HEALTHEQUITY, INC.

Previous wording

Failure to adequately place and safeguard HSA cash and Client-held funds, or the failure of any of our depository or insurance company partners, could materially and adversely affect our business, financial condition and results of operations.

Current wording

Failure to adequately place and safeguard HSA cash and Client-held funds, or the failure of any of our insurance company partners or Depository Partners, could materially and adversely affect our business, financial condition, and results of operations.

Previous wording

As a non-bank custodian, we rely on our federally insured custodial Depository Partners and our insurance company partners to hold HSA cash that we custody. The portion of HSA cash held by our insurance company partners continues to increase with the increasing adoption of our Enhanced Rates program. The HSA cash held through our insurance company partners is not federally insured, and our members bear the risk of loss with respect to either the failure of the insurance company partner holding their HSA cash or the breach by the insurance company partner of its obligations to guarantee principal or pay interest thereon. In addition, we deposit Client-held funds with our Depository Partners in interest-bearing demand deposit accounts, and federal deposit insurance may not be available for certain Clients.

Current wording

As a non-bank custodian, we rely on our insurance company partners and federally insured custodial Depository Partners to hold HSA cash that we custody. The portion of HSA cash held by our insurance company partners continues to increase with the increasing adoption of our Enhanced Rates program. The HSA cash held through our insurance company partners is not federally insured, and our members bear the risk of loss with respect to either the failure of the insurance company partner holding their HSA cash or the breach by the insurance company partner of its obligations to guarantee principal or pay interest thereon. In addition, we deposit Client-held funds with our Depository Partners in interest-bearing demand deposit accounts, and federal deposit insurance may not be available for certain Clients.

Previous wording

If any material adverse event were to affect one of our Depository Partners or our insurance company partners, including a significant decline in its financial condition, a decline in the quality of its service, a loss of deposits, its inability to comply with applicable banking, insurance or other regulatory requirements, systems failure or its inability to return principal or pay interest thereon, our business, financial condition and results of operations could be materially and adversely affected. In addition, in the event of such a failure of, or breach by, one of our insurance company partners, the HSA cash held through that insurance company partner would be at risk and no assurance can be given that our contractual arrangements with that insurance company partner would be sufficient for our members to fully recover their HSA cash, which would in turn result in reputational and financial harm to the Company.

Current wording

If any material adverse event were to affect one of our insurance company partners or Depository Partners, including a significant decline in its financial condition, a decline in the quality of its service, a loss of deposits, its inability to comply with applicable insurance, banking, or other regulatory requirements, systems failure, or its inability to return principal or pay interest thereon, our business, financial condition, and results of operations could be materially and adversely affected. In addition, in the event of such a failure of, or breach by, one of our insurance company partners, the HSA cash held through that insurance company partner would be at risk and no assurance can be given that our contractual arrangements with that insurance company partner would be sufficient for our members to fully recover their HSA cash, which would in turn result in reputational and financial harm to the Company.

Previous wording

In addition, certain of our insurance company partners have commitments to us with respect to the interest rates paid; however, some of these commitments are conditional upon certain market events and/or satisfaction of our obligations to the partner. A reduction of the interest rate payable, or a requirement that we post collateral in lieu of any such reduction, could have a material and adverse impact on our business, financial condition and results of operations.

Current wording

In addition, certain of our insurance company partners have commitments to us with respect to the interest rates paid; however, some of these commitments are conditional upon certain market events or the satisfaction of our obligations to the partner. A reduction of the interest rate payable, or a requirement that we post collateral in lieu of any such reduction, could have a material and adverse impact on our business, financial condition, and results of operations.

Previous wording

Failure to adequately manage the liquidity of the custodial assets held by our Depository Partners and insurance company partners could materially and adversely affect our business, financial condition, and results of operations.

Current wording

Failure to adequately manage the liquidity of the custodial assets held by our insurance company partners and Depository Partners could materially and adversely affect our business, financial condition, and results of operations.

Previous wording

Certain of our arrangements with our Depository Partners and insurance company partners require that we keep a minimum amount of HSA cash with such partner. If we fail to comply with those minimum HSA cash requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest paid to us under such arrangements. Such penalties or reductions, if imposed, could have a material and adverse impact on our business, financial condition and results of operations, and we may not have sufficient capital on hand to pay such penalties.

Current wording

Certain of our arrangements with our insurance company partners and Depository Partners require that we keep a minimum amount of HSA cash with such partner. If we fail to comply with those minimum HSA cash requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest paid to us under such arrangements. Such penalties or reductions, if imposed, could have a material and adverse impact on our business, financial condition, and results of operations, and we may not have sufficient capital on hand to pay such penalties.

