Skip to main content

Expensify Inc

For the period ended Dec 31, 2024. Filed Feb 27, 2025.

View on SEC.gov

About this filing

A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.

FY2024 · Filed Feb 27, 2025

EXFY$2.05-8.1%Stored close · as of Nov 6, 2026

What changed in Risk Factors?

Read the current filing

Previous report: 10-K

Period ended 2023-12-31; filed 2024-02-27.

0001476840-24-000016

Item 1A. Risk Factors

Current report: 10-K

Period ended 2024-12-31; filed 2025-02-27.

0001476840-25-000018

Item 1A. Risk Factors

The baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.

Compared 302 previous paragraphs and 329 current paragraphs.

250 unchanged; 44 reworded; 31 added; 6 removed; 2 previous and 4 current paragraphs rearranged.

Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.

A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.

Added paragraphs (31)

Current report

We may not be able to successfully implement our growth strategies on a timely basis or at all. Even if we are successful, if we fail to effectively manage our growth, our business and results of operations could be harmed.

Current report

For example, as a result of the bankruptcy and collapse of Synapse Financial Technologies, Inc., Expensify Payments has become subject to further recordkeeping requirements and received increased inquiries from regulators regarding our record keeping systems and process. These increased requirements and inquiries could lead to increased costs for maintaining our compliance with required regulations.

Current report

We rely on a single third-party vendor and travel management company ("TMC") for Expensify Travel, and if we lose any of these services, our business, results of operations, financial condition and growth prospects could be harmed.

Current report

Expensify Travel is an important element of our growth strategy, and we believe that, over time, Expensify Travel will be a prominent travel booking solution for SMBs in our core markets. We rely on a single third- party vendor, Spotnana, for Expensify Travel who manages the booking platform and interfaces with the TMC, Solutions Travel, LLC, to complete bookings. Our agreement with the TMC has a three year term that automatically renews annually thereafter unless either party provides 30 days' notice prior to renewal.

Current report

We use third-party artificial intelligence technologies in our business, and the deployment, use, and maintenance of these technologies involve technological and legal risks.

Current report

We use third-party artificial intelligence (“AI”), machine learning, and automated decision-making technologies (collectively, “AI Technologies”) throughout our business, and are making significant investments in this area.

Current report

For example we use AI Technologies to optimize our internal processes, including analyzing and processing receipts, responding to customer support requests, and drafting personalized marketing communications.

Current report

In particular, if the models underlying our AI Technologies are: incorrectly implemented; reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; used without sufficient oversight and governance to ensure their responsible use; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, the performance of our products, services and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

Current report

We use third-party AI Technologies and infrastructure which may pose operational and data security risks.

Current report

We use AI Technologies licensed from third parties, such as OpenAI, in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to OpenAI’s software and infrastructure. While we believe that there are alternative third-party AI Technologies which would be suitable, we cannot control the availability or pricing of such third-party AI Technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI Technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI Technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, to the extent any third-party AI Technologies are used as a hosted service, any disruption, outage, or loss of information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

Current report

Additionally, our reliance on third-party AI Technologies, such as those licensed from OpenAI, involves certain data privacy and security risks. While we generally seek to obtain contractual commitments from the applicable providers that prohibit the use of our data to train or refine their AI models, we may not be able to implement technical measures to prevent such providers from doing so in contravention to their contractual obligations. For more information on data privacy and security risks, see the risk factor “We receive, process, store and use business and personal data, which subjects us to governmental regulation and other legal obligations related to data privacy, protection and security, and our actual or perceived failure to comply with such obligations could harm our business and expose us to liability.”

Current report

The use of generative AI Technologies may produce inaccurate or infringing content, leading to reputational damage and legal challenges.

Current report

There is a risk that generative AI Technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results, all of which could harm our reputation, business, or customer relationships. While we take measures designed to ensure the accuracy of such AI generated content and to monitor for potential inaccuracies, those measures may not always be successful, and in some cases, we may need to rely on end users to report such inaccuracies.

Current report

The regulatory framework governing the use of AI Technologies is rapidly evolving, and we cannot predict how future legislation and regulation will impact our ability to offer products or services that we develop which leverage AI Technologies.

Current report

The regulatory framework for AI Technologies is rapidly evolving as many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Additionally, existing laws and regulations may be interpreted in ways that would affect the operation of our AI Technologies, or could be rescinded or amended as new administrations take differing approaches to evolving AI Technologies. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations.

Current report

Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have been enacted in China and either entered into force in the United States and the EU in 2024 or are expected to enter into force in 2025.

Current report

Additionally, In the United States, the Trump administration has rescinded an executive order relating to the safe and secure development of AI Technologies that was previously implemented by the Biden administration. The Trump administration then issued a new executive order that, among other things, requires certain agencies to develop and submit to the president action plans to “sustain and enhance America’s global AI dominance,” and to specifically review and, if possible, rescind rulemaking taken pursuant to the rescinded Biden executive order. Thus, the Trump administration may continue to rescind other existing federal orders and/or administrative policies relating to AI Technologies, or may implement new executive orders and/or other rule making relating to AI Technologies in the future. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. U.S. legislation related to AI Technologies has also been introduced at the federal level and is advancing at the state level. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision-making. California also enacted seventeen new laws in 2024 that further regulate use of AI Technologies and provide consumers with additional protections around companies’ use of AI Technologies, such as requiring companies to disclose certain uses of generative AI. Other states have also passed AI-focused legislation, such as Colorado’s Artificial Intelligence Act, which will require developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination, and Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions. Such additional regulations may impact our ability to develop, use, procure and commercialize AI Technologies in the future.

Current report

In Europe, on August 1, 2024, the EU Artificial Intelligence Act (the “EU AI Act”) entered into force, and establishes a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and—depending on the AI use case—includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models, and fines for breach of up to 7% of worldwide annual turnover. In addition, the revised EU Product Liability Directive came into force in December 2024, to be implemented into EU member state national law by December 2026. This Directive extends the EU’s existing strict product liability regime to AI Technologies and AI-enabled products, and facilitates civil claims in respect of harm caused by AI. Once fully applicable, the EU AI Act and the EU Product Liability Directive will have a material impact on the way AI is regulated in the EU. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI Technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

Current report

Furthermore, at the federal level, we are also subject to laws, regulations and standards covering financial institutions, marketing, advertising, cookies, tracking technologies, e-marketing, and other activities conducted by telephone, email, mobile devices and the internet, such as the Gramm-Leach-Bliley Act (“GLBA”), the Federal Wiretap Act, the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, and similar state consumer protection and communication privacy laws. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services. The GLBA includes both a “Privacy Rule,” which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule,” which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties.

Current report

In addition, the EU General Data Protection Regulation (the “EU GDPR”) and to the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the "GDPR") which impose stringent data protection requirements for processing the Personal Data of individuals. The GDPR places data protection obligations on processors and controllers of personal data, including, for example, disclosure and transparency requirements, limitations on retention and processing of personal data, and mandatory data breach notification requirements. In addition, the GDPR regulates transfers of Personal Data subject to the GDPR to third countries that have not been found to provide adequate protection to such Personal Data, and we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

Current report

Since we are under the supervision of relevant data protection authorities in both the EEA and the UK, we may be fined under both the EU GDPR and UK GDPR for the same breach. Penalties for certain breaches are up to the greater of EUR 20 million/ GBP 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities, enforcement notices, assessment notices for a compulsory audit and/or civil claims (including class actions).

Current report

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. In the EU and UK, informed consent is required for the placement of certain cookies or similar tracking technologies on an individual’s device and for direct electronic marketing. Consent is tightly defined and includes a prohibition on pre-checked consents and a requirement to obtain separate consents for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and similar tracking technologies.

Current report

As of December 31, 2024, we were not in compliance with all debt coven ants under the 2024 Amended Loan and Security Agreement, specifically the covenant restricting the amount of repurchases of common stock, which includes net share settlements of stock-based awards. On February 13, 2025, we entered into a third amendment to the 2024 Amended Loan and Security Agreement, which amended the covenant restricting the amount of repurchases of common stock, which includes net share settlements of stock-based awards, to allow for certain additional net share settlement activity and which provided a waiver from CIBC for our non-compliance with the previous version of such covenant as of December 31, 2024. We do not believe non-compliance with this covenant had any material impact on our operations.

Current report

Changes in government trade policies, including the imposition of tariffs, could materially adversely affect our results of operations.

