintain and grow student enrollments at our institutions, and a failure to comply may lead to additional enforcement actions by the state attorneys general and the FTC. In addition, we continue to receive requests from state and other regulatory bodies to provide ongoing proof that we are complying with applicable law and regulations and meeting our contractual obligations pursuant to these agreements. Compliance with these requests results in significant additional costs and a failure to respond, whether required or not, could result in additional enforcement actions.

Current wording

Pursuant to the agreement with the FTC, we agreed to various operating provisions including the operation of a system to monitor lead aggregators and generators involving a compliance review by, or on behalf of, the Company of the various sources a prospective student interacts with prior to the Company’s purchase and use of the prospective student lead. The compliance costs related to these agreements may be greater than anticipated and may have a negative impact on our ability to compete effectively and maintain and grow student enrollments at our institutions, and a failure to comply may lead to additional enforcement action by the FTC. In addition, we may receive requests from states and other regulatory bodies to provide ongoing proof that we are complying with applicable laws and regulations and meeting our obligations pursuant to this agreement. Compliance with these requests results in significant additional costs and a failure to respond, whether required or not, could result in additional enforcement actions.

Previous wording

We have been named as defendants currently and/or in the past in various lawsuits, investigations and claims covering a range of matters, including, but not limited to, violations of the federal securities laws, breaches of fiduciary duty and claims made by current and former students and employees of our institutions. Current claims include aqui tam action filed in federal court by an individual plaintiff on behalf of themselves and the federal government alleging that we submitted false claims or statements to the Department in violation of the False Claims Act. See Note 12 "Contingencies" to our consolidated financial statements for discussion of these and certain other current matters. Additional actions may arise in the future.

Current wording

We have been named as defendants currently and/or in the past in various lawsuits, investigations and claims covering a range of matters, including, but not limited to, violations of federal securities laws, breaches of fiduciary duty and claims made by current and former students and employees of our institutions. Current claims include a qui tam action filed in federal court by an individual plaintiff on behalf of themselves and the federal government alleging that we submitted false claims or statements to the Department in violation of the False Claims Act. See Note 12 "Contingencies" to our consolidated financial statements for discussion of these and certain other current matters. Additional actions may arise in the future.

Previous wording

Given the highly regulated nature of our industry, we and our institutions are also subject to and have regular audits, compliance reviews, inquiries, investigations, and claims of non-compliance by the Department, federal and state regulatory agencies, accrediting agencies, state attorney general offices, present and former students and employees, and others that may allege violations of statutes, regulations, accreditation standards, consumer protection and other legal and regulatory requirements applicable to us or our institutions. See Note 12 "Contingencies" to our consolidated financial statements and Item 1,"Business - Student Financial Aid and Related Federal Regulation - Compliance with Federal Regulatory Standards and Effect of Federal Regulatory Violations" for additional discussion of these and certain other current matters. If the results of any such audits, reviews, inquiries, investigations, claims, or actions are unfavorable to us, we may be required to pay monetary damages or be subject to fines, operational limitations, loss of federal funding, injunctions, undertakings, additional oversight and reporting, or other civil or criminal penalties.

Current wording

Given the highly regulated nature of our industry, we and our institutions are subject to and have regular audits, compliance reviews, inquiries, investigations, and claims of non-compliance by the Department, federal and state regulatory agencies, accrediting agencies, state attorney general offices, present and former students and employees, and others that may allege violations of statutes, regulations, accreditation standards, consumer protection and other legal and regulatory requirements applicable to us or our institutions. See Note 12 "Contingencies" to our consolidated financial statements and Item 1,"Business - Student Financial Aid and Related Federal Regulation - Compliance with Federal Regulatory Standards and Effect of Federal Regulatory Violations" for additional discussion of these and certain other current matters. If the results of any such audits, reviews, inquiries, investigations, claims, or actions are unfavorable to us, we may be required to pay monetary damages or be subject to fines, operational limitations, loss of federal funding, injunctions, undertakings, additional oversight and reporting, or other civil or criminal penalties.

