Grand Canyon Education, Inc.

Previous wording

Although we currently provide services to 22 university partners across the United States, GCU is, and will for the foreseeable future remain, our most significant university partner. Accordingly, the risk factors set forth below also include risks attributable to GCU’s operations, which could materially affect us.

Current wording

Although we currently provide services to 20 university partners across the United States, GCU is, and will for the foreseeable future remain, our most significant university partner. Accordingly, the risk factors set forth below also include risks attributable to GCU’s operations, which could materially affect us.

Previous wording

We have made, and expect to continue making, investments in the integration of artificial intelligence (“AI”) into our platforms, products, and services. However, AI presents various risks, challenges, and potential unintended consequences that could disrupt our ability to effectively integrate and leverage these technologies. The process of refining and expanding AI-driven offerings may involve significant costs, and there can be no assurance that our efforts will ultimately succeed.

Current wording

We have made, and expect to continue making, investments in the integration of AI into our platforms, products, and services. While we expect our use of AI to help grow our business and benefit our university partners, the use of AI presents various risks, challenges, and potential unintended consequences that could disrupt our ability to effectively integrate and leverage these technologies and it is not certain that we will realize our desired or anticipated benefits. The process of refining and expanding AI-driven offerings may involve significant costs, and there can be no assurance that our efforts will ultimately succeed.

Previous wording

Additionally, competitors may develop more effective or efficient AI solutions, potentially undermining our competitive position. The regulatory environment surrounding AI is still in development, and new laws or regulations could emerge that require substantial adjustments to our business practices. These changes could impose unexpected costs or operational disruptions, and the full scope and impact of such regulatory developments remain uncertain. AI technologies also carry the risk of generating content that is factually incorrect or infringing on third-party intellectual property rights. If we suffer adverse consequences due to any of these factors, it could in turn have a material adverse effect on our reputation, financial performance, and operations.

Current wording

Additionally, competitors may develop more effective or efficient AI solutions, potentially undermining our competitive position. The regulatory environment surrounding AI is still in development, and new laws or regulations could emerge that require substantial adjustments to our business practices. These changes could impose unexpected costs or operational disruptions, and the full scope and impact of such regulatory developments remain uncertain. AI technologies also carry the risk of generating content that is or is alleged to be deficient, biased, factually incorrect or infringing on third-party intellectual property rights, which may in turn make us subject to private lawsuits, regulatory scrutiny, or reputational harm. Furthermore, the use of AI may result in incidents that compromise the confidentiality of data, including personal data. If we suffer adverse consequences due to any of these factors, it could in turn have a material adverse effect on our reputation, financial performance, and operations.

Previous wording

We are subject to laws and regulations as a result of our collection and use of personal information, and any violations of such laws or regulations, or any breach, theft, or loss of such information, could adversely affect our reputation and operations.

Current wording

We are subject to rapidly changing laws and regulations relating to privacy and data security as a result of our collection and use of personal information, and any failure to comply with such laws or regulations could lead to government enforcement actions or private litigation or adversely affect our reputation and operations.

Previous wording

Possession and use of personal information in our operations subjects us to risks and costs that could harm our business. We collect, use, and retain large amounts of personal information regarding our primary university partner’s applicants and students, including social security numbers, tax return information, personal and family financial data, and credit card numbers. We also collect and maintain personal information of our employees in the ordinary course of our business. Our services can be accessed globally through the Internet. Therefore, we may be subject to the application of national privacy laws in countries outside the U.S. from which applicants and students access our services. Such privacy laws could impose conditions that limit the way we market and provide our services.