Current report

We lease servers and other hardware in order to provide our services. These servers are highly custom, built to order servers, which from time to time need to be upgraded, repaired or replaced. Many of these servers contain parts that are manufactured in Taiwan, China, and other international regions. The Trump Administration has threatened to impose severe tariffs on imports from some or all of these regions. The imposition of such tariffs could materially increase the cost of maintenance for our servers or prevent us from being able to obtain parts all together. While our systems are designed to be redundant and fault tolerant, our inability to upgrade or repair them could result in our inability to continue to provide services to the expectations of our customers, which could lead to a loss of customers and materially adversely affect our results of operations.

Current report

Our tax obligations are varied and include U.S., federal, state and local taxes and international taxes due to the nature of our business. The tax laws that are applicable to our business are subject to interpretation and require significant judgment. We may recognize additional tax expense and be subject to additional tax liabilities due to changes in tax laws, regulations, and administrative practices and principles, including changes to the tax framework in the jurisdictions in which we operate.

Current report

We are subject to regular review and audit by U.S. federal, state, and foreign tax authorities. Tax authorities may disagree with certain positions we have taken, and any adverse outcome of such a review or audit could increase the amount of taxes imposed on our business, and harm our financial position, results of operations, and cash flows. In particular, we are currently under examination by the Internal Revenue Service ("IRS") for our 2021 and 2022 tax years. We are continuing to respond to inquiries related to these examinations. These examinations could result in challenges to various positions we have asserted in our tax filings and could impact our tax liability. The ultimate resolution of these examinations, and any other reviews, audits or litigation, may differ from the amounts recorded in our financial statements and may materially affect our financial results in the period or periods for which such determination is made.

Current report

In addition, economic and political pressures to increase tax revenue in various jurisdictions may make resolving tax disputes in our favor more difficult. While to date no material adjustments have been requested by tax authorities, including by the IRS related to its examination of the 2021 and 2022 tax years, an unfavorable outcome from any tax examination or audit could result in higher tax costs, penalties and interest, thereby adversely affecting our financial condition or results of operations. We regularly assess the likely outcomes of any audits and other tax disputes to determine the appropriateness of our tax provision and establish reserves for material, known tax exposures. However, the calculation of such tax exposures involves the application of complex tax laws and regulations in many jurisdictions. Therefore, there can be no assurance that we will accurately predict the outcomes of any tax examination, audit or other tax dispute or that issues raised by tax authorities will be resolved at a financial cost that does not exceed our related reserves.

Current report

We are subject to various risks associated with climate change and other environmental, social, and governance matters.

Current report

There is increased scrutiny from investors, customers, policymakers, and other stakeholders regarding companies’ management of climate change, human capital, and various other ESG matters. For example, there are inherent environmental risks wherever business is conducted, and climate change is expected to increase the frequency or severity of certain disasters or result in chronic changes that result in additional risks.

Current report

We engage in various initiatives to manage ESG matters and address related stakeholder expectations; however, such initiatives can be costly and may not have the desired effect. Methodologies and data for such initiatives are complex and continue to evolve. Moreover, stakeholder expectations are not uniform and, at times, conflict. Any failure to successfully navigate such expectations, including any regulatory requirements or interpretations, may result in reputational harm or other adverse impacts to our business.
Removed paragraphs (6)

Previous report

We experienced rapid growth in periods prior to the COVID-19 pandemic, and those growth rates may not be indicative of our future growth, and we may not be able to maintain profitability.

Previous report

A failure on our part to safeguard consumer data adequately or to destroy data securely or otherwise comply with legal obligations may subject us, depending on the personal data in question, to costs associated with notice and remediation, as well as potential regulatory investigations or enforcement actions, and possibly to civil liability, under federal, state, or foreign laws or regulation, industry standards, our internal privacy policies and procedures, or our contracts governing our processing of personal data claims by third parties, and damage to our reputation, any of which could have an adverse effect on our operations, financial performance and business. We could also incur significant costs investigating and defending such claims and, if we are found liable, significant damages.

Previous report

In addition, the EU General Data Protection Regulation ("GDPR") imposes stringent data protection requirements for processing the personal data of individuals within the European Economic Area ("EEA"). The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosure requirements, limitations on retention of personal data, mandatory data breach notification requirements and additional obligations. Non-compliance with the GDPR can trigger fines of up to the greater of €20 million or 4% of our global revenue. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the E.U. and the United States remains uncertain. For example, in 2016, the E.U. and United States agreed to a transfer framework for data transferred from the E.U. to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union ("CJEU"). The CJEU also raised questions about whether the European Commission’s Standard Contractual Clauses, one of the primary mechanisms used by companies to transfer personal data out of the EEA, complies with the GDPR. While the CJEU upheld the validity of the Standard Contractual Clauses, the CJEU ruled that the underlying data transfers must be assessed on a case-by-case basis by the data controller to determine whether the personal data will be adequately protected. At present, there are few if any viable alternatives to the Standard Contractual Clauses and, therefore, there is uncertainty regarding how to ensure that transfers of personal data from Europe to the United States comply with the GDPR. As such, any transfers by us of personal data from Europe may not comply with European data protection laws and may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions. Loss of our ability to transfer personal data from Europe may also require us to increase our data processing capabilities in those jurisdictions at significant expense.

Previous report

Further, following the United Kingdom’s withdrawal from the E.U. and the end of the related transition period, as of January 1, 2021, companies may be subject to both GDPR and the United Kingdom GDPR, or UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, imposing fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the E.U. in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure. Currently there is a four to six-month grace period agreed in the E.U. and United Kingdom Trade and Cooperation Agreement, ending June 30, 2021 at the latest, while the parties discuss an adequacy decision. The European Commission published a draft adequacy decision on February 19, 2021. If adopted, the decision will enable data transfers from E.U. member states to the United Kingdom for a four-year period, subject to subsequent extensions. While we have instituted a GDPR compliance strategy and program that we continue to evaluate and improve as our platform changes and expands, we still do not know how E.U. regulators will interpret or enforce many aspects of the GDPR, and some regulators may do so in an inconsistent manner, making such a prediction even more difficult.

Previous report

As of December 31, 2023, we were not in compliance with all of our debt covenants then in effect pursuant to the 2021 Amended Term Loan (as defined below). Specifically, we were not in compliance with the minimum fixed charge coverage ratio covenant, the covenant related to the requirement to maintain all deposit, operating and collateral accounts with CIBC with certain exceptions during the period, the covenant related to investments in non loan subsidiaries where investments cannot exceed twenty percent of our free cash flow as defined in the 2021 Amended Term Loan for the twelve month period then ended with certain exceptions, the covenant related to maintaining cash and other assets where the aggregate value of all subsidiaries cannot be in excess of ten percent of consolidated assets or individually by subsidiary in excess of five percent of consolidated assets, and the covenant related to subsidiary revenue where the aggregate value of all subsidiary revenue cannot be in excess of ten percent of consolidated revenue or individually by subsidiary in excess of five percent of consolidated revenue. We obtained a waiver from CIBC for our non-compliance with these covenants.

Previous report

•we will indemnify our directors and officers for serving us in those capacities or for serving other business enterprises at our request, to the fullest extent permitted by Delaware law. Delaware law provides that a corporation may indemnify such person if such person acted in good faith and in a manner such person reasonably believed to be in or not opposed to the best interests of the registrant and, with respect to any criminal proceeding, had no reasonable cause to believe such person’s conduct was unlawful;
Reworded paragraphs (44)

Previous wording

Although we experienced rapid growth in periods prior to the COVID-19 pandemic, our business was impacted by the COVID-19 pandemic, with declines in revenue and paid members due to government-imposed lock-downs, a decrease in business travel and other expense-generating activity, and SMBs downsizing or going out of business, among other things. While the number of paid members and revenue improved compared to the low point of the pandemic, our growth rate has not yet returned and may never return to pre-pandemic levels. Even if our revenue and paid members increase in the near term, we expect that our growth rate will decline as a result of a variety of factors, including the maturation of our business. Further, as we operate in a new and rapidly changing category of preaccounting software, widespread acceptance and use of our platform and features, particularly our expense management feature, is critical to our future growth and success. We believe our growth depends on a number of factors, including, but not limited to, our ability to:

Current wording

We operate in a relatively new and rapidly changing category of preaccounting software, and widespread acceptance and use of our platform and features, particularly our expense management feature, is critical to our future growth and success. We believe our growth depends on a number of factors, including, but not limited to, our ability to:

Previous wording

If we are unable to accomplish these tasks, our growth, including our revenue growth, would be harmed. Additionally, if future revenue growth does not offset any increases in our operating expenses, our business, results of operations, and financial condition will be harmed, and we may not be able to maintain profitability.

Current wording

If we are unable to accomplish these tasks, our growth, including our revenue growth, would be harmed.

