PSQ Holdings, Inc.

Previous wording

We outsource substantially all of the infrastructure relating to our cloud-accessible products to third-party hosting services. Our cloud-based products depend on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in these virtual data centers, which is transmitted by third-party internet service providers. Any limitation on the capacity of our third-party hosting services could impede our ability to onboard new consumers and business owners or expand the usage of our existing businesses and consumers, which could adversely affect our business, financial condition and results of operations. In addition, any incident affecting our third-party hosting services’ infrastructure may be caused by human error, intentional bad acts, cybersecurity incidents, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events. A prolonged service disruption affecting our cloud-based solution for any of the foregoing reasons would negatively impact our ability to serve our business owners and consumers and could damage our reputation with current and potential business owners and consumers, expose us to liability, cause us to lose businesses and consumers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Current wording

We outsource substantially all of the infrastructure relating to our cloud-accessible products to third-party hosting services. Our cloud-based products depend on protecting the virtual cloud infrastructure hosted by third-party hosting services by maintaining its configuration, architecture, features and interconnection specifications, as well as the information stored in virtual data centers, which is transmitted by third-party internet service providers. Any limitation on the capacity of our third-party hosting services could impede our ability to onboard new consumers and business owners or expand the usage of our existing businesses and consumers, which could adversely affect our business, financial condition and results of operations. In addition, any incident affecting our third-party hosting services’ infrastructure may be caused by human error, intentional bad acts, cybersecurity incidents, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events. A prolonged service disruption affecting our cloud-based solutions for any of the foregoing reasons would negatively impact our ability to serve our business owners and consumers and could damage our reputation with current and potential business owners and consumers, expose us to liability, cause us to lose businesses and consumers or otherwise harm our business. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party hosting services we use.

Previous wording

We rely on various information technology systems, including our licensed Sage-Intacct enterprise resource planning (“ERP”) system to manage our operations, which subjects us to inherent costs and risks associated with maintaining, upgrading, replacing and changing systems, including impairment of our information technology, potential disruption of our internal control systems, substantial capital expenditures, demands on management time, adequate training and other risks of delays or difficulties in upgrading, transitioning to new systems or of integrating adjoining systems to our current systems. Such changes or disruptions can have a material adverse impact in delivering financial information on a timely basis to the SEC and the public markets.

Current wording

We rely on various information technology systems, including our licensed Sage-Intacct enterprise resource planning system to manage our operations, which subjects us to inherent costs and risks associated with maintaining, upgrading, replacing and changing systems, including impairment of our information technology, potential disruption of our internal control systems, substantial capital expenditures, demands on management time, adequate training and other risks of delays or difficulties in upgrading, transitioning to new systems or of integrating adjoining systems to our current systems. Such changes or disruptions can have a material adverse impact in delivering financial information on a timely basis to the SEC and the public markets.

Previous wording

Changes in tax rates, changes in tax treatment of companies engaged in e-commerce, or the adoption of new tax legislation may adversely impact our financial results.

Current wording

Changes in tax rates, changes in tax treatment of transaction-based and digital services businesses could adversely affect our financial results.

Previous wording

As of December 31, 2024 and 2023, we had federal net operating loss (“NOL”) carryforwards of approximately $70.0 million and $26.1 million, respectively, available to reduce future taxable income, and which may be carried forward indefinitely. At December 31, 2024 and 2023, the Company had approximately $37.0 million and $14.3 million of combined state NOL carryforwards, respectively, of which some expire between 2032 and 2044 and some may be carried forward indefinitely. The deductibility of such U.S. federal NOLs each year is limited to 80% of our taxable income for such year. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, the amount of benefits from our NOL carryforwards may be impaired or limited if we incur a cumulative ownership change of more than 50% over a three-year period. We have not conducted a study to determine if any such changes have occurred that could limit our ability to use our NOL carryforwards. We may have experienced ownership changes in the past and the Business Combination is expected to result in an ownership change. As a result, our use of our U.S. federal NOL carryforwards will likely be limited. Any such disallowance may result in greater tax liabilities than we would incur in the absence of such a limitation and any increased liabilities could adversely affect our business, results of operations, financial position and cash flows.

Current wording

As of December 31, 2025 and 2024, we had federal net operating loss (“NOL”) carryforwards of approximately $108.5 million and $70.0 million, respectively, available to reduce future taxable income, and which may be carried forward indefinitely. At December 31, 2025 and 2024, the Company had approximately $41.4 million and $37.0 million of combined state NOL carryforwards, respectively, of which some expire between 2032 and 2044 and some may be carried forward indefinitely. The deductibility of such U.S. federal NOLs each year is limited to 80% of our taxable income for such year. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended ("Section 382"), the amount of benefits from our NOL carryforwards may be impaired or limited if we incur a cumulative ownership change of more than 50% over a three-year period. The Company has completed a Section 382 study through September 30, 2025, and has determined that an ownership change did occur on February 23, 2023. As a result, our use of our U.S. federal NOL carryforwards will likely be limited. Any such disallowance may result in greater tax liabilities than we would incur in the absence of such a limitation and any increased liabilities could adversely affect our business, results of operations, financial position and cash flows.

Previous wording

Although we generally seek to diversify our cash and cash equivalents across several financial institutions in an attempt to minimize exposure to any one of these entities, we currently hold, and in the future, may hold, a portion of our cash and cash equivalents that we use to meet our working capital needs in deposit accounts at financial institutions. The balance held in these accounts may exceed the Federal Deposit Insurance Corporation (“FDIC”) standard deposit insurance limit of $250,000. If a financial institution in which we hold such funds fails or is subject to significant adverse conditions in the financial or credit markets, we could be subject to a risk of loss of all or a portion of such uninsured funds or be subject to a delay in accessing all or a portion of such uninsured funds. For example, on March 10, 2023, Silicon Valley Bank (“SVB”) and Signature Bank were closed by state regulators and the FDIC was appointed receiver for each bank. The FDIC created successor bridge banks and all deposits of SVB and Signature Bank were transferred to the bridge banks under a systemic risk exception approved by the United States Department of the Treasury, the Federal Reserve and the FDIC. While we have taken and will continue to take steps to mitigate the risk of loss of or delayed access to all or a portion of our funds held at various financial institutions, if any financial institution in which we hold funds for working capital were to fail, we cannot provide any assurances that such governmental agencies would take action to protect our uninsured deposits in a similar manner.

Current wording

We currently hold, and in the future, may hold, a portion of our cash and cash equivalents that we use to meet our working capital needs in deposit accounts at financial institutions. The balance held in these accounts may exceed the Federal Deposit Insurance Corporation (“FDIC”) standard deposit insurance limit of $250,000. If a financial institution in which we hold such funds fails or is subject to significant adverse conditions in the financial or credit markets, we could be subject to a risk of loss of all or a portion of such uninsured funds or be subject to a delay in accessing all or a portion of such uninsured funds. If any financial institution in which we hold funds for working capital were to fail, we cannot provide any assurances that the FDIC or other governmental agencies would take action to protect our uninsured deposits.

