CPI Card Group Inc

As used herein, “CPI,” “we,” “our” and similar terms refer to CPI Card Group Inc. and its subsidiaries, unless the context indicates otherwise.

Overview

We are a payments technology company and leading provider of comprehensive Financial Payment Card solutions in the United States. We define “Financial Payment Cards” as credit, debit and Prepaid Debit Cards (as defined below) issued on the networks of the “Payment Card Brands” (Visa, Mastercard®, American Express® and Discover®). We define “Prepaid Debit Cards” as debit cards issued on the networks of the Payment Card Brands, but not linked to a traditional bank account. We also offer an instant card issuance solution, which provides customers the ability to issue a personalized debit or credit card within the bank branch to individual cardholders. We have established a leading position in the Financial Payment Card solutions market through more than 20 years of experience.

We serve a diverse set of several thousand customers which includes direct customers and indirect customer relationships, whereby CPI provides Financial Payment Card solutions to a customer through a Group Service Provider (as defined below). Our customers include some of the largest issuers of debit and credit cards in the United States, the largest Prepaid Debit Card program managers in the United States, numerous financial technology companies (“fintechs”), as well as independent community banks, credit unions and Group Service Providers. We define “Group Service Providers” as reseller or card processor organizations that assist small card issuers, such as credit unions, with managing their credit and debit card programs, including managing the Financial Payment Card issuance process, core banking operations and other financial services.

We serve our customers through a network of high-security production and card services facilities in the United States, each of which is audited for compliance with the standards of the Payment Card Industry Security Standards Council (the “PCI Security Standards Council”) by one or more of the Payment Card Brands. Many of our customers require us to comply with PCI Security Standards Council requirements that relate to the provision of our products and services. Our network of high-security production facilities allows us to optimize our solutions offerings and to serve the needs of our diverse customer base.

Driven by a combination of our strong relationships, quality, technology, innovation, and supply-chain management, we believe we have strong positions in the following markets:

Our business consists of the following reportable segments:

For additional details regarding our segments, see Part II, Item 8,Financial Statements and Supplementary Data, Note 17 "Segment Reporting," and Part II, Item 7,Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

Our Competitive Strengths

We continuously work to enhance our offerings and to create and deliver next generation products and solutions that meet the demands of the marketplace and our customers. CPI’s Second Wave® payment cards featuring a core made with recovered ocean-bound plastic (“ROBP”) and Earthwise® cards made with upcycled plastic address customer demands for more eco-focused card options. We also sell CPI Metals®, a premium encased metal card. Our offerings also include Card@Once, our proprietary and patented instant card issuance system and SaaS solution. We believe that our technological and operational capabilities, combined with our specific focus on the Financial Payment Solutions market, gives us a competitive advantage.

EMV®* is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMV* Co, LLC.

Our Strategy

We are a payments technology company that provides end-to-end debit, credit and prepaid payment solutions delivered physically, digitally and on-demand. Our vision is to be our customers’ partner of choice by providing market-leading quality payments solutions, customer service and continuous innovation with a market-competitive business model. We also aim to expand our addressable market over the long-term by adding adjacent product and service offerings, including more digital solutions, for our extensive customer base of thousands of financial institutions.

We believe we are well-positioned for success given our diversified business model, history of innovation and ability to evolve with the needs and expectations of our customers. By helping our customers elevate their customers’ experience, we foster compelling connections between people and technology through traditional and next generation solutions that build brands and enhance people’s everyday lives. To achieve our vision, we focus on our four strategic priorities: deep customer focus, market-leading quality payments solutions and customer service, continuous innovation and a market competitive business model.

Deep Customer Focus

We are committed to keeping our customers at the center of everything we do. By partnering with our customers and allowing their needs to inform our business, we enhance our ability to deliver value and help their businesses thrive. We aim to inspire and satisfy our customers by redefining experiences that may have traditionally seemed rigid and complex. With our full and expanding suite of catalytic and competitively differentiated products and solutions, we offer our customers choice, convenience and control.