Previous wording

We experienced rapid growth and increased demand for our platform prior to the COVID-19 pandemic. Our revenue grew from $53.9 million in 2018 to $80.5 million in 2019 to $88.1 million in 2020 to $142.8 million in 2021, but our headcount remained relatively consistent, with 131 employees as of December 31, 2018, 127 employees as of December 31, 2019, 133 employees as of December 31, 2020, and 144 employees as of December 31, 2021. From 2021 to 2022, our revenue grew to $169.5 million, but our headcount remained relatively consistent, with 144 employees as of December 31, 2021 and 138 employees as of December 31, 2022. In 2023, our revenue declined to $150.7 million, with 133 employees as of December 31, 2023. The growth and expansion of our business and platform may place a significant strain on our management and our administrative, operational and financial reporting resources. Our ability to accurately plan for and model future growth is limited and subject to a number of uncertainties, due in part to our global operations, customer preferences and mix of products and features. We have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If our assumptions regarding these risks and uncertainties, which we use to plan our business strategies and operations, are incorrect or change due to industry or market developments, or if we do not address these risks successfully, our operating results could differ materially from our expectations and our business could suffer. For example, we are required to manage multiple relationships with various strategic, integration and channel partners, customers and other third parties. In the event of further growth of our operations or in the number of our third-party relationships, our computer systems, procedures, or internal controls may not be adequate to support our operations, and our management may not be able to manage such growth effectively. To effectively manage our growth, we must continue to implement and improve our operational, financial and management information and reporting systems and manage our employee base. In addition, as we seek to continue to expand internationally, we will likely encounter unexpected challenges and expenses due to unfamiliarity with local regulations, requirements, practices and markets.

Current wording

Our ability to accurately plan for and model future growth is limited and subject to a number of risks and uncertainties, due in part to our global operations, customer preferences and mix of products and features. If our assumptions regarding these risks and uncertainties, which we use to plan our business strategies and operations, are incorrect or change due to industry or market developments, or if we do not address these risks successfully, our operating results could differ materially from our expectations and our business could suffer. Additionally, the growth and expansion of our business and platform may place a significant strain on our management and our administrative, operational and financial reporting resources. For example, we are required to manage multiple relationships with various strategic, integration and channel partners, customers and other third parties. In the event of further growth of our operations or in the number of our third-party relationships, our computer systems, procedures, or internal controls may not be adequate to support our operations, and our management may not be able to manage such growth effectively. To effectively manage growth, we must continue to implement and improve our operational, financial and management information and reporting systems and manage our employee base. If future revenue growth does not offset any increases in our operating expenses, our business, results of operations, and financial condition will be harmed, and we may not be able to maintain profitability. In addition, as we seek to continue to expand internationally, we will likely encounter unexpected challenges and expenses due to unfamiliarity with local regulations, requirements, practices and markets.

Previous wording

If we are unable to attract new customers on a cost-effective basis, convert individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, retain existing customers and expand usage within organizations, our revenue growth will be harmed.

Current wording

If we are unable to attract new customers on a cost-effective basis, convert individuals using our free basic expense management feature and organizations using our trial subscriptions into paying customers, retain existing customers and expand usage within organizations, our revenue growth will be harmed.

Previous wording

To increase our revenue, we must increase our customer base through various methods, including but not limited to, retaining existing customers, adding new customers, converting individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, and expanding usage within organizations. Our business is subscription-based, with monthly and annual subscriptions, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

Current wording

To increase our revenue, we must increase our customer base through various methods, including but not limited to, retaining existing customers, adding new customers, converting individuals using our free basic expense management feature and organizations using our trial subscriptions into paying customers, and expanding usage within organizations. Our business is subscription-based, with monthly and annual subscriptions, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

Previous wording

While we experienced significant growth in the number of our customers prior to the COVID-19 pandemic, our growth rate has not yet returned and may never return to pre-pandemic levels. Numerous factors may impede our ability to attract new customers, convert individuals and organizations using our free basic features and trial subscriptions into paying customers, expand usage within organizations, increase use of our other features such as the Expensify Card and gain new subscriptions, including but not limited to, failure to retain and motivate our personnel; failure to establish, maintain or expand relationships with channel and integration partners; failure to compete effectively against alternative products or services; our ability to determine optimal pricing for our subscriptions, including in international markets; failure to successfully deploy new features and integrations; failure to provide a quality customer experience and customer support; or failure to ensure the effectiveness of our bottom-up sales approach and other marketing programs. Channel partnerships are also an important aspect of our growth strategy, and we will need to maintain our partnerships with existing channel partners and identify and attract new channel partners in order to maintain the effectiveness of this strategy. Moreover, we believe that many of our new customers originate from word-of-mouth and other non-paid referrals from existing customers, so we must ensure that our existing customers remain loyal to our platform in order to continue receiving those referrals.

Current wording

Numerous factors may impede our ability to attract new customers, convert individuals and organizations using our free basic features and trial subscriptions into paying customers, expand usage within organizations, increase use of our other features such as the Expensify Card and gain new subscriptions, including but not limited to, failure to retain and motivate our personnel; failure to establish, maintain or expand relationships with channel and integration partners; failure to compete effectively against alternative products or services; our ability to determine optimal pricing for our subscriptions, including in international markets; failure to successfully deploy new features and integrations; failure to provide a quality customer experience and customer support; or failure to ensure the effectiveness of our bottom-up sales approach and other marketing programs. Channel partnerships are also an important aspect of our growth strategy, and we will need to maintain our partnerships with existing channel partners and identify and attract new channel partners in order to maintain the effectiveness of this strategy. Moreover, we believe that many of our new customers originate from word-of-mouth and other non-paid referrals from existing customers, so we must ensure that our existing customers remain loyal to our platform in order to continue receiving those referrals.

Previous wording

For example, we recently released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. This initial version has a subset of the features of our legacy app available as we continue development. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once completed. Although we see this direction as a natural next step in our long-term product vision, we have not developed an open-source financial group chat (or similar feature) before, and it may not meet customer needs, gain member traction or generate revenue sufficient to offset the costs of development, which could harm our business even if and when the feature complete version is released.

Current wording

For example, in 2021 we released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. The current version has a subset of the features of our legacy app available as we continue development. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once completed. Although we see this direction as a natural next step in our long-term product vision, we have not developed an open-source financial group chat (or similar feature) before, and it may not meet customer needs, gain member traction or generate revenue sufficient to offset the costs of development, which could harm our business even if and when the feature complete version is released.

Previous wording

Payments and other financial services-related laws and regulations and government oversight are material to our business. Our failure to comply with such laws and regulations could materially harm our business and can subject us to criminal and civil liability.

Current wording

Payments and other financial services-related laws and regulations and government oversight are material to our business. The actions of various policymakers across government levels may create a complexity of multiple, conflicting and changing governmental laws and regulations. Our failure to comply with such laws and regulations could materially harm our business and can subject us to criminal and civil liability.

Previous wording

The local, state, and federal laws, rules, regulations, licensing and other authorization schemes, and industry standards that govern our business, including our payment services, include, or may in the future include, those relating to banking, invoicing, cross-border and domestic money transmission, foreign exchange, payments services (such as payment processing and settlement services), anti-money laundering, combating terrorist financing, escheatment, U.S. and international sanctions regimes, and compliance with the Payment Card Industry Data Security Standard ("PCI-DSS"), a set of requirements designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect cardholder data. These laws, rules, regulations, licensing and other authorization schemes, and industry standards are administered and enforced by multiple authorities and governing bodies in the United States, including but not limited to the U.S. Department of the Treasury, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, Office of Foreign Assets Control, self-regulatory organizations, and numerous state and local governmental and regulatory authorities. Any failure or perceived failure to comply with existing or new laws and regulations, or orders of any governmental authority, including changes to or expansion of their interpretations, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, and increased regulatory scrutiny of our business. In addition, we may be forced to restrict or change our operations or business practices, make product changes, or delay planned product launches or improvements. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.

Current wording

These laws, rules, regulations, licensing and other authorization schemes, and industry standards are administered and enforced by multiple authorities and governing bodies in the United States, including but not limited to the U.S. Department of the Treasury, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, Office of Foreign Assets Control, self-regulatory organizations, and numerous state and local governmental and regulatory authorities. These various authorities and governing bodies may enact conflicting laws or regulations that are complex and may change frequently. Responding to such conflicting, complex or changing rules and regulations entails inherent costs, and any actual or perceived failure to comply with existing or new laws and regulations, or orders of any governmental authority, including changes to or expansion of their interpretations, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, and increased regulatory scrutiny of our business. In addition, we may be forced to restrict or change our operations or business practices, make product changes, or delay planned product launches or improvements. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.