Previous wording

We are subject to a variety of other claims and litigation that arise from time to time alleging non-compliance with or violations of state or federal regulatory matters including, but not limited to, claims involving students, graduates and employees. In the event the extensive changes in the overall federal and state regulatory construct results in additional statutory or regulatory bases for these types of matters, or other events result in more of such claims or unfavorable outcomes to such claims, there exists the possibility of a material adverse impact on our business, reputation, financial position, cash flows and results of operations for the periods in which the effects of any such matter or matters becomes probable and reasonably estimable.

Current wording

We are subject to a variety of other claims and litigation that arise from time to time alleging non-compliance with or violations of state or federal regulatory matters including, but not limited to, claims involving students, graduates and employees. In the event that extensive changes in the overall federal and state regulatory construct results in additional statutory or regulatory bases for these types of matters, or other events result in more of such claims or unfavorable outcomes to such claims, there exists the possibility of a material adverse impact on our business, reputation, financial position, cash flows and results of operations for the periods in which the effects of any such matter or matters becomes probable and reasonably estimable.

Previous wording

If the Department denies, or significantly conditions, recertification of either of our institutions to participate in Title IV Programs, that institution could not conduct its business as it is currently conducted.

Current wording

If the Department denies, or significantly conditions, recertification of any of our institutions to participate in Title IV Programs, that institution could not conduct its business as it is currently conducted.

Previous wording

Under the provisions of the Higher Education Act, an institution must apply to the Department for continued certification to participate in Title IV Programs at least every six years or whenever it undergoes a change of control. Generally, the recertification process includes a review by the Department of an institution’s educational programs and locations, administrative capability, financial responsibility, and other regulatory oversight categories. Both AIUS and CTU are currently in the recertification process with the Department. AIUS is currently operating on a provisional program participation agreement due to open regulatory review processes with the Department at the time of its prior recertification. During the period of provisional certification, an institution must obtain prior Department approval to add an educational program, open a new location, or make any other significant change, which could negatively impact AIUS’ ability to take these actions. Institutions may be given provisional program participation agreements for very nominal or arbitrary reasons and we have seen in some instances without justification, including the existence of an open and pending audit or review within the Department’s discretion or unspecified issues arising out of past administrative capability issues. Recently, the Department has imposed a number of additional reporting, limiting and monitoring conditions on continued participation against institutions it has recertified.

Current wording

Under the provisions of the Higher Education Act, an institution must apply to the Department for continued certification to participate in Title IV Programs at least every six years or whenever it undergoes a change of control. Generally, the recertification process includes a review by the Department of an institution’s educational programs and locations, administrative capability, financial responsibility, and other regulatory oversight categories. USAHS is operating under a temporary provisional program participation agreement as a result of its recent change of ownership. Pursuant to applicable regulations, if the change of ownership is approved, USAHS will then participate under provisional certification for up to three years. During the period of provisional certification, an institution must obtain prior Department approval to add an educational program, open a new location, increase the credential level of its offerings, or shorten or lengthen its programs, which could negatively impact USAHS ability to take these actions. Institutions may be given provisional program participation agreements for nominal or arbitrary reasons and we have seen in some instances without justification, including the existence of an open and pending audit or review within the Department’s discretion or unspecified issues arising out of past administrative capability issues. Recently, the Department has imposed a number of additional reporting, limiting and monitoring conditions on continued participation against institutions it has recertified.

Previous wording

If the Department finds that any of our institutions do not fully satisfy all required eligibility and certification standards, the Department could deny recertification or limit, suspend, or terminate the institution’s participation in Title IV Programs. Continued Title IV program eligibility is critical to the operation of our business. If either of our institutions becomes ineligible to participate in Title IV Programs, or have that participation significantly conditioned, it could not conduct its business as currently conducted and we would experience a dramatic decline in revenue.