Previous wording

•Natural disasters, including and not limited to unusual weather conditions, epidemic outbreaks, terrorist acts and political events could disrupt our business schedule.

Current wording

Natural disasters, including but not limited to unusual weather conditions, epidemic outbreaks, terrorist acts and political events could disrupt our business schedule.

Previous wording

The occurrence of one or more natural disasters, including and not limited to tornadoes, hurricanes, fires, floods and earthquakes, unusual weather conditions, pandemics and endemic outbreaks, terrorist attacks or disruptive political events in certain regions where our facilities are located, or where our third-party contractors’ and suppliers’ facilities are located, could adversely affect our business. Natural disasters including tornados, hurricanes, floods and earthquakes may damage our facilities or those of our suppliers, which could have a material adverse effect on our business, financial condition and results of operations. Terrorist attacks, actual or threatened acts of war or the escalation of current hostilities, or any other military or trade disruptions impacting our domestic or foreign suppliers of components of our products, may impact our operations by, among other things, causing supply chain disruptions and increases in commodity prices, which could adversely affect our raw materials or transportation costs. These events also could cause or act to prolong an economic recession in the United States or abroad. In addition, the disaster recovery and business continuity plans we have in place currently are limited and are unlikely to prove adequate in the event of a serious disaster or similar event. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans and, more generally, any of these events could cause consumer confidence and spending to decrease, which could adversely impact our operations.

Current wording

The occurrence of one or more natural disasters, including but not limited to tornadoes, hurricanes, fires, floods and earthquakes, unusual weather conditions, pandemics and endemic outbreaks, terrorist attacks or disruptive political events in certain regions where our facilities are located, or where our third-party contractors’ and suppliers’ facilities are located, could adversely affect our business. Natural disasters including tornados, hurricanes, floods and earthquakes may damage our facilities or those of our business partners or customers, which could have a material adverse effect on our business, financial condition and results of operations. Terrorist attacks, actual or threatened acts of war or the escalation of current hostilities, or any other military or trade disruptions could cause or act to prolong an economic recession in the United States or abroad. In addition, the disaster recovery and business continuity plans we have in place currently are limited and are unlikely to prove adequate in the event of a serious disaster or similar event. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans and, more generally, any of these events could cause consumer confidence and spending to decrease, which could adversely impact our operations.

Previous wording

The consumer finance and buy now pay later (“BNPL”) industry has become subject to increased regulatory scrutiny, and Credova’s failure to manage its business to comply with new regulations would materially and adversely affect Credova’s business, results of operations and financial condition.

Current wording

The consumer finance and BNPL industry has become subject to increased regulatory scrutiny, and Credova’s failure to manage its business to comply with new regulations would materially and adversely affect Credova’s business, results of operations and financial condition.

Previous wording

Regulators in various jurisdictions are showing increased attention and scrutiny of BNPL arrangements, including in those jurisdictions in which Credova operates. There is potential that Credova may become subject to additional legal or regulatory requirements if laws or regulations change in the future, the interpretation of laws and regulations changes in the future, industry standards for consumer finance and BNPL arrangements change in the future, or regulators more heavily scrutinize consumer finance and BNPL arrangements. This increased risk may relate to state lending licensing or other state licensing or registration requirements, regulatory requirements concerning consumer finance and BNPL arrangements, consumer protection or consumer finance matters, or similar limitations on the conduct of Credova’s business. There is a risk that additional or changed legal, regulatory and industry compliance standards may make it economically unfeasible for Credova to continue to operate, or to expand in accordance with its strategy. This would likely have a material adverse effect on Credova’s business, results of operations and financial condition, including by preventing Credova’s business from reaching sufficient scale.

Current wording

BNPL arrangements are coming under increased attention and scrutiny by regulators in various jurisdictions, including those jurisdictions in which Credova operates. There is potential that Credova may become subject to additional legal or regulatory requirements if laws or regulations change in the future, the interpretation of laws and regulations changes in the future, industry standards for consumer finance and BNPL arrangements change in the future, or regulators more heavily scrutinize consumer finance and BNPL arrangements. This increased risk may relate to state lending licensing or other state licensing or registration requirements, regulatory requirements concerning consumer finance and BNPL arrangements, consumer protection or consumer finance matters, or similar limitations on the conduct of Credova’s business. There is a risk that additional or changed legal, regulatory and industry compliance standards may make it economically unfeasible for Credova to continue to operate, or to expand in accordance with its strategy. This would likely have a material adverse effect on Credova’s business, results of operations and financial condition, including by preventing Credova’s business from reaching sufficient scale.

Previous wording

Despite any competitive advantage Credova may have, there is always a risk of new entrants in the market, which may disrupt Credova’s business and decrease Credova’s market share. Credova expects competition to intensify in the future, both as emerging technologies continue to enter the marketplace and as large financial incumbents increasingly seek to innovate the services that they offer to compete with Credova’s products. Technological advances and the continued growth of e-commerce activities have increased consumers’ accessibility to products and services and led to the expansion of competition in digital payment options such as pay-over-time solutions. Credova faces competition in areas such as: flexibility on payment options; duration, simplicity, and transparency of payment terms; reliability and speed in processing applications; underwriting effectiveness; compliance and security; promotional offerings; fees; approval rates; ease-of-use; marketing expertise; service levels; products and services; technological capabilities and integration; customer service; brand and reputation; and consumer and merchant satisfaction. In addition, it may be become more difficult to distinguish Credova’s platform, and products and services, from those of its competitors.

Current wording

New entrants may enter our market at any time, which may disrupt Credova’s business and decrease Credova’s market share. Credova expects competition to intensify in the future, both as emerging technologies continue to enter the marketplace and as large financial incumbents increasingly seek to innovate the services that they offer to compete with Credova’s products. Technological advances and the continued growth of e-commerce activities have increased consumer access to products and services and led to the expansion of competition in digital payment options such as pay-over-time solutions. Credova faces competition in areas such as: flexibility on payment options; duration, simplicity, and transparency of payment terms; reliability and speed in processing applications; underwriting effectiveness; compliance and security; promotional offerings; fees; approval rates; ease-of-use; marketing expertise; service levels; products and services; technological capabilities and integration; customer service; brand and reputation; and consumer and merchant satisfaction. In addition, it may be become more difficult to distinguish Credova’s platform, products and services, from those of its competitors.

Previous wording

Some of Credova’s competitors are substantially larger than Credova, which gives those competitors advantages Credova does not have, such as a more diversified product, a broader consumer and merchant base, the ability to reach more consumers, the ability to cross-sell their products, operational efficiencies, the ability to cross-subsidize their offerings through their other business lines, more versatile technology platforms, the ability to acquire competitors, broad-based local distribution capabilities, and lower-cost funding. Credova’s competitors may also have longer operating histories, more extensive and broader consumer and merchant relationships, and greater brand recognition and brand loyalty than Credova has. For example, more established companies that possess large, existing consumer and merchant bases, substantial financial resources, and established distribution channels could enter the market. Further, consumers’ increased usage of BNPL platforms in recent years may encourage more of such competitors that may be in a better position, due to financial and other resources, to attract merchants and customers to their platforms.