Previous wording

We partner with our Depository Partners and insurance company partners to hold our HSA Assets and other Client-held funds. We earn a substantial portion of our revenue from fees we earn from our Depository Partners and insurance company partners, which comprised approximately 45%, 39%, and 30% of our revenues during the fiscal years ended January 31, 2025, 2024, and 2023, respectively. A decline in prevailing interest rates would negatively impact our business by reducing the yield we realize on our HSA Assets and other Client-held funds. In addition, if we do not offer competitive interest rates on HSA Assets, our members may choose another HSA custodian. Any such scenario could materially and adversely affect our business and results of operations.

Current wording

We partner with our insurance company partners and Depository Partners to hold our HSA Assets and other Client-held funds. We earn a substantial portion of our revenue from fees we earn from our insurance company partners and Depository Partners which comprised approximately 48%, 45%, and 39% of our revenues during the fiscal years ended January 31, 2026, 2025, and 2024, respectively. A decline in prevailing interest rates would negatively impact our business by reducing the yield we realize on our HSA Assets and other Client-held funds. In addition, if we do not offer competitive interest rates on HSA Assets, our members may choose another HSA custodian. Any such scenario could materially and adversely affect our business and results of operations.

Previous wording

If the value of the invested HSA Assets our members hold declines, whether due to market conditions or other factors, our fees, which are based on a percentage of the asset values, would be adversely affected, which would in turn negatively impact our results of operations.

Current wording

If the value of invested HSA Assets that our members hold declines, whether due to market conditions or other factors, our fees received on invested HSA Assets, which are based on a percentage of the asset values, would be adversely affected, which would in turn negatively impact our results of operations.

Previous wording

The market for our products and services is subject to rapid and significant change and competition. The market for administering HSAs and other CDBs is characterized by rapid technological change, new product and service introductions, evolving industry standards, changing customer needs, existing competition, and the entrance of non-traditional competitors. In addition, there may be a limited-time opportunity to achieve and maintain a significant share of this market due in part to our rapidly evolving industry, industry consolidation, and the substantial resources available to our existing and potential competitors. In order to remain competitive, we are continually involved in a number of projects to develop new services or compete with these new market entrants. These projects carry risks, such as cost overruns, delays in delivery, performance problems, and lack of acceptance by our Clients, Network Partners and members.

Current wording

The market for our products and services is subject to rapid and significant change and competition. The market for administering HSAs and other CDBs is characterized by rapid technological change, new product and service introductions, evolving industry standards, changing customer needs, existing competition, price sensitivity, and the entrance of non-traditional competitors. In addition, there may be a limited-time opportunity to achieve and maintain a significant share of this market due in part to our rapidly evolving industry, industry consolidation, and the substantial resources available to our existing and potential competitors. In order to remain competitive, we are continually involved in a number of projects to develop new services or compete with these new market entrants. These projects carry risks, such as cost overruns, delays in delivery, performance problems, and lack of acceptance by our Clients, Network Partners, marketplace partners, and members.

Previous wording

The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase or create new operational and competitive risks.

Current wording

The expanding use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase or create new operational and competitive risks.

Previous wording

AI technologies – including generative AI –present numerous opportunities, such as benefits from increased operational efficiencies and innovative new products. We expect the use of AI technologies in the marketplace to increase as we, our service providers, and our competitors seek to leverage and maximize those benefits. However, the development and deployment of such technologies also poses certain risks. For example, new products and services incorporating or utilizing AI and machine learning may raise technological, security, legal and other risks and challenges related to, among other items, the use of personal information or the information of clients who have not granted permission for the use of their data in such AI systems, flaws in our models or training datasets that may result in biased or inaccurate results or other unanticipated outcomes, ethical considerations regarding AI, potential infringement of third-party intellectual property rights, exposure of data, and our ability to safely deploy and implement governance and controls for AI systems. We are also exposed to risks arising from the use of AI technologies by bad actors, who may use such technologies to commit fraud, misappropriate funds, and facilitate cyberattacks. Further, our competitors may adopt AI or generative AI more quickly or more effectively than we do, causing competitive harm. Any of these risks could negatively impact our reputation, the demand for our products and services, our financial condition and results of operations, and otherwise draw adverse regulatory scrutiny.

Current wording

However, the development and deployment of such technologies also pose significant risks. For example, new products and services incorporating or utilizing AI and machine learning may raise technological, security, legal, reputational, and other risks and challenges related to, among other items, the use of personal information or the information of clients who have not granted permission for the use of their data in such AI systems, flaws in our models or training datasets that may result in biased or inaccurate results, or other unanticipated outcomes, ethical considerations regarding AI, potential infringement of third-party intellectual property rights, exposure of data, and our ability to safely deploy and implement governance and controls for AI systems. We are also exposed to risks arising from the use of AI technologies by bad actors, who may use such technologies to commit fraud, misappropriate funds, and facilitate cyberattacks. Further, our competitors may adopt AI or generative AI more quickly or more effectively than we do, causing competitive harm. AI is subject to rapidly evolving domestic and international laws and regulations, the scope and requirements of which may be inconsistent across jurisdictions and which could impose significant costs and obligations on us. Any of these risks could negatively impact our reputation, the demand for our products and services, and our financial condition and results of operations.