Current wording

If the Department finds that any of our institutions do not fully satisfy all required eligibility and certification standards, the Department could deny recertification or limit, suspend, or terminate the institution’s participation in Title IV Programs. Continued Title IV Program eligibility is critical to the operation of our business. If any of our institutions becomes ineligible to participate in Title IV Programs, or have that participation significantly conditioned, it could not conduct its business as currently conducted and we would experience a dramatic decline in revenue.

Previous wording

Our student enrollments could suffer from any of these circumstances. It is likely that legislative, regulatory, and economic uncertainties will continue, and thus it is difficult to assess our long-term growth prospects. Reduced enrollments at our institutions, for any of the reasons mentioned or otherwise, generally reduce our profitability, which, depending on the level of the decline, could be material.

Current wording

Our student enrollments could suffer from any of these circumstances. We believe it is likely that legislative, regulatory and economic uncertainties will continue, and thus it is currently difficult to assess our long-term growth prospects. Reduced enrollments at our institutions, for any of the reasons mentioned herein or otherwise, generally reduce our profitability, which, depending on the level of the decline, could be material.

Previous wording

Congress, the Department and other agencies have required increasing disclosure of information to prospective students (with some disclosures only required by for-profit institutions), and our agreements with multiple state attorneys general require additional disclosures that are not required by our competitors. Some of these disclosures may negatively impact a prospective student’s decision to enroll in one of our institutions.

Current wording

Congress, the Department and other agencies have required increasing disclosure of information to prospective students (with some disclosures only required by for-profit institutions). Some of these disclosures may negatively impact a prospective student’s decision to enroll in one of our institutions.

Previous wording

If our institutions are unable to successfully conduct outreach for and recruit prospective students for their educational programs, our institutions' ability to attract and enroll prospective students in those programs could be adversely affected. We have been investing in our student admissions and advising functions and other initiatives to improve student experiences, retention and academic outcomes. If these initiatives do not continue to succeed, our ability to attract, enroll and retain students in our programs could be adversely affected. Further, Internet and other technology, including data gathering and marketing and advertising, is changing fast and we may be unable to adapt our initiatives to attract, enroll and retain students in a timely manner. Consequently, our ability to increase revenue or maintain profitability could be impaired. Some of the factors that could prevent us from successfully conducting outreach and recruitment for our institutions and the programs that they offer include, but are not limited to: student or employer dissatisfaction with our educational programs and services; diminished access to prospective students; our failure to maintain or expand our brand names or other factors related to our marketing or advertising practices; FTC or Federal Communications Commission restrictions on contacting prospective students, Internet, mobile phone and other advertising and marketing media; costs and effectiveness of Internet, mobile phone and other advertising programs; and changing media preferences of our target audiences.

Current wording

If our institutions are unable to successfully conduct outreach for and recruit prospective students for their educational programs, our institutions’ ability to attract and enroll prospective students in those programs could be adversely affected. We have been investing in our student admissions and advising functions and other initiatives to improve student experiences, retention and academic outcomes. If these initiatives do not continue to succeed, our ability to attract, enroll and retain students in our programs could be adversely affected. Further, internet and other technology, including data gathering and marketing and advertising, is changing fast and we may be unable to adapt our initiatives to attract, enroll and retain students in a timely manner. Consequently, our ability to increase revenue or maintain profitability could be impaired. Some of the factors that could prevent us from successfully conducting outreach and recruitment for our institutions and the programs that they offer include, but are not limited to: student or employer dissatisfaction with our educational programs and services; diminished access to prospective students; our failure to maintain or expand our brand names or other factors related to our marketing or advertising practices; FTC or Federal Communications Commission restrictions on contacting prospective students and the use of internet, mobile phone and other advertising and marketing media; costs and effectiveness of internet, mobile phone and other advertising programs; and changing media preferences of our target audiences.