Market-Leading Quality Payments Solutions and Customer Service

Our strong team of dedicated, passionate employees embrace a culture of collaboration and steadfast focus on delivering superior products and exceptional customer service which has helped build us into a leading solutions provider. With a focus on market-leading quality payments solutions and customer service, we are committed to operational excellence and adapting to market dynamics to help our customers achieve top-of-wallet status and build their businesses. We listen to the voices of our customers and focus on helping them deliver unique and differentiated solutions that elevate their customers’ experience. We are accountable for our actions, and work synergistically to deliver results for our customers, our employees and our stockholders.

Continuous Innovation

With innovation as a core competency, we strategically invest to support continued growth and expand our opportunities to partner purposefully with our current and potential customers. We strive to enhance our offerings to create and deliver next generation products and solutions that meet the demands of the marketplace and exceed customers’ expectations. Continuous innovation aims to win new business and help our customers differentiate themselves with distinctive products and solutions, build their brands and achieve top-of-wallet status.

Market-Competitive Business Model

By creating a dynamic and efficient operating model, we have positioned ourselves to better serve our customers. We aim to streamline our operations, which enables us to allocate resources focused on providing our customers with unmatched solutions, innovation and exceptional service. We have also developed standards of excellence and target metrics regarding the quality, reliability and on-time delivery of our products. We invest in equipment advancements and technology in order to create broader capabilities as well as improve the quality and efficiencies of, and the customer satisfaction with, our offerings. We continue to focus on driving top-line performance, profitability and operational efficiency.

Our Products and Services

EMV Financial Payment Cards (Contact and Contactless Dual-Interface)

We produce plastic EMV cards, including our eco-focused solutions that we describe further below, and encased metal contact EMV cards. These EMV cards feature an integrated circuit that interfaces with an EMV payment terminal over a contact plate on the surface of the card when inserted into an EMV-enabled payment terminal. We also produce contactless EMV cards which feature a radio-frequency identification (“RFID”) antenna that utilizes near field communications (“NFC”) technology to allow transactions to process on a contactless basis when the card is brought within the requisite proximity to an NFC-enabled payment terminal. Dual-interface EMV cards also have contact EMV technology, and we generally refer to all cards we produce with an RFID antenna as ‘contactless’ cards.

Eco-Focused Cards

We believe we are a leading provider of eco-focused card solutions in the U.S., having sold more than 100 million eco-focused contactless payment cards since launch in 2019. Our eco-focused solutions include our Second Wave cards that feature a core made with ROBP and our Earthwise cards made with upcycled plastic. Dependent upon design and card construction, eco-focused cards incorporate varying types and amounts of upcycled plastic content, including ROBP and recycled PVC. Cards in the eco-focused portfolio have been approved by two of the major Payment Card Brands. These solutions aim to satisfy increasing consumer demand for more eco-focused products and help support our and our customers’ environmental, social and governance (“ESG”) objectives.

Non-EMV Financial Payment Cards

We produce non-EMV cards that utilize magnetic stripes, contactless cards that utilize NFC technology, and cards that include both magnetic stripes and NFC technology. In addition, we produce non-EMV cards that are issued on the networks of the Payment Card Brands, including Prepaid Debit Cards. In 2020 we began producing non-EMV cards for the purpose of government disbursement in the U.S., and have produced non-EMV transit cards and health savings account cards. We also produce retail gift cards that are not issued on the networks of the Payment Card Brands.

Card Data Personalization and Fulfillment

We provide data preparation and card data personalization solutions for debit, credit and Prepaid Debit Cards in contact, contactless and dual-interface EMV, and non-EMV card formats. Our personalization services are technology-driven with full color printing and edge-to-edge coverage, and provide a wide range of card customization options, using advanced processes to personalize (encode, program and emboss or print with data such as cardholder name and account number) and fulfill cards to individual cardholders. Our services provide customers with an inventory of their card stock and fulfillment materials. In addition, we provide EMV data preparation services for our customers and in certain cases generate PIN numbers and mailers on their behalf. We also provide consultation and card design services to further assist customers in card customization.