Previous wording

The market for our products and services is highly competitive. We view our competition in terms of direct and indirect competitors. Our direct HSA competitors are well-known retail investment companies, such as Fidelity Investments, HSA custodians and administrators that include state or federally chartered banks, such as Webster Bank and Optum Bank, insurance companies, and non-bank custodians approved by the U.S. Treasury. We also have numerous indirect HSA administration competitors, including benefits administrators and health plans, that license technology platforms and partner with other HSA custodians to provide "white label" HSA offerings. Our other CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks, and these competitors have entered, and others may also enter, the HSA market or expand existing HSA offerings to compete with us.

Current wording

The market for our products and services is highly competitive. We view our competition in terms of direct and indirect competitors. Our direct HSA competitors are well-known retail investment companies, such as Fidelity Investments, HSA custodians and administrators that include state or federally chartered banks, such as Webster Bank and Optum Bank, insurance companies, and non-bank custodians approved by the U.S. Treasury. We also have numerous indirect HSA administration competitors, including benefits administrators and health plans, that license technology platforms and partner with other HSA custodians to provide "white label" HSA offerings. Our other CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks, and these competitors have entered, and others may also enter, the HSA market or expand existing HSA offerings to compete with us. Our marketplace initiative also faces competition from telehealth companies with whom we are not affiliated, other providers of similar marketplaces, the producers of products and services competitive with the products and services made available through our marketplace, as well as from similar initiatives by our direct HSA competitors.

Previous wording

If one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively. Our competitors have and may continue to establish or strengthen cooperative relationships with our current or future Network Partners or other strategic partners, thereby limiting our ability to promote our solution with these parties. We have seen an increase in Network Partners that have decided to offer HSAs or other CDBs directly to their customers, and a continuation of this trend would significantly reduce our channel partner opportunities and result in account attrition.

Current wording

If one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively. Our competitors have and may continue to establish or strengthen cooperative relationships with our current or future Network Partners, marketplace partners, or other strategic partners, thereby limiting our ability to promote our solution with these parties. We have seen an increase in Network Partners that have decided to offer HSAs or other CDBs directly to their customers, and a continuation of this trend would significantly reduce our channel partner opportunities and result in account attrition.

Previous wording

We derived 15%, 16%, and 17% of our total revenue during the fiscal years ended January 31, 2025, 2024, and 2023, respectively, from interchange fees that are paid to us when our customers utilize our payment cards. These fees represent a percentage of the expenses transacted on each card. For example, the COVID-19 pandemic had a materially adverse impact on the interchange fees generated due to decreased usage of our payment cards in our commuter product and in healthcare spending. If our customers do not use these payment cards at the rate we expect, if they elect to withdraw funds using a non-revenue generating mechanism such as direct reimbursement, or if other alternatives to these payment cards develop, our results of operations, business, and prospects would be materially adversely affected.

Current wording

We derived 15%, 15%, and 16% of our total revenue during the fiscal years ended January 31, 2026, 2025, and 2024, respectively, from interchange fees that are paid to us when our customers utilize our payment cards. These fees represent a percentage of the expenses transacted on each card. If our customers do not use these payment cards at the rate we expect, if they elect to withdraw funds using a non-revenue generating mechanism such as direct reimbursement, or if other alternatives to these payment cards develop, our results of operations, business, and prospects would be materially adversely affected.

Previous wording

Effective internal control over financial reporting is necessary for us to provide reliable financial reports, prevent fraud and operate successfully as a public company. Any failure, whether in connection with our growth, acquisitions, or otherwise, to execute on our internal controls and continue to maintain effective internal controls, to timely implement any necessary additional improvement to our internal controls or to effect remediation of any future material weakness or significant deficiency could, among other things, result in losses from fraud or error, harm our reputation or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our reputation, results of operations, or financial condition.

Current wording

Effective internal control over financial reporting is necessary for us to provide reliable financial reports, prevent fraud, and operate successfully as a public company. Any failure, whether in connection with our growth, acquisitions, or otherwise, to execute on our internal controls and continue to maintain effective internal controls, to timely implement any necessary additional improvement to our internal controls, or to effect remediation of any future material weakness or significant deficiency could, among other things, result in losses from fraud or error, harm our reputation, result in regulatory fines, penalties, or investigations, or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our reputation, results of operations, or financial condition.

Previous wording

Management reviews and updates our systems of internal controls and procedures, as appropriate. Any system of controls is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our reputation, results of operations and financial condition.