Current wording

Some of Credova’s competitors are substantially larger than Credova, which gives those competitors advantages Credova does not have, such as a more diversified product, a broader consumer and merchant base, the ability to reach more consumers, the ability to cross-sell their products, operational efficiencies, the ability to cross-subsidize their offerings through their other business lines, more versatile technology platforms, the ability to acquire competitors, broad-based local distribution capabilities, and lower-cost funding. Credova’s competitors may also have longer operating histories, broader and more extensive consumer and merchant relationships, and greater brand recognition and brand loyalty than Credova. For example, more established companies that possess large, existing consumer and merchant bases, substantial financial resources, and established distribution channels could enter the market. Further, consumers’ increased usage of BNPL platforms in recent years may encourage more of such competitors that may be in a better position, due to financial and other resources, to attract merchants and customers to their platforms.

Previous wording

Increased competition, particularly for large, well-known merchants, has in the past resulted and will result in the need for Credova to alter the pricing it offers to merchants. If Credova is unable to successfully compete, the demand for Credova’s platform and products could stagnate or substantially decline, and Credova could fail to retain or grow the number of consumers or merchants using its platform, which would reduce the attractiveness of its platform to other consumers and merchants, and which would materially and adversely affect Credova’s business, results of operations, financial condition, and prospects.

Current wording

Increased competition, particularly for large, well-known merchants, has in the past resulted and likely will in the future result in the need for Credova to alter the pricing it offers to merchants. If Credova is unable to successfully compete, the demand for Credova’s platform and products could stagnate or substantially decline, and Credova could fail to retain or grow the number of consumers or merchants using its platform, which would reduce the attractiveness of its platform to other consumers and merchants, and materially and adversely affect Credova’s business, results of operations, financial condition, and prospects.

Previous wording

Credova’s revenue is derived from consumer transaction volume, so Credova’s success depends on its ability to generate repeat use and increased transaction volume from existing consumers and to attract new consumers to its platform. Credova’s ability to retain and grow its relationships with consumers depends on the willingness of consumers to use Credova’s platform and products. The attractiveness of Credova’s platform to consumers depends upon, among other things: the number and variety of merchants and the mix of products available through Credova’s platform; the manner in which consumers may use Credova’s products, including the ease of use relative to competitor products; Credova’s brand and reputation; consumer experience and satisfaction, including the trustworthiness of Credova’s services; consumer trust and perception of Credova’s solutions; technological innovation; and services and products offered by competitors. If Credova fails to retain its relationship with existing consumers, if Credova does not attract new consumers to its platform and products, or if Credova does not continually expand usage and volume from consumers on its platform, Credova’s business, results of operations, financial condition, and prospects would be materially and adversely affected.

Current wording

Credova’s revenue is derived from consumer transaction volume, and as a result, Credova’s success depends on its ability to generate repeat use and increased transaction volume from existing consumers and to attract new consumers to its platform. Credova’s ability to retain and grow its relationships with consumers depends on the willingness of consumers to use Credova’s platform and products. The attractiveness of Credova’s platform to consumers depends upon, among other things: the number and variety of merchants and the mix of products available through Credova’s platform; the manner in which consumers may use Credova’s products, including the ease of use relative to competitor products; Credova’s brand and reputation; consumer experience and satisfaction, including the trustworthiness of Credova’s services; consumer trust and perception of Credova’s solutions; technological innovation; and services and products offered by competitors. If Credova fails to retain its relationship with existing consumers, if Credova does not attract new consumers to its platform and products, or if Credova does not continually expand usage and volume from consumers on its platform, Credova’s business, results of operations, financial condition, and prospects would be materially and adversely affected.

Previous wording

Credova’s business, the consumer financial services industry, and Credova’s merchants’ businesses are sensitive to macroeconomic conditions. Economic factors such as interest rates, changes in monetary and related policies, market volatility, inflationary conditions, student loan obligations, consumer confidence, and unemployment rates are among the most significant factors that impact consumer spending behavior. Weak economic conditions or a significant deterioration in economic conditions, including the current inflationary environment and possibility of a recession, reduce the amount of disposable income consumers have, which in turn reduces consumer spending and the willingness of qualified consumers to take out loans. Such conditions are also likely to affect the ability and willingness of consumers to pay amounts owed under the loans facilitated through Credova’s platform, each of which would have an adverse effect on Credova’s business, results of operations, financial condition, and future prospects.

Current wording

Credova’s business, the consumer financial services industry, and the businesses of Credova’s merchants are sensitive to macroeconomic conditions. Economic factors such as interest rates, changes in monetary and related policies, market volatility, inflationary conditions, student loan obligations, consumer confidence, and unemployment rates are among the most significant factors that impact consumer spending behavior. Weak economic conditions or a significant deterioration in economic conditions, including the current inflationary environment and possibility of a recession, reduce the amount of disposable income consumers have, which in turn reduces consumer spending and the willingness of qualified consumers to take out loans. Such conditions are also likely to affect the ability and willingness of consumers to pay amounts owed under the loans facilitated through Credova’s platform, each of which would have an adverse effect on Credova’s business, results of operations, financial condition, and future prospects.

Previous wording

The generation of new loans facilitated through Credova’s platform, and the transaction fees and other fee income due to Credova associated with such loans, depends upon sales of products and services by its merchants. Credova’s merchants’ sales may decrease or fail to increase as a result of factors outside of their control, such as the macroeconomic conditions referenced above, or business conditions affecting a particular merchant, industry vertical, or region. Weak economic conditions also could extend the length of Credova’s merchants’ sales cycle and cause consumers to delay making (or not make) purchases of Credova’s merchants’ products and services. The decline of sales by Credova’s merchants for any reason will generally result in lower credit sales and, therefore, lower loan volume and associated fee income for us.

Current wording

The generation of new loans facilitated through Credova’s platform, and the transaction fees and other fee income due to Credova associated with such loans, depends upon sales of products and services by its merchants. Credova’s merchants’ sales may decrease or fail to increase as a result of factors outside of their control, such as the macroeconomic conditions referenced above, or business conditions affecting a particular merchant, industry vertical, or region. Weak economic conditions also could extend the length of Credova’s merchants’ sales cycle and cause consumers to delay making (or not make) purchases of Credova’s merchants’ products and services. A decline in sales by Credova’s merchants for any reason will generally result in lower credit sales and, therefore, lower loan volume and associated fee income for Credova.

Previous wording

Consumers may not view or treat their BNPL product loans as having the same significance as other obligations, and the loans facilitated through Credova’s platform are not secured, guaranteed, or insured and involve a high degree of financial risk.

