Item 1A. Risk Factors.
Investing in our Class A common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this report, including “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our condensed consolidated financial statements and the accompanying notes included elsewhere in this report before making an investment decision. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also materially and adversely affect our business operations, results of operations, financial condition or prospects. The trading price of our Class A common stock could decline due to the materialization of any of these risks, and you may lose all or part of your investment. In addition, the risks discussed below include forward-looking statements and our actual results may differ substantially from those discussed in the forward-looking statements. You should also read the section under the caption “Special Note Regarding Forward-Looking Statements” in Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations.
Risks Related to Our Business and Industry
Our rapid growth may not be sustainable or indicative of our future growth.
Our recent rapid growth, including in payment volumes, may not be sustainable or indicative of our future growth. Even though the number of billers and consumers who use our platform has grown rapidly in recent years, there can be no assurance that we will be able to attract new billers or retain existing billers. Our costs associated with retaining revenue from existing billers are substantially lower than costs associated with attracting and generating revenue from new billers or costs associated with generating increased adoption of our platform by existing billers. Therefore, if we are unable to retain revenue from existing billers, even if related losses are offset by an increase in new billers or increased adoption of our platform by existing billers, our operating results could be adversely impacted.
Our ability to attract new billers, retain revenue from existing billers or increase adoption of our platform by both new and existing billers is impacted by a number of factors, including:
our transaction fees and certain of our billers’ ability to pass them on to consumers;
our ability to timely expand the functionality and scope of our platform;
36
our ability to maintain the rates at which our billers pay us and continue to use our platform;
competitive factors, including the introduction of competing solutions, discount pricing and other strategies that may be implemented by our competitors;
our ability to maintain high-quality customer support for billers and consumers;
our ability to attract and retain strategic partners, software partners and IPN, partners;
our ability to expand into new industries and market segments;
actual or perceived privacy or security breaches or incidents;
the frequency and severity of any system outages, technological changes or similar issues;
our ability to successfully identify and acquire or invest in businesses, products or technologies that we believe could complement or expand our platform;
our ability to increase awareness of our brand and successfully compete with other companies;
our ability to expand internationally; and
our focus on long-term value over short-term results, meaning that we may make strategic decisions that may not maximize our short-term revenue or profitability if we believe that the decisions are consistent with our mission and will improve our financial performance over the long-term.
Our business could be harmed if we fail to manage our infrastructure to support future growth.
The rapid growth we have experienced in our business places significant demands on our operational infrastructure. The scalability and flexibility of our platform depends on the functionality of our technology and network infrastructure and its ability to handle increased traffic and demand for bandwidth. The growth in the number of billers and partners using our platform and the number of bills processed through our platform has increased the amount of data that we process. Any problems with the transmission of increased data and bills could result in harm to our brand or reputation. Moreover, as our business grows, we will need to devote additional resources to improving our operational infrastructure and continuing to enhance its scalability in order to maintain the performance of our platform, including customer support, risk and compliance operations and professional services. Any failure of or delay in these efforts could result in service interruptions, impaired system performance and reduced biller, partner and consumer satisfaction. If sustained or repeated, these performance issues could reduce the attractiveness of our platform to billers and partners and could result in lost biller and partner opportunities and higher attrition rates, any of which could hurt our revenue growth, biller and partner loyalty and our reputation. Even if our efforts to scale our business are successful, they will be expensive and complex, and require the dedication of significant management time and attention. We could also face inefficiencies or service disruptions as a result of our efforts to scale our internal infrastructure. We cannot be sure that the expansion and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could adversely affect our business, operating results and financial condition.
Moreover, our rapid growth has placed, and will likely continue to place, a significant strain on our managerial, administrative, operational, financial and other resources. We have grown substantially in the past three years and intend to further expand our overall business, including headcount, with no assurance that our revenue will continue to grow or grow sufficiently to offset the costs associated with increased headcount. As we grow, we will be required to continue to improve our operational and financial controls and reporting procedures and we may not be able to do so effectively. Furthermore, some members of our management do not have significant experience managing a large public company, so our management may not be able to manage such growth effectively. In managing our growing operations, we are also subject to the risks of over-hiring and over-compensating our employees and over-expanding our operating infrastructure. As a result, we may be unable to manage our expenses effectively in the future, which may negatively impact our gross profit or operating expenses.
In addition, we believe that an important contributor to our success has been our corporate culture, which we believe fosters innovation, and is rooted in a philosophy of aligning our success with that of billers, partners and consumers. As a result of our rapid growth, a significant portion of our employees have been with us for fewer than three years. As we continue to grow and develop the infrastructure of a public company, we must effectively integrate, develop and motivate a growing number of new employees, who will be dispersed geographically, with our headquarters in Redmond, Washington and a large employee presence in Toronto, Canada, Charlotte, North Carolina and Delhi, India. Our geographically dispersed workforce may make it more difficult for our management to manage our growth effectively and preserve our corporate culture. In addition, we must preserve our ability to execute quickly in further developing our platform and implementing new features and tools. As a result, we may find it difficult to maintain our corporate culture, which could limit our ability to innovate and operate effectively. Any failure to preserve our culture could also negatively
37
affect our ability to recruit and retain personnel, to continue to perform at current levels or to execute on our business strategy effectively and efficiently.
If we are unsuccessful in establishing, growing or maintaining partnerships, our ability to compete could be impaired, and our operating results may suffer.
We rely on integration of our end-to-end electronic bill payment solution into third-party software products, which enables us to power such software products’ bill payment capabilities. We also rely on strategic partners, such as U.S. Bank, JPMorgan Chase and a major payroll solutions provider, and industry-expert partners to refer new billers to our platform. Additionally, the IPN is our patented and proprietary network that enables partners, such as PayPal, Walmart, a leading global ecommerce retailer and banks, to embed our end-to-end electronic bill payment solution into their ecosystems through a single point of access. Collectively, our software, strategic and IPN partners drive increased transaction volume and adoption of our platform.
To grow our business, we will seek to expand our existing and establish additional relationships with strategic, software and IPN partners. Establishing such relationships, particularly with financial institutions and other large enterprises, entails extensive sales and marketing efforts with no guarantee of success. Sales and marketing to large organizations involve risks that may not be present, or that are present to a lesser extent, with sales and marketing to other, smaller organizations. We must invest significant time educating and selling to multiple management and technical decision-makers to obtain their support. In addition, we may be required to meet wide-ranging and detailed ancillary requirements. For example, financial institutions generally require us to submit to an exhaustive security audit, given the sensitivity and importance of storing consumer billing and payment data on our platform. Adoption is also frequently subject to budget constraints and unplanned administrative, processing and other delays, including considerable efforts to negotiate and document relationships. Further, platform deployment and integration with partners’ software and other solutions requires significant efforts. If we are unable to increase adoption of our platform by partners and manage the costs associated with marketing our platform to potential partners and integrating with their systems, our business, operating results and financial condition may be adversely affected. In addition, if we are unsuccessful in establishing, growing or maintaining partnerships, our ability to compete could be impaired, and our operating results may suffer. If we lost one or more of our largest partnerships, we could also lose associated biller relationships or payment channels and our business, operating results and financial condition could be harmed.