Current wording

Management reviews and updates our systems of internal controls and procedures, as appropriate. Any system of controls is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply

Previous wording

As one of the largest providers of HSAs and other CDBs, our proprietary technology platforms enable the exchange of, and access to, sensitive information. As a result, we are frequently the target of cyber-attacks, including ransomware attacks, which means we must continue to monitor and take steps to secure each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture. In addition,

Current wording

As one of the largest providers of HSAs and other CDBs, our proprietary technology platforms enable the exchange of, and access to, sensitive information. As a result, we are frequently the target of cyber attacks, including ransomware attacks, which means we must continue to monitor and take steps to secure each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture. In addition, geopolitical events, including the war between Russia and Ukraine, have resulted in, and may continue to result in, an increase in cyber attacks.

Previous wording

Our ability to ensure the security of our technology platforms and sensitive customer and partner information is critical to our operations. We rely on standard Internet and other security systems to provide the security and authentication necessary to effect secure transmission of data. Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers and other malfeasance. Such threats could result in actual security events that compromise our networks, or those of third-party service providers on which we rely, and result in the information stored or transmitted there to be accessed, modified or used in an unauthorized manner, publicly disclosed, lost, or stolen. Such access, use, disclosure, or other loss of information may result in regulatory scrutiny, and legal claims and liability, including under laws that protect the privacy of personal information, as it has in the past. Cybersecurity events disrupt our operations and the services we provide to our Clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position.

Current wording

Our ability to ensure the security of our technology platforms and sensitive customer and partner information is critical to our operations. We rely on standard Internet and other security systems to provide the security and authentication necessary to effect secure transmission of data. Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers, AI-powered threats, human error, insider threats, and other malfeasance or outages. Such threats could result in actual security events that compromise our networks, or those of third-party service providers on which we rely, and result in the information stored or transmitted there to be accessed, modified, or used in an unauthorized manner, publicly disclosed, lost, or stolen. Such access, use, disclosure, or other loss of information may result in regulatory scrutiny, and legal claims and liability, including under laws that protect the privacy of personal information, as it has in the recent past. Cybersecurity events disrupt our operations and the services we provide to our Clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position.

Previous wording

Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties and other liabilities, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our members, Clients and Network Partners. We have been the victim of such breaches, which have damaged our reputation and caused a loss of confidence in our products and services, and may lead to a reduction in demand and result in an unwillingness of members, Clients, Network Partners and other data owners to provide us with their payment information or personal information, and otherwise harm our brand. Furthermore, when third parties improperly obtain and use the personal information of our members, we are required to expend significant resources to investigate and resolve these problems.

Current wording

Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties, regulatory scrutiny, and other liabilities, including under laws that protect the privacy of personal information, and disrupt our operations and the services we provide to our members, Clients and Network Partners. We have been the victim of such breaches, which have damaged our reputation and caused a loss of confidence in our products and services, and which may lead to a reduction in demand and result in an unwillingness of members, Clients, Network Partners, and other data owners to provide us with their payment information or personal information, and otherwise harm our brand. Furthermore, when third parties improperly obtain and use the personal information of our members, we are required to expend significant resources to investigate and resolve these problems.

Previous wording

While we have security measures in place, we have experienced data privacy incidents in the past, including an incident in 2024 in which a business partner's user account containing personally identifiable information was breached. As a result of the incident, we are now subject to several putative class action lawsuits seeking unspecified damages, and we are subject to regulatory inquiries related to the incident. Whether as a result of these incidents, or if our security measures are breached again or unauthorized access to data is otherwise obtained as a result of third-party action, team member error or otherwise, our reputation could be significantly damaged, our business may suffer and we could incur substantial liability, which could result in loss of sales, Clients and Network Partners.

Current wording

While we have security measures in place, we have experienced data privacy incidents in the past, including an incident in 2024 in which a business partner's user account containing personally identifiable information was breached. As a result of the incident, we are now subject to a consolidated putative class action lawsuits seeking unspecified damages, and we are subject to regulatory inquiries related to the incident, which may lead to fines or other enforcement by these regulators. Whether as a result of these incidents, or if our security measures are breached again or unauthorized access to data is otherwise obtained as a result of third-party action, team member error, or otherwise, our reputation could be significantly damaged, our business may suffer, and we could incur substantial liability, which could result in loss of sales, Clients and Network Partners.

Previous wording

Because techniques used to obtain unauthorized access to or sabotage systems change frequently and such novel techniques may not be identified until they are launched against a target, we may be unable to anticipate, or to implement adequate preventative measures to address, these techniques. Any or all of these issues could negatively impact our ability to attract new, or increase engagement by, members, Clients and Network Partners, and subject us to third-party lawsuits, regulatory fines, contractual liability, and other action or liability, thereby harming our operating results or financial condition.