Current wording

Consumers may not view or treat their BNPL product loans as having the same significance as other financial obligations, and the loans facilitated through Credova’s platform are not secured, guaranteed, or insured and involve a high degree of financial risk.

Previous wording

Credova maintains an allowance for credit losses at a level sufficient to estimate expected credit losses based on evaluating known and inherent risks in Credova’s loan portfolio. This estimate is highly dependent upon the reasonableness of Credova’s assumptions and the predictability of the relationships that drive the results of Credova’s valuation methodologies. Management has processes in place to monitor these judgments and assumptions, including review by Credova’s credit committee, but these processes may not ensure that Credova’s judgments and assumptions are correct. The method for calculating the best estimate of expected credit losses takes into account Credova’s historical experience, adjusted for current conditions, and Credova’s judgment concerning the probable effects of relevant observable data, trends, and market factors. Changes in such estimates can significantly affect the allowance and provision for losses. It is possible that Credova will experience credit losses that are different from Credova’s current estimates. If Credova’s estimates and assumptions prove incorrect and Credova’s allowance for credit losses is insufficient, Credova may incur net charge-offs in excess of its reserves, or Credova could be required to increase its provision for credit losses, either of which would adversely affect Credova’s results of operations.

Current wording

Credova maintains an allowance for credit losses at a level estimated to be sufficient to cover expected credit losses based on evaluating known and inherent risks in Credova’s loan portfolio. This estimate is highly dependent upon the reasonableness of Credova’s assumptions and the predictability of the relationships that drive the results of Credova’s valuation methodologies. Management has processes in place to monitor these judgments and assumptions, including review by Credova’s credit committee, but these processes may not ensure that Credova’s judgments and assumptions are correct. The method for calculating the best estimate of expected credit losses takes into account Credova’s historical experience, adjusted for current conditions, and Credova’s judgment concerning the probable effects of relevant observable data, trends, and market factors. Changes in such estimates can significantly affect the allowance and provision for losses. It is possible that Credova will experience credit losses that are different from Credova’s current estimates. If Credova’s estimates and assumptions prove incorrect and Credova’s allowance for credit losses is insufficient, Credova may incur net charge-offs in excess of its reserves, or Credova could be required to increase its provision for credit losses, either of which would adversely affect Credova’s results of operations.

Previous wording

Credova has significant vendors that, among other things, provide it with financial, technology, and other services to support Credova’s products and other activities, including, for example, credit ratings and reporting, cloud-based data storage and other IT solutions, and payment processing. The Consumer Financial Protection Bureau (“CFPB”) has issued guidance stating that institutions under its supervision may be held responsible for the actions of the companies with which they contract. Accordingly, Credova could be adversely impacted to the extent its vendors fail to comply with the legal requirements applicable to the particular products or services being offered.

Current wording

Credova has significant vendors that, among other things, provide it with financial, technology, and other services to support Credova’s products and other activities, including, for example, credit ratings and reporting, cloud-based data storage and other IT solutions, and payment processing. The CFPB has issued guidance stating that institutions under its supervision may be held responsible for the actions of the companies with which they contract. Accordingly, Credova could be adversely impacted to the extent its vendors fail to comply with the legal requirements applicable to the particular products or services being offered.

Previous wording

In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. Most of Credova’s vendor agreements are terminable by the vendor on little or no notice, and if Credova’s current vendors were to terminate their agreements with Credova or otherwise stop providing services to it on acceptable terms, Credova may be unable to procure alternatives from other vendors in a timely and efficient manner and on acceptable terms (or at all). If any vendor fails to provide the services Credova requires, fails to meet contractual requirements (including compliance with applicable laws and regulations), fails to maintain adequate data privacy controls and electronic security systems, or suffers a cyber-attack or other security breach, Credova could be subject to CFPB, the Federal Trade Commission (“FTC”) and other regulatory enforcement actions, claims from third parties, including Credova’s consumers, and suffer economic and reputational harm that could have an adverse effect on Credova’s business. Further, Credova may incur significant costs to resolve any such disruptions in service, which could adversely affect Credova’s business.

Current wording

In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. Most of Credova’s vendor agreements are terminable by the vendor on little or no notice, and if Credova’s current vendors were to terminate their agreements with Credova or otherwise stop providing services to it on acceptable terms, Credova may be unable to procure alternatives from other vendors in a timely and efficient manner and on acceptable terms (or at all). If any vendor fails to provide the services Credova requires, fails to meet contractual requirements (including compliance with applicable laws and regulations), fails to maintain adequate data privacy controls and electronic security systems, or suffers a cyber-attack or other security breach, Credova could be subject to CFPB, the FTC and other regulatory enforcement actions, claims from third parties, including Credova’s consumers, and suffer economic and reputational harm that could have an adverse effect on Credova’s business. Further, Credova may incur significant costs to resolve any such disruptions in service, which could adversely affect Credova’s business.

Previous wording

Although Credova’s merchants are obligated to fulfill their contractual commitments to consumers and to comply with applicable law from time to time, they might not, or a consumer might allege that they did not. This, in turn, can result in claims or defenses against Credova or any subsequent holder of Credova’s installment agreements. If merchants fail to fulfill their contractual or legal obligations to consumers, it may also negatively affect Credova’s reputation with consumers thereby negatively affecting Credova’s business. Federal and state regulatory authorities may also bring claims against Credova, including unfair and deceptive acts or practices (“UDAP”) or unfair, deceptive or abusive acts or practices (“UDAAP”) claims, if Credova fails to provide consumer protections relating to potential merchant actions or disputes.

Current wording

Although Credova’s merchants are obligated to fulfill their contractual commitments to consumers and to comply with applicable law from time to time, they might not, or a consumer might allege that they did not. This, in turn, can result in claims or defenses against Credova or any subsequent holder of Credova’s installment agreements. If merchants fail to fulfill their contractual or legal obligations to consumers, it may also negatively affect Credova’s reputation with consumers thereby negatively affecting Credova’s business. Federal and state regulatory authorities may also bring claims against Credova, including unfair and deceptive acts or practices or UDAAP claims, if Credova fails to provide consumer protections relating to potential merchant actions or disputes.

Previous wording

Furthermore, because Credova’s platform allows customers to finance merchandise such as firearms, ammunition and certain related accessories, Credova may be subject to reputational harm if a customer purchases a firearm through Credova’s platform that is later involved in a shooting or other crime.

Current wording

Furthermore, because Credova’s platform allows customers to finance merchandise such as firearms, ammunition and certain related accessories, Credova may be subject to reputational harm if a customer purchases a firearm through Credova’s platform that is later involved in a firearm-related crime.