Previous wording

Our success and ability to grow depends on the ability to hire, train and retain significant numbers of talented people. We face competition from companies in postsecondary education and other industries in attracting, hiring and retaining personnel who possess the combination of skills and experiences that we seek to implement our business strategy. In particular, our performance is dependent upon the availability and retention of qualified personnel for our student support operations. The negative publicity surrounding our industry sometimes makes it difficult and more expensive to attract, hire and retain qualified and experienced personnel, and the Department’s regulations related to incentive compensation affect our ability to compensate admissions and financial aid personnel. Our ability to effectively train our student support personnel and the length of time it takes them to become productive also impacts our results of operations. In addition, as a result of the overall tightening of the labor market and the competitive world for quality employees that emerged during the pandemic, we have had increasing difficulty in filling our open positions. This may result in additional costs in the future as we are required to provide increased compensation in order to attract and retain qualified employees.

Current wording

Our success and ability to grow depends on the ability to hire, train and retain significant numbers of talented people. We face competition from companies in postsecondary education and other industries in attracting, hiring and retaining personnel who possess the combination of skills and experiences that we seek to implement our business strategy. In particular, our performance is dependent upon the availability and retention of qualified personnel for our student support operations. The negative publicity surrounding our industry sometimes makes it difficult and more expensive to attract, hire and retain qualified and experienced personnel, and the Department’s regulations related to incentive compensation affect our ability to compensate admissions and financial aid personnel. Our ability to effectively train our student support personnel and the length of time it takes them to become productive also impacts our results of operations. This may result in additional costs in the future as we are required to provide increased compensation in order to attract and retain qualified employees.

Previous wording

We rely on proprietary rights and intellectual property in conducting our business, which may not be adequately protected under current laws, and we may encounter disputes from time to time relating to our use of intellectual property of third parties.

Current wording

We rely on proprietary rights and intellectual property in conducting our business, which may not be adequately protected under current laws, and we may encounter disputes from time to time relating to our use of the intellectual property of third parties.

Previous wording

We may encounter disputes from time to time over rights and obligations concerning intellectual property, and we may not prevail in these disputes. Third parties may raise a claim against us alleging an infringement or violation of the intellectual property of that third party. Some third party intellectual property rights may be extremely broad, and it may not be possible for us to conduct our operations in such a way as to avoid those intellectual property rights. Any such intellectual property claim could subject us to costly litigation and impose a significant strain on our financial resources and management personnel regardless of whether such claim has merit.

Current wording

We may encounter disputes from time to time over rights and obligations concerning intellectual property, and we may not prevail in these disputes. Third parties may raise a claim against us alleging an infringement or violation of the intellectual property of that third party. Some third-party intellectual property rights may be extremely broad, and it may not be possible for us to conduct our operations in such a way as to avoid those intellectual property rights. In addition, in some instances, our faculty members or our students may post various articles or other third-party content on class discussion boards or download third-party content to personal computers, which may result in claims or liability for the unauthorized duplication or distribution of this material. Any intellectual property claim could subject us to costly litigation and impose a significant strain on our financial resources and management personnel regardless of whether such claim has merit.

Previous wording

The successful integration and profitable operation of an acquired institution or business, including the realization of anticipated cost savings and additional revenue opportunities, can present challenges, and the failure to overcome these challenges can have an adverse effect on our business, financial condition, cash flows and results of operations. Some of these challenges include:

Current wording

On December 2, 2024, we completed our acquisition of the University of St. Augustine for Health Sciences (“USAHS”). Our future success will depend, in part, on our ability to integrate USAHS, and any other institutions or businesses we may acquire in the future, into our operations. The successful integration and profitable operation of an acquired institution or business, including the realization of anticipated cost savings and additional revenue opportunities, can present challenges, and the failure to overcome these challenges can have an adverse effect on our business, financial condition, cash flows and results of operations. Such challenges, while ultimately dependent on the particular acquisition at hand, may include, among other things, the inability to maintain uniform standards, controls, policies and procedures; the acquired business not performing as expected; distraction of management’s attention from normal business operations during the integration process; the inability to attract and/or retain key management personnel to operate the acquired entity; the inability to obtain, or delays in obtaining, regulatory or other approvals necessary to operate the business; the risk that disruptions from the integration will harm our or the acquired entity’s businesses; potential adverse reactions or changes to business relationships resulting from the acquisition; the inability to correctly estimate the size of a target market or accurately assess market dynamics; expenses associated with the integration efforts; and our assumption of unexpected risks, liabilities and obligations of the acquired business, including issues not discovered in the due diligence process.