Current wording

Because techniques used to obtain unauthorized access to or sabotage systems change frequently and such novel techniques, including by use of AI technologies by threat actors, may not be identified until they are launched against a target, we may be unable to anticipate, or to implement adequate preventative measures to address, these techniques. Any or all of these issues could negatively impact our ability to attract new, or increase engagement by, members, Clients and Network Partners, and subject us to third-party lawsuits, regulatory actions or fines, contractual liability, and other action or liability, thereby harming our operating results or financial condition.

Previous wording

Criminals are using increasingly sophisticated methods to obtain personal information, which they then use to commit fraud. As a non-bank custodian of HSAs, we are frequently targeted by sophisticated and persistent bad actors for fraudulent activity, through various tactics such as high-volume credential stuffing attacks, denial of service attacks, and social engineering attacks, among others. We have experienced a significant increase in the volume and sophistication of outside fraudulent activity targeting member accounts, resulting in a significant loss to us as we incurred service costs to reimburse and protect impacted members. Losses due to fraud committed against us and our Clients, members, and Network Partners may not be covered by insurance policies, and losses not covered by insurance may be material. Even in the event that losses relating to fraudulent activity are covered

Current wording

Criminals are using increasingly sophisticated methods, including AI, to obtain personal information, which they then use to commit fraud. As a non-bank custodian of HSAs, we are frequently targeted by sophisticated and persistent bad actors for fraudulent activity, through various tactics such as high-volume credential stuffing attacks, denial of service attacks, and social engineering attacks, among others. For example, in the fiscal year ended January 31, 2025, and the fiscal quarter ended April 30, 2025, we experienced a significant increase in the volume and sophistication of outside fraudulent activity targeting member accounts, resulting in a significant loss to us as we incurred service costs to reimburse and protect impacted members. Losses due to fraud committed against us and our Clients, members, and Network Partners may not be covered by insurance policies, and losses not covered by insurance may be material. Even in the event that losses relating to fraudulent activity are covered by insurance, premiums and/or deductibles related to our insurance coverage may increase or the scope of our coverage may decrease, any of which could have an adverse impact on our financial results.

Previous wording

We attempt to mitigate these risks through various business continuity efforts, including redundant infrastructure, 24/7/365 system activity monitoring, backup and recovery procedures, use of a secure storage facility for backup media, separate production and test systems, and change management and system security measures, but our precautions, even after previous incidents, may not protect against all potential problems. Our data recovery centers are equipped with physical space, power, storage and networking infrastructure and Internet connectivity to support our technology platforms in the event of the interruption of services at our data centers. Even with these data recovery centers, our operations can be interrupted during transition processes when our primary and other data centers experienced failures. Disruptions at our data centers may cause disruptions to our technology platforms and lead to data loss or corruption. We have experienced interruptions and delays in service and availability for data centers, and bandwidth and other technology issues in the past. Frequent or persistent system failures that result in the unavailability of our technology platforms or slower response times could reduce our members', Clients' and Network Partners' ability to access our technology platforms, impair the delivery of our products and services, and harm the perception of our platforms as reliable, trustworthy, and consistent. Any future errors, failure, interruptions or delays experienced in connection with these third-party technologies could delay access to our products by members, Clients and Network Partners, which would harm our business. This could damage our reputation, subject us to potential liability or costs related to defending against claims or cause our members, Clients and Network Partners to cease doing business with us, any of which could negatively impact our financial results.

Current wording

We attempt to mitigate these risks through various business continuity efforts, including redundant infrastructure, 24/7/365 system activity monitoring, backup and recovery procedures, use of a secure storage facility for backup media, separate production and test systems, and change management and system security measures, but our precautions, even after previous incidents, may not protect against all potential problems. Our data recovery centers are equipped with physical space, power, storage and networking infrastructure and Internet connectivity to support our technology platforms in the event of the interruption of services at our data centers. Even with these data recovery centers, our operations can be interrupted during transition processes when our primary and other data centers experience failures. Disruptions at our data centers may cause disruptions to our technology platforms and lead to data loss or corruption. We have experienced interruptions and delays in service and availability for data centers, and bandwidth and other technology issues in the past. Frequent or persistent system failures that result in the unavailability of our technology platforms or slower response times could reduce our members', Clients', and Network Partners' ability to access our technology platforms, impair the delivery of our products and services, and harm the perception of our platforms as reliable, trustworthy, and consistent. Any future errors, failure, interruptions, or delays experienced in connection with these third-party technologies could delay access to our products by members, Clients and Network Partners, which would harm our business. This could damage our reputation, subject us to potential liability or costs related to defending against claims or cause our members, Clients and Network Partners to cease doing business with us, any of which could negatively impact our financial results.