Current wording

Possession and use of personal information in our operations subjects us to risks and costs that could harm our business. We collect, use, and retain large amounts of personal information regarding our primary university partner’s applicants and students, including social security numbers, tax return information, personal and family financial data, and credit card numbers. We also collect and maintain personal information of our employees in the ordinary course of

Previous wording

controls, which could result in a breach of student or employee data and privacy. In addition, errors in the storage, use, or transmission of personal information could result in a breach of privacy for current or prospective students or employees. Possession and use of personal information in our operations also subjects us to legislative and regulatory burdens that could require us to implement certain policies and procedures, such as the procedures we adopted to comply with the Red Flags Rule that was promulgated by the FTC under the federal Fair Credit Reporting Act and that requires the establishment of guidelines and policies regarding identity theft related to student credit accounts, and could require us to make certain notifications of data breaches and restrict our use of personal information. Similarly, California passed the California Consumer Privacy Act (CCPA) in 2018 (which went into effect in 2020), and there are similar bills that have been passed or are pending in a number of other states, as well. These state laws represent a trend toward stronger privacy protections and greater data transparency in the United States. Currently, federal law legislates privacy on an industry-by-industry basis. Without an overarching federal law driving privacy compliance, the risk is high of a patchwork of privacy legislation formed by individual state laws, similar to the states’ approach to breach notification obligations. This could not only increase costs for compliance but also raise the risk of enforcement by individual state Attorneys General. A violation of any laws or regulations relating to the collection or use of personal information, including the Gramm-Leach-Bliley Act’s Safeguards Rule, could result in the imposition of fines against us. Moreover, ED has published extensive requirements for the protection of student data and has indicated such requirements may be strengthened in the future.

Current wording

Possession and use of personal information in our operations subjects us to legislative and regulatory burdens that could require us to implement certain policies and procedures, such as the procedures we adopted to comply with the Red Flags Rule that was promulgated by the FTC under the federal Fair Credit Reporting Act and that requires the establishment of guidelines and policies regarding identity theft related to student credit accounts, and could require us to make certain notifications of data breaches and restrict our use of personal information. Similarly, California passed the California Consumer Privacy Act (CCPA) in 2018 (which went into effect in 2020), and there are similar bills that have been passed or are pending in a number of other states, as well. These state laws represent a trend toward stronger privacy protections and greater data transparency in the United States. Currently, federal law legislates privacy on an industry-by-industry basis. Without an overarching federal law driving privacy compliance, the risk is high of a patchwork of privacy legislation formed by individual state laws, similar to the states’ approach to breach notification obligations. This could not only increase costs for compliance but also raise the risk of enforcement by individual state Attorneys General. A violation of any laws or regulations relating to the collection or use of personal information, including the Gramm-Leach-Bliley Act’s Safeguards Rule, could result in the imposition of fines against us. Moreover, ED has published extensive requirements for the protection of student data and has indicated such requirements may be strengthened in the future.

Previous wording

Our computer networks and the networks of certain of our vendors that hold and manage confidential information on our behalf may be vulnerable to unauthorized access, employee theft or misuse, computer hackers, computer viruses, and other security threats. Confidential information may also inadvertently become available to third parties when we integrate systems or migrate data to our servers in connection with periodic hardware or software upgrades.

Current wording

We have in the past, and may in the future, be subject to such cyber-security incidents. Incidents may occur as a single instance, or may occur over an extended period of time without detection. Our computer networks and the networks of certain of our vendors that hold and manage confidential information on our behalf may be vulnerable to unauthorized access, employee theft or misuse, computer hackers, computer viruses, and other security threats. Confidential information may also inadvertently become available to third parties when we integrate systems or migrate data to our servers in connection with periodic hardware or software upgrades.

Previous wording

Due to the sensitive nature of the personal information stored on our servers, our networks may be targeted by hackers seeking to access this data. A user who circumvents security measures could misappropriate sensitive information or cause interruptions or malfunctions in our operations. Although we use security and business controls to limit access and use of personal information, a third party may be able to circumvent those security and business

Current wording

Due to the sensitive nature of the personal information stored on our servers, our networks may be targeted by hackers seeking to access this data. A user who circumvents security measures could misappropriate sensitive information or cause interruptions or malfunctions in our operations. Although we use security and business controls to limit access and use of personal information, a third party may be able to circumvent those security and business controls, which could result in a breach of student or employee data and privacy. In addition, errors in the storage, use, or transmission of personal information could result in a breach of privacy for current or prospective students or employees. The increased use of mobile devices by our employees, and the employees and students of our university partners, increases the risk of Information Technology (“IT”) threats and vulnerabilities, such as those involving unsecure networks, as well as unintentional disclosure of personal information, such as through the theft of a mobile device, which can lead to a security incident and/or data breach.

