Paymentus Holdings Inc

Previous wording

Our historical growth rate, including in payment volumes, may not be sustainable or indicative of our future growth. Even though the number of billers, financial institutions and consumers who use our platform has experienced solid growth in recent years, there can be no assurance that we will be able to attract new billers and financial institutions or retain existing billers and financial institutions or maintain similar growth. Our costs associated with retaining revenue from existing billers and financial institutions are substantially lower than costs associated with attracting and generating revenue from new billers and financial institutions or costs associated with generating increased adoption of our platform by existing billers and financial institutions. Therefore, if we are unable to retain revenue from existing billers and financial institutions, even if related losses are offset by an increase in new billers and financial institutions or increased adoption of our platform by existing billers, our operating results could be adversely impacted.

Current wording

Our historical growth rate, including in payment volumes, may not be sustainable or indicative of our future growth. Even though the number of billers, financial institutions and consumers who use our platform has experienced solid growth in recent years, there can be no assurance that we will be able to attract new billers and financial institutions or retain existing billers and financial institutions or maintain similar growth. Our costs associated with retaining revenue from existing billers and financial institutions are substantially lower than costs associated with attracting and generating revenue from new billers and financial institutions or costs associated with generating increased adoption of our platform by existing billers and financial institutions. Therefore, if we are unable to retain revenue from existing billers and financial institutions, even if related losses are offset by an increase in new billers and financial institutions or increased adoption of our platform by existing billers, our operating results could be adversely impacted. In addition, a failure to maintain our historical, or meet our expected, growth rates in our key performance metrics will likely have an adverse impact on the market price of our Class A common stock.

Previous wording

In addition, we believe that an important contributor to our success has been our corporate culture, which we believe fosters innovation, and is rooted in a philosophy of aligning our success with that of billers, financial institutions, partners and consumers. As a result of our growth, a significant portion of our employees have not been with us for a significant period of time. As we continue to grow and develop the infrastructure of a public company, we must effectively integrate, develop and motivate a growing number of new employees, who will be dispersed geographically, with our headquarters in Charlotte, North Carolina and a large employee presence across the United States and in Toronto, Canada and Delhi, India. Our geographically dispersed and often remote workforce may make it more difficult for our management to manage our growth effectively, preserve our corporate culture and preserve our ability to execute quickly in further developing our platform and implementing new features and tools. Any failure to preserve our culture could also limit our ability to innovate, operate effectively, recruit and retain personnel, perform at current levels or execute on our business strategy effectively and efficiently.

Current wording

In addition, we believe that an important contributor to our success has been our corporate culture, which we believe fosters innovation, and is rooted in a philosophy of aligning our success with that of billers, financial institutions, partners and consumers. As a result of our growth, a significant portion of our employees have not been with us for a significant period of time. As we continue to grow and develop the infrastructure of a public company, we must effectively integrate, develop and motivate a growing number of new employees, who will be dispersed geographically, with our headquarters in Charlotte, North Carolina and a large employee presence across the United States, Canada and India. Our geographically dispersed and often remote workforce may make it more difficult for our management to manage our growth effectively, preserve our corporate culture and preserve our ability to execute quickly in further developing our platform and implementing new features and tools. Any failure to preserve our culture could also limit our ability to innovate, operate effectively, recruit and retain personnel, perform at current levels or execute on our business strategy effectively and efficiently.

Previous wording

We must invest significant time educating and selling to multiple management and technical decision-makers to obtain their support. In addition, we may be required to meet wide-ranging and detailed ancillary requirements. For example, financial institutions and many larger clients generally require us to submit to an exhaustive security audit, given the sensitivity and importance of storing consumer billing and payment data on our platform. Adoption is also frequently subject to budget constraints and unplanned administrative, processing and other delays, including considerable efforts to negotiate and document relationships. Further, platform deployment and integration with partners’ software and other solutions requires significant efforts. If we are unable to increase adoption of our platform by partners and manage the costs associated with marketing our platform to potential partners and integrating with their systems, our business, operating results and financial condition may be adversely affected. In addition, if we are unsuccessful in establishing, growing or maintaining partnerships, our ability to compete could be impaired, and our operating results may suffer. If we lose one or more of our largest partnerships, we could also lose associated biller relationships or payment channels and our business, operating results and financial condition could be harmed.

Current wording

To grow our business, we will seek to expand our existing partnerships and establish additional relationships with strategic, software and IPN partners. Establishing such relationships, particularly with financial institutions and other large enterprises, entails extensive sales and marketing efforts with no guarantee of success. Sales and marketing to large organizations involve risks that may not be present, or that are present to a lesser extent, with sales and marketing to other, smaller organizations. We must invest significant time educating and selling to multiple management and technical decision-makers to obtain their support. In addition, we may be required to meet wide-ranging and detailed ancillary requirements. For example, financial institutions and many larger clients generally require us to submit to an exhaustive security audit, given the sensitivity and importance of storing consumer billing and payment data on our platform. Adoption is also frequently subject to budget constraints and unplanned administrative, processing and other delays, including considerable efforts to negotiate and document relationships. Further, platform deployment and integration with partners’ software and other solutions requires significant efforts. If we are unable to increase adoption of our platform by partners and manage the costs associated with marketing our platform to potential partners and integrating with their systems, our business, operating results and financial condition may be adversely affected. In addition, if we are unsuccessful in establishing, growing or maintaining partnerships, our ability to compete could be impaired, and our operating results may suffer. If we lose one or more of our largest partnerships, we could also lose associated biller relationships or payment channels and our business, operating results and financial condition could be harmed.

Previous wording

The United States economy experienced a period of prolonged economic uncertainty and inflationary conditions in 2022 and into 2023, which was particularly acute in the utility sector and negatively impacted our financial performance during that period. Although inflationary pressures lessened to some extent in the second half of 2023, economic uncertainty and inflationary conditions remain high and could have an adverse impact on our 2024 performance. As a result of these conditions, some of our clients may defer anticipated implementations, as was the case in 2022, or reevaluate the development of technology resources, which would delay expected revenue recognition. Furthermore, inflationary pressure resulted in higher average bills, particularly in the utility sector, and increased interchange fees. We may not be able to adjust our pricing to address the inflationary pressures, and our ability to do so typically lags behind the impact of inflation on our clients, the increase in average bill amounts and increased interchange fees. In addition, we may not be able to prudently manage our expenses, and we are seeing ongoing wage pressure in our workforce due to the levels of inflation, which is also putting some short-term pressure on our EBITDA margins. Continued economic uncertainty and inflationary conditions could have a material adverse impact on our business, operating results and financial condition.