Print-On-Demand Solution

Through our print-on-demand services, we are able to produce images, personalized payment cards and related collateral on a one-by-one, on-demand basis for our customers, enabling individualized offerings and reducing inventory. Our service offering includes online ordering of a customized payment card through a program manager, with

direct fulfillment to a consumer. We believe our print-on-demand solution further differentiates us with our financial institution and Prepaid Debit Card program manager customers and enables us to access business-to-business and business-to-consumer verticals such as healthcare, transit, payroll, corporate incentives, government disbursement, benefits and insurance.

Instant Card Issuance Systems and Services

In addition to centralized personalization services performed at our facilities, our customers may also utilize personalization services through Card@Once, our proprietary and patented instant card issuance system and SaaS-based solution, which provides our customers the ability to issue a completely personalized, permanent debit or credit card within the bank branch to individual cardholders upon demand. Our instant issuance system is enabled by cloud-based software that securely transfers data from our servers to encode a magnetic stripe card, a contact EMV card or a contactless dual-interface EMV card, and personalize the card on a desktop printer solution provided by CPI. These processes are audited for PCI data security standards compliance annually. Our instant issuance system generates both initial sales revenue for the printer solution and recurring revenue from card personalization and sales of cards and consumables. We offer multiple Card@Once solutions including our premium Spectrum solution that enables issuers to produce a high-resolution payment card with over-the-edge printing capability.

Digital Solutions

While not currently significant to our financial results, we provide digital solutions, including push provisioning which allows our customers to facilitate the provisioning of payment credentials to a cardholder’s digital wallet, digital cards which allow our customers to utilize prepaid cards with online merchants, and online front-end ordering and card customization allowing customers to order one-time use physical rewards cards.

Tamper-Evident Secure Packaging Solutions

We offer specialized and innovative tamper-evident secure packaging products and services to customers aimed at reducing fraud for Prepaid Debit Cards sold through the retail channel. In certain cases, we also manage the fulfillment of fully-completed Prepaid Debit Card packages to retail locations on behalf of our customers utilizing this solution.

Suppliers

While we have developed constructive relationships with our suppliers and, in general, receive a high level of cooperation and support from them, one objective of our procurement strategy is to not depend on any single supplier. However, certain components are only available from a single supplier, or substituting a component from a different supplier may require additional time and investment. Some of the most important components of our products include the EMV/contactless microchips and antennas. Our main suppliers of EMV/contactless microchips and antennas include four leading international producers with locations in Germany, Thailand, South Korea and Singapore, some of which source materials from Taiwan. For the year ended December 31, 2023 approximately 96% of our purchased microchips and antennas came from these four main suppliers, and approximately 72% came from one supplier, including most of our contactless chips. The other key components for our products are substrates and inlays. Additionally, our Second Wave payment cards feature a core made with ROBP, which we either have sourced or currently source from suppliers in Haiti and Thailand.

We monitor supply-chain risks and evaluate alternative suppliers based on numerous attributes including quality, performance, service, scalability, features, innovation, resiliency and price. In 2022, we entered into a capacity reservation agreement with one of our chip suppliers to reserve production supply capacity. Under the agreement, we agreed to pay certain fees in exchange for the supplier’s commitment to reserve capacity to produce a set quantity of chips from 2023 through 2025, subject to certain conditions, and the Company has committed to purchase those chips. The total value of our commitment is $194.9 million over the term of the agreement. As of December 31, 2023, the remaining commitment was $125.3 million.

Customers

We categorize our customers as follows: large issuers, small- to mid-sized issuers, fintechs, prepaid debit issuers and program managers and Group Service Providers. We consider large issuers to be the top 10 card issuers in the United States based on an average of cards issued during the past three years. Our diverse customer base includes some of the largest issuers of credit and debit cards in the United States and the largest Prepaid Debit Card program managers in the United States.

The Company had one customer that accounted for 10% or more of its net sales in 2023. Net sales from this customer were approximately 18% of total net sales for the year ended December 31, 2023. We have been serving this customer for more than 10 years. Nearly two-thirds of our net sales for the year ended December 31, 2023 were from our top ten direct customers, which include certain Group Service Providers, and we have been serving these top ten direct customers for an average of more than 10 years. In addition, through our direct and indirect customer relationships, a majority of our annual net sales in our Debit and Credit segment are derived from small- to mid-sized issuers and fintechs. Individually, many of these customers, including independent community banks and credit unions, represent minor amounts of our annual net sales.