Previous wording

Additionally, university personnel or students, or our employees or independent contractors, could use our online learning platform to store or process regulated personal information without our knowledge. In the event that our systems experience a data security incident, or an individual or entity accesses information without, or in excess of, proper authorization, we could be subject to data security incident notification laws, which may require prompt remediation and notification to individuals. If we are unaware of the data and information stored on our systems, we may be unable to appropriately comply with all legal obligations, and we may be exposed to governmental enforcement or prosecution actions, private litigation, fines and penalties or adverse publicity that could harm our reputation and business. As a result, we may be required to expend significant resources to protect against the threat of these security breaches or to alleviate problems caused by these breaches. A major breach, theft, or loss of personal information regarding our university partner’s students and their families or our employees that is held by us or our vendors, or a violation of laws or regulations relating to the same, could have a material adverse effect on our reputation and result in further regulation and oversight by federal and state authorities and increased costs of compliance.

Current wording

we may be unable to appropriately comply with all legal obligations, and we may be exposed to governmental enforcement or prosecution actions, private litigation, fines and penalties or adverse publicity that could harm our reputation and business. As a result, we may be required to expend significant resources to protect against the threat of these security breaches or to alleviate problems caused by these breaches. A major breach, theft, or loss of personal information regarding our university partners’ students and their families or our employees that is held by us or our vendors, or a violation of laws or regulations relating to the same, could have a material adverse effect on our reputation and result in further regulation and oversight by federal and state authorities and increased costs of compliance.

Previous wording

The performance and reliability of the infrastructure of our computer networks and phone systems, including the online programs of our university partners, is critical to our operations, our reputation and our ability to attract and retain students on our university partners’ behalf. Any computer system disruption or failure, or a sudden and significant increase in traffic on the servers that host our online operations, may result in the online courses and programs being unavailable for a period of time. In addition, any significant failure of our computer networks or servers, whether as a result of third-party actions or in connection with planned upgrades and conversions, could disrupt our operations. Individual, sustained, or repeated occurrences could significantly damage the reputation of our technology and services and result in a loss of potential or existing students of our university partner institutions. Additionally, our operations are vulnerable to interruption or malfunction due to events beyond our control, including natural disasters and network and

Current wording

The performance and reliability of the infrastructure of our computer networks and phone systems, including the online programs of our university partners, is critical to our operations, our reputation and our ability to attract and retain students on our university partners’ behalf. Any computer system disruption or failure, or a sudden and significant increase in traffic on the servers that host our online operations, may result in the online courses and programs being unavailable for a period of time. In addition, any significant failure of our computer networks or servers, whether as a result of third-party actions or in connection with planned upgrades and conversions, could disrupt our operations. Individual, sustained, or repeated occurrences could significantly damage the reputation of our technology and services and result in a loss of potential or existing students of our university partner institutions. Additionally, our operations are vulnerable to interruption or malfunction due to events beyond our control, including natural disasters and network and telecommunications failures. Our computer networks may also be vulnerable to unauthorized access, computer hackers, computer viruses, malicious code, organized cyber-attacks and other security problems. A user who circumvents security measures could misappropriate proprietary information or cause interruptions to or malfunctions in operations. As a result, we may be required to expend significant resources to protect against the threat of these security breaches or to alleviate problems caused by these incidents. Any interruption to our operations could have a material adverse effect on our ability to attract students to our university partner’s programs and to retain those students.