Current wording

The United States economy experienced a period of prolonged economic uncertainty and inflationary conditions in 2022 and into 2023, with some moderation in 2024. These effects were particularly acute in the utility sector and negatively impacted our financial performance during this period. Although inflationary pressures eased to some extent in 2023 and remained relatively stable in 2024, economic uncertainty regarding inflationary conditions remains high and could adversely affect our 2025 performance. The introduction of new tariffs or trade disputes with other countries may exacerbate this risk. As a result of these conditions or in the event that worsen, some of our clients may defer anticipated implementations or reevaluate the development of technology resources, which could delay expected revenue recognition. Furthermore, inflationary pressures led to higher average bills, particularly in the utility sector, and increased interchange fees. We may not be able to adjust our pricing to fully address these pressures, and our ability to do so typically lags behind the impact of inflation on our clients, the rise in average bill amounts, and the increased interchange fees. Additionally, we may face challenges in prudently managing our expenses, as ongoing wage pressures due to inflation are placing short-term pressure on our EBITDA margins. Continued economic uncertainty and inflationary conditions could have a material adverse impact on our business, operating results, and financial condition.

Previous wording

The market for electronic bill presentment and payment services is relatively new and subject to ongoing technological change, evolving industry standards, payment methods and changing regulations, and changing biller, financial institution and consumer needs, requirements and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including launching new products and services. The success of any new product and service, or any enhancements or modifications to existing products and services, depends on several factors, including the timely completion, introduction and market acceptance of such products and services, enhancements and modifications. If we are unable to enhance our platform, add new payment methods or develop new products that keep pace with technological and regulatory change and achieve market acceptance, or if new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently or more securely than our products, our business, operating results and financial condition would be adversely affected. Furthermore, modifications to our existing platform or technology will increase our research and development expenses. Any of the foregoing could reduce the demand for our services, result in biller, financial institution, partner and consumer dissatisfaction and adversely affect our business.

Current wording

The market for electronic bill presentment and payment services is relatively new and subject to ongoing technological change, evolving industry standards, payment methods and changing regulations, and changing biller, financial institution and consumer needs, requirements and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including launching new products and services. The success of any new product and service, or any enhancements or modifications to existing products and services depends on several factors, including the timely completion, introduction and market acceptance of such products and services, enhancements and modifications. If we are unable to enhance our platform, add new payment methods or develop or integrate new products that keep pace with technological and regulatory change and achieve market acceptance, or if new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently or more securely than our products, our business, operating results and financial condition could be adversely affected. Furthermore, modifications to our existing platform or technology will increase our research and development expenses. Any of the foregoing could reduce the demand for our services, result in biller, financial institution, partner and consumer dissatisfaction and adversely affect our business.

Previous wording

We anticipate expanding our operations internationally by targeting international billers, financial institutions and partners, and further expanding use of our platform internationally among our existing international billers, financial institutions and partners, which will create a variety of operational challenges.

Current wording

As part of our long-term strategy, we anticipate expanding our operations internationally by targeting international billers, financial institutions and partners, and further expanding use of our platform internationally among our existing international billers, financial institutions and partners, which will create a variety of operational challenges.

Previous wording

As part of our long-term growth plans, we expect to acquire or invest in additional businesses, products or technologies that we believe could further complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. Acquisitions may divert management’s time and focus from operating our business and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not such acquisitions are completed. Acquisitions also may require us to spend a substantial portion of our available cash, incur debt or other liabilities, amortize expenses related to intangible assets or incur write-offs of goodwill or other assets. In addition, integrating an acquired business or technology is risky. Completed and future acquisitions may result in unforeseen operational difficulties and expenditures associated with:

Current wording

As part of our long-term growth plans, we expect to acquire or invest in additional businesses, products or technologies that we believe could further complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. Acquisitions may divert management’s time and focus from operating our business and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not such acquisitions are completed. Acquisitions also may require us to spend a substantial portion of our available cash, incur debt or other liabilities, amortize expenses related to intangible assets or incur write-offs of goodwill or other assets. In addition, integrating an acquired business or technology is risky and require unexpected investment. Completed and future acquisitions may result in unforeseen operational difficulties and expenditures associated with:

Previous wording

We are subject to many risks associated with widespread health issues, such as the recent COVID-19 pandemic, which can result in significantly curtailed movement of people (both government-mandated and voluntary), goods and services. Such risks include, but are not limited to (1) extreme societal, economic and financial market volatility, resulting in business shutdowns and a global economic downturn, (2) uncertainty regarding the duration, timing and severity of the impact of such health issues on consumer behavior, (3) transitioning to and operating our business with a remote workforce, which can negatively impact employee productivity, training and collaboration as well as our sales and marketing efforts and our implementation cycles, (4) increased risks of security breaches or incidents due to remote operations and the costs associated with enhancing the security of our platform, data and internal information technology, or IT, infrastructure, and (5) the disruption of the operations of our billers, financial institutions and partners that may impact our operations. Any or all of these and other risks related to widespread health issues could materially and adversely impact our business, operating results and financial condition.

Current wording

We are subject to many risks associated with widespread health issues, such as the COVID-19 pandemic, which can result in significantly curtailed movement of people (both government-mandated and voluntary), goods and services. Such risks include, but are not limited to (1) extreme societal, economic and financial market volatility, resulting in business shutdowns and a global economic downturn, (2) uncertainty regarding the duration, timing and severity of the impact of such health issues on consumer behavior, (3) operating our business with a remote workforce, which can negatively impact employee productivity, training and collaboration as well as our sales and marketing efforts and our implementation cycles, (4) increased risks of security breaches or incidents due to remote operations and the costs associated with enhancing the security of our platform, data and internal information technology, or IT, infrastructure, and (5) the disruption of the operations of our billers, financial institutions and partners that may impact our operations. Any or all of these and other risks related to widespread health issues could materially and adversely impact our business, operating results and financial condition.

Previous wording

Natural disasters or other catastrophic events may cause damage or disruption to our operations, commerce in general and the global economy, and thus could harm our business. Our headquarters are located in Charlotte, North Carolina, and we have a large employee presence in the United States, Toronto, Canada and Delhi, India. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war or terrorist attack affecting regions where we maintain operations or where our data centers are located, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our services, breaches of data security, security incidents, and unauthorized access to or loss, disclosure, modification, misuse, corruption, unavailability, or destruction of critical data, any of which could harm our business, operating results and financial condition. In addition, most of our employees currently work remotely. Given these widespread remote work arrangements, if a natural disaster, power outage, connectivity issue or other event occurs that impacts our employees’ ability to work remotely, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time.