Previous wording

In addition, Credova’s partners include credit bureaus, collection agencies and banking parties, each of whom operate in a highly regulated environment, and many laws and regulations that apply directly to them may apply directly or indirectly to Credova through Credova’s contractual arrangements with these partners. Federal, state and international laws or regulators, as well as Credova’s contractual partners, may require notice in event of a security breach that involves personally identifiable information, and these disclosures may result in negative publicity, loss of confidence in Credova’s security measures, regulatory or other investigations, the triggering of indemnification and other contractual obligations, and other adverse effects to Credova’s partner ecosystem and operations. Credova may also incur significant costs and loss of operational resources in connection with remediating, investigating, mitigating, or eliminating the causes of security breaches, cyberattacks, or similar disruptions after they have occurred, and particularly given the evolving nature of these risks, Credova’s incident response, disaster recovery, and business continuity planning may not sufficiently address all of these eventualities. The retention and coverage limits in Credova’s insurance policies may not be sufficient to reimburse the full cost of responding to and remediating the effects of a security breach, cyberattack, or similar disruption, and Credova may not be able to collect fully, if at all, under these insurance policies or to ensure that the insurer will not deny coverage as to any future claim.

Current wording

In addition, Credova’s partners include credit bureaus, collection agencies and banks, each of which operate in a highly regulated environment, and many laws and regulations that apply directly to them may apply directly or indirectly to Credova through Credova’s contractual arrangements with these partners. Federal, state and international laws or regulators, as well as Credova’s contractual partners, may require notice in event of a security breach that involves personally identifiable information, and these disclosures may result in negative publicity, loss of confidence in Credova’s security measures, regulatory or other investigations, the triggering of indemnification and other contractual obligations, and other adverse effects to Credova’s partner ecosystem and operations. Credova may also incur significant costs and loss of operational resources in connection with remediating, investigating, mitigating, or eliminating the causes of security breaches, cyberattacks, or similar disruptions after they have occurred, and particularly given the evolving nature of these risks, Credova’s incident response, disaster recovery, and business continuity planning may not sufficiently address all of these risks. The retention and coverage limits in Credova’s insurance policies may not be sufficient to reimburse the full cost of responding to and remediating the effects of a security breach, cyberattack, or similar disruption, and Credova may not be able to collect fully, if at all, under these insurance policies or to ensure that the insurer will not deny coverage as to any future claim.

Previous wording

Credova’s platform and internal systems rely on software that is highly technical and complex. In addition, Credova’s platform and internal systems depend on the ability of such software to store, retrieve, process, and manage immense amounts of data. As a result, undetected vulnerabilities, errors, failures, bugs, or defects may be present in such software or occur in the future in such software, including open source software and other software Credova licenses in from third parties, especially when updates or new products or services are released.

Current wording

Credova’s platform and internal systems rely on software that is highly technical and complex. In addition, Credova’s platform and internal systems depend on the ability of such software to store, retrieve, process, and manage immense amounts of data. As a result, undetected vulnerabilities, errors, failures, bugs, or defects may be present in such software or occur in the future in such software, including open source software and other software Credova licenses from third parties, especially when updates or new products or services are released.

Previous wording

Credova also relies on online payment gateways, banking and financial institutions for the validation of bank cards, settlement and collection of payments. There is a risk that these systems may fail to perform as expected or be adversely impacted by a number of factors, some of which may be outside Credova’s control, including damage, equipment faults, power failure, fire, natural disasters, computer viruses and external malicious interventions such as hacking, cyber-attacks or denial-of-service attacks.

Current wording

Credova also relies on online payment gateways, banking and financial institutions for the validation of bank cards, settlement and collection of payments. There is a risk that these systems may fail to perform as expected or be adversely impacted by a number of factors, some of which may be outside Credova’s control, including damage, equipment faults, power failure, fire, natural disasters, computer viruses and external malicious interventions such as hacking, cyber-attacks or denial-of-service attacks, which would adversely affect Credova’s business, results of operations, and financial condition.

Previous wording

Fraudulent activity is likely to result in Credova suffering losses, which may have a material adverse impact on Credova’s reputation and cause it to bear increased costs to rectify and safeguard business operations and its systems against such fraudulent activity. Significant amounts of fraudulent cancellations or chargebacks could adversely affect Credova’s business, results of operations or financial condition. High profile or significant increases in fraudulent activity could also lead to regulatory intervention, negative publicity, and the erosion of trust from Credova’s consumers and merchants, which could result in a material adverse effect on Credova’s business, results of operations and financial condition.

Current wording

Fraudulent activity is likely to result in financial losses, which may have a material adverse impact on Credova’s reputation and cause it to bear increased costs to rectify and safeguard business operations and its systems against such fraudulent activity. Significant amounts of fraudulent cancellations or chargebacks could adversely affect Credova’s business, results of operations or financial condition. High profile or significant increases in fraudulent activity could also lead to regulatory intervention, negative publicity, and the erosion of trust from Credova’s consumers and merchants, which could result in a material adverse effect on Credova’s business, results of operations and financial condition.

Previous wording

We are or may become subject to data privacy and securities laws and regulations that apply to the collection, transmission, storage, use, processing, destruction, retention and security of personal information. Our current privacy policies and practices are designed to comply with privacy and data protection laws in the United States. These policies and practices inform consumers how we handle their personal information and, as permitted by law, allow consumers to change or delete the personal information in their consumer accounts. The legislative and regulatory landscape for privacy and data protection continues to evolve in the United States, both federally and at the state level, as well as in other jurisdictions worldwide, and these laws and regulations may at times be conflicting. It is possible that these laws may be interpreted and applied in a manner that is inconsistent from one jurisdiction or is inconsistent with our practices, and our efforts to comply with the evolving data protection rules may be unsuccessful. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with federal, state, provincial and international laws regarding privacy and security of personal information could expose us to penalties under such laws, orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement action (including fines and penalties), litigation, significant costs for remediation, and damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations and prospects. Although we endeavor to comply with our published privacy policies and related documentation, and all applicable privacy and security laws and regulations, we may at times fail to do so or may be perceived to have failed to do so. Even if we have not violated these laws and regulations, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could have a material adverse effect on our business, financial condition, results of operations and prospects. Additionally, if we are unable to properly protect the privacy and security of personal information, including sensitive personal information (e.g., financial information), we could be found to have breached our contracts with certain third parties.

Current wording

We are or may become subject to data privacy and securities laws and regulations that apply to the collection, transmission, storage, use, processing, destruction, retention and security of personal information. The legislative and regulatory landscape for privacy and data protection continues to evolve in the United States, both federally and at the state level, as well as in other jurisdictions worldwide, and these laws and regulations may at times be conflicting. It is possible that these laws may be interpreted and applied in a manner that is inconsistent from one jurisdiction or is inconsistent with our practices, and our efforts to comply with the evolving data protection rules may be unsuccessful. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with federal, state, provincial and international laws regarding privacy and security of personal information could expose us to penalties under such laws, orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement actions (including fines and penalties), litigation, significant costs for remediation, and damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations and prospects. We may at times fail to comply with our published privacy policies and related documentation and applicable privacy and security laws and regulations or may be perceived to have failed to do so. Even if we have not violated these laws and regulations, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could have a material adverse effect on our business, financial condition, results of operations and prospects. Additionally, if we are unable to properly protect the privacy and security of personal information, including sensitive personal information (e.g., financial information), we could be found to have breached our contracts with certain third parties.