We generally enter into master purchase or service agreements that govern the general terms and conditions of our commercial relationships. We then enter into a purchase order or other short-term arrangement that defines the quantities of products to be delivered or services rendered and other terms specific to the order as appropriate. In most cases, our contractual arrangements include neither exclusivity clauses nor commitments from our customers to order any given quantities of products on a medium or long-term basis.

Production and Services

We have a network of high-security facilities that we leverage to fulfill customer orders, with an array of products and services available to our customers. We have designed our facilities and operating processes to target providing exceptional service to all customers, with capabilities to:

As of December 31, 2023, we operated facilities comprising approximately 402,000 square feet in the United States where we focus on Financial Payment Card production, personalization services, card printer provisioning and fulfillment, card packaging and fulfillment services. See Part I, Item 2,Properties in this Annual Report on Form 10-K for information on the operations of each facility.

We rely on secure ground and secure air freight to deliver finished products to our customers. Due to the high-security nature of the Financial Payment Card products we provide to our customers, certain products must be shipped to these customers via a secure method, such as armored vehicle. With respect to customers for whom we fulfill individual and personalized debit and credit cards, we primarily utilize the U.S. postal service and other express shipping services to deliver these cards directly to individual cardholders. For other customers, we deliver our products via regular ground and air freight.

In addition, we seek to embrace practices and solutions at our facilities designed to limit our impact on the environment, preserve natural resources and create innovative and responsible products. Our key areas of focus in this area include: incorporating environmental sustainability practices as and where feasible in alignment with our business model, values and customer needs; engaging employees; and communicating and promoting our commitment and contribution to more sustainable practices and products.

Sales and Marketing

We market ourselves as a leader and trusted partner in payments, seeking to meet or exceed the needs of our customers through high quality, flexibility, and meaningful, innovative products at value-driven pricing. We strategize and collaborate with our customers to bring them valuable and innovative solutions. We have sales representatives, customer relationships and partners that provide a wide geographic reach across the United States to sell and market our solutions. Our sales representatives offer a complete end-to-end solution that incorporates the full spectrum of our products and services from concept to delivery. Our sales and marketing strategy is focused on strengthening our relationships with existing customers through a consultative approach that includes cross-selling expanded services and sharing expertise to enhance customers’ card programs. We leverage the strength of our full-service offerings to attract new customers. Our marketing efforts focus on the needs of our specific types of customers. By tailoring our marketing strategy to different customer segments, we are able to provide relevant targeted solutions to meet our customers’ individual needs. We use an array of different marketing communications and thought leadership across various industry publications, editorial white papers, case studies, conferences and trade shows, print and digital advertisements, educational webinars, podcasts, and blogs to introduce our existing customers and new customers to innovations in the payments market. We also strive to meet customer demand for new or enhanced products by innovating through research and development activities. We believe these efforts drive customer retention and satisfaction and attract new customers.

Competition

The market for products and services in the payment card industry is highly competitive. Some of our competitors possess substantially greater financial, sales and marketing resources than we do, and therefore have substantial flexibility in competing with us, including through the use of integrated product offerings, innovation and competitive pricing. Competitive factors for our business include product quality, durability, security, service reliability, product line comprehensiveness and integration, timely introduction of new products, features and capabilities, and price.

Our products and services compete with other card solutions providers. Certain existing and potential customers also have the ability to produce and/or personalize Financial Payment Cards in-house. Accordingly, we compete with certain of our customers, including those that offer transaction processing products and services to financial institutions. We believe we are in competition with ABCorp, Arroweye, CompoSecure L.L.C., Entrust, FIS, Fiserv, Giesecke & Devrient GmbH, HID Global, IDEMIA (formerly known as Oberthur Technologies S.A.), Perfect Plastic Printing, Thales (formerly known as Gemalto NV), Travel Tags, and WestRock (Multi Packaging Solutions), among others.