Current wording

Natural disasters or other catastrophic events may cause damage or disruption to our operations, commerce in general and the global economy, and thus could harm our business. Our headquarters are located in Charlotte, North Carolina, and we have a large employee presence in the United States, Canada and India. In the event of a major earthquake, hurricane, flood or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war or terrorist attack affecting regions where we maintain operations, have a significant customer presence, or where our data centers are located, we may be unable to continue our operations, experience reduced transaction volumes, and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our services, breaches of data security, security incidents, and unauthorized access to or loss, disclosure, modification, misuse, corruption, unavailability, or destruction of critical data, any of which could harm our business, operating results and financial condition. In addition, most of our employees currently work remotely. Given these widespread remote work arrangements, if a natural disaster, power outage, connectivity issue or other event occurs that impacts our employees’ ability to work remotely, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time.

Previous wording

The local, state and federal laws, rules, regulations, licensing schemes and industry standards that govern our business, both directly and through our relationships with banks, card networks and other financial services partners, include, or may in the future include, those relating to payments services, such as payment processing and settlement services, anti-money laundering, combating terrorist financing, escheatment, international sanctions regimes and compliance with the Payment Card Industry Data Security Standard, or PCI-DSS, a set of requirements designed to ensure that all companies that process, store or transmit payment card information maintain a secure environment to protect cardholder data. We do not directly collect or store payment card information; instead, we rely on a third-party payment processor to do so. These laws, rules, regulations, licensing schemes and standards are enforced by multiple authorities and governing bodies in the United States, including the Department of the Treasury, self-regulatory organizations and numerous state and local agencies. Currently, we do not possess any permits or licenses from financial regulators. We believe the licensing requirements of federal and state agencies that regulate or monitor banks or other types of providers of electronic commerce services do not apply to us. While our business itself is not currently subject to financial services-related regulation, and we have received confirmation from multiple state regulators that we are not required to obtain money transmitter licenses in those states, the banks, payment networks and card networks that we partner with operate in a highly regulated landscape and there is a risk that those regulations could become directly applicable to us. As we expand into new jurisdictions, the number of foreign laws, rules, regulations, licensing schemes and standards governing our business will expand as well. In addition, as our business and products continue to develop and expand, we may become subject to additional laws, rules, regulations, licensing schemes and standards. For example, the Consumer Financial Protection Bureau, or CFPB, and several states have recently provided guidance or prohibitions against the use of convenience or similar "pay-to-pay" fees in certain industries that may impact us and our billers. In late 2023, the CFPB proposed new federal oversight of large technology firms and providers of digital wallets and payment applications that would require large nonbank financial companies handling more than 5 million transactions per year to adhere to the same rules as large banks, credit unions, and other financial institutions already supervised by the CFPB. The ultimate adoption or impact of this rule is uncertain, but it could materially increase regulatory risks and impact the way we conduct our business. We may not always be able to accurately predict the scope or applicability of certain laws, rules, regulations, licensing …

Excerpt shortened here; the source contains the full paragraph.

Current wording

The local, state and federal laws, rules, regulations, licensing schemes and industry standards that govern our business, both directly and through our relationships with banks, card networks and other financial services partners, include, or may in the future include, those relating to payments services, such as payment processing and settlement services, anti-money laundering, combating terrorist financing, escheatment, international sanctions regimes and compliance with the Payment Card Industry Data Security Standard, or PCI-DSS, a set of requirements designed to ensure that all companies that process, store or transmit payment card information maintain a secure environment to protect cardholder data. We do not directly collect or store payment card information; instead, we rely on a third-party payment processor to do so. These laws, rules, regulations, licensing schemes and standards are enforced by multiple authorities and governing bodies in the United States, including the Department of the Treasury, self-regulatory organizations and numerous state and local agencies. Currently, we do not possess any permits or licenses from financial regulators. We believe the licensing requirements of federal and state agencies that regulate or monitor banks or other types of providers of electronic commerce services do not apply to us. While our business itself is not currently subject to financial services-related regulation, and we have received confirmation from multiple state regulators that we are not required to obtain money transmitter licenses in those states, the banks, payment networks and card networks that we partner with operate in a highly regulated landscape and there is a risk that those regulations could become directly applicable to us, such as the Electronic Fund Transfer Act and the Bank Secrecy Act. Nevertheless, there is a risk that a state regulator may misinterpret our services and find we are offering unlicensed money transmission. In Canada, we have determined we are subject to the Retail Payments Activity Act as a Payment Service Provider and have registered as such with the Bank of Canada, and as a Money Service Business with FINTRAC. Accordingly, we are now subject to increased scrutiny of compliance with Canadian payments regulations. As we expand into new jurisdictions, the number of foreign laws, rules, regulations, licensing schemes and standards governing our business will expand as well. In addition, as our business and products continue to develop and expand, we may become subject to additional laws, rules, regulations, licensing schemes and standards. For example, the Consumer Financial Protection Bureau, or CFPB, and several states have recently provided guidance or prohibitions against the use of convenience or similar "pay-to-pay" fees in certain industries that may impact us and our billers. In January 2024, the CFPB issued a proposed rule that would prohibit non-sufficient funds fees on transactions declined i…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal data and are considering or enacting new laws. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, in June 2018, California enacted the CCPA, which became operative on January 1, 2020 and broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, the CPRA, was passed in November 2020. Effective as of January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding California residents’ rights with respect to certain categories of sensitive personal information. California also has a dedicated state agency that is vested with authority to implement and enforce the CCPA, as amended by the CPRA. The interpretation and enforcement of the CCPA is in nascent stages, and the effects of the CCPA, as amended by the CPRA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and sanctions and litigation.

Current wording

In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal data and are considering or enacting new laws. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, California's CCPA, as amended by the CPRA, broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. California also has a dedicated state agency, the California Privacy Protection Agency (“CPPA”), that is vested with authority to implement and enforce the CCPA. We have taken steps to comply with applicable portions of the CCPA, but we cannot assure you that such steps completely eliminate the risk of liability under the CCPA. The interpretation and enforcement of the CCPA, as well as other rules promulgated by the CPPA, is in nascent stages, and further regulatory guidance may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and sanctions and litigation.