Previous wording

Expensify Payments LLC (“Expensify Payments”) is a licensed money transmitter (or its equivalent) in various U.S. states and territories and is in the process of obtaining money transmission licenses in a number of additional states and territories. As a licensed money transmitter, Expensify Payments, its ultimate beneficial owners, and its control persons are subject to a range of restrictions and ongoing compliance obligations under the money transmitter statutes (or their equivalent) administered by the banking departments (or their equivalent) of the various U.S. states and territories where it is licensed, including requirements with respect to the investment of customer funds, financial recordkeeping and reporting, reconciliation of customer funds, bonding, minimum capital, minimum net worth, disclosure, and inspection by regulatory authorities concerning various aspects of its business. In a number of cases, evaluation of our compliance efforts, as well as questions of whether and to what extent our activities in connection with the provision of certain products and services (both current and historical) are considered money transmission, are matters of regulatory interpretation and could change over time. In the past, regulators have identified violations or alleged violations of certain statutory and regulatory requirements, and we have been subject to fines and other penalties by state regulatory authorities due to their interpretation and application of their respective state money transmitter regime to our activities. In the future, as a result of the laws and regulations applicable to us and our business, we could be subject to investigations, inspections, examinations, and supervision, and resulting liability, including governmental fines, restrictions on our business, or other similar enforcement actions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses, regulatory approvals, or other similar authorizations. We cannot make any assurances that we will be able to obtain or maintain any such licenses, regulatory approvals, and other similar authorizations, and there could be substantial costs and potential product changes involved in obtaining and maintaining any such licenses, approvals, or other similar authorizations, which could have a material adverse effect on our business. In addition, there are substantial costs and potential product changes involved in maintaining and renewing any licenses, regulatory approvals, and other similar authorizations, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, net worth, corporate governance, or other requirements applicable to us, including those required in connection with maintaining such licenses, approvals, or …

Excerpt shortened here; the source contains the full paragraph.

Current wording

Expensify Payments LLC (“Expensify Payments”) is a licensed money transmitter (or its equivalent) in various U.S. states and territories and is in the process of obtaining money transmission licenses in a number of additional states and territories. As a licensed money transmitter, Expensify Payments, its ultimate beneficial owners, and its control persons are subject to a range of restrictions and ongoing compliance obligations under the money transmitter statutes (or their equivalent) administered by the banking departments (or their equivalent) of the various U.S. states and territories where it is licensed, including requirements with respect to the investment of customer funds, financial recordkeeping and reporting, reconciliation of customer funds, bonding, minimum capital, minimum net worth, disclosure, and inspection by regulatory authorities concerning various aspects of its business. In a number of cases, evaluation of our compliance efforts, as well as questions of whether and to what extent our activities in connection with the provision of certain products and services (both current and historical) are considered money transmission, are matters of regulatory interpretation and could change over time. In the past, regulators have identified violations or alleged violations by us of certain statutory and regulatory requirements, and we have been subject to fines and other penalties by state regulatory authorities due to their interpretation and application of their respective state money transmitter regime to our activities. As a result of the laws and regulations applicable to us and our business, we are and could in the future be subject to investigations, inspections, examinations, and supervision, and resulting liability, including governmental fines, restrictions on our business, or other similar enforcement actions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses, regulatory approvals, or other similar authorizations. We cannot make any assurances that we will be able to obtain or maintain any such licenses, regulatory approvals, and other similar authorizations, and there could be substantial costs and potential product changes involved in obtaining and maintaining any such licenses, approvals, or other similar authorizations, which could have a material adverse effect on our business. In addition, there are substantial costs and potential product changes involved in maintaining and renewing any licenses, regulatory approvals, and other similar authorizations, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, net worth, corporate governance, or other requirements applicable to us, including those required in connection with maintaining such licenses, a…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

On May 10, 2022, the Executive Committee authorized a share repurchase program to repurchase up to $50 million of our outstanding Class A common stock. Although the Executive Committee has authorized this repurchase program, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares. The actual timing, manner, price and total amount of future repurchases will depend on a variety of factors, including business, economic and market conditions, corporate and regulatory requirements, prevailing stock prices, restrictions under the terms of loan agreements and other considerations. The share repurchase program may be modified, suspended, or terminated at any time, and we cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, this program could diminish our cash and cash equivalents and marketable securities.

Current wording

On February 25, 2025, the Executive Committee authorized a share repurchase program to repurchase up to $50 million of our outstanding Class A common stock, which replaces the Company's share repurchase program that was approved in 2022. Although the Executive Committee has authorized this repurchase program, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares. The actual timing, manner, price and total amount of future repurchases will depend on a variety of factors, including business, economic and market conditions, corporate and regulatory requirements, prevailing stock prices, restrictions under the terms of loan agreements and other considerations. The share repurchase program may be modified, suspended, or terminated at any time, and we cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, this program could diminish our cash and cash equivalents and marketable securities.

Previous wording

The Expensify Card is an important element of our growth strategy, and we believe that, over time, the Expensify Card will be a prominent corporate card solution for SMBs in our core markets. For our Legacy Card Program, launched in 2020, we rely on a single third-party vendor, Marqeta, for the Expensify Card, who also manages the relationship with the card's issuing bank, Sutton Bank, and the card network, Visa. In the annual periods ended December 31, 2023, 2022 and 2021, consideration from this vendor representing monetized Expensify Card activities reduced our cost of revenue by $10.1 million, $6.2 million, and $2.9 million, respectively. Our agreement with Marqeta initially had a three year term that was renewed in June 2022 and now automatically renews annually thereafter unless either party provides 90 days’ notice prior to renewal.

Current wording

The Expensify Card is an important element of our growth strategy, and we believe that, over time, the Expensify Card will be a prominent corporate card solution for SMBs in our core markets. For our Legacy Card Program, launched in 2020, we rely on a single third-party vendor, Marqeta, for the Expensify Card, who also manages the relationship with the card's issuing bank, Sutton Bank, and the card network, Visa. In the annual periods ended December 31, 2024, 2023 and 2022, consideration from this vendor representing monetized Expensify Card activities reduced our cost of revenue by $7.2 million, $10.1 million, and $6.2 million, respectively. Our agreement with Marqeta initially had a three year term that was renewed in June 2022 and now automatically renews annually thereafter unless either party provides 90 days’ notice prior to renewal.

Previous wording

Under our Updated Card Program, which had not yet launched to customers as of December 31, 2023 and thus has not yet resulted in any revenue, we rely on Marqeta as the payment processor, Bancorp as the card’s issuing bank, and Visa as the card network. Under the Updated Card Program, our agreement with Marqeta has an initial term of approximately four years, and will automatically renew annually thereafter. Our agreement with Bancorp has an initial five year term, and will automatically renew annually thereafter.

Current wording

Under our Updated Card Program, which launched in February 2024, we rely on Marqeta as the payment processor, Bancorp as the card’s issuing bank, and Visa as the card network. In the annual period ended December 31, 2024, interchange revenue earned under the Updated Card Program was $9.2 million. Under the Updated Card Program, our agreement with Marqeta has an initial term of approximately four years, and will automatically renew annually thereafter. Our agreement with Bancorp has an initial five year term, and will automatically renew annually thereafter.

Previous wording

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems, but also rely on third parties for a range of IT Systems and related products and services. We and certain of our third-party providers collect, maintain, and process data our customers provide us, some of which is confidential information about them or their financial transactions. We also process personal information about our employees, vendors, and business partners, and those who purchase products or services from our customers – as well as proprietary information belonging to the business such as trade secrets (collectively, “Confidential Information”).

Current wording

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems, but also rely on third parties for a range of IT Systems and related products and services. We and certain of our third-party providers also collect, maintain, and process data about our customers, including personal information and information about their financial transactions. We also process personal information about our employees, vendors, and business partners, and those who purchase products or services from our customers – as well as proprietary information such as trade secrets (collectively, “Confidential Information”).