Intellectual Property

We own, control or license various intellectual property rights, such as patents, trade secrets, confidential information, trademarks, service marks, tradenames, copyrights and applications. We are party to certain patent cross-license arrangements with industry participants and may, from time to time, enter into similar commercial agreements should we consider it necessary or beneficial for our business.

We rely on a combination of statutory (copyright, trademark and trade secret) and contractual safeguards to protect our intellectual property throughout the world. As of December 31, 2023, we had 70 U.S. and foreign trademark registrations and applications, 42 existing U.S. patents, 51 existing foreign patents, as well as 45 pending U.S. and foreign patent applications. Our U.S. and foreign patents and applications have an average remaining maturity of approximately 12 years, and our trademarks will be due for renewal for additional ten-year periods on an ongoing basis.

Regulation

Privacy and Data Security

In the course of our business, we receive personally identifiable information of cardholders from our customers, either from a financial institution or through a Group Service Provider. Such information can include names, email and physical addresses, card account numbers and expiration dates. As a service provider to financial institutions in the United States, we are subject to certain Federal Trade Commission requirements, certain privacy provisions of the

Gramm-Leach-Bliley Act and its implementing regulations, various other federal and state privacy statutes and regulations, certain of the PCI Security Standards Council’s requirements and the Health Insurance Portability and Accountability Act (“HIPAA”), each of which is subject to change at any time. Outside of the United States, we are subject to privacy laws and regulations of certain countries and jurisdictions. The interpretation and application of privacy and data protection laws are often uncertain and in a state of flux. Furthermore, many of our customers are subject to privacy and data protection laws, and our customers often impose contractual obligations on us related to their obligations. In order to comply with our obligations under applicable privacy laws and regulations and our contractual agreements with our customers, we are required to implement adequate policies and safeguards to protect the privacy of personally identifiable information we receive.

Under the PCI Security Standards Council’s requirements, we must meet certain security standards in order to achieve compliance that allows us to produce and personalize Financial Payment Cards issued on their networks. These standards include extensive requirements with respect to the physical characteristics of our facilities, as well as our electronic treatment and storage of cardholder data. We believe that we have developed significant expertise in achieving and maintaining compliance with the requirements from the Payment Card Brands, and have invested, and will continue to invest, significant capital to achieve and retain compliance, which is regularly verified by both the Payment Card Brands and our customers. We believe the complexity involved and investment needed to obtain and retain these compliance designations may serve as a barrier to new entrants into our market.

The status and interpretation of pending and existing laws and regulations is evolving and these laws and regulations may be applied inconsistently, and the obligations imposed upon us by our customers can vary. It is possible that our current data protection policies and practices may be deemed inconsistent with new legal requirements or interpretations thereof, and breaches in the security of our systems and technology could result in a violation of these laws and regulations and contractual requirements. Changes to these laws and regulations, as well as any associated inquiries or investigations or any other government actions, and additional requirements imposed by our customers may be costly to comply with and may delay or impede the development of new products, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including reputational harm, fines, or demands or orders that we modify or cease existing business practices.

Financial Services

We are generally not directly subject to federal or state regulations specifically applicable to financial institutions such as banks, thrifts and credit unions. However, as a provider of products and services to these financial institutions, our operations may be examined by various state and federal regulatory authorities and representatives of the Federal Financial Institutions Examination Council, which is a formal inter-agency body empowered to prescribe uniform principles, standards and report forms for the federal examination of financial institutions and to make recommendations to promote uniformity in the supervision of financial institutions. Also, state and federal regulations require our financial institution customers to include certain provisions in their contracts with service providers like us and to conduct ongoing monitoring and risk management for third party relationships. In addition, we engage independent auditors annually to review certain of our operations to provide internal control evaluations for our customers’ auditors.

In conducting certain aspects of our card services, we are directly subject to various federal and state laws and regulations and contractual obligations. In order to comply with our obligations under applicable laws, we are required, among other things, to comply with reporting requirements, to implement operating policies and procedures to comply with Office of Foreign Assets Control requirements, to protect the privacy and security of our customers’ information and to undergo periodic audits and examinations.