Previous wording

An acquisition related to an institution or other educational business often requires various regulatory approvals. If we are unable to obtain such approvals, or we obtain them on unfavorable terms, our ability to consummate a transaction may be impaired or we may be unable to operate the acquired entity in a manner that is favorable to us. If we fail to properly evaluate an acquisition, we may be required to incur costs in excess of what we anticipated, and we may not achieve the anticipated benefits of such acquisition.

Current wording

An acquisition related to an institution or other educational business often requires various regulatory approvals and in the case of a Title IV eligible institution, like USAHS, has recently required growth restrictions, reporting obligations and temporary conditions on operations that limit changes to the institution after acquisition. If we are unable to obtain such approvals, or we obtain them on unfavorable terms, our ability to consummate a future transaction may be impaired or we may be unable to operate the acquired entity in a manner that is favorable to us. If we fail to properly evaluate an acquisition, we may be required to incur costs in excess of what we anticipated, and we may not achieve the anticipated benefits of such acquisition, including the acquisition of USAHS.

Previous wording

The information technology networks and systems owned, operated, controlled or used by us, our third-party vendors or other external agencies may be vulnerable to damage, disruptions or shutdowns, software or hardware vulnerabilities, data breaches, security incidents, failures during the process of upgrading or replacing software or databases or components thereof, power outages, natural disasters, hardware failures, attacks by computer hackers, telecommunication failures, user errors, user malfeasance, computer viruses, unauthorized access, phishing or social engineering attacks, ransomware attacks, distributed denial-of-service attacks, brute force attacks, robocalls and other real or perceived cyberattacks or catastrophic events, all of which may not be prevented by our efforts to secure our networks and systems. Security incidents can also occur as a result of non-technical issues, including intentional or inadvertent actions by our employees, our third-party vendors, external agencies or their personnel, or other parties. Security incidents are becoming increasingly prevalent and severe, as well as increasingly difficult to detect. Any of these incidents could lead to interruptions or shutdowns of our platforms, disruptions in our ability to process service requests, record or analyze the use of our services, loss or corruption of data, or unauthorized access to, or acquisition of, personal information or other sensitive information, such as our intellectual property. We maintain policies and practices and operational safeguards, measures and controls aimed at reducing our cyber risk, protecting and recovering our data and ensuring business continuity, which include reasonable efforts to ensure that our third-party vendors maintain reasonable security, including encryption and authentication technology, and will notify us promptly if a security incident occurs. However, none of our or our vendors’ or external agencies’ security measures can provide absolute security. Advances in computer capabilities, increasingly sophisticated tools and methods used by hackers and cyber terrorists, new discoveries in the field of cryptography or other developments may result in our failure or inability, or the failure or inability of our vendors or external agencies, to adequately protect personal or other sensitive information, and there can be no assurance that we, our vendors or external agencies will not suffer a cyberattack, that hackers or other unauthorized parties will not gain access to or exfiltrate personal information or other sensitive data or that any such data compromise or unauthorized access will be discovered in a timely fashion.