If we are unable to increase our revenue at a rate sufficient to offset expected increases in our costs, or if the investments we make in our business fail to generate the expected benefits, our business, operating results and financial condition will be harmed and we may not be able to maintain profitability over the long term.
As we scale our business, we expect to continue to expend substantial financial and other resources on:
sales and marketing, including an expansion of our sales organization and new initiatives in order to drive further expansion of our IPN and partner ecosystem;
our technology infrastructure, including systems architecture, scalability, availability, performance and security;
product development, including investments in our product development team and the development of new products and new functionality for our AI-enabled platform;
regulatory compliance and risk management;
acquisitions or strategic investments;
expansion into new channels, verticals and international markets; and
general administration, including increased legal and accounting expenses associated with being a public company.
The increased costs associated with these and other investments we may make in our business may fail to generate the expected benefits. If we are unable to increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, operating results and financial condition will be harmed, and we may not be able to maintain profitability over the long term. In particular, we expect net income and adjusted EBITDA may decline in the near-term as we make investments in our platform and incur increased operating costs associated with being a public company.
Additionally, we anticipate that our growth rate will decline over time to the extent that the number of billers using our platform increases and we achieve higher market penetration rates. As our growth rate declines, investors’ perception of our business may be adversely affected and the market price of our Class A common stock could decline as a result. To the extent our growth rate slows, our business performance will become increasingly dependent on our ability to retain revenue from existing billers and increase adoption of our platform by existing billers.
Our sales efforts to large enterprises involve considerable time and expense with long and unpredictable sales cycles.
38
One of the factors affecting our growth and financial performance is the adoption of our platform by large enterprise billers over legacy solutions and in-house proprietary technologies or our competitor’s products. To increase adoption within large enterprise billers and to attract new large enterprise billers, we primarily rely on our direct sales team. As part of our sales efforts, we invest considerable time and expense evaluating the specific organizational needs of potential billers and educating these potential billers about the technical capabilities and value of our platform. Because large enterprises tend to have more consumers impacted by a switch in billing services, they often evaluate our platform at multiple levels within their organization, each of which often have specific requirements, and typically involve their senior management. As a result, our sales efforts to large enterprises involve considerable time and expense with long and unpredictable sales cycles, which may cause our results of operations to fluctuate.
Large enterprise billers also make product purchasing and adoption decisions based in part or entirely on factors, or perceived factors, not directly related to the features of platforms, including, among others, a biller’s projections of business growth, uncertainty about economic conditions (including as a result of the recent COVID-19 outbreak), capital budgets, anticipated cost savings from the implementation of our platform, potential preference for such biller’s internally-developed software and billing solutions, perceptions about our business and platform, more favorable terms offered by potential competitors and previous technology investments. In addition, certain decision-makers and other stakeholders within potential billers tend to have vested interests in the continued use of internally developed solutions or other existing electronic payment and billing solutions, which may make it more difficult for us to sell our products. As a result of these and other factors, our sales efforts to large enterprises typically require an extensive effort throughout the organization and a significant investment of human resources, expense and time, including by our senior management, and there can be no assurances that we will be successful in making a sale. If our sales efforts to a potential biller do not result in sufficient revenue to justify our investments, our business, operating results and financial condition could be adversely affected.
The COVID-19 pandemic could have a material adverse impact on our employees, billers, partners, consumers and other key stakeholders, which could materially and adversely impact our business, operating results and financial condition
The COVID-19 pandemic and efforts to control its spread have significantly curtailed the movement of people, goods and services in the United States, where we generate substantially all of our revenue, and worldwide, where we are targeting future growth. It has also caused extreme societal, economic and financial market volatility, resulting in business shutdowns and a global economic downturn. The extent of the impact of the COVID-19 pandemic on our operational and financial performance will depend on future developments, including the duration, spread and severity of the pandemic, the availability, effectiveness and uptake of vaccines for COVID-19, the emergence of new variants of COVID-19 and whether existing vaccines are effective with respect to such variants, the actions to contain the disease or mitigate its impact, and the duration, timing and severity of the impact on consumer behavior, including any recession resulting from the pandemic, all of which are unpredictable.
In light of the uncertainty relating to the spread of COVID-19, we have taken precautionary measures intended to reduce the risk of the virus spreading to our employees, billers and partners, and we may take further precautionary measures. In particular, governmental authorities have at times instituted, and in the future may institute, shelter-in-place policies and other restrictions in many jurisdictions in which we operate, including in Redmond, Washington, where our headquarters are located, and Toronto, Canada, Charlotte, North Carolina and Delhi, India, where we maintain significant operations, which policies and restrictions have at times required our employees to work remotely. Even as shelter-in-place policies or other governmental restrictions are lifted, we are taking, and expect to continue to take, a measured and careful approach to having employees return to offices and travel for business. These precautionary measures and policies could negatively impact employee productivity, training and collaboration or otherwise disrupt our business operations. In addition, such restrictions impact certain of our sales efforts, marketing efforts and implementations, adversely affecting the effectiveness of such efforts in some cases and potentially inhibiting future growth.
In addition, the COVID-19 pandemic has disrupted and may continue to disrupt the operations of our billers and partners for an indefinite period of time, which in turn could negatively impact our business and operating results. Widespread remote work arrangements may also negatively impact our billers’ and partners’ operations, and the operations of third-party service providers who perform critical services for us, and, by extension, our operations.
Further, the extent and duration of working remotely exposes us, and our billers, partners and others with whom we have business relationships to increased risks of security breaches or incidents. The increase in remote working may also result in privacy, data protection, data security, and fraud risks, and our understanding of applicable legal and regulatory requirements, as well as the latest guidance from regulatory authorities in connection with the COVID-19 pandemic, may be subject to legal or regulatory challenge, particularly as regulatory guidance evolves in response to pandemic-related developments. Furthermore, we may need to enhance the security of our platform, our data and our internal information technology, or IT, infrastructure, which may require us to expend additional resources and may not be successful.
39
More generally, the COVID-19 pandemic has adversely affected economies and financial markets globally, potentially leading to a prolonged economic downturn, which could decrease technology spending, lengthen sales and implementation cycles, and adversely affect demand for our products and harm our business and operating results. The COVID-19 pandemic may delay, or prevent us from making, collections, and disrupt our ability to develop or enhance offerings. As the COVID-19 pandemic persists, government authorities and companies may continue to implement or reimpose restrictions or policies that could adversely impact consumer spending and payment volumes, global capital markets, the global economy and the market price of our Class A common stock.
We are subject to economic and geopolitical risk, the business cycles and credit risk of our billers and partners and their consumers, and the overall level of consumer, business and government spending, which could negatively affect our business, operating results and financial condition.