Previous wording

To participate in the Title IV programs, a school must be authorized by the appropriate state post-secondary agency or agencies, be accredited by an accrediting commission recognized by ED, and be certified as an eligible institution by ED. In addition, the operations and programs of our university partners, and any future university partners, are regulated by other state education agencies and additional specialized accrediting commissions. As a result of these requirements, we are subject to extensive regulation from state entities, institutional accrediting commissions, specialized accrediting commissions, and ED. These regulatory requirements cover many of our operations, as well as the operations of our university partners. These include regulations related to educational programs, instructional and administrative staff, administrative procedures, marketing, recruiting, financial operations, and financial condition of any university partner. These regulatory requirements also affect our ability to assist university partner institutions with adding new educational programs and changing existing educational programs. The agencies that regulate higher education periodically revise their requirements and modify their interpretations of existing requirements. Regulatory requirements are not always precise and clear, and regulatory agencies may sometimes disagree with the way we have (or any university partner has) interpreted or applied these requirements. Any misinterpretation of regulatory requirements could materially adversely affect us. If we fail, or any university partner institution fails, to comply with any of these regulatory requirements, we or any university partner could suffer financial penalties, limitations on operations, or other sanctions, each of which could materially adversely affect us. In addition, if we or any university partner are charged with regulatory violations, our reputation could be damaged, which could have a negative impact on our stock price and enrollments at university partner institutions. ED and other regulators have increased the frequency and severity of their enforcement actions against post-secondary schools, including our primary university partner. In some cases, these enforcement actions have resulted in material sanctions, loss of Title IV eligibility, or closure in

Current wording

To participate in the Title IV programs, a school must be authorized by the appropriate state post-secondary agency or agencies, be accredited by an accrediting commission recognized by ED, and be certified as an eligible institution by ED. In addition, the operations and programs of our university partners, and any future university partners, are regulated by other state education agencies and additional specialized accrediting commissions. As a result of these requirements, we are subject to extensive regulation from state entities, institutional accrediting commissions, specialized accrediting commissions, and ED. These regulatory requirements cover many of our operations, as well as the operations of our university partners. These include regulations related to educational programs, instructional and administrative staff, administrative procedures, marketing, recruiting, financial operations, and financial condition of any university partner. These regulatory requirements also affect our ability to assist university partner institutions with adding new educational programs and changing existing educational programs. The agencies that regulate higher education periodically revise their requirements and modify their interpretations of existing requirements. Regulatory requirements are not always precise and clear, and regulatory agencies may sometimes disagree with the way we have (or any university partner has) interpreted or applied these requirements. Any misinterpretation of regulatory requirements could materially adversely affect us. If we fail, or any university partner institution fails, to comply with any of these regulatory requirements, we or any university partner could suffer financial penalties, limitations on operations, or other sanctions, each of which could materially adversely affect us. In addition, if we or any university partner are charged with regulatory violations, our reputation could be damaged, which could have a negative impact on our stock price and enrollments at university partner institutions. ED and other regulators have increased the frequency and severity of their enforcement actions against post-secondary schools, including our primary university partner. In some cases, these enforcement actions have resulted in material sanctions, loss of Title IV eligibility, or closure in schools. We cannot predict with certainty how all of these regulatory requirements will be applied, or whether we will be able to comply with all of the applicable requirements in the future.

Previous wording

In addition to other regulations discussed elsewhere (such as the new Gainful Employment regulations), on July 1, 2024 new regulations became effective covering the areas of financial responsibility, administrative capability, certification standards and procedures, and ability to benefit.

Current wording

In addition to other regulations discussed elsewhere (such as those related to the OBBBA), on July 1, 2024 new regulations became effective covering the areas of financial responsibility, administrative capability, certification standards and procedures, and ability to benefit.