Current wording

The information technology networks and systems owned, operated, controlled or used by us, our third-party vendors or other external agencies may be vulnerable to damage, disruptions or shutdowns, software or hardware vulnerabilities, data breaches, security incidents, failures during the process of upgrading or replacing software or databases or components thereof, power outages, natural disasters, hardware failures, attacks by computer hackers, telecommunication failures, user errors, user malfeasance, computer viruses, unauthorized access, phishing or social engineering attacks, ransomware attacks, distributed denial-of-service attacks, brute force attacks, robocalls and other real or perceived cyberattacks or catastrophic events, all of which may not be prevented by our efforts to secure our networks and systems. Security incidents can also occur as a result of non-technical issues, including intentional or inadvertent actions by our employees, our third-party vendors, external agencies or their personnel, or other parties. Security incidents are becoming increasingly prevalent and severe, as well as increasingly difficult to detect. Any of these incidents could lead to interruptions or shutdowns of our platforms, disruptions in our ability to process service requests and record or analyze the use of our services, the loss or corruption of data or unauthorized access to, or acquisition of, personal information or other sensitive information, such as our intellectual property. We maintain policies and practices and operational safeguards, measures and controls aimed at reducing our cyber risk, protecting and recovering our data and ensuring business continuity, which include reasonable efforts that aim to ensure that our third-party vendors maintain reasonable security, including encryption and authentication technology, and will notify us promptly if a security incident occurs. However, none of our or our vendors’ or external agencies’ security measures can provide absolute security. Advances in computer capabilities, increasingly sophisticated tools and methods used by hackers and cyber terrorists, new discoveries in the field of cryptography or other developments may result in our failure or inability, or the failure or inability of our vendors or external agencies, to adequately protect personal or other sensitive information, and there can be no assurance that we, our vendors or external agencies will not suffer a cyberattack, that hackers or other unauthorized parties will not gain access to or exfiltrate personal information or other sensitive data or that any such data compromise or unauthorized access will be discovered in a timely fashion.

Previous wording

Like many businesses, we, our third-party vendors and external agencies have in the past and will in the future continue to be subject to cyberattacks, cybersecurity threats and attempts to compromise and penetrate our data security and systems and disrupt our services. Regular patching of each of our respective computer systems and frequent updates to our virus detection and prevention software with the latest virus and malware signatures may not catch newly introduced malware, ransomware, viruses or “zero-day” viruses prior to their infecting our, our third-party vendors and/or external agencies’ computer systems or networks. Future cyberattacks against us, our third-party vendors or external agencies could lead to operational disruptions that could have an adverse effect on our ability to provide services to clients and customers and on our results of operations and financial results. Any general decline in Internet use for any reason, including security or privacy concerns, cost of Internet service or changes in government regulation, could result in less demand for online educational services and inhibit growth in our online programs.

Current wording

Like many businesses, we, our third-party vendors and external agencies have in the past and will in the future continue to be subject to cyberattacks, cybersecurity threats and attempts to compromise and penetrate our data security and systems and disrupt our services. Regular patching of each of our respective computer systems and frequent updates to our virus detection and prevention software with the latest virus and malware signatures may not catch newly introduced malware, ransomware, viruses or “zero-day” viruses prior to their infecting our, our third-party vendors and/or external agencies’ computer systems or networks. Future cyberattacks against us, our third-party vendors or external agencies could lead to operational disruptions that could have an adverse effect on our ability to provide services to students and on our results of operations and financial results. Any general decline in internet use for any reason, including security or privacy concerns, cost of internet service or changes in government regulation, could result in less demand for online educational services and inhibit growth in our online programs.

Previous wording

Failure of our systems to operate effectively or a compromise in the security of our systems, or the systems of our affiliates or other third parties, that results in unauthorized persons or entities obtaining personal information or other sensitive information could materially and adversely affect our reputation, operations, operating results and financial condition. Actual or anticipated cyberattacks may cause us to incur costs, including costs to deploy additional personnel and protection technologies, train employees, pay higher insurance premiums and engage third-party specialists for additional services. Breaches in our data security or that of our affiliates or other third parties could expose us to risks of data loss, inappropriate disclosure of confidential or proprietary information, potential claims, investigations, regulatory proceedings, litigation penalties and liability, could impede our processing of transactions and our financial reporting and could result in a disruption of our operations. In addition, we may incur other substantial costs in connection with remediating and otherwise responding to any data security incident, including potential liability for stolen client, student or employee data, repairing system damage, or providing credit monitoring or other benefits to clients, students or employees affected by the incident. Additionally, if we, our third-party service providers or external agencies experience security incidents that result in a decline in performance of necessary services, availability problems or the loss, corruption of, unauthorized access to or disclosure of personal data or confidential information, people may become unwilling to provide us the information necessary to receive our services, and our reputation and market position could be harmed. Existing students may also decrease their use of our services or cease using our services altogether. The impact of these security threats, incidents and other disruptions are difficult to predict. Our insurance coverage for such security threats, incidents and other disruptions may not be adequate to cover all related costs, and we may not otherwise be fully indemnified for them. This may result in an increase in our costs for insurance or insurance not being available to us on economically feasible terms or at all. Insurers may also deny us coverage as to any future claim. Any of these results could harm our growth prospects, financial condition, business and reputation.