The electronic bill presentment and payment services industry depends heavily on the overall level of consumer, business and government spending. We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits. A sustained deterioration in general economic conditions in the markets in which we operate or increases in interest rates may adversely affect our financial performance by reducing the number or average payment amount of transactions made using electronic bill payments on our platform. Relatedly, a reduction in the amount of consumer spending could result in a decrease in our revenue and profit. If our billers present fewer bills to consumers using electronic billing or consumers making electronic bill payments spend less per transaction, we will have fewer transactions to process or lower transaction amounts, each of which would contribute to lower revenue. These developments could have a material adverse impact on our business, operating results and financial condition.
Further, a downturn in the economy could force our billers or partners or their consumers to close or declare bankruptcy, resulting in lower revenue and earnings for us and greater exposure to potential credit losses and future transaction declines. We also have a certain amount of fixed and other costs, including rent and salaries, which could limit our ability to quickly adjust costs and respond to changes in our business and the economy. Changes in economic conditions could also adversely affect our future revenue and profit and cause a materially adverse effect on our business, operating results and financial condition.
The markets in which we participate are competitive, and if we do not compete effectively, our business, operating results and financial condition could be harmed.
The market for electronic bill presentment and payment services is fragmented, competitive and constantly evolving. Our primary competitors are legacy solution providers and financial institutions with internally developed solutions for bill presentment and payment services. With the introduction of new technologies and market entrants, we expect that the competitive environment will remain intense. Legacy solution providers, new market entrant solution providers and financial institutions may internally develop products, acquire existing, third-party products or enter into partnerships or other strategic relationships that would enable them to expand their product offerings to compete with our platform, provide more comprehensive offerings than they individually had offered or achieve greater economies of scale than us.
These legacy solution providers and financial institutions may have the operating flexibility to bundle competing solutions with other offerings, and may offer them at a lower price or for no additional cost to billers as part of a larger sale. Legacy solution providers offer solutions for in-person cash payments, check-based mail payments, prior-generation interactive voice response, or IVR, phone-based payments and web-based payments, as well as a variety of point solutions for various payment needs.
In addition, new entrants not currently considered to be competitors may enter the market through acquisitions, partnerships, or strategic relationships. New market entrants include a variety of payment processing vendors, particularly those focused on online and mobile payments, as well as mobile wallets and other offerings. Many of these new entrants are also potential partners of ours. As we look to market and sell our platform to potential billers or strategic partners with existing solutions, we must convince their internal stakeholders that our platform is superior to their current solutions.
We compete on several factors, including:
product features, quality and breadth and depth of functionality;
ease of deployment and implementation speed;
ease of integration with leading billing and enterprise software, customer information systems and banking technology infrastructures;
ability to automate processes;
cloud-based delivery architecture;
advanced security, reliability, customer service and control features;
40
data asset size and ability to leverage artificial intelligence, or AI, to grow faster and smarter;
regulatory compliance leadership;
brand awareness and reputation;
pricing, total cost of ownership and return on investment; and
Our competitors vary in size, breadth, and scope of the products and services offered. Many of our current and potential competitors have greater name recognition, longer operating histories, more established biller and consumer relationships, larger marketing budgets and greater resources than us. Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards and requirements.
For these reasons, we may not be able to compete successfully or continue to achieve or maintain market acceptance for our platform, any of which would harm our business, operating results and financial condition.
Our revenue is sensitive to shifts in payment mix.
A substantial majority of our revenue is derived from transaction fees, either absorbed by billers or paid by consumers, and the majority of bills on our platform are paid via credit or debit cards. In general, we receive more revenue for card-based payments than for electronic check and automated clearing house, or ACH, payments. Accordingly, if more consumers start paying their bills by electronic check, ACH or other payment methods with lower transaction fees, it could materially impact our operating results.
We expect fluctuations in our operating results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our operating results, the market price of our Class A common stock could decline.
Our rapid growth makes it difficult for us to forecast our future operating results. Our operating results have fluctuated in the past and are expected to fluctuate in the future due to a variety of factors, many of which are outside of our control. As a result, our past results may not be indicative of our future performance.
In addition to the other risks described herein, factors that may affect our operating results include the following:
fluctuations in demand for our platform;
our ability to attract new billers and retain and increase adoption by our existing billers;
our ability to expand our relationships with our partners and identify and attract new partners;
changes in payment method preferences and channels by consumers, which may affect our revenue and gross margin, particularly as a result of interchange fees;
variations across the industries of our billers, which may affect payment methods used by consumers and average payment amounts and, in turn, our revenue and gross margin, particularly as a result of interchange fees;
the continued impact of the COVID-19 pandemic on our operating results, liquidity and financial condition and on our employees, billers, partners, consumers and other key stakeholders;
changes in biller preference for cloud-based services as a result of security breaches and incidents in the industry or privacy concerns, or other security or reliability concerns regarding our products;
fluctuations or delays in purchasing decisions in anticipation of new products or product enhancements by us or our competitors;
changes in biller and consumer budgets and in the timing of their budget cycles and purchasing decisions;
potential and existing billers choosing our competitors’ products or developing their own solutions in-house;
the development or introduction of new platforms or services that are easier to use or more advanced than our current platform and suite of services;
our ability to adapt to new forms of payment that become widely accepted, including cryptocurrencies;
the adoption or retention of more entrenched or rival services in the international markets where we compete or plan to compete;
our ability to control costs, including our operating expenses;
41
the amount and timing of payment for operating expenses, particularly research and development and sales and marketing expenses, including commissions;
the amount and timing of non-cash expenses, including stock-based compensation, goodwill impairments and other non-cash charges;
the amount and timing of costs associated with recruiting, training and integrating new employees, and retaining and motivating existing employees;
the effects of acquisitions and their integration;
general economic conditions, both domestically and internationally, as well as economic conditions specifically affecting industries in which our billers operate;
the impact of new accounting pronouncements;
changes in the competitive dynamics of our markets;
security breaches of and incidents impacting, technical difficulties with, or interruptions to, the delivery and use of our platform; and
awareness of our brand and our reputation in our target markets.
Any of these and other factors, or the cumulative effect of some of these factors, may cause our operating results to vary significantly. In addition, we expect to incur significant additional expenses due to the increased costs of operating as a public company. If the assumptions used to plan our business are incorrect, our revenue may fail to meet our expectations and we may fail to meet profitability expectations. Further, if our quarterly operating results fall below the expectations of investors and securities analysts who follow our Class A common stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class action lawsuits.
We depend on third-party payment processors to process bill payments made on our platform and our business, operating results and reputation could be harmed if we experience service interruptions related to our payment processors.
We depend on third-party payment processors, including PayPal’s Braintree service, to process bill payments made through various channels on our platform, including credit and debit cards, ACH transfers, eChecks and PayPal. The per-transaction settlement fees we pay under our agreements with payment processors collectively comprise a significant portion of our cost of revenue. We also rely on payment processors to collect and store payment card information and provide certain fraud detection services. Our multiyear agreements with payment processors contain industry-standard terms and conditions, including technical requirements for how we must process and settle transactions and chargebacks. These agreements also obligate us to comply with card networks’ security standards and guidelines, and to reimburse the payment processors for any fines they are assessed by payment networks as a result of any rule violations by us. See the section titled “—Risks Related to Regulation—We are required to comply with payment network operating rules and changes to such rules or payment network fees could harm our business.”