Previous wording

There are numerous U.S. and Canadian federal, state, and provincial laws and regulations related to the privacy and security of personal information. Determining whether protected information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. For example, in 2018, California enacted the California Consumer Privacy Act (“CCPA”), which, among other things, requires new disclosures to California consumers and affords such consumers new abilities to opt out of certain sales of information and may restrict the use of cookies and similar technologies for advertising purposes. The CCPA, which became effective on January 1, 2020, was amended on multiple occasions and is the subject of regulations issued by the California Attorney General regarding certain aspects of the law and its application. Moreover, California voters approved the California Privacy Rights Act (the “CPRA”) in November 2020. The CPRA significantly modifies the CCPA, creating additional obligations relating to consumer data, with enforcement beginning July 1, 2023. Aspects of the CCPA and CPRA remain unclear, resulting in further uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply. Similar laws have been proposed, and likely will be proposed, in other states and at the federal level, and if passed, such laws may have potentially conflicting requirements that would make compliance challenging. Similar state laws have been passed in Virginia, Colorado, Utah, Connecticut, and New Jersey and other states are expected to follow. If we fail to comply with applicable privacy laws, we could face civil and criminal fines or penalties.

Current wording

There are numerous U.S. federal, state, and provincial laws and regulations related to the privacy and security of personal information. Determining whether protected information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. For example, in 2018, California enacted the CCPA, which, among other things, requires new disclosures to California consumers and affords such consumers new abilities to opt out of certain sales of information and may restrict the use of cookies and similar technologies for advertising purposes. The CCPA, which became effective on January 1, 2020, was amended on multiple occasions and is the subject of regulations issued by the California Attorney General regarding certain aspects of the law and its application. Moreover, California voters approved the CPRA in November 2020. The CPRA significantly modifies the CCPA, creating additional obligations relating to consumer data, with enforcement beginning July 1, 2023. Aspects of the CCPA and CPRA remain unclear, resulting in further uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply. Similar laws have been passed, proposed, and likely will be proposed, in other states and at the federal level, and such laws may have potentially conflicting requirements that would make compliance challenging. If we fail to comply with applicable privacy laws, we could face civil and criminal fines or penalties.

Previous wording

Failing to take appropriate steps to keep consumers’ personal information secure, or misrepresentations regarding our current privacy practices, can also constitute unfair acts or practices in or affecting commerce and be construed as a violation of Section 5(a) of the Federal Trade Commission Act (the “FTCA”), 15 U.S.C. § 45(a). The Federal Trade Commission (“FTC”) expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of our business, and the cost of available tools to improve security and reduce vulnerabilities. The FTC may also bring an action against a company who collects or otherwise processes personal information for any statements it deems misleading or false contained in privacy disclosures to consumers. While we use best efforts to comply with our published privacy policies and related documents, we may at times fail to do so, or may be perceived to have failed to do so. In addition, we may be unsuccessful in achieving compliance if our personnel, partners, or service providers fail to comply with our published privacy policies and related documentation. Such failures can subject us to potential foreign, local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems.

Current wording

Failing to take appropriate steps to keep consumers’ personal information secure, or misrepresentations regarding our current privacy practices, can also constitute unfair acts or practices in or affecting commerce and be construed as a violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a). The “FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of our business, and the cost of available tools to improve security and reduce vulnerabilities. The FTC may also bring an action against a company who collects or otherwise processes personal information for any statements it deems misleading or false contained in privacy disclosures to consumers. We may at times fail to comply with our published privacy policies and related documents, or may be perceived to have failed to do so. In addition, we may be unsuccessful in achieving compliance if our personnel, partners, or service providers fail to comply with our published privacy policies and related documentation. Such failures can subject us to potential foreign, local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems.

Previous wording

As our business grows, we may also become subject to international privacy laws regulating the collection, transmission, storage, use, processing, destruction, retention and security of personal information. For example, in the European Union, the collection, transmission, storage, use, processing, destruction, retention and security of personal data is governed by the provisions of the General Data Protection Regulation (the “GDPR”) in addition to other applicable laws and regulations. The GDPR came into effect in May 2018, repealing and replacing the European Union Data Protection Directive, and imposing revised data privacy and security requirements on companies in relation to the processing of personal data of European Union data subjects. The GDPR, together with national legislation, regulations and guidelines of the European Union Member States governing the collection, transmission, storage, use, processing, destruction, retention and security of personal data, impose strict obligations with respect to, and restrictions on, the collection, use, retention, protection, disclosure, transfer and processing of personal data. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union that are not deemed to have protections for personal information, including the United States. The GDPR authorizes fines for certain violations of up to 4% of the total global annual turnover of the preceding financial year or €20 million, whichever is greater. Such fines are in addition to any civil litigation claims by data subjects. Separately, Brexit has led and could also lead to legislative and regulatory changes and may increase our compliance costs. As of January 1, 2021, and the expiry of transitional arrangements agreed to between the United Kingdom and the European Union, data processing in the United Kingdom is governed by a United Kingdom version of the GDPR (combining the GDPR and the Data Protection Act 2018), exposing us to two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations. On June 28, 2021, the European Commission adopted an adequacy decision for the United Kingdom, allowing for the relatively free exchange of personal information between the European Union and the United Kingdom. Other jurisdictions outside the European Union are similarly introducing or enhancing privacy and data security laws, rules and regulations, which could increase our compliance costs and the risks associated with noncompliance.

Current wording

As our business grows, we may also become subject to international privacy laws regulating the collection, transmission, storage, use, processing, destruction, retention and security of personal information. For example, in the European Union, the collection, transmission, storage, use, processing, destruction, retention and security of personal data is governed by the provisions of the General Data Protection Regulation (the “GDPR”) in addition to other applicable laws and regulations. The GDPR came into effect in May 2018, repealing and replacing the European Union Data Protection Directive, and imposing revised data privacy and security requirements on companies in relation to the processing of personal data of European Union data subjects. The GDPR, together with national legislation, regulations and guidelines of the European Union Member States governing the collection, transmission, storage, use, processing, destruction, retention and security of personal data, impose strict obligations with respect to, and restrictions on, the collection, use, retention, protection, disclosure, transfer and processing of personal data. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union that are not deemed to have protections for personal information, including the United States. The GDPR authorizes fines for certain violations of up to 4% of the total global annual turnover of the preceding financial year or €20 million, whichever is greater. Such fines are in addition to any civil litigation claims by data subjects. Separately, Brexit has led and could in the future lead to legislative and regulatory changes and may increase our compliance costs. Data processing in the United Kingdom is governed by a United Kingdom version of the GDPR (combining the GDPR and the Data Protection Act 2018), exposing us to two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations. On June 28, 2021, the European Commission adopted an adequacy decision for the United Kingdom, allowing for the relatively free exchange of personal information between the European Union and the United Kingdom. Other jurisdictions outside the European Union are similarly introducing or enhancing privacy and data security laws, rules and regulations, which could increase our compliance costs and the risks associated with noncompliance.