Previous wording

We believe that the brand identity that we have developed has significantly contributed to the success of our business. We also believe that maintaining and enhancing the “Expensify” brand is critical to expanding our customer base and establishing and maintaining relationships with partners. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts, our ability to ensure that our platform remains high-quality, reliable, useful and competitively priced, the quality and perceived value of our platform, our ability to successfully differentiate our platform and features from those of our competitors and the ability of our customers to achieve successful results by using our platform and features. Maintaining and enhancing our brand may require us to make substantial investments not just in our core expense management service but also in newer features, such as our financial chat services, and to make substantial investments in foreign markets, and these investments may not be successful. We also plan to enhance our brand and drive interest in our overall platform by introducing certain consumer-focused features, which may not be successful. Substantial advertising expenditures may be required to maintain and enhance our brand, which may not prove successful. Advertising and other brand promotion activities may not generate customer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand. For example, in 2023 we opened the Expensify Lounge in San Francisco, CA as a brand awareness campaign that ultimately did not yield the expected results and was shut down in late 2023. As another example, in 2023 we hosted our third ExpensiCon, an invite-only, all-expenses paid industry conference set in an exotic location that includes a full itinerary of events and excursions. The goal of this ExpensiCon was to increase our market consensus among our Approved! Accounting partners and increase adoption of our platform. We have spent significant resources on this initiative, and there can be no assurance that we will be successful in achieving those goals or that the nature of the event will not expose us to additional risks. Additionally, there could be a negative reaction to certain advertising campaigns and values-based activity and communications. If we fail to promote and maintain the “Expensify” brand, or if we incur excessive expenses in this effort, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts or to achieve the widespread brand awareness that is critical for broad customer adoption of our platform and features. We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become more difficult and expensive.

Current wording

We believe that the brand identity that we have developed has significantly contributed to the success of our business. We also believe that maintaining and enhancing the “Expensify” brand is critical to expanding our customer base and establishing and maintaining relationships with partners. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts, our ability to ensure that our platform remains high-quality, reliable, useful and competitively priced, the quality and perceived value of our platform, our ability to successfully differentiate our platform and features from those of our competitors and the ability of our customers to achieve successful results by using our platform and features. Maintaining and enhancing our brand may require us to make substantial investments not just in our core expense management service but also in newer features, such as our financial chat services, and to make substantial investments in foreign markets, and these investments may not be successful. We also plan to enhance our brand and drive interest in our overall platform by introducing certain consumer-focused features, which may not be successful. Substantial advertising expenditures may be required to maintain and enhance our brand, which may not prove successful. Advertising and other brand promotion activities may not generate customer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand. For example, in 2023 we opened the Expensify Lounge in San Francisco, CA as a brand awareness campaign, but it ultimately did not yield the expected results and was shut down in late 2023. Further, in 2023 we hosted our third ExpensiCon, an invite-only, all-expenses paid industry conference set in an exotic location that included a full itinerary of events and excursions. We spent significant resources on ExpensiCon and achieved mixed results. There can be no assurance that similar initiatives will achieve desired results. Additionally, there could be a negative reaction to certain advertising campaigns and values-based activity and communications. If we fail to promote and maintain the “Expensify” brand, or if we incur excessive expenses in this effort, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts or to achieve the widespread brand awareness that is critical for broad customer adoption of our platform and features. We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become more difficult and expensive.

Previous wording

To improve the scalability, security, efficiency and failover aspects of our features, and to support our ongoing efforts to expand and enhance our platform and our business, we are continually updating our software and content and investing in the development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. Additionally, we will need to continue to make substantial investments and expenditures to, among other things:

Current wording

To improve the scalability, security, efficiency and failover aspects of our features, and to support our ongoing efforts to expand and enhance our platform and our business, we are continually updating our software and content and investing in the development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. Additionally, we have and will need to continue to make substantial investments and expenditures to, among other things:

Previous wording

•expand our operations across multiple geographies;

Current wording

•expand our operations across multiple geographies; and

Previous wording

We may also review or revise our software architecture as we grow, which may require significant resources and investments. For example, we recently released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once it is completed. There can be no assurance that this direction will achieve customer acceptance or that we will realize the anticipated return on our investment even if and when the feature complete version is released.

Current wording

We may also review or revise our software architecture as we grow, which may require significant resources and investments. For example, in 2021 we released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once it is completed. There can be no assurance that this direction will achieve customer acceptance or that we will realize the anticipated return on our investment even if and when the feature complete version is released.

Previous wording

In addition, as we continue to grow our operations and reach a larger and increasingly global customer and member base, we need to be able to provide efficient customer support that meets the needs of organizations using our platform and features globally at scale. The number of organizations using our platform and features has grown significantly, which puts additional pressure on our support organization. Our platform is designed to leverage our proprietary AI-powered customer support engine, Concierge. Our Concierge service is powered by AI and trained by customer support agents. As we continue to grow and add features, we will need to hire additional support personnel to be able to continue to provide efficient customer support globally at scale, and if we are unable to provide such support, our business, results of operations and financial condition would be harmed.

Current wording

In addition, as we continue to grow our operations and reach a larger and increasingly global customer and member base, we need to be able to provide efficient customer support that meets the needs of organizations using our platform and features globally at scale. Our platform is designed to leverage our proprietary AI-powered customer support engine, Concierge. Our Concierge service is powered by AI and trained by customer support agents. As we continue to grow and add features, we will need to hire additional support personnel to be able to continue to provide efficient customer support globally at scale, and if we are unable to provide such support, our business, results of operations and financial condition would be harmed.

Previous wording

In addition, one of our business strategies is to supplement our small core team of generalists with a large number of specialist contractors, managed by third-party vendors, from around the world. For example, we rely on certain third-party vendors to provide a specialized on-demand workforce to provide 24/7 real-time chat support and free phone onboarding for every Expensify member. We also intend to use this strategy to pair our core group of engineering generalists with a global network of open source engineering specialists, such as for the development and maintenance of our open-source financial group chat. If we are unable attract a sufficient number of specialized on-demand workers, or if changes to applicable foreign, state and local laws governing the definition or classification of independent contractors make it difficult or impossible for us to hire a sufficient number of specialized on-demand workers in a cost-effective manner, our costs could increase and our business, results of operations and financial condition could be harmed.

Current wording

In addition, one of our business strategies is to supplement our small core team of generalists with a large number of specialist contractors, managed by third-party vendors, from around the world. For example, we rely on certain third-party vendors to provide a specialized on-demand workforce to provide 24/7 real-time chat support and free phone onboarding for every Expensify member. We have used and will continue to use this strategy to pair our core group of engineering generalists with a global network of open source engineering specialists, such as for the development and maintenance of our open-source financial group chat. If we are unable attract a sufficient number of specialized on-demand workers, or if changes to applicable foreign, state and local laws governing the definition or classification of independent contractors make it difficult or impossible for us to hire a sufficient number of specialized on-demand workers in a cost-effective manner, our costs could increase and our business, results of operations and financial condition could be harmed.

Previous wording

We believe that a critical component of our success has been our culture, which is deeply embedded in everything we do. Our culture is centered on a belief that a life well lived is one that enables you to achieve the following three goals: Live Rich, Have Fun and Save the World. We have invested substantial time and resources in building our team with an emphasis on collaboration and innovation, ensuring customer success and a commitment to diversity and inclusion. We invest in our culture to create fun, diverse and memorable experiences for our employees, including employee travel to company-wide meetings in the U.S. and abroad. As we continue to grow and develop the infrastructure associated with being a public company, we will need to maintain our culture among a larger number of employees dispersed in various geographic regions. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel.

Current wording

We believe that a critical component of our success has been our culture, which is deeply embedded in everything we do. Our culture is centered on a belief that a life well lived is one that enables you to achieve the following three goals: Live Rich, Have Fun and Save the World. We have invested substantial time and resources in building our team with an emphasis on collaboration and innovation, ensuring customer success and a commitment to diversity and inclusion. We invest in our culture to create fun, diverse and memorable experiences for our employees, including certain employee travel to company-wide meetings in the U.S. and abroad. As we continue to grow and develop the infrastructure associated with being a public company, we will need to maintain our culture among a larger number of employees dispersed in various geographic regions. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel.

Previous wording

Our revenue generated from customers outside the United States was $13.3 million (9% of our revenue), $14.7 million (9% of our revenue), and $15.2 million (11% of our revenue) for the annual periods ended December 31, 2023, 2022 and 2021, respectively. Our core geographies are the United States, the United Kingdom, Canada and Australia. We intend to pursue expansion of our international operations. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that are different from those in the United States. In addition, we face risks in doing business internationally that could adversely affect our business and results of operations, including:

Current wording

Our revenue generated from customers outside the United States was $12.4 million (9% of our revenue), $13.3 million (9% of our revenue), and $14.7 million (9% of our revenue) for the annual periods ended December 31, 2024, 2023 and 2022, respectively. Our core geographies are the United States, the United Kingdom, Canada and Australia. In the future, we may pursue expansion of our international operations. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that are different from those in the United States. In addition, we face risks in doing business internationally that could adversely affect our business and results of operations, including:

Previous wording

As we seek to expand our business globally, our overall performance will depend in part on worldwide economic and geopolitical conditions. Economies domestically and internationally have been affected from time to time by falling demand for a variety of goods and services, restricted credit, poor liquidity, reduced corporate profitability, employment pressures in services sectors, volatility in credit, equity and foreign exchange markets, bankruptcies and health crises, including COVID-19, as well as war, terrorist activity, political unrest, civil strife and other geopolitical uncertainty, and the resulting impact on business continuity and travel, supply chain disruptions, inflation, security issues, and overall uncertainty with respect to the economy, including with respect to tariff and trade issues.