If any of our payment processors were to terminate its relationship with us, whether as a result of a failure by us to meet our contractual obligations or for other reasons, or if any of them were to refuse to renew its agreement with us on commercially reasonable terms, we would need to engage one or more alternate payment processors. In that case, we could experience service interruptions and incur significant expenses in arranging for replacement payment processing services. Such interruptions could also negatively impact our reputation and our relationships with existing or potential billers and partners, as well as cause us to become obligated to provide service credits or refunds under our service level commitments. Likewise, our payment processors have in the past and may in the future experience outages that have and may cause us to temporarily lose our ability to process transactions on our platform. If any of our payment processors fails to meet our standards and expectations, becomes compromised or suffers errors, outages or vulnerabilities, we could temporarily lose our ability to process transactions on our platform until such issues have been remedied or we have engaged one or more alternate payment processors.
We operate in an emerging and evolving market, which may develop more slowly or differently than we expect. If our market does not grow as we expect, or if we cannot expand our platform to meet the demands of this market, our revenue may decline or fail to grow.
Our primary competition remains the legacy processes that billers have relied on for many years, such as physical bills, physical checks and non-scalable legacy IVR and similar systems, as well as systems developed internally by financial institutions. Our success depends to a substantial extent on the widespread adoption of our cloud-based electronic billing and payment platform as an alternative to these existing solutions and adoption by billers that are not using any such solutions at all. Some organizations may be reluctant or unwilling to use our platform for several reasons,
42
including concerns about additional costs, uncertainty regarding the reliability and security of cloud-based offerings or lack of awareness of the benefits of our platform. Our ability to expand sales of our platform depends on several factors, including prospective billers’ awareness of our platform; the timely completion, introduction and market acceptance of enhancements to our platform or new products that we may introduce; the effectiveness of our marketing programs; the costs of our platform and the ability of billers to pass on transaction costs to their consumers; and the success of competing solutions. If we are unsuccessful in developing and marketing our platform, or if organizations do not perceive or value the benefits of our platform as an alternative to legacy systems, the market for our platform may not continue to develop or may develop more slowly than we expect, either of which would harm our business, operating results and prospects.
Our risk management efforts may not be effective to prevent fraudulent activities, which could expose us to material financial losses and liability and otherwise harm our business.
We offer a software platform that automates the entire bill payment lifecycle, providing electronic bill presentment, consumer engagement and payment processing for a large number of billers and consumers. We are responsible for verifying the identity of our billers, and monitoring transactions for fraud. We and our billers have been in the past and will continue to be targeted by parties who seek to commit acts of financial fraud using techniques such as stolen identities and bank accounts, compromised business email accounts, employee or insider fraud, account takeover, false applications and check fraud. We may suffer losses from acts of financial fraud committed by or against our billers or partners or their consumers, our employees or other third-parties.
The techniques used to perpetrate fraud on our platform are continually evolving, and we expend considerable resources to continue to monitor and combat them. In addition, when we introduce new products and functionality, or expand existing products, we may not be able to identify all risks created by the new products or functionality. Our risk management policies, procedures, techniques and processes may not be sufficient to identify all of the risks to which we are exposed, to enable us to prevent or mitigate the risks we have identified or to identify additional risks to which we may become subject in the future. Furthermore, our risk management policies, procedures, techniques and processes may contain errors or our employees or agents may commit mistakes or errors in judgment as a result of which we may suffer large financial losses. The software-driven and highly automated nature of our platform could enable criminals and those committing fraud to cause significant losses to our business. As greater numbers of billers, partners and consumers use our platform, our exposure to material risk of losses from a single user, or from a small number of users, will increase.
Our current business and anticipated domestic and international growth will continue to place significant demands on our risk management efforts, and we will need to continue developing and improving our existing risk management infrastructure, policies, procedures, techniques and processes. As techniques used to perpetrate fraud on our platform evolve, we may need to modify our products or services to mitigate fraud risks. As our business grows and becomes more complex, we may be less able to forecast and carry appropriate reserves on our books for fraud related losses. Further, these types of fraudulent activities on our platform can also expose us to civil and criminal liability and governmental and regulatory sanctions as well as potentially cause us to be in breach of our contractual obligations to our third-party partners.
If we lose our founder and chief executive officer or other key members of our management team, or if we are unable to attract and retain executives and employees we need to support our operations and growth, our business may be harmed.
Our success and future growth depend upon the continued services of our management team and other key employees. Dushyant Sharma, our founder, chairman, president and chief executive officer, is critical to our overall management, as well as the continued development of our products, partnerships, culture and strategic direction. From time to time, there may be changes in our management team resulting from the hiring or departure of executives and key employees, which could disrupt our business. Our senior management and key employees are employed on an at-will basis. We currently do not have “key person” insurance on any of our employees. Certain of our key employees have been with us for a long period of time and have fully vested stock options that may become valuable and are publicly tradable, subject to lock-up restrictions and Rule 144 limitations, which reduces the incentive for each of these key employees to remain at our company. The loss of our founder and chief executive officer, or one or more of our other senior management members, or other key employees, including due to illness resulting from COVID-19, could harm our business, and we may not be able to find adequate replacements. We cannot ensure that we will be able to retain the services of any members of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart.
Failure to attract and retain additional qualified personnel and any restrictions on the movement of personnel could prevent us from executing our business strategy and growth plans.
To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executive officers, software developers, compliance and risk management personnel and other key employees in our industry and
43
location is intense and increasing. We compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software and payment systems, as well as for skilled legal and compliance and risk operations professionals. Many of the companies with which we compete for experienced personnel have greater resources than we do and can frequently offer such personnel substantially greater compensation than we can offer. In addition, a new or revised visa program, and in particular one that limits the availability of H1-B and other visas, may impact our ability to recruit, hire, retain or effectively collaborate with qualified skilled personnel, including in the areas of AI and machine learning, and payment systems and risk management, which could adversely impact our business, operating results and financial condition. If we fail to identify, attract, develop and integrate new personnel, or fail to retain and motivate our current personnel, our growth prospects would be adversely affected.
If we fail to offer high-quality customer support, if we experience complaints regarding our customer support or if our support is more expensive than anticipated, our business and reputation could suffer.
Billers and their consumers rely on our customer support services to resolve issues and realize the full benefits provided by our platform. High-quality support is also important to maintain and drive further adoption by our existing billers and their consumers. We primarily provide customer support to billers over email, with some additional support provided over chat and through our platform, and to consumers over the phone. If we do not help our billers and their consumers quickly resolve issues and provide effective ongoing support, or if our support personnel or methods of providing support are insufficient to meet the needs of our billers and their consumers, our ability to retain billers, increase adoption by our existing billers and acquire new billers could suffer, and our reputation with existing or potential billers could be harmed. In addition, biller and consumer complaints or negative publicity about our customer service could diminish confidence in and use of our products or services. Effective customer service requires significant expenses, which, if not managed properly, could negatively impact our profitability. If we are not able to meet the customer support needs of our billers and their consumers during the hours that we currently provide support, we may need to increase our support coverage and provide additional support by other means and methods, which may reduce our profitability.