Current wording

Failure of our systems to operate effectively or a compromise in the security of our systems, or the systems of our third-party vendors, external agencies or other third parties, that results in unauthorized persons or entities obtaining personal information or other sensitive information could materially and adversely affect our reputation, operations, operating results and financial condition. Actual or anticipated cyberattacks may cause us to incur costs, including costs to deploy additional personnel and protection technologies, train employees, pay higher insurance premiums and engage third-party specialists for additional services. Breaches in our data security or that of our third-party vendors, external agencies or other third parties could expose us to risks of data loss, inappropriate disclosure of confidential or proprietary information, potential claims, investigations, regulatory proceedings, litigation penalties and liability, could impede our processing of transactions and our financial reporting and could result in a disruption of our operations. In addition, we may incur other substantial costs in connection with remediating and otherwise responding to any data security incident, including potential liability for stolen client, student or employee data, repairing system damage, or providing credit monitoring or other benefits to clients, students or employees affected by the incident. Additionally, if we, our third-party service providers or external agencies experience security incidents that result in a decline in performance of necessary services, availability problems or the loss, corruption of, unauthorized access to or disclosure of personal data or confidential information, people may become unwilling to provide us the information necessary to receive our services, and our reputation and market position could be harmed. Existing students may also decrease their use of our services or cease using our services altogether. The impact of security threats, incidents and other disruptions are difficult to predict. Our insurance coverage for such security threats, incidents and other disruptions may not be adequate to cover all related costs, and we may not otherwise be fully indemnified for them. This may result in an increase in our costs for insurance or insurance not being available to us on economically feasible terms or at all. Insurers may also deny us coverage as to any future claim. Any of these results could materially harm our growth prospects, financial condition, business and reputation.

Previous wording

The personal information that we collect may be vulnerable to breach, theft or loss which could adversely affect our reputation, operations and ability to attract and retain students.

Current wording

The personal information that we collect may be vulnerable to breach, theft or loss, any of which could adversely affect our reputation, operations and ability to attract and retain students.

Previous wording

In the ordinary course of our business, we maintain on our network systems, on the networks of our third-party providers, and have reported to external agencies certain information that is confidential, proprietary, personal (such as student information), or otherwise sensitive in nature, including financial information and confidential business information. Our computer networks, those of our vendors that manage confidential information for us or provide services to our students or us and those of external agencies can be accessed globally through the internet and are vulnerable to unauthorized access, inadvertent access or display, theft or misuse, hackers, installation of ransomware and malware and computer viruses, during regular use and in connection with hardware and software upgrades and changes. These attacks have become more prevalent and sophisticated. Unauthorized access, misuse, theft or hacks can evade our intrusion detection and prevention precautions without alerting us to the breach or loss for some period of time or may never be detected. A user who circumvents security measures could misappropriate confidential or proprietary information or personal information about our students or employees, cause interruptions or malfunctions in operations or commit fraud. We have experienced malware and virus attacks on our systems which went undetected by our virus detection and prevention software.

Current wording

In the ordinary course of our business, we maintain on our network systems and the networks of our third-party providers, and report to external agencies, certain information that is confidential, proprietary, personal (such as student information) or otherwise sensitive in nature, including financial information and confidential business information. Our computer networks, those of our vendors that manage confidential information for us or provide services to our students or us and those of external agencies can be accessed globally through the internet and are vulnerable to unauthorized access, inadvertent access or display, theft or misuse, hackers, installation of ransomware and malware and computer viruses, during regular use and in connection with hardware and software upgrades and changes. These attacks have become more prevalent and sophisticated. Unauthorized access, misuse, theft or hacks can evade our intrusion detection and prevention precautions, and the intrusion detection and prevention precautions of our third-party providers and external agencies to which we report certain information, without alerting us to the breach or loss for some period of time or ever. An individual or group that circumvents security measures could misappropriate confidential or proprietary information or personal information about our students or employees, cause interruptions or malfunctions in our operations or commit fraud. We have experienced malware and virus attacks on our systems which went undetected by our virus detection and prevention software.