Current wording

As we seek to expand our business globally, our overall performance will depend in part on worldwide economic and geopolitical conditions. Economies domestically and internationally have been affected from time to time by falling demand for a variety of goods and services, restricted credit, poor liquidity, reduced corporate profitability, employment pressures in services sectors, volatility in credit, equity and foreign exchange markets, bankruptcies and health crises, as well as war, terrorist activity, political unrest, civil strife and other geopolitical uncertainty, and the resulting impact on business continuity and travel, supply chain disruptions, inflation, security issues, and overall uncertainty with respect to the economy, including with respect to tariff and trade issues. See the risk factor titled, “—Changes in government trade policies, including the imposition of tariffs, could materially adversely affect our results of operations” for more information.

Previous wording

For example, the invasion of Ukraine by Russian military forces in February 2022 and Hamas's attack on Israel in October 2023 has resulted in sustained conflict and disruption in those regions and the surrounding areas. The length, impact and outcome of these conflicts are highly unpredictable; however, they could lead to significant market and other disruptions, some of which have already been experienced, including significant volatility in commodity prices and supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability and changes in consumer or purchaser preferences, as well as an increase in cyberattacks and espionage. Additionally, sanctions or other measures implemented by other countries, as well as potential responses from other countries, could adversely affect the global economy and financial markets, which could in turn have a material adverse effect on our business, financial condition and results of operations. In addition, political instability or adverse political developments and new or continued economic deterioration in any of the countries in which we operate could harm our business, results of operations and financial condition.

Current wording

For example, the invasion of Ukraine by Russian military forces in February 2022 and Hamas's attack on Israel in October 2023 has resulted in sustained conflict and disruption in those regions and the surrounding areas. The length, impact and outcome of these conflicts are highly unpredictable; however, they caused and could continue to cause significant market and other disruptions, some of which have already been experienced, including significant volatility in commodity prices and supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability and changes in consumer or purchaser preferences, as well as an increase in cyberattacks and espionage. Additionally, sanctions or other measures implemented by other countries, as well as potential responses from other countries, could adversely affect the global economy and financial markets, which could in turn have a material adverse effect on our business, financial condition and results of operations. In addition, political instability or adverse political developments and new or continued economic deterioration in any of the countries in which we operate could harm our business, results of operations and financial condition.

Previous wording

For example, in the United States, the data protection landscape is also rapidly growing and evolving on both the state and federal level. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For example, a number of state-level general data privacy laws have or will soon go into effect that introduce new data privacy rights for consumers and new operational requirements for companies. For instance, the California Consumer Privacy Act (“CCPA”), provides data privacy rights for California residents and operational requirements for covered businesses. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents certain privacy rights relating to their personal data. The CCPA also considers certain financial information to be “sensitive personal information” imposing additional requirements on businesses, such as public disclosures about how such data is being used and disclosed by the business. The CCPA also provides for civil penalties for violations, as well as a private right of action for certain data breaches that increases the potential exposure in relation to data breaches. We cannot fully predict the impact of these laws, or subsequent guidance, regulations or rules on our business or operations, including those that are still in draft form, but they may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Further, if we become subject to other state-level privacy laws, guidelines or regulations, we may be required again to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

Current wording

For example, in the United States, the data protection landscape is rapidly growing and evolving on both the state and federal level. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For example, over a third of U.S. states have passed their own comprehensive consumer privacy laws that have or will soon go into effect that introduce new data privacy rights for consumers and new operational requirements for companies. For instance, the California Consumer Privacy Act (“CCPA”) provides data privacy rights for California residents and operational requirements for covered businesses. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents certain privacy rights relating to their Personal Data. The CCPA also considers certain financial information to be “sensitive personal information” imposing additional requirements on businesses. The CCPA is enforceable by the California Attorney General and the California Privacy Protection Agency, a new, additional enforcement bureau. The California Privacy Protection Agency is continuously amending the CCPA regulations, building upon the requirements in the CCPA, including with respect to automated decision making, risk assessment, and cybersecurity audits. In the event of an actual or perceived violation of the CCPA, these regulators could seek severe statutory damages, injunctive relief or agreed settlements providing for ongoing audit and reporting requirements. There is also a private right of action relating to certain data security incidents. Additionally, laws in all fifty U.S. states require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. We cannot fully predict the impact of these laws, or subsequent guidance, regulations or rules on our business or operations, but they may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use Personal Data, our financial condition, and the results of our operations or prospects. Further, if we become subject to new state-level privacy laws, guidelines or regulations in the future, we may be required again to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

Previous wording

Furthermore, at the federal level, we are also subject to laws, regulations and standards covering marketing, advertising, cookies, tracking technologies, e-marketing, and other activities conducted by telephone, email, mobile devices and the internet, such as the Federal Wiretap Act, the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, and similar state consumer protection and communication privacy laws. Additionally, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal data secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. There are a number of legislative proposals in the United States, at both the federal and state level, and in the E.U. and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations and standards may have on our business.

Current wording

Additionally, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ Personal Data secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. There are a number of legislative proposals in the United States, at both the federal and state level, and in the EU and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations and standards may have on our business.

Previous wording

We receive, process, store and use business and personal data relating to our employees, members and customers around the world, including the United States and the European Economic Area (“EEA”). As a result, our business is therefore subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, sharing and protection of personal data. For instance, laws in all fifty U.S. states and outside the United States (and sometimes contractual and/or other obligations) and certain international laws and regulations require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. We seek to comply with applicable laws, regulations, policies, legal obligations and industry standards and have developed privacy policies, data processing addenda and internal privacy procedures to reflect our practices designed to achieve such compliance. However, such laws, regulations, regulatory codes and guidelines regulations are complex, may be inconsistent across jurisdictions or conflict with other rules and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent and therefore, there can be no assurance that our policies and process will be fully implemented, complied with, or effective. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business. Further, any significant change in applicable laws, regulations, or industry practices regarding the use or disclosure of our members’ or customers’ data, or regarding the manner in which the express or implied consent of members or customers for the use and disclosure of such data is obtained, could require us to modify our platform, possibly in a material manner, and may limit our ability to develop new services and features that make use of the data that our members and customers voluntarily share.

Current wording

We seek to comply with applicable laws, regulations, policies, legal obligations and industry standards and have developed privacy policies, data processing addenda and internal privacy procedures to reflect our practices designed to achieve such compliance. However, such laws, regulations, regulatory codes and guidelines regulations are complex, may be inconsistent across jurisdictions or conflict with other rules and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent and therefore, there can be no assurance that our policies and process will be fully implemented, complied with, or effective. For instance, laws in all fifty U.S. states and outside the United States (and sometimes contractual and/or other obligations) and certain international laws and regulations require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business. Further, any significant change in applicable laws, regulations, or industry practices regarding the use or disclosure of our Personal Data, could require us to modify our platform, possibly in a material manner, and may limit our ability to develop new services and features that make use of Personal Data regarding our members and customers.

Previous wording

In addition to the E.U., a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR. Others, such as those in Russia, India and China, could potentially impose more stringent obligations, including data localization requirements. If we are unable to develop and offer features that meet legal requirements or help our members and customers meet their obligations under the laws or regulations relating to privacy, data protection, or information security, or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience reduced demand for our platform, harm to our reputation and become subject to investigations, claims and other remedies, which would expose us to significant fines, penalties and other damages, all of which would harm our business. Further, given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.

Current wording

If we are unable to develop and offer features that meet legal requirements or help our members and customers meet their obligations under the laws or regulations relating to privacy, data protection, or information security, or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience reduced demand for our platform, harm to our reputation and become subject to investigations, claims and other remedies, which would expose us to significant fines, penalties and other damages, all of which would harm our business. Further, given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.

Previous wording

Internet activity, security, reliability, cost, ease of use, accessibility and quality of service. The performance of the Internet has been adversely affected by “viruses,” “worms” and similar malicious programs and the Internet has experienced a variety of outages and other delays as a result of damage to portions of its infrastructure. If the use of the Internet is adversely affected by these issues, demand for our applications could suffer.

Current wording

In addition, the use of the Internet as a means of conducting business could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of Internet activity, security, reliability, cost, ease of use, accessibility and quality of service. The performance of the Internet has been adversely affected by “viruses,” “worms” and similar malicious programs and the Internet has experienced a variety of outages and other delays as a result of damage to portions of its infrastructure. If the use of the Internet is adversely affected by these issues, demand for our applications could suffer.