If the fees we charge are unacceptable to our billers or their consumers, our business, operating results and financial condition could be harmed.
We generate substantially all of our revenue by charging billers fees on a per-transaction basis. As the market for our platform matures, or as new or existing competitors introduce new products or services that compete with ours, we may experience pricing pressure and be unable to renew our agreements with existing billers or attract new billers at fee levels that are consistent with our pricing model and operating budget. Our pricing strategy for new products we introduce may prove to be unappealing to our billers or consumers, and our competitors could choose to bundle certain products and services competitive with ours and offer them at lower prices. If this were to occur, it is possible that we would have to change our pricing strategies or reduce our prices, which could harm our business, operating results and growth prospects.
Further, a significant portion of our revenue is generated from billers that elect to pass on transaction fees to consumers in the form of convenience fees. In certain markets, such as utilities and municipalities, convenience fees are commonplace. Despite the fact that such fees are relatively standard, they are often met with negative consumer perception, which could lead to heightened regulatory scrutiny and further pricing pressure.
If we fail to meet our service level commitments, we could be obligated to provide credits or refunds or face contract terminations, which could adversely affect our business, operating results and financial condition.
Certain of our agreements with our billers and partners contain service level commitments, including commitments regarding the accuracy of information and data we provide and how quickly we will respond to support inquiries. If we are unable to meet the stated service level commitments or our platform suffers extended periods of unavailability or downtime, we may be contractually obligated to provide these parties with service credits or refunds. In addition, certain billers could shift to using a different solution such that we would no longer be their exclusive payment provider and we could also face contract terminations, either of which would adversely affect our future revenue. Further, any extended service outages could adversely affect our reputation, revenue and operating results.
If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations and changing business needs, requirements or preferences, our products may become less competitive and our growth rate could decline.
The market for electronic bill presentment and payment services is relatively new and subject to ongoing technological change, evolving industry standards, payment methods and changing regulations, and changing biller and consumer needs, requirements and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including launching new products and services. The success of any new product and service, or any enhancements or modifications to existing products and services, depends on several factors, including the timely completion, introduction and market acceptance of such products and services, enhancements and modifications. If we are unable to enhance our platform, add new payment methods or develop new
44
products that keep pace with technological and regulatory change and achieve market acceptance, or if new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently or more securely than our products, our business, operating results and financial condition would be adversely affected. Moreover, we may experience delays in the development and introduction of new products due to the effects of the COVID-19 pandemic. Furthermore, modifications to our existing platform or technology will increase our research and development expenses. Any of the foregoing could reduce the demand for our services, result in biller, partner and consumer dissatisfaction and adversely affect our business.
Failure to effectively develop and expand our sales and marketing capabilities could harm our ability to increase our biller base and achieve broader market acceptance of our products.
Our ability to increase our biller base and achieve broader market acceptance of our platform will depend to a significant extent on our ability to expand our sales and marketing organizations, and to deploy our sales and marketing resources efficiently. Although we will adjust our sales and marketing spend levels as needed in response to changes in the economic environment, we plan to continue expanding our direct sales team as well as our sales team focused on identifying partnerships. These efforts will require us to invest significant financial and other resources. We may not achieve anticipated revenue growth from expanding our sales team if we are unable to hire, develop, integrate and retain talented and effective sales personnel, if our new and existing sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if our sales and marketing programs are not effective. Our business and operating results will be harmed if our sales and marketing efforts do not generate significant increases in revenue.
We plan to expand our operations internationally by targeting international billers and partners, and further expanding use of our platform internationally among our existing international billers and partners, which will create a variety of operational challenges.
A component of our growth strategy involves expanding our operations internationally. Although 98% of our 2020 revenue was generated in the United States, many of our largest billers have billable consumers in international geographies. We are continuing to adapt to and develop strategies to expand to international geographies. However, there is no guarantee that such efforts will have the desired effect or that we will be able to grow our international footprint without unexpected delay or expense when international expansion opportunities arise. If we invest substantial time and resources to further expand our operations internationally and are unable to do so successfully, cost-effectively and in a timely manner, our business and operating results may suffer.
Our international operations strategy involves a variety of risks, including:
changes in regulations and our ability to comply with and obtain any relevant licenses;
currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions;
reduction in cross-border trade and other adverse impacts resulting from trade sanctions or changes in trade relations, laws or regulations;
potential application of more stringent regulations relating to payments, privacy, data protection and information security, and the authorized use of, or access to, sensitive and personal data;
exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act, or FCPA, U.S. domestic bribery laws and similar laws and regulations in other jurisdictions; and
unexpected changes in tax laws.
Acquisitions and strategic investments could be difficult to identify and integrate, divert the attention of management, disrupt our business, dilute stockholder value and adversely affect our business, operating results and financial condition.
In August 2021, we entered into an agreement to acquire Payveris and we may in the future seek to acquire or invest in additional businesses, products or technologies that we believe could further complement or expand our platform, enhance our technical capabilities or otherwise offer growth opportunities. Acquisitions may divert management’s time and focus from operating our business and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not such acquisitions are completed. Acquisitions also may require us to spend a substantial portion of our available cash, incur debt or other liabilities, amortize expenses related to intangible assets or incur write-offs of goodwill or other assets. In addition, integrating an acquired business or technology is risky. Completed and future acquisitions may result in unforeseen operational difficulties and expenditures associated with:
incorporating new businesses and technologies into our infrastructure;
45
consolidating operational and administrative functions;
coordinating outreach to our community;
maintaining morale and culture and retaining and integrating key employees;
maintaining or developing controls, procedures and policies (including effective internal control over financial reporting and disclosure controls and procedures); and
identifying and assuming liabilities related to the activities of the acquired business before the acquisition, including liabilities for violations of laws and regulations, intellectual property issues, commercial disputes, taxes and other matters.
Moreover, we may not benefit from our acquisitions as we expect, or in the time frame we expect. Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, as well as unfavorable accounting treatment and exposure to claims and disputes by third parties, including intellectual property claims. We also may not generate sufficient financial returns to offset the costs and expenses related to any acquisitions. In addition, if an acquired business fails to meet our expectations, our business, operating results and financial condition may suffer. Acquisitions could also be viewed negatively by analysts or investors, which could cause our stock price to decline.
If we fail to maintain and enhance our brand, our ability to expand our business, operating results and financial condition could be adversely affected.
We believe that maintaining and enhancing the Paymentus brand is important to support the marketing and sale of our existing and future products to new billers and partners and to increase adoption of our platform by existing billers and partners. Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing and demand generation efforts, our ability to provide reliable products that continue to meet the needs of our billers and consumers at competitive prices, our ability to maintain our billers’ and consumers’ trust, our ability to continue to develop new functionality and products and our ability to successfully differentiate our products from competitive products and services. Our promotion activities may not generate brand awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. Further, any negative publicity about our industry, our company, the quality and reliability of our products and services, our risk management processes, our privacy, data protection or information security practices, litigation, regulatory activity or the experience of billers and partners with our products or services could harm our reputation. If we fail to successfully promote and maintain our brand, our business, operating results and financial condition could be adversely affected.