Previous wording

Our technology platforms may incorporate software covered by open source licenses. The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unfavorable conditions on us. For example, by the terms of certain open source licenses, we could be required to offer our technology platforms that incorporate the open source software for no cost, that we make publicly available source code for modifications or derivative works that we created based upon, incorporating or using the open source software, and/or that we license such modifications or derivative works under the terms of the particular open source license. If portions of our proprietary software are determined to be subject to an open source license, then the value of our technologies and services could be reduced.

Current wording

-18- construed in a manner that imposes unfavorable conditions on us. For example, by the terms of certain open source licenses, we could be required to offer our technology platforms that incorporate the open source software for no cost, that we make publicly available source code for modifications or derivative works that we created based upon, incorporating or using the open source software, and/or that we license such modifications or derivative works under the terms of the particular open source license. If portions of our proprietary software are determined to be subject to an open source license, then the value of our technologies and services could be reduced.

Previous wording

Healthcare laws and regulations are rapidly evolving and may change significantly, which could adversely affect our financial condition and results of operations. These changes may accelerate under the new U.S. administration (and through reactions to the administration) in ways we cannot predict. In addition, proposals to implement a single payer or "Medicare for all" system in the U.S. or in individual states, if adopted, could have a material adverse effect on our business. The full impact of healthcare reform and other changes in the healthcare industry and in healthcare spending is unknown. Accordingly, we are unable to predict what effect healthcare reform measures will have on our business.

Current wording

Healthcare laws and regulations are rapidly evolving and may change significantly, which could adversely affect our financial condition and results of operations. In addition, proposals to implement a single payer or "Medicare for all" system in the U.S. or in individual states, if adopted, could have a material adverse effect on our business. The full impact of healthcare reform and other changes in the healthcare industry and in healthcare spending is unknown. Accordingly, we are unable to predict what effect healthcare reform measures will have on our business.

Previous wording

HSAs and other CDBs exist as a result of provisions in the Internal Revenue Code and other laws and regulations. Changes to the regulatory landscape impacting our products require substantial time and costs for us to ensure our products are compliant. For example, regulatory changes related to our FSA and COBRA products enacted in the wake of the COVID-19 pandemic created uncertainty and additional workload on our team members and resulted in additional costs. In addition, federal or state governments could impose laws that limit the eligibility requirements for our products, which could limit our ability to grow or cause us to lose existing members, or such governments could change the eligibility requirements we must meet to maintain the licenses we need to offer our products. We cannot predict if any new reforms will ultimately become law, or if enacted, what their terms or the regulations promulgated pursuant to such reforms will be, and such reforms could have a material adverse effect on our business.

Current wording

HSAs and other CDBs exist as a result of provisions in the Internal Revenue Code and other laws and regulations. Changes to the regulatory landscape impacting our products require substantial time and costs for us to ensure our products are compliant. In addition, federal or state governments could impose laws that limit the eligibility requirements for our products, which could limit our ability to grow or cause us to lose existing members, or such governments could change the eligibility requirements we must meet to maintain the licenses we need to offer our products. We cannot predict if any new reforms will ultimately become law, or if enacted, what their terms or the regulations promulgated pursuant to such reforms will be, and such reforms could have a material adverse effect on our business.

Previous wording

We are subject to privacy regulations, including regarding the access, use, and disclosure of personally identifiable information, and the privacy breaches that we or our third-party service providers have experienced or may experience in the future could result in substantial financial and reputational harm, including possible criminal and civil penalties.

Current wording

We are subject to privacy regulations, including regarding the access, use, and disclosure of personal information, and the privacy breaches that we or our third-party service providers have experienced or may experience in the future could result in substantial financial and reputational harm, including possible criminal and civil penalties.

Previous wording

Privacy and data protection regulation have become priority issues in many states, and as such the regulatory environment is continually changing. For example, many states provide a private right of action for data breaches. Additional privacy requirements are expected as new state and federal privacy laws are enacted.

Current wording

We and certain third party service providers process sensitive personal information in connection with our services, including, where applicable, protected health information and nonpublic personal information. A failure to comply with evolving privacy and data protection requirements including sector-specific regimes such as HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which govern protected health information, the Gramm-Leach-Bliley Act, which governs nonpublic personal information, and various state privacy and breach-notification laws, or a failure to prevent unauthorized access to or disclosure of personal information due to cyberattack, human error, system misconfiguration, third‑party compromise, or other security incident or event could result in regulatory investigations, penalties, litigation (including class actions), contractual claims, member losses, remediation and monitoring costs, operational disruption, and reputational harm. We experienced privacy/security incidents in the past (including an incident in 2024 involving a third-party user account) and future incidents could have greater impact. While we maintain formal privacy and security programs, third‑party oversight, and incident response and notification processes designed to mitigate risks to the confidentiality, integrity, and availability of the sensitive information, including personal information that we hold, residual risk remains. Compliance costs may increase as requirements and expectations continue to change, along with the possibility of costly penalties in the event we are deemed to not be in compliance with such laws and regulations. Privacy and data protection regulation have become priority issues in many states, and, as such, the regulatory environment is continually changing. For example, many states provide a private right of action for data breaches. Additional privacy requirements are expected as new state and federal privacy laws are enacted.