Previous wording

The number and significance of our legal disputes and inquiries have increased as we have grown larger, as our business has expanded in scope and geographic reach, and as our features and services have increased in complexity, and we expect the potential for future legal proceedings, claims and disputes will continue to increase. Becoming a public company has raised our public profile, which may result in increased litigation.

Current wording

The number and significance of our legal disputes and inquiries have increased as we have grown larger, as our business has expanded in scope and geographic reach, and as our features and services have increased in complexity, and we expect the potential for future legal proceedings, claims and disputes will continue to increase.

Previous wording

In the future, we may raise additional capital through additional debt or equity financings to support our business growth, to respond to business opportunities, challenges, or unforeseen circumstances, or for other reasons. On an ongoing basis, we are evaluating sources of financing and may raise additional capital in the future. Our ability to obtain additional capital will depend on our development efforts, business plans, investor demand, operating performance, the condition of the capital markets, and other factors. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity or equity-linked securities, those securities may have rights, preferences, or privileges senior to the rights of existing stockholders, and existing stockholders may experience dilution. Debt financing, if available, may involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which could reduce our operational flexibility or make it more difficult for us to obtain additional capital and to pursue business opportunities. In addition, subject to limited exceptions, our loan and security agreement with Canadian Imperial Bank of Commerce ("CIBC”) restricts us from incurring indebtedness without the prior written consent of the lender. Further, if we are unable to obtain additional capital when required, or are unable to obtain additional capital on satisfactory terms, our ability to continue to support our business growth or to respond to business opportunities, challenges, or unforeseen circumstances would be adversely affected.

Current wording

In the future, we may raise additional capital through additional debt or equity financings to support our business growth, to respond to business opportunities, challenges, or unforeseen circumstances, or for other reasons. On an ongoing basis, we evaluate sources of financing and may raise additional capital in the future. Our ability to obtain additional capital will depend on our development efforts, business plans, investor demand, operating performance, the condition of the capital markets, and other factors. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity or equity-linked securities, those securities may have rights, preferences, or privileges senior to the rights of existing stockholders, and existing stockholders may experience dilution. Debt financing, if available, may involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which could reduce our operational flexibility or make it more difficult for us to obtain additional capital and to pursue business opportunities. In addition, subject to limited exceptions, our loan and security agreement with Canadian Imperial Bank of Commerce ("CIBC"), as amended and restated on February 21, 2024 and as amended on February 13, 2025, and as may be further amended from time to time, ("2024 Amended Loan and Security Agreement"), restricts us from incurring indebtedness without the prior written consent of the lender. Further, if we are unable to obtain additional capital when required, or are unable to obtain additional capital on satisfactory terms, our ability to continue to support our business growth or to respond to business opportunities, challenges, or unforeseen circumstances would be adversely affected.

Previous wording

Our operating activities may be restricted as a result of covenants related to the indebtedness under our existing loan and security agreement and/or future indebtedness, and we may be required to repay the outstanding indebtedness in an event of default, which would have an adverse effect on our business.

Current wording

Our operating activities may be restricted as a result of covenants related to the indebtedness under our 2024 Amended Loan and Security Agreement and/or future indebtedness, and we may be required to repay the outstanding indebtedness in an event of default, which would have an adverse effect on our business.

Previous wording

Our loan and security agreement with CIBC, as amended and restated on February 21, 2024, consists of a $25.0 million revolving line of credit, which matures in September 2025. The loan and security agreement subjects us, and any future indebtedness would likely subject us, to various customary covenants, including requirements as to financial reporting, insurance and certain liquidity and leverage thresholds and restrictions on our ability to maintain cash deposits outside of CIBC above certain thresholds, dispose of our business or property, to change our line of business, to liquidate or dissolve, to enter into any change in control transaction, to merge or consolidate with any other entity or to acquire all or substantially all the capital stock or property of another entity, to incur additional indebtedness, to incur liens on our property, to pay any dividends or other distributions on capital stock other than dividends payable solely in capital stock, to redeem capital stock, to engage in transactions with affiliates, to encumber our intellectual property and certain other restrictions on our activities. Our business may be adversely affected by these restrictions on our ability to operate our business.

Current wording

Our 2024 Amended Loan and Security Agreement consists of a $25.0 million revolving line of credit, which matures in September 2025, and subjects us, and any future indebtedness would likely subject us, to various customary covenants, including requirements as to financial reporting, insurance and certain liquidity and leverage thresholds and restrictions on our ability to maintain cash deposits outside of CIBC above certain thresholds, dispose of our business or property, to change our line of business, to liquidate or dissolve, to enter into any change in control transaction, to merge or consolidate with any other entity or to acquire all or substantially all the capital stock or property of another entity, to incur additional indebtedness, to incur liens on our property, to pay any dividends or other distributions on capital stock other than dividends payable solely in capital stock, to redeem capital stock, to engage in transactions with affiliates, to encumber our intellectual property and certain other restrictions on our activities. Our business may be adversely affected by these restrictions on our ability to operate our business.

Previous wording

Additionally, our ability to meet our debt obligations and other expenses will depend on our future performance, which will be affected by financial, business, economic, regulatory and other factors, many of which we are unable to control. We may be required to repay the outstanding indebtedness under the loan facility if an event of default occurs under the loan and security agreement. Under the loan and security agreement and a credit agreement with CIBC that provides for a $8.3 million amortizing term mortgage, an event of default will occur if, among other things, we fail to make payments under such agreements; we breach certain of our covenants under such agreements, subject to specified cure periods with respect to certain breaches; we or our assets become subject to certain legal proceedings, such as bankruptcy proceedings; we are unable to pay our debts as they become due; or we default on contracts with third parties which would permit CIBC to accelerate the maturity of such indebtedness or that could have a material adverse change on us. We may not have enough available cash or be able to raise additional funds through equity or debt financings to repay such indebtedness at the time any such event of default occurs. CIBC could also exercise its rights as collateral agent to take possession of, and to dispose of, the collateral securing the loans, which collateral includes substantially all of our personal property (including intellectual property). Our business, financial condition and results of operations could be materially adversely affected as a result of any of these events. We may seek to enter into an extension of the loan and security agreement or enter into a new facility with another lender. We may not be able to extend the term or obtain other debt financing on terms that are favorable to us, if at all, and we could be subject to additional restrictions on our business operations. If we are unable to obtain adequate financing or financing on satisfactory terms when required, our ability to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

Current wording

Additionally, our ability to meet our debt obligations and other expenses will depend on our future performance, which will be affected by financial, business, economic, regulatory and other factors, many of which we are unable to control. We may be required to repay any outstanding indebtedness if an event of default occurs under the 2024 Amended Loan and Security Agreement. Under the 2024 Amended Loan and Security Agreement, an event of default will occur if, among other things, we fail to make payments under such agreement; we breach certain of our covenants under such agreement, subject to specified cure periods with respect to certain breaches; we or our assets become subject to certain legal proceedings, such as bankruptcy proceedings; we are unable to pay our debts as they become due; or we default on contracts with third parties which would permit CIBC to accelerate the maturity of such indebtedness or that could have a material adverse change on us. We may not have enough available cash or be able to raise additional funds through equity or debt financings to repay such indebtedness at the time any such event of default occurs. CIBC could also exercise its rights as collateral agent to take possession of, and to dispose of, the collateral securing the loan, which collateral includes substantially all of our personal property (including intellectual property). Our business, financial condition and results of operations could be materially adversely affected as a result of any of these events. We may seek to enter into an extension of the 2024 Amended Loan and Security Agreement or enter into a new facility with another lender. We may not be able to extend the term or obtain other debt financing on terms that are favorable to us, if at all, and we could be subject to additional restrictions on our business operations. If we are unable to obtain adequate financing or financing on satisfactory terms when required, our ability to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

Previous wording

On February 21, 2024 we amended and restated the 2021 Amended Term Loan to, among other things, revise the positive and negative covenants in a manner intended to better align with our operations. We expect to be in compliance with all debt covenants by the end of the fiscal quarter ended March 31, 2024. However, if a waiver from CIBC is required in the future for potential non-compliance, CIBC may be unwilling to provide a waiver and could, as a result, call our outstanding debt obligations immediately which could have a material adverse effect on our financial condition.

Current wording

We expect to be in compliance with all debt covenants under the 2024 Amended Loan and Security Agreement by the end of the fiscal quarter ended March 31, 2025. However, if a waiver from CIBC is required in the future for potential non-compliance, CIBC may be unwilling to provide a waiver and could, as a result, call our outstanding debt obligations immediately which could have a material adverse effect on our financial condition.