We may require additional capital to support the growth of our business, and this capital might not be available on acceptable terms, if at all.
We have funded our operations since inception primarily through equity financings and cash from operations. We intend to continue to make investments to support our business, which may require us to engage in equity, equity-linked or debt financings to secure additional funds. Additional financing may not be available on terms favorable to us, if at all. The market prices for other technology companies have been highly volatile as a result of the COVID-19 pandemic and related governmental actions, which may also reduce our ability to access capital on favorable terms or at all and adversely impact the market price of our Class A common stock. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, financial condition and prospects. If we incur debt, the debt holders would have rights senior to holders of our Class A common stock to make claims on our assets, and the terms of any debt could restrict our operations, including our ability to pay dividends on our Class A common stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our Class A common stock.
Because our decision to issue securities in the future will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the market price of our Class A common stock and diluting their interests.
Natural catastrophic events, pandemics and man-made problems such as power disruptions, computer viruses, security breaches and incidents and terrorism may disrupt our business.
Natural disasters, pandemics such as COVID-19 or other catastrophic events may cause damage or disruption to our operations, commerce in general and the global economy, and thus could harm our business. Our headquarters are located in Redmond, Washington and we have a large employee presence in Toronto, Canada, Charlotte, North Carolina, and Delhi, India. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war or terrorist attack affecting regions where we maintain operations or where our data centers are located, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our services, breaches of
46
data security and loss of critical data, any of which could harm our business, operating results and financial condition. In addition, the COVID-19 pandemic other governmental restrictions have caused most of our employees to work remotely. Given these widespread remote work arrangements, if a natural disaster, power outage, connectivity issue or other event occurs that impacts our employees’ ability to work remotely, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time.
Additionally, as computer malware, viruses, computer hacking, intrusions, ransomware attacks, denial-of-service attacks, social engineering attacks, fraudulent use attempts, phishing attacks and other security breaches and incidents have become more prevalent, we, and third parties upon which we rely, face increased risk in maintaining the performance, reliability, security and availability of our solutions and related services and technical infrastructure to the satisfaction of our billers, partners and consumers. Any computer malware, viruses, computer hacking, intrusions, ransomware attacks, denial-of-service attacks, social engineering attacks, fraudulent use attempts, phishing attacks or other security breaches and incidents related to our network infrastructure or information technology systems or to computer hardware we lease from third parties, could, among other things, harm our reputation and our ability to retain existing billers and partners and attract new billers and partners.
In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance. The successful assertion of one or more large claims against us that exceed available insurance coverage, the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, or denials of coverage, could have a material adverse effect on our business, operating results, financial condition and reputation.
Any future litigation, investigations or similar matters, or adverse facts and developments related thereto, could adversely affect our business, operating results and financial condition.
We have in the past and may in the future become subject to legal proceedings, claims, investigations or similar matters that arise in the ordinary course of business, such as claims brought by our billers or their consumers in connection with commercial disputes, employment claims made by our current or former employees or claims regarding misappropriation of consumer data. Litigation, investigations or similar matters might result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, operating results and financial condition. Insurance might not cover such matters, might not provide sufficient payments to cover all the costs to resolve one or more such matters and might not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our operating results and leading analysts or potential investors to reduce their expectations of our performance, which could reduce the market price of our Class A common stock.
Risks Related to Regulation
Payments and other financial services-related regulations and oversight are material to our business and any failure by us to comply could materially harm our business.
The local, state and federal laws, rules, regulations, licensing schemes and industry standards that govern our business, both directly and through our relationships with banks, card networks and other financial services partners, include, or may in the future include, those relating to payments services, such as payment processing and settlement services, anti-money laundering, combating terrorist financing, escheatment, international sanctions regimes and compliance with the Payment Card Industry Data Security Standard, or PCI-DSS, a set of requirements designed to ensure that all companies that process, store or transmit payment card information maintain a secure environment to protect cardholder data. We do not directly collect or store payment card information; instead, we rely on a third-party payment processor to do so. These laws, rules, regulations, licensing schemes and standards are enforced by multiple authorities and governing bodies in the United States, including the Department of the Treasury, self-regulatory organizations and numerous state and local agencies. Currently, we do not possess any permits or licenses from financial regulators. We believe the licensing requirements of federal and state agencies that regulate or monitor banks or other types of providers of electronic commerce services do not apply to us. While our business itself is not currently subject to financial services-related regulation, and we have received confirmation from multiple state regulators that we are not required to obtain money transmitter licenses in those states, the banks, payment networks and card networks that we partner with operate in a highly regulated landscape and there is a risk that those regulations could become directly applicable to us. As we expand into new jurisdictions, the number of foreign laws, rules, regulations, licensing schemes and standards governing our business will expand as well. In addition, as our business and products continue to develop and expand, we may become subject to additional laws, rules, regulations, licensing schemes and standards. We may not always be able to accurately predict the scope or applicability of certain laws, rules, regulations, licensing schemes or standards to our business, particularly as we expand into new areas of operations, which could have a significant negative effect on our existing business and our ability to pursue future plans.
47
In the future, as a result of the regulations that are or may become applicable to our business, we could be subject to investigations and resulting liability, including governmental fines, restrictions on our business or other sanctions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions or be required to obtain additional licenses, certifications or regulatory approvals. There can be no assurance that we will be able to successfully implement changes to our business practices or obtain or maintain any such licenses, certifications or regulatory approvals, and, even if we were able to do so, there could be substantial costs and potential product changes involved in obtaining, maintaining and renewing such licenses, certifications and approvals, which could have a material and adverse effect on our business. In addition, we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance or other requirements of such licenses, certifications or approvals. These factors could impose substantial additional costs, involve considerable delay to the development or provision of our products or services, require significant and costly operational changes or prevent us from providing our products or services in any given market.
We are required to comply with payment network operating rules and changes to such rules or payment network fees could harm our business.
Payment networks, such as Visa, Mastercard, American Express, NACHA and INTERAC, establish their own rules and standards that allocate liabilities and responsibilities among the payment networks and their participants. These rules and standards, including PCI-DSS, govern a variety of areas, including how consumers may use their cards, the security features of cards, security standards for processing, data protection and information security and allocation of liability for certain acts or omissions, including liability in the event of a data breach. Participants are subject to audits by the payment networks to ensure compliance with applicable rules and standards.