Previous wording

Overall, because of the complexity of these laws, the changing obligations and the risk associated with our collection and use of data, we cannot guarantee that we are, or will be, in compliance with all applicable U.S., Canadian, or other international regulations as they are enforced now or as they evolve.

Current wording

Overall, because of the complexity of these laws, the changing obligations and the risk associated with our collection and use of data, we cannot guarantee that we are, or will be, in compliance with all applicable U.S. or international regulations as they are enforced now or as they evolve.

Previous wording

Hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks, which may remain undetected until after they occur. Despite our efforts to protect our information technology networks and systems, payment processing, and information, we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats. Our security measures may not be adequate to prevent or detect service interruption, system failure, data loss or theft, or other material adverse consequences. No security solution, strategy, or measures can address all possible security threats. Our applications, systems, networks, software, and physical facilities could have material vulnerabilities, be breached, or personal or confidential information could be otherwise compromised due to employee error or malfeasance, if, for example, third parties attempt to fraudulently induce our personnel or our business owners to disclose information or usernames and/or passwords, or otherwise compromise the security of our networks, systems and/or physical facilities. We cannot be certain that we will be able to address any such vulnerabilities, in whole or part, and there may be delays in developing and deploying patches and other remedial measures to adequately address vulnerabilities, and taking such remedial steps could adversely impact or disrupt our operations. We expect similar issues to arise in the future as products and services sold through the Platform are more widely adopted, and as we continue to introduce future products and services. An actual or perceived breach of our security systems or those of our third party service providers may require notification under applicable data privacy regulations or for customer relations or publicity purposes, which could result in reputational harm, costly litigation (including class action litigation), material contract breaches, liability, settlement costs, loss of sales, regulatory scrutiny, actions or investigations, a loss of confidence in our business, systems and payment processing, a diversion of management’s time and attention, and significant fines, penalties, assessments, fees, and expenses. Moreover, pursuant to SEC rules, public companies must disclose material cybersecurity incidents on Form 8-K within four business days (subject to a delayed compliance date for smaller reporting companies, of which we are one). In addition, companies must provide cybersecurity risk management disclosures in their annual reports.

Current wording

Hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks, which may remain undetected until after they occur. Despite our efforts to protect our information technology networks and systems, payment processing, and information, we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats. Our security measures may not be adequate to prevent or detect service interruption, system failure, data loss or theft, or other material adverse consequences. No security solution, strategy, or measures can address all possible security threats. Our applications, systems, networks, software, and physical facilities could have material vulnerabilities, be breached, or personal or confidential information could be otherwise compromised due to employee error or malfeasance, if, for example, third parties attempt to fraudulently induce our personnel or our business owners to disclose information or usernames and/or passwords, or otherwise compromise the security of our networks, systems and/or physical facilities. We cannot be certain that we will be able to address any such vulnerabilities, in whole or part, and there may be delays in developing and deploying patches and other remedial measures to adequately address vulnerabilities, and taking such remedial steps could adversely impact or disrupt our operations. We expect similar issues to arise in the future as products and services sold through the Platform are more widely adopted, and as we continue to introduce future products and services. An actual or perceived breach of our security systems or those of our third party service providers may require notification under applicable data privacy regulations or for customer relations or publicity purposes, which could result in reputational harm, costly litigation (including class action litigation), material contract breaches, liability, settlement costs, loss of sales, regulatory scrutiny, actions or investigations, a loss of confidence in our business, systems and payment processing, a diversion of management’s time and attention, and significant fines, penalties, assessments, fees, and expenses. Moreover, pursuant to SEC rules, public companies must disclose material cybersecurity incidents on Form 8-K within four business days. In addition, companies must provide cybersecurity risk management disclosures in their annual reports.

Previous wording

We may not have adequate insurance coverage for handling cyber security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees, and other impacts that arise out of incidents or breaches. If the impacts of a security incident or breach, or the successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could harm our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Moreover, our privacy risks are likely to increase as we continue to expand, grow our consumer and business base, and process, store, and transmit increasingly large amounts of personal or sensitive data.

Current wording

We may not have adequate insurance coverage for handling cyber security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorneys' fees, and other impacts that arise out of incidents or breaches. If the impacts of a security incident or breach, or the successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could harm our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Moreover, our privacy risks are likely to increase as we continue to expand, grow our consumer and business base, and process, store, and transmit increasingly large amounts of personal or sensitive data.

Previous wording

Even when not merited, the lawsuits and other legal proceedings may divert management’s attention, and we may incur significant expenses in pursuing or defending these lawsuits or other legal proceedings. The results of litigation and other legal proceedings are inherently uncertain, and adverse judgments or settlements in some of these legal disputes may result in adverse monetary damages, penalties or injunctive relief against us, which could negatively impact our financial position, cash flows or results of operations. Any claims or litigation, even if fully indemnified or insured, could damage our reputation and make it more difficult to compete effectively or to obtain adequate insurance in the future.

Current wording

Even when not merited lawsuits and other legal proceedings may divert management’s attention, and we may incur significant expenses in pursuing or defending these lawsuits or other legal proceedings. The results of litigation and other legal proceedings are inherently uncertain, and adverse judgments or settlements in some of these legal disputes may result in adverse monetary damages, penalties or injunctive relief against us, which could negatively impact our financial position, cash flows or results of operations. Any claims or litigation, even if fully indemnified or insured, could damage our reputation and make it more difficult to compete effectively or to obtain adequate insurance in the future.

Previous wording

Credova is subject to a range of state and federal laws and regulations concerning consumer finance that change periodically. These laws and regulations include but are not limited to state lending licensing or other state licensing or registration laws, consumer credit disclosure laws such as the Truth in Lending Act (“TILA”), the Fair Credit Reporting Act (“FCRA”) and other laws concerning credit reports and credit reporting, the Equal Credit Opportunity Act (“ECOA”) which addresses anti-discrimination, the Electronic Fund Transfer Act (“EFTA”) which governs electronic money movement, a variety of anti-money laundering and anti-terrorism financing rules, the Telephone Consumer Protection Act (“TCPA”) and other laws concerning initiating phone calls or text messages, the Electronic Signatures in Global and National Commerce Act, debt collection laws, laws governing short-term consumer loans and general consumer protection laws, such as laws that prohibit unfair, deceptive, misleading or abusive acts or practices. There is also the potential that Credova may become subject to additional legal or regulatory requirements if its business operations, strategy or geographic reach expand in the future. These laws and regulations may also change in the future, and they may be applied to Credova and its products in a manner that Credova does not currently anticipate. While Credova has developed policies and procedures designed to assist in compliance with laws and regulations applicable to Credova’s business, no assurance is given that Credova’s compliance policies and procedures will be effective. Credova may not always have been, and may not always be, in compliance with these laws and regulations and such non-compliance could have a material adverse effect on Credova’s business, results of operations and financial condition.