Previous wording

Certain other state laws impose similar privacy obligations, and all 50 states have laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. For example, the CCPA has prompted the enactment of several new state laws or amendments of existing state laws, such as in New York, Nevada, Virginia, Colorado, Connecticut and Utah. These laws marked the beginning of a trend toward more stringent privacy legislation in other U.S. states and have prompted a number of proposals for new federal and state-level privacy legislation. This legislation, if passed, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs or changes in business practices and policies.

Current wording

Certain other state laws besides California's CCPA impose similar privacy obligations, in addition to data breach notification laws in all 50 states. For example, the CCPA has prompted the enactment of several new state laws or amendments of existing state laws, such as in New York, Nevada, Virginia, Colorado, Connecticut and Utah. Although CCPA broadly includes business-to-business (B2B) as well as employee personal information, whereas the other states laws are mostly limited to individual consumers in their household context, these laws mark the beginning of a general trend toward more stringent privacy legislation in other U.S. states and have prompted a number of proposals for new federal and state-level privacy legislation. This legislation, if passed or amended, as well as interpretation and implementation of such legislation by state attorneys general or by federal or state regulatory authorities, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs or changes in business practices and policies.

Previous wording

In addition, several foreign countries and governmental bodies, including the EU, have established their own laws, rules and regulations addressing privacy, data protection and information security with regard to the handling and processing of sensitive and personal data obtained from their residents with which we or our billers, financial institutions or partners may need to comply. These laws and regulations are in certain cases more stringent than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of various types of data, including data that identifies or may be used to identify an individual, such as names, email addresses and in some jurisdictions, IP addresses. The EU’s privacy, data protection and information security landscapes are currently evolving, resulting in possible significant operational costs for internal compliance and risk to our business. Within the EU, the GDPR, which went into effect in May 2018, contains numerous requirements and changes from previously existing EU law, including more robust, direct obligations on data processors in addition to data controllers, heavier documentation requirements for data protection compliance programs by companies and significant increase in the level of sanctions for non-compliance as compared to previous EU data protection law. In particular, under the GDPR, EU data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers and data subjects. We have taken steps to comply with applicable portions of the GDPR, but we cannot assure you that such steps completely eliminate the risk of liability under the GDPR. The laws and regulations relating to privacy, data protection and information security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Current wording

In addition, several foreign countries and governmental bodies, including within the EU, China, Australia, and other countries, have established their own laws, rules and regulations addressing privacy, data protection and information security with regard to the handling and processing of sensitive and personal data obtained from their residents with which we or our billers, financial institutions or partners may need to comply. These laws and regulations are in certain cases more stringent than those in the United States and are also subject to interpretation and enforcement decisions by federal and state or provincial data protection authorities charged with implementing these laws. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of various types of data, including data that identifies or may be used to identify an individual, such as names, email addresses and in some jurisdictions, IP addresses. The EU’s privacy, data protection and information security landscapes are currently evolving, resulting in possible significant operational costs for internal compliance and risk to our business. Within the EU, the GDPR, which went into effect in May 2018, contains numerous requirements and changes from previously existing EU law, including more robust, direct obligations on data processors in addition to data controllers, heavier documentation requirements for data protection compliance programs by companies and significant increase in the level of sanctions for non-compliance as compared to previous EU data protection law. In particular, under the GDPR, EU data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers and data subjects. We have taken steps to comply with applicable portions of the GDPR, but we cannot assure you that such steps completely eliminate the risk of liability under the GDPR. The laws and regulations relating to privacy, data protection and information security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Previous wording

Our platform enables our billers and partners to communicate directly with their consumers, including via email, text messages and telephone calls. Our platform also enables recording and monitoring of calls between our billers and partners and their consumers for training and quality assurance purposes. On occasion we also send communications directly to consumers. These activities are subject to a variety of U.S. state and federal laws, rules and regulations, such as the TCPA, the CAN-SPAM Act, and others related to telemarketing, recording and monitoring of communications. The TCPA prohibits companies from making telemarketing calls to numbers listed in the Federal Do-Not-Call Registry and imposes other obligations and limitations on making phone calls and sending text messages to consumers. The CAN-SPAM Act regulates commercial email messages and specifies penalties for the transmission of commercial email messages that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from senders. The TCPA, the CAN-SPAM Act and other communications laws, rules and regulations are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making compliance efforts more challenging. We and our billers and partners may be required to comply with these and similar laws, rules and regulations. To comply with these laws, rules and regulations, in some cases we rely on our billers and partners to obtain legally required consents from their consumers to receive communications sent using our platform. We cannot, however, be certain that our or their efforts to comply will always be successful. Our business could be adversely affected by changes to the application or interpretation of existing laws, rules and regulations governing our platform’s communication capabilities, or the enactment of new laws, rules and regulations, and by our and our billers’ and partners’ failure to comply with such laws, rules and regulations in using our platform. If any of these laws, rules or regulations were to significantly restrict our or our billers’ or partners’ ability to use our platform to communicate with existing and potential consumers, we may not be able to develop adequate alternative communication modules for our platform. Further, our or our billers’ or partners’ non-compliance with these laws, rules and regulations could result in significant financial penalties, litigation, including class action litigation, consent decrees and injunctions, adverse publicity and other negative consequences, any of which could adversely affect our business, operating results and financial condition and significantly harm our reputation.