Previous wording

We are subject to U.S. federal and state income, payroll, property, sales and use, and other types of taxes in numerous jurisdictions. Significant judgment is required in determining our provisions for income taxes. Changes in

Current wording

We are subject to U.S. federal and state income, payroll, property, sales and use, and other types of taxes in numerous jurisdictions. Significant judgment is required in determining our provisions for income taxes. Changes in tax rates, enactments of new tax laws, revisions of tax regulations, and claims or litigation with taxing authorities could result in substantially higher taxes.

Previous wording

Regulatory changes and changes in the enforcement environment under the new U.S. administration may have an adverse result on our business.

Current wording

Regulatory changes and changes in the enforcement environment may have an adverse result on our business.

Previous wording

The new U.S. administration has already made, and expects to further make, many changes to the federal government and federal law and enforcement. These include changes to federal workforce headcount, a high volume of executive orders, and many new or modified regulations and guidance. Such changes create uncertainty around our business and our Clients. In addition, changes to the legal, regulatory or political environment may require management's attention, divert resources from other areas, and expose us to potential liability.

Current wording

Changes to regulations and the enforcement environment create uncertainty around our business and our Clients. In addition, changes to the legal, regulatory, or political environment may require management's attention, divert resources from other areas, and expose us to potential liability.

Previous wording

-20- including IRS, Health and Human Services (“HHS”), and Department of Labor (“DOL”) regulations; ERISA, HIPAA, HITECH, and other privacy and data security regulations; the Advisers Act; state banking laws; state third-party administrator laws; the Patient Protection and Affordable Care Act; and developing regulation regimes for the use of AI.

Current wording

Our business, including HSAs and many of the CDBs we administer and our investment adviser and trust company subsidiaries, is subject to extensive, complex, and frequently changing federal and state laws and regulations, including IRS, Health and Human Services (“HHS”), and Department of Labor (“DOL”) regulations; ERISA, HIPAA, HITECH, and other privacy and data security regulations; the Advisers Act; state banking laws; state third-party administrator laws; the Patient Protection and Affordable Care Act; and developing regulation regimes for the use of AI.

Previous wording

Our sales process is highly dependent on the reputation of our products, services, and business and on positive recommendations from our existing members, Clients and Network Partners. Further, we use third-party service providers for certain call centers and COBRA claims and transaction processing, including certain offshore service providers for member chat service, which service providers may not provide the same quality of support services for our Clients and members. Any failure to maintain high-quality education and technical support, or a market perception that we do not maintain high-quality education support, could adversely affect our reputation, our ability to sell our products and services to existing and prospective customers and our business and operating results. We promote 24/7/365 education and support along with our proprietary technology platforms. Interruptions or delays

Current wording

-21- providers for member chat service, which service providers may not provide the same quality of support services for our Clients and members. Any failure to maintain high-quality education and technical support, or a market perception that we do not maintain high-quality education support, could adversely affect our reputation, our ability to sell our products and services to existing and prospective customers, and our business and operating results. We promote 24/7/365 education and support along with our proprietary technology platforms. Interruptions or delays that inhibit our ability to meet that standard have hurt our reputation and ability to attract and retain customers, and any such interruptions or delays in the future would likely also do so.

Previous wording

We rely on our management team (including our new CEO) and team members and our business could be harmed if we are unable to retain qualified personnel.

Current wording

We rely on our management team and team members, and our business could be harmed if we are unable to retain qualified personnel.

Previous wording

Our success depends, in part, on the skills, working relationships and continued services of our executive team, including our new CEO, and other key personnel. While we have entered into employment agreements with our executive officers, all of our team members are “at-will” employees, and their employment can be terminated by us or them at any time, for any reason, and without notice, subject, in certain cases, to severance payment rights. In order to retain valuable team members, in addition to salary and cash incentives, we provide equity-based awards that vest over time or based on performance. The value to team members of these awards will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other organizations. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual, or that a replacement could be hired on terms that are favorable to us. Volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

Current wording

Our success depends, in part, on the skills, working relationships and continued services of our executive team and other key personnel. While we have entered into employment agreements with our executive officers, all of our team members are “at-will” employees, and their employment can be terminated by us or them at any time, for any reason, and without notice, subject, in certain cases, to severance payment rights. In order to retain valuable team members, in addition to salary and cash incentives, we provide equity-based awards that vest over time or based on performance. The value to team members of these awards will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other organizations. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual, or that a replacement could be hired on terms that are favorable to us. Volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

Previous wording

We believe that a critical component to our success has been our corporate culture. We have invested substantial time and resources in building our team. As we continue to grow, including through the integration of team members joining us through our acquisitions, we have found it difficult to maintain these important aspects of our corporate culture. In addition, it is difficult to instill our culture in our now predominantly remote workforce. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives.