Previous wording

To participate in the Title IV programs, an institution must either satisfy specific quantitative standards of financial responsibility prescribed by ED or post a letter of credit in favor of ED and possibly accept operating restrictions as well. These financial responsibility tests are applied to each institution on an annual basis based on the institution’s audited consolidated financial statements, and may be applied at other times, such as if the institution undergoes a change in control. These tests may also be applied to an institution’s parent company or other related entity. As a service provider, we are not directly subject to this regulation. However, if ED were to determine that a university partner institution did not meet the financial responsibility standards due to a failure to meet the composite score or other financial responsibility factors, ED could impose a range of sanctions on the institution, such as requiring the institution to post a letter of credit, accept provisional certification (which would hamper the ability of the institution to add new programs), comply with additional ED monitoring requirements, agree to receive Title IV program funds under an arrangement other than ED’s standard advance funding arrangement, such as the reimbursement system of payment or heightened cash monitoring, and to comply with or accept other limitations on the ability to increase the number of programs offered by our university partner institutions or the number of students they enroll, any of which sanctions could have an adverse impact on our business. For example, GCU, calculated its composite score with respect to its fiscal years ending June 30, 2024 and 2023. As of June 30, 2024 and 2023, GCU’s composite score per GCU’s audited financial statements was 1.9 and 1.8, respectively, using the proprietary school calculation. If GCU’s future composite scores do not exceed 1.5, ED could impose sanctions. If any such sanctions were imposed on GCU or one of our other university partners, it could have a negative impact on our ability to conduct our business. In addition, if its composite score dropped low enough, it could cause GCU to be ineligible for participation in NC-SARA, which would require GCU to become authorized in numerous states in which it operates or has students.

Current wording

To participate in the Title IV programs, an institution must either satisfy specific quantitative standards of financial responsibility prescribed by ED or post a letter of credit in favor of ED and possibly accept operating restrictions as well. These financial responsibility tests are applied to each institution on an annual basis based on the institution’s audited consolidated financial statements, and may be applied at other times, such as if the institution undergoes a change in control. These tests may also be applied to an institution’s parent company or other related entity. As a service provider, we are not directly subject to this regulation. However, if ED were to determine that a university partner institution did not meet the financial responsibility standards due to a failure to meet the composite score or other financial responsibility factors, ED could impose a range of sanctions on the institution, such as requiring the institution to post a letter of credit, accept provisional certification (which would hamper the ability of the institution to add new programs), comply with additional ED monitoring requirements, agree to receive Title IV program funds under an arrangement other than ED’s standard advance funding arrangement, such as the reimbursement system of payment or heightened cash monitoring, and to comply with or accept other limitations on the ability to increase the number of programs offered by our university partner institutions or the number of students they enroll, any of which sanctions could have an adverse impact on our business. For example, GCU, calculated its composite score with respect to its fiscal years ending June 30, 2025 and 2024. As of June 30, 2025 and 2024, GCU’s composite score per GCU’s audited financial statements was 1.9 for both years, using the proprietary school calculation. If GCU’s future composite scores do not exceed 1.5, ED could impose sanctions. If any such sanctions were imposed on GCU or one of our other university partners, it could have a negative impact on our ability to conduct our business. In addition, if its composite score dropped low enough, it could cause GCU to be ineligible for participation in NC-SARA, which would require GCU to become authorized in numerous states in which it operates or has students.

Previous wording

Despite our best efforts, we or our university partners may face complaints from our university partners’ students and prospective students over statements made by us and our agents throughout the conduct of our services that would expose our university partners, and derivatively us, to increased risk of enforcement action and applicable sanctions or other penalties and increased risk of private qui tam actions under the Federal False Claims Act. Also, if ED determines that an institution (including its contractors) has engaged in substantial misrepresentation, ED may revoke an institution’s program participation agreement, impose limitations on the institution’s participation in Title IV programs, deny applications from the institution for approval of new programs or locations or other matters, or initiate proceedings to fine the institution or limit, suspend, or terminate its eligibility to participate in Title IV programs. For example, in October 2023, ED imposed a fine of $37 million on GCU (which GCU is appealing) related to alleged misrepresentation by GCU regarding the costs of certain doctorate programs. Similar rules apply under state laws or are incorporated in institutional accreditation standards. The FTC applies similar rules prohibiting any unfair or deceptive marketing practices to the education sector and has pursued litigation against us and GCU related in part to these matters. SeePart I, Item 3**–** Legal Proceedings**–** FTC Complaint. If ED or another regulator determines that statements made by us or on our university partners’ behalf are in violation of the regulations, we could be subject to sanctions, legal actions, and other liability, which could have a material adverse effect on our business.