We are required to comply with card network operating rules and have agreed to reimburse our service providers for any fines they are assessed by payment networks as a result of any rule violations by us. We may also be directly liable to the payment networks for rule violations. The payment networks set and interpret the card operating rules. The payment networks could adopt new operating rules or interpret or reinterpret existing rules that we or our processors might find difficult or even impossible to follow or costly to implement. These changes may be made for any number of reasons, including as a result of changes in the regulatory environment, to maintain or attract new participants or to serve the strategic initiatives of the networks, and may impose additional costs and expenses on or be disadvantageous to certain participants. For example, changes in the payment network rules regarding chargebacks may affect our ability to dispute chargebacks and the amount of losses we incur from chargebacks. If we fail to make such changes or otherwise resolve the issue with the payment networks, the networks could pass on fines and assessments in respect of fraud or chargebacks related to our merchants or disqualify us from processing transactions if satisfactory controls are not maintained, which could have a material adverse effect on our business, operating results and financial condition. As a result of any violations of rules or new rules being implemented, the networks may fine, penalize or suspend the registration of participants for certain acts or omissions or the failure of the participants to comply with applicable rules and standards, existing billers, partners or other third parties may cease using or referring our services, prospective billers, partners or other third parties may choose to terminate negotiations with us, or delay or choose not to consider us for their processing needs, and the networks could refuse to allow us to process payments through their networks. Any of the foregoing could materially adversely impact our business, operating results and financial condition.
From time to time, these networks increase the fees that they charge payment processors. We could attempt to pass these increases along to our billers, but this strategy might result in the loss of billers to competing solutions. If competitive practices prevent us from passing along the higher fees to our billers in the future, we may have to absorb all or a portion of such increases, which may increase our operating costs and reduce our earnings. In addition, regulators are subjecting interchange and other fees to increased scrutiny, and new regulations could require greater pricing transparency of the breakdown in fees or fee limitations, which could lead to increased price-based competition, lower margins and higher rates of biller attrition and negatively affect our business, operating results and financial condition. As a result of any increased fees, such payments could become prohibitively expensive for us or for our billers.
We are subject to U.S. and foreign governmental laws, regulations, rules, standards, policies, contractual obligations and other legal obligations, particularly those related to privacy, data protection and information security, and our actual or perceived failure to comply with such obligations could harm our business, by resulting in litigation, fines, penalties, increased costs or adverse publicity and reputational damage that may negatively affect the value of our business and decrease the market price of our Class A common stock.
Our billers and consumers store personal and business information, financial information and other sensitive information on our platform. In addition, we receive, store, handle, transmit, use and otherwise process personal and business information and other data from and about actual and prospective billers, as well as our employees and service providers. As a result, we and our handling of data are subject to a variety of laws, rules and regulations relating to privacy, data protection and information security, including regulation by various governmental authorities, such as the
48
U.S. Federal Trade Commission, or FTC, and various state, local and foreign agencies. Our data handling and processing activities are also subject to contractual obligations and industry standard requirements. The legislative and regulatory landscapes for privacy, data protection and information security continue to evolve in jurisdictions worldwide, with an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws or regulations could result in litigation, enforcement actions, damages, fines, penalties or adverse publicity and reputational damage, any of which could have a material adverse effect on our business, operating results and financial condition.
The U.S. federal and various state and foreign governments have also adopted or proposed limitations on the collection, distribution, use and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses. In the United States, various laws and regulations apply to the security, collection, processing, storage, use, disclosure and other processing of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act, and state and local laws relating to privacy and data security. Additionally, the FTC and many state attorneys general have interpreted and are continuing to interpret federal and state consumer protection laws to impose standards for the online collection, use, dissemination, processing and security of data.
In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal data. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, in June 2018, California enacted the California Consumer Privacy Act, or the CCPA, which became operative on January 1, 2020 and broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, a new California ballot initiative, the California Privacy Rights Act, or the CPRA, was passed in November 2020. Effective beginning on January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and will significantly modify the CCPA, including by expanding California residents’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. The interpretation and enforcement of the CCPA and many aspects of the CPRA remain unclear, and the effects of the CCPA and the CPRA potentially are significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and sanctions and litigation.
Certain other state laws impose similar privacy obligations, and all 50 states have laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. For example, the CCPA has prompted the enactment of several new state laws or amendments of existing state laws, such as in New York, Nevada, Virginia and Colorado. These laws could mark the beginning of a trend toward more stringent privacy legislation in other U.S. states and have prompted a number of proposals for new federal and state-level privacy legislation. This legislation, if passed, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs or changes in business practices and policies.
In addition, several foreign countries and governmental bodies, including the European Union, or EU, have established their own laws, rules and regulations addressing privacy, data protection and information security with regard to the handling and processing of sensitive and personal data obtained from their residents with which we or our billers or partners may need to comply. These laws and regulations are in certain cases more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of various types of data, including data that identifies or may be used to identify an individual, such as names, email addresses and in some jurisdictions, IP addresses. The EU’s privacy, data protection and information security landscapes are currently evolving, resulting in possible significant operational costs for internal compliance and risk to our business. Within the EU, the General Data Protection Regulation, or GDPR, which went into effect in May 2018, contains numerous requirements and changes from previously existing EU law, including more robust, direct obligations on data processors in addition to data controllers, heavier documentation requirements for data protection compliance programs by companies and significantly increases the level of sanctions for non-compliance as compared to previous EU data protection law. In particular, under the GDPR, EU data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers and data subjects. Being subject to the GDPR, we may need to take steps to cause our processes to be
49
compliant with applicable portions of the GDPR, but we cannot assure you that we will be able to implement changes in a timely manner or without significant disruption to our business, or that such steps will be effective, and we may face the risk of liability under the GDPR. The laws and regulations relating to privacy, data protection and information security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.
We are also subject to certain obligations under the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, as well as certain state laws and related contractual obligations. HIPAA imposes obligations on certain covered entity healthcare providers, health plans and healthcare clearinghouses, as well as on business associates, like us, that perform certain services involving the use or disclosure of individually identifiable health information, including mandatory contractual terms, with respect to safeguarding the privacy, security and transmission of individually identifiable health information.
The scope and interpretation of the laws and regulations relating to privacy, data protection and information security that are or may be applicable to us are often uncertain and may be conflicting, as a result of the rapidly evolving regulatory framework for privacy issues worldwide. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices, solutions or platform capabilities. For example, laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted or the content provided by users. As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures to preserve and protect our data and our platform users’ data against loss, misuse, corruption, misappropriation caused by systems failures or unauthorized access. If our policies, procedures or measures relating to privacy, data protection, information security or the processing of data for marketing purposes or consumer communications fail to comply with laws, regulations, policies, legal obligations or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties and negative publicity, and could cause our application providers, billers and partners to lose trust in us, and have an adverse effect on our business, operating results and financial condition.
In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us. Because the interpretation and application of privacy, data protection and information security laws, regulations, rules and other standards are still uncertain, it is possible that these laws, rules, regulations and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.
Further, any failure or perceived failure by us, or any third parties with which we do business, to comply with laws, regulations, policies (including our publicly posted privacy policies), procedures, measures, legal or contractual obligations, industry standards or regulatory guidance relating to privacy, data protection or information security may result in governmental investigations and enforcement actions, litigation, fines and penalties, or adverse publicity, and could cause our billers and partners to lose trust in us, which could have an adverse effect on our reputation, business, operating results and financial condition. We expect that there will continue to be new proposed laws, regulations and industry standards relating to privacy, data protection, information security, marketing and consumer communications, and we cannot predict the impact such future laws, regulations and standards may have on our business. Future laws, regulations, standards and other obligations or any changed interpretation of existing laws or regulations may be inconsistent among jurisdictions and may conflict with our current or future practices, which could impair our ability to develop and market new functionality and maintain and grow our biller base and increase revenue. Additionally, our billers or partners may be subject to differing privacy laws, rules and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Future restrictions on the collection, use, processing, storage, sharing or disclosure of various types of data, including financial information and other personal data, or additional requirements for express or implied consent of our billers, partners or consumers for the collection, use, processing, storage, sharing and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments.