Previous wording

The FTC passed an amendment to the Safeguards Rule under the Gramm-Leach-Bliley Act ("GLBA"), effective on June 9, 2023, that updated data security requirements for financial institutions, including all Title IV institutions of higher education. The Department has increased enforcement authority by requiring auditors to verify an institution’s compliance with components of the Safeguards Rule. If the Department determines that an institution has not implemented a compliant information security program with the required elements by December 31, 2023, the institution would receive an audit finding and must submit a corrective action plan. Failure to comply with the applicable GLBA requirements may result in FTC enforcement, which could include the imposition of conditions, penalties, monitoring and oversight.

Current wording

The FTC passed an amendment to the Safeguards Rule under the Gramm-Leach-Bliley Act (the “GLBA”), effective on June 9, 2023, that updated data security requirements for financial institutions, including all Title IV institutions of higher education. The Department has increased enforcement authority by requiring auditors to verify an institution’s compliance with components of the Safeguards Rule. Failure to comply with the applicable GLBA requirements may result in FTC enforcement, which could include the imposition of conditions, penalties, monitoring and oversight.

Previous wording

In addition to being subject to privacy and information security laws and regulations in the U.S., because our services can be accessed globally via the Internet, we may also be subject to privacy laws in countries outside the U.S. from which students access our services, which laws may constrain the way we market and provide our services. Any breach of student or employee privacy or errors in storing, using or transmitting personal information could violate privacy laws and regulations resulting in fines or other penalties. The adoption of new or modified state or federal data or cybersecurity legislation could increase our costs and require changes in our operating procedures or systems. An example of this is the California Consumer Privacy Act which became effective January 1, 2020.

Current wording

In addition to being subject to privacy and information security laws and regulations in the U.S., because our services can be accessed globally via the internet, we may also be subject to privacy and information security laws in countries outside the U.S. from which students access our services, which laws may constrain the way we market and provide our services. Any breach of student or employee privacy or errors in storing, using or transmitting personal information could violate privacy laws and regulations resulting in fines or other penalties. The adoption of new or modified state or federal data or cybersecurity legislation could increase our costs and require changes in our operating procedures or systems. An example of this is the California Consumer Privacy Act which became effective January 1, 2020.

Previous wording

Our remote work environment may exacerbate the risks related to our business technology infrastructure.

Current wording

Our primarily remote work environment may exacerbate the risks related to our business technology infrastructure.

Previous wording

Almost all of our employees work remotely, as do a number of our third-party service vendors. This remote work environment may exacerbate certain risks to our business, including increasing the stress on, and our vulnerability to disruptions of, our technology infrastructure and systems and the risks of phishing and other cybersecurity attacks, unauthorized dissemination of confidential information and social engineering attempts. If a natural disaster, power outage, connectivity issue or other event occurs that impacts the ability of employees to work remotely, it may be difficult or, in certain cases, impossible for us to continue our business for a period of time, which could be substantial.

Current wording

A significant portion of our employees work remotely, as do a number of our third-party service vendors. This remote work environment may exacerbate certain risks to our business, including increasing the stress on, and our vulnerability to disruptions of, our technological infrastructure and systems and the risks of phishing and other cybersecurity attacks, unauthorized dissemination of confidential information and social engineering attempts. If a natural disaster, power outage, connectivity issue or other event occurs that impacts the ability of employees to work remotely, it may be difficult or, in certain cases, impossible for us to continue our business for a period of time, which could materially harm our growth prospects, financial condition, business and reputation.