Current wording

Our platform enables our billers and partners to communicate directly with their consumers, including via email, text messages and telephone calls. Our platform also enables recording and monitoring of calls between our billers and partners and their consumers for training and quality assurance purposes. On occasion we also send communications directly to consumers. These activities are subject to a variety of U.S. state and federal laws, rules and regulations, such as the TCPA, the CAN-SPAM Act, and others related to telemarketing, recording and monitoring of communications. The TCPA prohibits companies from making telemarketing calls to numbers listed in the Federal Do-Not-Call Registry and imposes other obligations and limitations on making phone calls and sending text messages to consumers. The CAN-SPAM Act regulates commercial email messages and specifies penalties for the transmission of commercial email messages that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from senders. The TCPA, the CAN-SPAM Act and other communications laws, rules and regulations are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making compliance efforts more challenging. In addition, the FCC recently issued a new final rule on text messaging and the TCPA that went into effect in January 2025. Finally, several states have also enacted state-level laws modeled after the TCPA (e.g., “mini-TCPAs”) which impose stricter regulations on telemarketing activities, including the use of automated systems for calls and text messages. We and our billers and partners may be required to comply with these and similar laws, rules and regulations. To comply with these laws, rules and regulations, in some cases we rely on our billers and partners to obtain legally required consents from their consumers to receive communications sent using our platform. We cannot, however, be certain that our or their efforts to comply will always be successful. Our business could be adversely affected by changes to the application or interpretation of existing laws, rules and regulations governing our platform’s communication capabilities, or the enactment of new laws, rules and regulations, and by our and our billers’ and partners’ failure to comply with such laws, rules and regulations in using our platform. If any of these laws, rules or regulations were to significantly restrict our or our billers’ or partners’ ability to use our platform to communicate with existing and potential consumers, we may not be able to develop adequate alternative communication modules for our platform. Further, our or our billers’ or partners’ non-compliance with these laws, rules and regulations could result in significant financial penalties, litigation, including class action litigation, consent decrees and injunctions, …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our success and increased visibility, and that of the electronic and online billing and payments sector more generally, may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business. We are subject to a wide variety of local, state, federal and international laws, rules, regulations, licensing schemes and industry standards in the United States and in other countries in which we operate. These laws, rules, regulations, licensing schemes and standards govern numerous areas that are important to our business. In addition to the payments and financial services-related regulations, and privacy, data protection and information security-related laws, our business is also subject to, without limitation, rules and regulations applicable to securities, labor and employment, immigration, competition and marketing and communications practices. Laws, rules, regulations, licensing schemes and standards applicable to our business are subject to change and evolving interpretations and application, including by means of legislative changes and executive orders, and it can be difficult to predict how they may be applied to our business and the way we conduct our operations, particularly as we introduce new products and services and expand into new jurisdictions. We may not be able to respond quickly or effectively to regulatory, legislative and other developments, and these changes may in turn impair our ability to offer our existing or planned features, products and services and increase our cost of doing business.

Current wording

Our success and increased visibility, and that of the electronic and online billing and payments sector more generally, may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business. We are subject to a wide variety of local, state, federal and international laws, rules, regulations, licensing schemes and industry standards in the United States and in other countries in which we operate. These laws, rules, regulations, licensing schemes and standards govern numerous areas that are important to our business. In addition to the payments and financial services-related regulations, and privacy, data protection and information security-related laws, our business is also subject to, without limitation, rules and regulations applicable to securities, labor and employment, immigration, competition and marketing and communications practices. Laws, rules, regulations, licensing schemes and standards applicable to our business are subject to change and evolving interpretations and application, including by means of legislative changes and executive orders, and it can be difficult to predict how they may be applied to our business and the way we conduct our operations, particularly as we introduce new products and services and expand into new jurisdictions. Actions by the current U.S. presidential administration could have further impacts on our business if previously enacted laws are amended or if new legislative or regulatory reforms are adopted. In addition, the change in administration has led and will lead to leadership changes at a number of U.S. federal regulatory agencies, including the SEC and agencies with oversight over the financial services industry, such as the CFPB. There is a substantial lack of clarity regarding the likelihood, timing and details of potential changes or reforms by the new administration and the U.S. Congress. This poses uncertainty with respect to such agencies’ policy priorities and may lead to increased regulatory enforcement activity in the financial services industry. We may not be able to respond quickly or effectively to regulatory, legislative and other developments, and these changes may in turn impair our ability to offer our existing or planned features, products and services and increase our cost of doing business.

Previous wording

result in additional compliance and licensure requirements;

Current wording

result in additional compliance costs and licensure requirements;

Previous wording

We identified material weaknesses in our internal control over financial reporting and we may identify additional material weaknesses in the future that may cause us to fail to meet our reporting obligations or result in material misstatements of our financial statements. If we fail to remediate any material weaknesses, identify additional material weaknesses, or if we otherwise fail to establish and maintain effective internal control over financial reporting, our ability to accurately and timely report our financial results could be adversely affected.

Current wording

We have previously identified material weaknesses in our internal control over financial reporting. Identification of additional material weaknesses in the future or a failure to maintain effective internal control over financial reporting, may result in material misstatements to our consolidated financial statements, adversely affect our ability to accurately and timely report our financial results, and may negatively impact investor confidence and our stock price.

Previous wording

We are required to comply with the rules of the SEC implementing Sections 302 and 404 of the Sarbanes-Oxley Act, which require management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of internal control over financial reporting. In addition to disclosing changes that have materially affected, or are reasonably likely to materially affect our internal control over financial reporting on a quarterly basis, we are required to make an annual assessment of our internal control over financial reporting pursuant to the rules of the SEC implementing Section 404 in our annual reports on Form 10-K. However, as an emerging growth company, our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting pursuant to Section 404 until we are no longer an emerging growth company. If our internal control over financial reporting is not effective, management’s report and our independent registered public accounting firm’s report would be adverse.

Current wording

We are required to comply with the rules of the SEC implementing Sections 302 and 404 of the Sarbanes-Oxley Act, which require management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of internal control over financial reporting. In addition to disclosing changes that have materially affected, or are reasonably likely to materially affect our internal control over financial reporting on a quarterly basis, we are required to make an annual assessment of the effectiveness of our internal control over financial reporting in our annual reports on Form 10-K. However, as an emerging growth company, our independent registered public accounting firm will not be required to audit the effectiveness of our internal control over financial reporting until we are no longer an emerging growth company. If our internal control over financial reporting is not effective, management’s report and our independent registered public accounting firm’s report, when required, would be adverse.

Previous wording

We are subject to the requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the New York Stock Exchange and other applicable securities rules and regulations. Complying with these rules and regulations has increased and will continue to increase our legal and financial compliance costs, make some activities more difficult, time consuming or costly and increase demand on our systems and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are required to disclose changes made in our internal control over financial reporting on a quarterly basis. In order to maintain and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight are required. As a result, management’s attention may be diverted from other business concerns, which could adversely affect our business and operating results. We have and may need to continue to hire additional employees or engage outside consultants to comply with these requirements, which has and will increase our costs and expenses.

Current wording

We are subject to the requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the New York Stock Exchange and other applicable securities rules and regulations. Complying with these rules and regulations has increased and will continue to increase our legal and financial compliance costs, make some activities more difficult, time consuming or costly and increase demand on our systems and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are required to disclose changes made in our internal control over financial reporting on a quarterly basis. In order to maintain and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight are required. Once we lose our status as an emerging growth company and are required to have an integrated audit, we expect the need for significant resources and management oversight to increase further. As a result, management’s attention may be diverted from other business concerns, which could adversely affect our business and operating results. We have and may need to continue to hire additional employees or engage outside consultants to comply with these requirements, which has and will increase our costs and expenses.

Previous wording

These new rules and regulations may make it more expensive for us to maintain director and officer liability insurance, and in the future, we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage.