Current wording

Despite our best efforts, we or our university partners may face complaints from our university partners’ students and prospective students over statements made by us and our agents throughout the conduct of our services that would expose our university partners, and derivatively us, to increased risk of enforcement action and applicable sanctions or other penalties and increased risk of private qui tam actions under the Federal False Claims Act. Also, if ED determines that an institution (including its contractors) has engaged in substantial misrepresentation, ED may revoke an institution’s program participation agreement, impose limitations on the institution’s participation in Title IV programs, deny applications from the institution for approval of new programs or locations or other matters, or initiate proceedings to fine the institution or limit, suspend, or terminate its eligibility to participate in Title IV programs. If ED or another regulator determines that statements made by us or on our university partners’ behalf are in violation of the regulations, we could be subject to sanctions, legal actions, and other liability, which could have a material adverse effect on our business.

Previous wording

A school participating in the Title IV programs must calculate the amount of unearned Title IV program funds that it has disbursed to students who withdraw from their educational programs before completing such programs and must return those unearned funds to the appropriate lender or ED in a timely manner, generally within 45 days of the date the school determines that the student has withdrawn. To the extent our services for a university partner include conducting returns to Title IV, as they do with our primary university partner, GCU, we would likely be jointly and severally liable to ED, along with the relevant university partner, for return of those funds. Further, we could be fined or otherwise sanctioned by ED, which could increase our cost of regulatory compliance and materially adversely affect us.

Current wording

A school participating in the Title IV programs must calculate the amount of unearned Title IV program funds that it has disbursed to students who withdraw from their educational programs before completing such programs and must return those unearned funds to the appropriate lender or ED in a timely manner, generally within 45 days of the date the school determines that the student has withdrawn. To the extent our services for a university partner include conducting returns to Title IV, as they do with our primary university partner, GCU, we would likely be jointly and severally liable to ED, along with the relevant university partner, for return of those funds. Further, we could be fined or otherwise sanctioned by ED, which could increase our cost of regulatory compliance and materially adversely affect us. Further, a failure to comply with these regulatory requirements could result in termination of our ability to continue providing these services to other university partner institutions, which would materially adversely affect us.

Previous wording

State regulatory requirements for online education have historically varied among the states. To address this issue and to meet new ED requirements many schools have applied and have been approved to be approved institutional participants in the State Authorization Reciprocity Agreement (“SARA”). SARA is an agreement among member states, districts and territories that establishes comparable national standards for interstate offering of post-secondary distance education courses and programs. It is intended to make it easier for students to take online courses offered by post-secondary institutions based in another state. SARA is overseen by a national council (NC-SARA) and administered by four regional education compacts. GCU, for example, is a member of SARA in Arizona (AZ-SARA), which is

Current wording

State regulatory requirements for online education have historically varied among the states. To address this issue and to meet new ED requirements many schools have applied and have been approved to be approved institutional participants in SARA. SARA is an agreement among member states, districts and territories that establishes comparable national standards for interstate offering of post-secondary distance education courses and programs. It is intended to make it easier for students to take online courses offered by post-secondary institutions based in another state. SARA is overseen by a national council (NC-SARA) and administered by four regional education compacts. GCU, for example, is a member of SARA in Arizona (AZ-SARA), which is administered by the Western Interstate Commission for Higher Education (referred to as W-SARA). There is a yearly renewal for participating in NC-SARA and AZ-SARA and

Previous wording

administered by the Western Interstate Commission for Higher Education (referred to as W-SARA). There is a yearly renewal for participating in NC-SARA and AZ-SARA and institutions must agree to meet certain requirements to participate. All states other than California are members of SARA.