Current wording

Credova is subject to a range of state and federal laws and regulations concerning consumer finance that change periodically. These laws and regulations include but are not limited to state lending licensing or other state licensing or registration laws, consumer credit disclosure laws such as the TILA, the FCRA and other laws concerning credit reports and credit reporting, the ECOA, which addresses anti-discrimination, the EFTA, which governs electronic money movement, a variety of anti-money laundering and anti-terrorism financing rules, the TCPA and other laws concerning initiating phone calls or text messages, the Electronic Signatures in Global and National Commerce Act, debt collection laws, laws governing short-term consumer loans and general consumer protection laws, such as laws that prohibit unfair, deceptive, misleading or abusive acts or practices. There is also the potential that Credova may become subject to additional legal or regulatory requirements if its business operations, strategy or geographic reach expand in the future. These laws and regulations may also change in the future, and they may be applied to Credova and its products in a manner that Credova does not currently anticipate. While Credova has developed policies and procedures designed to assist in compliance with laws and regulations applicable to Credova’s business, no assurance is given that Credova’s compliance policies and procedures will be effective. Credova may not always have been, and may not always be, in compliance with these laws and regulations and such non-compliance could have a material adverse effect on Credova’s business, results of operations and financial condition.

Previous wording

•the Bureau of Alcohol, Tobacco, Firearms and Explosives, or the ATF, regulations, audit and regulatory policies that impact the process by which Credova’s merchants sell firearms and ammunition and similar policies of state agencies that have concurrent jurisdiction, such as the California Department of Justice;

Current wording

•ATF regulations, audit and regulatory policies that impact the process by which Credova’s merchants sell firearms and ammunition and similar policies of state agencies that have concurrent jurisdiction, such as the California Department of Justice;

Previous wording

•Federal Trade Commission, or FTC, regulations governing the manner in which orders may be solicited and prescribing other obligations in fulfilling orders and consummating sales.

Current wording

•FTC regulations governing the manner in which orders may be solicited and prescribing other obligations in fulfilling orders and consummating sales.

Previous wording

As a public company, we are subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of the NYSE and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”). Compliance with these rules and regulations will increase our legal and financial compliance costs, make some activities more difficult, time-consuming or costly and increase demand on our systems and resources, particularly after we are no longer an “emerging growth company” as defined in the JOBS Act. Among other things, the Exchange Act requires that we file annual, quarterly and current reports with respect to our business and results of operations and maintain effective disclosure controls and procedures and internal control over financial reporting. In order to improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could harm our business, financial condition, results of operations and prospects. Although we have already hired additional personnel to help comply with these requirements, we may need to further expand our legal and finance departments in the future, which will increase our costs and expenses.

Current wording

As a public company, we are subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of the NYSE and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”). Compliance with these rules and regulations have increased our legal and financial compliance costs, made some activities more difficult, time-consuming or costly and increased demand on our systems and resources, and these impacts are expected to further increase after we are no longer an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”). Among other things, the Exchange Act requires that we file annual, quarterly and current reports with respect to our business and results of operations and maintain effective disclosure controls and procedures and internal control over financial reporting. In order to improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could harm our business, financial condition, results of operations and prospects. Although we have already hired additional personnel to help comply with these requirements, we may need to further expand our legal and finance departments in the future, which will increase our costs and expenses.

Previous wording

The directors and management of publicly traded corporations are increasingly concerned with the extent of their personal exposure to lawsuits and shareholder claims, as well as governmental and creditor claims that may be made against them in connection with their positions with publicly held companies. Outside directors are becoming increasingly concerned with the availability of directors’ and officers’ liability insurance to pay on a timely basis the costs incurred in defending shareholder claims. Directors’ and officers’ liability insurance is expensive and difficult to obtain. The SEC and the NYSE have also imposed higher independence standards and certain special requirements on directors of public companies. Accordingly, it may become increasingly difficult to attract and retain qualified outside directors to serve on our Board.

Current wording

The directors and management of publicly traded corporations are increasingly concerned with the extent of their personal exposure to lawsuits and shareholder claims, as well as governmental and creditor claims that may be made against them in connection with their positions with publicly held companies. Outside directors are becoming increasingly concerned with the availability of directors’ and officers’ liability insurance to pay on a timely basis the costs incurred in defending shareholder claims. Directors’ and officers’ liability insurance is expensive and difficult to obtain. The nature of our business may heighten these concerns due to our current product offerings in regulated or higher-risk industries. The SEC and the NYSE have also imposed higher independence standards and certain special requirements on directors of public companies. Accordingly, it may become increasingly difficult to attract and retain qualified outside directors to serve on our Board.

Previous wording

Volatility or lack of appreciation in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their vested equity have not significantly appreciated in value relative to the original purchase price of the shares or the exercise price of the options, or conversely, if the exercise price of the options that they hold are significantly above the market price of our common stock. If we are unable to retain our employees, or if we need to increase our compensation expenses to retain our employees, our business, operating results, and financial condition could be adversely affected.

Current wording

Volatility or lack of appreciation in our stock price may also affect our ability to attract and retain our key employees. Employees may be more likely to leave us if the shares they own or the shares underlying their vested equity have not significantly appreciated in value relative to the original purchase price of the shares or the exercise price of the options, or conversely, if the exercise price of the options that they hold are significantly above the market price of our Class A Common Stock. If we are unable to retain our employees, or if we need to increase our compensation expenses to retain our employees, our business, operating results, and financial condition could be adversely affected.

Previous wording

Matters impacting our internal controls may cause us to be unable to report our financial information in an accurate manner or on a timely basis and thereby subject us to adverse regulatory consequences, including sanctions by the SEC or violations of NYSE rules. There also could be a negative reaction in the financial markets due to a loss of investor confidence in us and the reliability of our financial statements. Confidence in the reliability of our financial statements also could suffer if we or our independent registered public accounting firm continue to report a material weakness in our internal controls over financial reporting. This could materially adversely affect us and lead to a decline in the market price of our common stock.

Current wording

Matters impacting our internal controls may cause us to be unable to report our financial information in an accurate manner or on a timely basis and thereby subject us to adverse regulatory consequences, including sanctions by the SEC or violations of NYSE rules. There also could be a negative reaction in the financial markets due to a loss of investor confidence in us and the reliability of our financial statements. Confidence in the reliability of our financial statements also could suffer if we or our independent registered public accounting firm continue to report a material weakness in our internal control over financial reporting. This could materially adversely affect us and lead to a decline in the market price of our common stock.