Current wording

We believe that a critical component to our success has been our corporate culture. We have invested substantial time and resources in building our team. As we continue to grow, including through our acquisitions, we have found it difficult to maintain these important aspects of our corporate culture. In addition, it is difficult to instill our culture in our now predominantly remote workforce. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives.

Previous wording

We rely on a single bank identification number ("BIN") sponsor in relation to the payment cards we issue. A BIN sponsor is a bank or credit union that provides the BIN that allows a prepaid card program to run on one of the major card brand networks (e.g., VISA, MasterCard, Discover or American Express). Our BIN sponsor enables us to link the payment cards that we offer our members to the VISA network, thereby allowing our members to use our payment cards to pay for expenses with a “swipe” of the card. If any material adverse event were to affect our BIN sponsor, including a significant decline in the financial condition of such BIN sponsor, a decline in the quality of service provided by our BIN sponsor, the inability of our BIN sponsor to comply with applicable banking and financial service regulatory requirements or industry standards, systems failure or the inability of our BIN sponsor to pay us fees, our business, financial condition, and results of operations could be materially and adversely affected because we may be forced to reduce the availability of, or eliminate entirely, our payment card offering, which would

Current wording

We rely on a single bank identification number ("BIN") sponsor in relation to the payment cards we issue. A BIN sponsor is a bank or credit union that provides the BIN that allows a prepaid card program to run on one of the major card brand networks (e.g., VISA, MasterCard, Discover, or American Express). Our BIN sponsor enables us to link the payment cards that we offer our members to the VISA network, thereby allowing our members to use our payment cards to pay for expenses with a “swipe” of the card. If any material adverse event were to affect our BIN

Previous wording

-22- materially impact our interchange revenue. In addition, we do not have long-term contracts with our BIN sponsor, and our BIN sponsor may increase the fees charged to us or terminate our relationship. If we were required to change BIN sponsor, we could not accurately predict the success of such change or that the terms of our agreement with a new BIN sponsor would be as favorable to us, especially in light of the regulatory scrutiny of the payment card industry, which has rendered the market for BIN sponsor services less competitive.

Current wording

-22- sponsor, including a significant decline in the financial condition of such BIN sponsor, a decline in the quality of service provided by our BIN sponsor, the inability of our BIN sponsor to comply with applicable banking and financial service regulatory requirements or industry standards, systems failure, or the inability of our BIN sponsor to pay us fees, our business, financial condition, and results of operations could be materially and adversely affected because we may be forced to reduce the availability of, or eliminate entirely, our payment card offering, which would materially impact our interchange revenue. In addition, we do not have long-term contracts with our BIN sponsor, and our BIN sponsor may increase the fees charged to us or terminate our relationship. If we were required to change our BIN sponsor, we could not accurately predict the success of such change or that the terms of our agreement with a new BIN sponsor would be as favorable to us, especially in light of the regulatory scrutiny of the payment card industry, which has rendered the market for BIN sponsor services less competitive.

Previous wording

As a key part of our strategy, we seek to acquire or invest in assets, businesses, products, or technologies that we believe would complement or expand our products and services, enhance our technical capabilities, or otherwise offer growth opportunities. There is no assurance that we will be successful in consummating such acquisitions, or even if consummated, realize the anticipated benefits of these or any future acquisitions. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

Current wording

As a key part of our strategy, we seek to acquire or invest in assets, businesses, products, or technologies that we believe would complement or expand our products and services, enhance our technical capabilities, or otherwise offer growth opportunities. There is no assurance that we will be successful in consummating such acquisitions or investments, or even if consummated, realize the anticipated benefits of these or any future acquisitions or investments. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating, and pursuing suitable acquisitions or investments, whether or not they are consummated.

Previous wording

Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses that are not discovered by due diligence during the acquisition process. Generally, if an acquisition fails to meet our expectations, our operating results, business, and financial condition may suffer. Certain of our past acquisitions also resulted in dilutive issuances of equity securities and the incurrence of additional debt, and future acquisitions could result in additional dilutive issuances of equity securities or the incurrence of additional debt, which could adversely affect our business, results of operations, or financial condition.

Current wording

Acquisitions and investments also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses or businesses we invest in that are not discovered during the due diligence process. If an acquisition or investment fails to meet our expectations, our operating results, business, and financial condition may suffer. Certain of our past transactions also resulted in dilutive issuances of equity securities and the incurrence of additional debt, and future acquisitions or investments could result in additional dilutive issuances of equity securities or the incurrence of additional debt, which could adversely affect our business, results of operations, or financial condition.