Current wording

institutions must agree to meet certain requirements to participate. As of December 31, 2025, all states other than California are members of SARA.

Previous wording

Laws, regulations, or interpretations related to doing business over the Internet could also increase our cost of doing business and affect our ability to recruit students in particular states, which could, in turn, negatively affect enrollments and revenues and have a material adverse effect on our business. As discussed, ED has started a new negotiated rulemaking addressing state authorization which implicates SARA. While no regulations have been published, any regulation could have a material adverse effect on our business.

Current wording

Laws, regulations, or interpretations related to doing business over the Internet could also increase our cost of doing business and affect our ability to recruit students in particular states, which could, in turn, negatively affect enrollments and revenues and have a material adverse effect on our business. ED initiated a negotiated rulemaking process addressing state authorization which could have implicated SARA but published a notice in December 2024 terminating that negotiated rulemaking process. ED may revisit state authorization requirements through future rulemaking or other guidance, and any such changes could have a material adverse effect on our business.

Previous wording

a whole, appear to be coordinated in the manner described in the 2021 FTC statement. These actions, or any future actions by ED, FTC or any other federal or state government agencies or accrediting bodies with oversight over us or GCU, if ultimately resolved adversely to us or GCU, could result in monetary penalties and liabilities, further impact GCU’s non-profit status, and/or cause reputational harm. At this time, we cannot predict what changes those could be or what effect any of those outcomes could have on our business. Claims and lawsuits, and other regulatory actions, brought or taken against us or our university partners, even if they are without merit, may also result in adverse publicity, negatively affect the market price of our stock, adversely affect student enrollments, and reduce the willingness of third parties to do business with us. Even if we or our university partners adequately address the issues raised by any such proceeding and successfully defend against it, we may have to devote significant financial and management resources to address these issues, which could harm our business.* *See Part 1, Item 3 – Litigation for a discussion of certain litigation matters to which we are a party.

Current wording

Because our university partner institutions operate in a highly regulated industry, they are subject to program reviews, audits, investigations, claims of non-compliance, and lawsuits by government agencies, regulatory agencies, students, employees, stockholders, and other third parties alleging non-compliance with applicable legal requirements, many of which are imprecise and subject to interpretation. Similarly, we could be subject to those same reviews. If the result of any such proceeding is unfavorable to our university partners, they may lose or have limitations imposed on their state licensing, accreditation, or Title IV program participation; be required to pay monetary damages (including triple damages in certain whistleblower suits); or be subject to fines, injunctions, or other penalties, any of which could have a material adverse effect on their business, prospects, financial condition, and results of operations. Claims and lawsuits, and other regulatory actions, brought or taken against us or our university partners, even if they are without merit, may also result in adverse publicity, negatively affect the market price of our stock, adversely affect student enrollments, and reduce the willingness of third parties to do business with us. Even if we or our university partners adequately address the issues raised by any such proceeding and successfully defend against it, we may have to devote significant financial and management resources to address these issues, which could harm our business.* *See Part 1, Item 3 – Litigation for a discussion of certain litigation matters to which we are a party.

Previous wording

The process of re-authorization of the HEA began in 2014 and is ongoing. Congressional hearings began in 2013 and will continue to be scheduled by the U.S. Senate Committee on Health, Education, Labor and Pensions, the U.S. House of Representatives Committee on Education and the Workforce and other Congressional committees regarding various aspects of the education industry, including accreditation matters, student debt, student recruiting, cost of tuition, distance learning, competency-based learning, student success and outcomes and other matters.

Current wording

The Higher Education Act has not been comprehensively reauthorized since 2008, and Congress has periodically considered proposals to reauthorize and amend the statute. Congressional hearings will continue to be scheduled by the U.S. Senate Committee on Health, Education, Labor and Pensions, the U.S. House of Representatives Committee on Education and the Workforce and other Congressional committees regarding various aspects of the education industry, including accreditation matters, student debt, student recruiting, cost of tuition, distance learning, competency-based learning, student success and outcomes and other matters.