In 2010, the Dodd-Frank Act was enacted. The Dodd-Frank Act introduced substantial reforms to the supervision and operation of the financial services industry, including introducing changes that: affect the oversight and supervision of financial institutions; provide for a new resolution procedure for large financial companies; introduce more stringent regulatory capital requirements; implement changes to corporate governance and executive compensation practices; and require significant rule-making. The Dodd-Frank Act has generated numerous new regulations that have imposed compliance costs. The Dodd-Frank Act established the Consumer Financial Protection Bureau (“CFPB”) which is empowered to conduct rule-making and supervision related to, and enforcement of, federal consumer financial protection laws. The CFPB has issued guidance that applies to “supervised service providers” which the CFPB has

defined to include service providers like us as well as CFPB supervised banks and nonbanks. The CFPB has in the past and may in the future issue regulations that may require us to make compliance investments. It is difficult to predict with certainty the extent to which the Dodd-Frank Act, the CFPB or the resulting regulations will impact our business or the businesses of our current and potential customers.

Environmental Protection

Our operations are subject to environmental protection regulations, including those governing the emissions of pollutants into the air, wastewater discharges, the use and handling of hazardous substances, waste disposal, and the investigation and remediation of soil and groundwater contamination. We are also required to obtain environmental permits from governmental authorities for certain of our operations.

Human Capital

Our leadership team has significant experience in the payments industry, and many of our employees possess career-long expertise and knowledge that is unique to the Financial Payment Card industry. Our compensation programs are designed to attract and retain individuals with the unique skill sets that are fundamental to our business. We provide our employees with competitive salaries and incentives, access to health insurance and paid time off, in addition to other benefits. As part of our promotion and retention efforts, we also invest in ongoing leadership development and conduct employee surveys to measure employee engagement and identify areas of focus.

Employee health and safety in the workplace is one of the Company’s core values. Health and safety of our employees has remained paramount and the Company has adapted its health and safety procedures and protocols as necessary to foster a safe working environment. We maintain a combination of on-site and remote employees in our workforce.

We are committed to a diverse and inclusive workplace, in which we promote honest, ethical and respectful conduct. Our Code of Business Conduct and Ethics sets the standards for appropriate behavior, and employees are required to follow these standards and participate in related training. We encourage employees to bring forward issues and concerns. In addition, we periodically analyze our employment procedures and pay practices to help ensure individuals are provided with equal employment opportunities and equitable pay. We also focus on a variety of community initiatives to enhance the lives of people in the communities where we operate through volunteerism, charitable giving and economic support.

As of December 31, 2023, approximately 1,448 people were employed by CPI, of which nearly half are women and approximately 60% identify as being within a minority category. Approximately 74% of our full-time employees are production and service facility staff. In 2023, we completed the process of transitioning temporary worker positions in our Prepaid Debit Card locations, where historically we experienced more seasonality, to permanent employee positions, in order to better manage our workforce and operations, and significantly reduced our reliance on temporary workers. None of our employees are represented by labor unions. We believe that our relations with our employees are positive.

Available Information

CPI Card Group Inc. is a Delaware corporation. We were initially formed as CPI Holdings I, Inc. in June 2007 and changed our name to CPI Card Group Inc. in August 2015. Our principal executive offices are located at 10368 West Centennial Road, Littleton, CO 80127, telephone (720) 681-6304. The Company's Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to those reports are available free of charge through the “Investor Relations” portion of the Company's website (www.cpicardgroup.com), as soon as reasonably practical after they are filed with, or furnished to, the SEC. Our website and the information contained on that site, or connected to that site, are not incorporated into and are not a part of this report. The SEC also maintains a website (www.sec.gov), which contains reports and information statements, and other information filed electronically with the SEC by the Company.

CPI Card Group Inc. qualifies as a smaller reporting company in accordance with Rule 12b-2 under the Exchange Act and has elected to follow certain of the scaled back disclosure accommodations within this Annual Report on Form 10-K. Beginning with the year ended December 31, 2021, the Company is classified as an accelerated filer with respect to SEC regulations and filing requirements.