Previous wording

The Sarbanes-Oxley Act of 2002 (the "Sarbanes-Oxley Act") requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to develop, maintain and, if required, improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and may continue to expend, significant resources, including accounting-related costs and investments to strengthen our accounting systems. If any of these new or improved controls and systems do not perform as expected, we may experience material weaknesses in our controls. For fiscal years 2019, 2020 and 2021, we identified a material weakness in our internal controls that we had insufficient technical skills to address accounting matters combined with insufficient accounting staff and internal control knowledge to design and implement processes and controls, including the review of the completeness and accuracy of reports used to record journal entries, necessary to ensure material misstatements did not occur. We took certain measures to remediate this material weakness, and it was remediated as of December 31, 2022. However, completion of remediation does not provide assurance that our remediated controls will continue to operate properly or that our financial statements will be free from error. Further, we can give no assurance that any additional material weaknesses or control deficiencies will not arise in the future.

Current wording

The Sarbanes-Oxley Act of 2002 (the "Sarbanes-Oxley Act") requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. In order to develop, maintain and, if required, improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and may continue to expend, significant resources, including accounting-related costs and investments to strengthen our accounting systems. If any of these new or improved controls and systems do not perform as expected, we may experience material weaknesses in our controls.

Previous wording

Additionally, our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business, and weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our consolidated financial statements for prior periods. Such failure could also adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on Nasdaq.

Current wording

Additionally, our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business, and weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our consolidated financial statements for prior periods. Such failure could also adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the Nasdaq Stock Market LLC ("Nasdaq").

Previous wording

Each share of our LT10 and LT50 common stock is entitled to 10 and 50 votes per share, respectively, and each share of our Class A common stock is entitled to one vote per share. All shares of LT10 and LT50 common stock are held directly by the Voting Trust established in connection with our initial public offering pursuant to a voting trust agreement (“Voting Trust Agreement”). As of December 31, 2023, the Voting Trust held 7,333,619 and 7,321,894 shares of LT10 and LT50 common stock, respectively, representing approximately 17.2% of the economic interest and 86.2% of the voting power of outstanding capital stock. All decisions with respect to the voting (but not the disposition) of shares held in the Voting Trust from time to time will be made by the trustees of the Voting Trust ("Trustees") in their sole and absolute discretion, and with no responsibility under the Voting Trust Agreement as stockholder, trustee or otherwise, except for his or her own individual malfeasance. The Voting Trust and its Trustees will, for the foreseeable future, have significant influence over our corporate management and affairs, and will be able to control virtually all matters requiring stockholder approval. The Voting Trust is able to, subject to applicable law, elect all of the members of our Board of Directors and control actions to be taken by us and our Board of Directors, including amendments to our amended and restated certificate of incorporation and amended and restated bylaws, compensation matters and approval of significant corporate transactions, including mergers and sales of substantially all of our assets. The directors so elected will have the authority, subject to the terms of our indebtedness and applicable rules and regulations, to issue additional stock, implement stock repurchase programs, declare dividends and make other decisions. This concentrated control will limit your ability to influence corporate matters for the foreseeable future and may materially adversely affect the market price of our Class A common stock. It is possible that the interests of the Voting Trust may, in some circumstances, conflict with our interests and the interests of our other stockholders, including you. For example, the Voting Trust may have different tax positions or other differing incentives from other stockholders that could influence its decisions regarding whether and when to cause us to dispose of assets, incur new or refinance existing indebtedness, or take other actions. Additionally, the Voting Trust and the holders of our LT10 and LT50 common stock may cause us to make strategic decisions or pursue acquisitions that could involve risks to you or may not be aligned with your interests.

Current wording

Each share of our LT10 and LT50 common stock is entitled to 10 and 50 votes per share, respectively, and each share of our Class A common stock is entitled to one vote per share. All shares of LT10 and LT50 common stock are held directly by the Voting Trust established in connection with our initial public offering pursuant to a voting trust agreement ("Voting Trust Agreement"). As of December 31, 2024, the Voting Trust held 4,209,827 and 7,695,524 shares of LT10 and LT50 common stock, respectively, representing approximately 13.0% of the economic interest and 84.3% of the voting power of outstanding capital stock. All decisions with respect to the voting (but not the disposition) of shares held in the Voting Trust from time to time will be made by the trustees of the Voting Trust ("Trustees") in their sole and absolute discretion, and with no responsibility under the Voting Trust Agreement as stockholder, trustee or otherwise, except for his or her own individual malfeasance. The Voting Trust and its Trustees will, for the foreseeable future, have significant influence over our corporate management and affairs, and will be able to control virtually all matters requiring stockholder approval. The Voting Trust is able to, subject to applicable law, elect all of the members of our Board of Directors and control actions to be taken by us and our Board of Directors, including amendments to our amended and restated certificate of incorporation and amended and restated bylaws, compensation matters and approval of significant corporate transactions, including mergers and sales of substantially all of our assets. The directors so elected will have the authority, subject to the terms of our indebtedness and applicable rules and regulations, to issue additional stock, implement stock repurchase programs, declare dividends and make other decisions. This concentrated control will limit your ability to influence corporate matters for the foreseeable future and may materially adversely affect the market price of our Class A common stock. It is possible that the interests of the Voting Trust may, in some circumstances, conflict with our interests and the interests of our other stockholders, including you. For example, the Voting Trust may have different tax positions or other differing incentives from other stockholders that could influence its decisions regarding whether and when to cause us to dispose of assets, incur new or refinance existing indebtedness, or take other actions. Additionally, the Voting Trust and the holders of our LT10 and LT50 common stock may cause us to make strategic decisions or pursue acquisitions that could involve risks to you or may not be aligned with your interests.

Previous wording

We are a “controlled company” within the meaning of Nasdaq listing standards and, as a result, will qualify for, and intend to rely on, exemptions from certain corporate governance requirements. You will not have the same protections afforded to stockholders of companies that are subject to such requirements.

Current wording

We are a “controlled company” within the meaning of Nasdaq listing standards and, as a result, qualify for, and rely on, exemptions from certain corporate governance requirements. You will not have the same protections afforded to stockholders of companies that are subject to such requirements.

Previous wording

We intend to rely on some or all of these exceptions. As a result, we do not have a majority of independent directors, we do not have a nominating and corporate governance committee, and the members of our compensation committee are not independent directors. Accordingly, you do not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance requirements of Nasdaq.

Current wording

We rely on some or all of these exceptions. As a result, we do not have a majority of independent directors, we do not have a nominating and corporate governance committee, and the members of our compensation committee are not independent directors. Accordingly, you do not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance requirements of Nasdaq.

Showing the first 40 of 44 pairs. Open the source sections for the rest.

Rearranged current paragraphs (4)

Current report — wording carried from elsewhere

The regulatory environment in which we conduct our business is extensive and complex. The local, state, and federal laws, rules, regulations, licensing and other authorization schemes, and industry standards that govern our business, including our payment services, include, or may in the future include, those relating to banking, invoicing, cross-border and domestic money transmission, foreign exchange, payments services (such as payment processing and settlement services), anti-money laundering, combating terrorist financing, escheatment, U.S. and international sanctions regimes, and compliance with the Payment Card Industry Data Security Standard ("PCI-DSS"), a set of requirements designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect cardholder data.

Current report — wording carried from elsewhere

In addition to standard termination for cause provisions, either party can terminate without cause upon 90 days' notice after the first year term is completed. In the event of termination, we have the right to request transition services for up to three months after termination, and during the transition period the agreement will continue on the same terms. If such transition is not successful, or if we otherwise lose the TMC for any reason, we could experience service interruptions as well as delays and additional expenses, and we may be unable to replace these services on competitive terms, or at all, which could harm our business, results of operations, financial condition, and growth prospects. Such termination or loss could lead to our customers having to go directly to airlines, hotels, or other providers for support instead of through Expensify or the TMC.

Current report — wording carried from elsewhere

We receive, process, store and use business and personal data relating to our employees, business contacts, members and customers around the world (collectively, “Personal Data”), including the United States and the European Economic Area (“EEA”). As a result, our business is subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, disclosure and protection of Personal Data.

Current report — wording carried from elsewhere

In addition to the EU, a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of Personal Data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR. Others, such as those in Russia, India and China, could potentially impose more stringent obligations, including data localization requirements.
Rearranged previous paragraphs (2)

Previous report — wording carried elsewhere

•operate as a public company; and

Previous report — wording carried elsewhere

In addition, the use of the Internet as a means of conducting business could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of