Current wording

These new rules and regulations may make it more expensive for us to maintain director and officer liability insurance, and in the future, we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

Previous wording

changes in the relative amounts of income before taxes in the various jurisdictions in which we operate due to differing statutory tax rates in various jurisdictions;

Current wording

changes in the relative amounts of income before taxes in the various jurisdictions in which we operate due to changes in our business or differing statutory tax rates in various jurisdictions;

Previous wording

changes in tax laws, tax treaties and regulations or the interpretation thereof, including the Tax Cuts and Jobs Act of 2017, as modified by the Coronavirus Aid, Relief, and Economic Security Act and the Emergency Coronavirus Relief Act and the Inflation Reduction Act of 2022;

Current wording

changes in tax laws, tax treaties and regulations or the interpretation thereof, which may materially impact our results of operations, or the way we conduct our business;

Previous wording

Further, beginning January 1, 2022, the Tax Cuts and Jobs Act of 2017 eliminated the right to deduct research and development expenditures for tax purposes in the period the expenses were incurred and instead requires all U.S. and foreign research and development expenditures to be amortized over five and fifteen tax years, respectively. This capitalization requirement may materially increase our effective tax rate, deferred tax assets and cash tax liabilities as well as reduce our operating cash flows over time as we continue to utilize available net operating losses and tax credits.

Current wording

Further, in recent years new tax legislation eliminated the right to deduct research and development expenditures for tax purposes in the period the expenses were incurred and instead requires all U.S. and foreign research and development expenditures to be amortized over five and fifteen tax years, respectively. This capitalization requirement may materially increase deferred tax assets and cash tax liabilities as well as reduce our operating cash flows.

Previous wording

We may modify, enhance, upgrade and implement new systems, procedures and controls in our software and technology to reflect changes in our business, technological advancements and changing industry trends. These modifications, enhancements or updates incorporated in our platform may contain undetected errors, viruses or defects when implemented or when new functionality is released. Despite extensive testing, from time to time we have discovered and may in the future discover defects or errors in our software and technology. Any performance problems or defects in our software and technology could materially and adversely affect our business, operating results and financial conditions, and could increase the risk of a cybersecurity incident. Defects, errors or other similar performance problems or disruptions, whether in connection with day-to-day operations or otherwise, could be costly for us, adversely affect our billers’, financial institutions' or partners’ businesses, harm our reputation and result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. In addition, if we have any such errors, defects or other performance problems, our billers, financial institutions or partners could seek to terminate, or elect not to renew, their contracts with us, delay or withhold payment or assert claims against us. Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation, regulatory actions, or adverse publicity, which could materially and adversely affect our business, operating results and financial condition. Additionally, our software incorporates open-source code and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, operating results and financial condition by increasing the risk of a cybersecurity incident. Further, we rely on technology and software supplied by third parties that may also contain undetected errors, viruses or defects. Software defects and errors or delays in electronic bill presentment or our facilitation of payment processing could result in additional development and remediation costs, diversion of technical and other resources from our existing development efforts, loss of credibility with current or potential billers, financial institutions, partners and consumers, harm to our reputation and exposure to liability claims, any of which could result in a material adverse effect on our business, operating results and financial condition.

Current wording

We may modify, enhance, upgrade and implement new systems, procedures and controls in our software and technology to reflect changes in our business, technological advancements and changing industry trends. These modifications, enhancements or updates incorporated in our platform may contain undetected errors, viruses or defects when implemented or when new functionality is released. Despite extensive testing, from time to time we have discovered and may in the future discover defects or errors in our software and technology. Any performance problems or defects in our software and technology could materially and adversely affect our business, operating results and financial conditions, and could increase the risk of a cybersecurity incident. Defects, errors or other similar performance problems or disruptions, whether in connection with day-to-day operations or otherwise, could be costly for us, adversely affect our billers’, financial institutions’ or partners’ businesses, harm our reputation and result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. In addition, if we have any such errors, defects or other performance problems, our billers, financial institutions or partners could seek to terminate, or elect not to renew, their contracts with us, delay or withhold payment or assert claims against us. Any of these actions could also result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation, regulatory actions, or adverse publicity, which could materially and adversely affect our business, operating results and financial condition. Additionally, our software incorporates open-source code and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, operating results and financial condition by increasing the risk of a cybersecurity incident. Further, we rely on technology and software supplied by third parties that may also contain undetected errors, viruses or defects. Software defects and errors or delays in electronic bill presentment or our facilitation of payment processing could result in additional development and remediation costs, diversion of technical and other resources from our existing development efforts, loss of credibility with current or potential billers, financial institutions, partners and consumers, harm to our reputation and exposure to liability claims, any of which could result in a material adverse effect on our business, operating results and financial condition.

Previous wording

The terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to provide, or distribute our platform, products or services related to, the open source software subject to those licenses. In addition, the public availability of such software may make it easier for others to compromise our platform. Although we generally monitor our use of open source software to avoid subjecting our platform to conditions we do not intend and to try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur, or could be claimed to have occurred, in part because open source license terms are often ambiguous. Moreover, we cannot assure you that our processes for controlling our use of open source software in our platform, products and services will be effective. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products. Likewise, we could be sued and face claims from third parties claiming ownership of, or demanding release of, any open source software or derivative works that we have developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation and could require us to make our software source code freely available, purchase a costly license or cease offering the implicated products or services. Litigation could be costly for us to defend, have a negative effect on our business, operating results and financial condition or require us to devote additional research and development resources to redesign our products. If we are held to have breached or failed to fully comply with all the terms and conditions of an open source software license, we could face infringement or other liability, be required to seek costly licenses from third parties, or provide our offerings on terms that are not economically feasible. We may need to re-engineer our platform (which could involve substantial time and resources), to discontinue or delay the provision of our offerings if re-engineering could not be accomplished on a timely basis or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, operating results and financial condition.

Current wording

Although we generally monitor our use of open source software to avoid subjecting our platform to conditions we do not intend and to try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur, or could be claimed to have occurred, in part because open source license terms are often ambiguous. Moreover, we cannot assure you that our processes for controlling our use of open source software in our platform, products and services will be effective. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products. Likewise, we could be sued and face claims from third parties claiming ownership of, or demanding release of, any open source software or derivative works that we have developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation and could require us to make our software source code freely available, purchase a costly license or cease offering the implicated products or services. Litigation could be costly for us to defend, have a negative effect on our business, operating results and financial condition or require us to devote additional research and development resources to redesign our products. If we are held to have breached or failed to fully comply with all the terms and conditions of an open source software license, we could face infringement or other liability, be required to seek costly licenses from third parties, or provide our offerings on terms that are not economically feasible. We may need to re-engineer our platform (which could involve substantial time and resources), to discontinue or delay the provision of our offerings if re-engineering could not be accomplished on a timely basis or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, operating results and financial condition.