Previous wording

The increased scrutiny and results-based accountability initiatives in the education sector, as well as ongoing policy differences in Congress regarding spending levels, could lead to significant changes in connection with the reauthorization of the HEA or otherwise. These changes may place additional regulatory burdens on postsecondary schools generally, and specific initiatives may be targeted at or have an impact upon companies like us that provide services to institutions of higher education. The adoption of any laws or regulations that limit our ability to provide our bundled services to our university partners could compromise our ability to drive revenue through their programs or make our platform less attractive to them. Congress could also enact laws or regulations that require us to modify our practices in ways that could increase our costs.

Current wording

schools generally, and specific initiatives may be targeted at or have an impact upon companies like us that provide services to institutions of higher education. The adoption of any laws or regulations that limit our ability to provide our bundled services to our university partners could compromise our ability to drive revenue through their programs or make our platform less attractive to them. Congress could also enact laws or regulations that require us to modify our practices in ways that could increase our costs.

Previous wording

Our success depends upon our ability to recruit and retain key personnel.

Current wording

Our success depends upon our ability and our university partners’ ability to recruit and retain key personnel.

Previous wording

We are subject to the reporting requirements of the Securities Exchange Act of 1934, the Sarbanes-Oxley Act and the rules and regulations of The Nasdaq Global Select Market. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are required to perform system and process evaluation and testing of our internal control over financial reporting to allow management to report on the effectiveness of our internal control over financial reporting in our Form 10-K filing for that year, as required by Section 404 of the Sarbanes-Oxley Act. This may require us to incur substantial additional

Current wording

We are subject to the reporting requirements of the Securities Exchange Act of 1934, the Sarbanes-Oxley Act and the rules and regulations of The Nasdaq Global Select Market. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are required to perform system and process evaluation and testing of our internal control over financial reporting to

Previous wording

professional fees and internal costs to further expand our accounting and finance functions and expend significant management efforts. If we are not able to comply with the requirements of Section 404 of the Sarbanes-Oxley Act in a timely manner, or if we are unable to maintain proper and effective internal controls, we may not be able to produce timely and accurate financial statements. If that were to happen, the market price of our stock could decline and we could be subject to sanctions or investigations by the stock exchange on which our common stock is listed, the SEC, or other regulatory authorities.

Current wording

allow management to report on the effectiveness of our internal control over financial reporting in our Form 10-K filing for that year, as required by Section 404 of the Sarbanes-Oxley Act. This may require us to incur substantial additional professional fees and internal costs to further expand our accounting and finance functions and expend significant management efforts. If we are not able to comply with the requirements of Section 404 of the Sarbanes-Oxley Act in a timely manner, or if we are unable to maintain proper and effective internal controls, we may not be able to produce timely and accurate financial statements. If that were to happen, the market price of our stock could decline and we could be subject to sanctions or investigations by the stock exchange on which our common stock is listed, the SEC, or other regulatory authorities.

Previous wording

You should not rely on an investment in our common stock to provide dividend income. We have not declared or paid cash dividends on our common stock to date. We currently intend to retain our future earnings, if any, to fund the development and growth of our business or to repurchase shares of our common stock. In addition, the terms of our prior credit facility limited, and the terms of any future debt agreements are likely to similarly limit, our ability to pay dividends. As a result, capital appreciation, if any, of our common stock will be your sole source of gain for the foreseeable future. Investors seeking cash dividends should not purchase our common stock.

Current wording

You should not rely on an investment in our common stock to provide dividend income. We have not declared or paid cash dividends on our common stock to date. We currently intend to retain our future earnings, if any, to fund the development and growth of our business or to repurchase shares of our common stock. In addition, the terms of our prior credit facility limited, and the terms of any future debt agreements are likely to similarly limit, our ability to pay