Previous wording

Cybersecurity threats and attacks, privacy and cybersecurity breaches, insider threats and malicious internet-based activity and other incidents continue to evolve in nature and become more sophisticated and severe, and providers of cloud-based services have frequently been targeted by such attacks, particularly in the financial technology sector. These cybersecurity challenges, including threats to our own IT infrastructure or those of our billers, financial institutions or partners or their consumers or third-party service providers, may take a variety of forms ranging from stolen bank accounts, business email compromise, biller or financial institution employee fraud, account takeover, check fraud or cybersecurity attacks, to "mega breaches" targeting cloud-based services and other hosted software. A cybersecurity incident or breach could result in loss, compromise, corruption or disclosure of confidential information, intellectual property and sensitive and personal data and impair our ability to provide our solutions and meet our billers’, financial institutions' or partners’ or their consumers’ requirements, or cause production downtimes and compromised data. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. As we increase our biller and financial institution base and our brand becomes more widely known and recognized, threat actors may increasingly seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our billers’, financial institutions' or partners’ or their consumers’ sensitive and personal data. Information security risks for technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties as well as nation-state and nation-state-supported actors. Additionally, geopolitical events and resulting government activity could lead to information security threats and attacks by affected jurisdictions and their sympathizers. Because of our position in the financial services industry, we believe that we are likely to continue to be a target of such threats and attacks.

Current wording

Cybersecurity threats and attacks, privacy and cybersecurity breaches, insider threats and malicious internet-based activity and other incidents continue to evolve in nature and become more sophisticated and severe, and providers of cloud-based services have frequently been targeted by such attacks, particularly in the financial technology sector. These cybersecurity challenges, including threats to our own IT infrastructure or those of our billers, financial institutions or partners or their consumers or third-party service providers, may take a variety of forms ranging from stolen bank accounts, business email compromises, biller or financial institution employee fraud, account takeover, check fraud or cybersecurity attacks, to “mega breaches” targeting cloud-based services and other hosted software. A cybersecurity incident or breach could result in loss, compromise, corruption or disclosure of confidential information, intellectual property and sensitive and personal data and impair our ability to provide our solutions and meet our billers’, financial institutions’ or partners’ or their consumers’ requirements, or cause production downtimes and compromised data. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. As we increase our biller and financial institution base and our brand becomes more widely known and recognized, threat actors may increasingly seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our billers’, financial institutions’ or partners’ or their consumers’ sensitive and personal data. Information security risks for technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties as well as nation-state and nation-state-supported actors. Additionally, geopolitical events and resulting government activity could lead to information security threats and attacks by affected jurisdictions and their sympathizers. Because of our position in the financial services industry, we believe that we are likely to continue to be a target of such threats and attacks.

Previous wording

We have administrative, technical and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection and information security measures. However, if our privacy, data protection or information security measures or those of the previously mentioned third parties are inadequate, breached or otherwise compromised, including as a result of third-party action, employee or contractor error, malfeasance, malware, phishing, hacking, system error, software bugs or defects in our products, trickery, process failure, or otherwise, and, as a result, there is improper disclosure of, or someone obtains unauthorized access to or exfiltrates funds or accesses, modifies, corrupts, or destroys any sensitive and personal data on our systems or our partners’ systems, or if we suffer a ransomware or advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our reputation and business could be damaged. If sensitive and personal data is unavailable, lost, modified, corrupted, or destroyed without authorization or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with remediation and the implementation of additional security measures, and may incur significant liability and financial loss and be subject to regulatory scrutiny, investigations, proceedings and penalties.

Current wording

We have administrative, technical and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection and information security measures. However, if our privacy, data protection or information security measures or those of the previously mentioned third parties are inadequate, breached or otherwise compromised, including as a result of third-party action, employee or contractor error, malfeasance, malware, phishing, hacking, system error, software bugs or defects in our products, trickery, process failure, or otherwise, and, as a result, there is improper disclosure of, or someone obtains unauthorized access to or exfiltrates funds or accesses, modifies, corrupts, or destroys any sensitive or personal data on our systems or our partners’ systems, or if we suffer a ransomware or advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our reputation and business could be damaged. If sensitive or personal data is unavailable, lost, modified, corrupted, or destroyed without authorization or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with notification, remediation and the implementation of additional security measures, may be subject to regulatory scrutiny, investigations, proceedings and penalties, or incur significant liability and financial loss in the form of lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation, or adverse publicity, which could materially and adversely affect our business, operating results and financial condition.

Previous wording

Sales of a substantial number of shares of our Class A common stock, particularly sales by our directors, executive officers and principal stockholders, or the perception that such sales may occur could cause the market price of our Class A common stock to fall or make it more difficult for you to sell your Class A common stock at a time and price that you deem appropriate.

Current wording

Sales of a substantial number of shares of our Class A common stock, particularly sales by our directors, executive officers and principal stockholders, or the perception that such sales may occur could cause the market price of our Class

Previous wording

As of December 31, 2023, we had 20,758,603 shares of Class A common stock and 103,062,508 shares of Class B common stock issued and outstanding. These shares may be sold in the public market in the United States, subject to prior registration in the United States, if required, or reliance upon an exemption from U.S. registration, including, in the case of shares held by affiliates or control persons, compliance with the volume restrictions of Rule 144 (“Rule 144”) of the Securities Act of 1933, as amended (the “Securities Act”).

Current wording

As of December 31, 2024, we had 32,136,989 shares of Class A common stock and 92,699,294 shares of Class B common stock issued and outstanding. These shares may be sold in the public market in the United States, subject to prior registration in the United States, if required, or reliance upon an exemption from U.S. registration, including, in the case of shares held by affiliates or control persons, compliance with the volume restrictions of Rule 144 (“Rule 144”) of the Securities Act of 1933, as amended (the “Securities Act”).

Previous wording

In addition, 1,946,006 shares of Class A common stock and 3,849,350 shares of Class B common stock were subject to outstanding equity awards as of December 31, 2023. We have registered under the Securities Act the offer and sale of all shares of Class A common stock and Class B common stock subject to equity awards outstanding and reserved for issuance under our 2012 Equity Incentive Plan and 2021 Equity Incentive Plan. The shares covered by those registration statements are eligible for resale in the public markets, subject to Rule 144 limitations applicable to affiliates. If these additional shares are sold, or if it is perceived that they will be sold in the public market, the market price of our Class A common stock could decline.

Current wording

In addition, 2,096,168 shares of Class A common stock and 3,534,103 shares of Class B common stock were subject to outstanding equity awards as of December 31, 2024. We have registered under the Securities Act the offer and sale of all shares of Class A common stock and Class B common stock subject to equity awards outstanding and reserved for issuance under our 2012 Equity Incentive Plan and 2021 Equity Incentive Plan. The shares covered by those registration statements are eligible for resale in the public markets, subject to Rule 144 limitations applicable to affiliates. If these additional shares are sold, or if it is perceived that they will be sold in the public market, the market price of our Class A common stock could decline.

Previous wording

Furthermore, up to 1,193,880 shares of Class A common stock may be issuable pursuant to warrant agreements with JPMC Strategic Investments I Corporation. These shares will become eligible for sale in the public market to the extent permitted by the vesting terms of the warrant, and Rules 144.

Current wording

Furthermore, up to 1,193,880 shares of Class A common stock may be issuable pursuant to warrant agreements with JPMC Strategic Investments I Corporation. These shares will become eligible for sale in the public market to the extent permitted by the vesting terms of the warrant, and Rule 144.

Previous wording

As of December 31, 2023, the holders of approximately 105 million shares of our Class A common stock and Class B common stock, or certain permitted transferees, are entitled to require us to file registration statements under the Securities Act for the public resale of the shares of Class A common stock, including shares issuable upon conversion of their shares of Class B common stock, or to include such shares in registration statements that we may file, subject to certain conditions. If we register the offer and sale of shares for the holders of registration rights, those shares can be freely sold in the public market upon registration.

Current wording

As of December 31, 2024, the holders of approximately 98 million shares of our Class A common stock and Class B common stock, or certain permitted transferees, are entitled to require us to file registration statements under the Securities Act for the public resale of the shares of Class A common stock, including shares issuable upon conversion of their shares of Class B common stock, or to include such shares in registration statements that we may file, subject to certain conditions. If we register the offer and sale of shares for the holders of registration rights, those shares can be freely sold in the public market upon registration.

Previous wording

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. Because of the ten-to-one voting ratio between our Class B common stock and Class A common stock, AKKR and our founder and chief executive officer, collectively controlled approximately 99% of the voting power of our outstanding common stock as of December 31, 2023 and therefore are able to control all matters submitted to our stockholders and will continue to control such matters so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A common stock and Class B common stock, including the election of directors, amendments of our organizational documents, compensation matters and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future.

Current wording

Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. Because of the ten-to-one voting ratio between our Class B common stock and Class A common stock, AKKR and our founder and chief executive officer, collectively controlled approximately 98% of the voting power of our outstanding common stock as of December 31, 2024 and therefore are able to control all matters submitted to our stockholders, including the election of directors, amendments of our organizational documents, compensation matters and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future.

Previous wording

As of December 31, 2023, AKKR controlled approximately 79% of the voting power of our outstanding common stock. As a result, AKKR has the ability to elect all of the members of our board of directors and thereby control our policies and operations, including the appointment of management, future issuances of our Class A common stock or other securities, the payment of dividends, if any, on our Class A common stock, the incurrence of debt by us, amendments to our certificate of incorporation and bylaws, and the entering into extraordinary transactions, and the interests of AKKR may not in all cases be aligned with our or your interests.

Current wording

As of December 31, 2024, AKKR controlled approximately 75% of the voting power of our outstanding common stock. As a result, AKKR has the ability to elect all of the members of our board of directors and thereby control our policies and operations, including the appointment of management, future issuances of our Class A common stock or other securities, the payment of dividends, if any, on our Class A common stock, the incurrence of debt by us, amendments to our certificate of incorporation and bylaws, and the entering into extraordinary transactions, and the interests of AKKR may not in all cases be aligned with our or your interests.

Previous wording

In November 2023, AKKR distributed to its investors, on a pro rata basis and for no additional consideration, 538,888 shares of our Class B common stock, some of which was subsequently converted into shares of our Class A common stock. There can be no assurance regarding the further disposition of these shares by the recipients, future distributions of our Class B common stock held by AKKR, or subsequent conversion by recipients of distributed Class B shares into our Class A common stock or disposition thereof.

Current wording

For the years ended December 31, 2024 and 2023, AKKR distributed to its investors, on a pro rata basis and for no additional consideration, 15,844,426 shares and 538,888 shares, respectively, of our Class B common stock, some of which was subsequently converted into shares of our Class A common stock. There can be no assurance regarding the further disposition of these shares by the recipients, future distributions of our Class B common stock held by AKKR, or subsequent conversion by recipients of distributed Class B shares into our Class A common stock or disposition thereof.

Previous wording

We have elected to take advantage of the"controlled company" exemption to the corporate governance rules for New York Stock Exchange-listed companies, which could make our Class A common stock less attractive to some investors or otherwise harm our stock price.

Current wording

We may elect to take advantage of the"controlled company" exemption to the corporate governance rules for New York Stock Exchange-listed companies, which could make our Class A common stock less attractive to some investors or otherwise harm our stock price.

Previous wording

AKKR controls a majority of the voting power of our outstanding common stock. Because we qualify as a "controlled company" under the corporate governance rules for New York Stock Exchange-listed companies, we are not required to have a majority of our board of directors be independent, nor are we required to have an independent compensation committee or an independent nominating function. In light of our status as a controlled company, in the future we could elect not to have a majority of our board of directors be independent or not to have an independent compensation committee or nominating and corporate governance committee. Accordingly, should the interests of our management and AKKR differ from those of other stockholders, the other stockholders may not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance rules for New York Stock Exchange-listed companies. Our status as a controlled company could make our Class A common stock less attractive to some investors or otherwise harm our stock price.

Current wording

AKKR controls a majority of the voting power of our outstanding common stock. Because we qualify as a "controlled company" under the corporate governance rules for New York Stock Exchange-listed companies, we are not required to have a majority of our board of directors be independent, nor are we required to have an independent compensation committee or an independent nominating function. Even though we are not required to comply with these corporate governance requirements, we currently have chosen to do so. However, in the future, we could elect not to have a majority of our board of directors be independent or not to have an independent compensation committee or nominating and corporate governance committee. Accordingly, should the interests of our management and AKKR differ from those of other stockholders, the other stockholders may not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance rules for New York Stock Exchange-listed companies. Our status as a controlled company could make our Class A common stock less attractive to some investors or otherwise harm our stock price.