If we are not able to comply with these laws or regulations, or if we become liable under these laws or regulations, we could be directly harmed, including through fines and litigation, and we may be forced to implement new measures to reduce our exposure to this liability. This may require us to expend substantial resources or to discontinue certain products, which would negatively affect our business, operating results and financial condition. In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or
50
otherwise adversely affect the growth of our business. Furthermore, any costs incurred as a result of this potential liability could harm our operating results.
Our and our billers’ and partners’ communications with existing and potential consumers are subject to laws regulating telephone and email marketing practices, and our or their failure to comply with such communications laws could adversely affect our business, operating results and financial condition and significantly harm our reputation.
Our platform enables our billers and partners to communicate directly with their consumers, including via email, text messages and telephone calls. Our platform also enables recording and monitoring of calls between our billers and partners and their consumers for training and quality assurance purposes. On occasion we also send communications directly to consumers. These activities are subject to a variety of U.S. state and federal laws, rules and regulations, such as the Telephone Consumer Protection Act of 1991, or the TCPA, the CAN-SPAM Act of 2003, or the CAN-SPAM Act, and others related to telemarketing, recording and monitoring of communications. The TCPA prohibits companies from making telemarketing calls to numbers listed in the Federal Do-Not-Call Registry and imposes other obligations and limitations on making phone calls and sending text messages to consumers. The CAN-SPAM Act regulates commercial email messages and specifies penalties for the transmission of commercial email messages that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from senders. The TCPA, the CAN-SPAM Act and other communications laws, rules and regulations are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making compliance efforts more challenging. We and our billers and partners may be required to comply with these and similar laws, rules and regulations. To comply with these laws, rules and regulations, in some cases we rely on our billers and partners to obtain legally required consents from their consumers to receive communications sent using our platform. We cannot, however, be certain that our or their efforts to comply will always be successful. Our business could be adversely affected by changes to the application or interpretation of existing laws, rules and regulations governing our platform’s communication capabilities, or the enactment of new laws, rules and regulations, and by our and our billers’ and partners’ failure to comply with such laws, rules and regulations in using our platform. If any of these laws, rules or regulations were to significantly restrict our or our billers’ or partners’ ability to use our platform to communicate with existing and potential consumers, we may not be able to develop adequate alternative communication modules for our platform. Further, our or our billers’ or partners’ non-compliance with these laws, rules and regulations could result in significant financial penalties, litigation, including class action litigation, consent decrees and injunctions, adverse publicity and other negative consequences, any of which could adversely affect our business, operating results and financial condition and significantly harm our reputation.
If we fail to comply with extensive, complex, overlapping and frequently changing rules, regulations and legal interpretations, our business could be materially harmed.
Our success and increased visibility, and that of the electronic and online billing and payments sector more generally, may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business. We are subject to a wide variety of local, state, federal and international laws, rules, regulations, licensing schemes and industry standards in the United States and in other countries in which we operate. These laws, rules, regulations, licensing schemes and standards govern numerous areas that are important to our business. In addition to the payments and financial services-related regulations, and privacy, data protection and information security-related laws, our business is also subject to, without limitation, rules and regulations applicable to securities, labor and employment, immigration, competition and marketing and communications practices. Laws, rules, regulations, licensing schemes and standards applicable to our business are subject to change and evolving interpretations and application, including by means of legislative changes and executive orders, and it can be difficult to predict how they may be applied to our business and the way we conduct our operations, particularly as we introduce new products and services and expand into new jurisdictions. We may not be able to respond quickly or effectively to regulatory, legislative and other developments, and these changes may in turn impair our ability to offer our existing or planned features, products and services and increase our cost of doing business.
There can be no assurance that our employees or contractors will not violate laws, rules, regulations, licensing schemes and industry standards. Any failure or perceived failure by us or our employees or contractors to comply with existing or new laws, rules, regulations, licensing schemes, industry standards or orders of any governmental authority (including changes to or expansion of the interpretation of those laws, regulations, standards or orders), may, among other things:
subject us to significant fines, penalties, criminal and civil lawsuits, license suspension or revocation, forfeiture of significant assets, audits, inquiries, whistleblower complaints, adverse media coverage, investigations and enforcement actions in one or more jurisdictions levied by federal, state, local or foreign regulators, state attorneys general and private plaintiffs who may be acting as private attorneys general pursuant to various applicable federal, state and local laws;
51
result in additional compliance and licensure requirements;
increase regulatory scrutiny of our business;
restrict our operations, product features, quality and breadth and depth of functionality; and
force us to change our business practices or compliance program, make product or operational changes or delay planned product launches or improvements.
The complexity of U.S. federal and state regulatory and enforcement regimes, coupled with the current and potential future scope of our international operations and the evolving regulatory environment, could result in a single event giving rise to many overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.
Any of the foregoing could, individually or in the aggregate, harm our reputation as a trusted provider, damage our brand and business, cause us to lose existing billers and partners, prevent us from obtaining new billers and partners, require us to expend significant funds to remedy problems caused by breaches and to avert further breaches, expose us to legal risk and potential liability, and adversely affect our business, operating results and financial condition.
We identified material weaknesses in our internal control over financial reporting in connection with the preparation and audit of our financial statements for the fiscal years ended December 31, 2019 and 2020, and we may identify additional material weaknesses in the future that may cause us to fail to meet our reporting obligations or result in material misstatements of our financial statements. If we fail to remediate any material weaknesses, identify additional material weaknesses, or if we otherwise fail to establish and maintain effective internal control over financial reporting, our ability to accurately and timely report our financial results could be adversely affected.
We are required to comply with the United States Securities and Exchange Commission’s, or SEC’s rules implementing Sections 302 and 404 of the Sarbanes-Oxley Act, which requires management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of internal control over financial reporting. Though we will be required to disclose changes made in our internal control over financial reporting on a quarterly basis, we will not be required to make our first annual assessment of our internal control over financial reporting pursuant to Section 404 until the year following our first annual report required to be filed with the SEC. As an emerging growth company, our independent registered public accounting firm will not be required to attest to the effectiveness of our internal control over financial reporting pursuant to Section 404 until the later of the year following our first annual report required to be filed with the SEC or the date we are no longer an emerging growth company. If our internal control over financial reporting is not effective, management’s report and our independent registered public accounting firm’s report would be adverse.
In connection with the preparation and audit of our consolidated financial statements for the fiscal years ended December 31, 2019 and 2020, we and our independent registered public accounting firm identified certain control deficiencies in the design and implementation of our internal control over financial reporting that constituted material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented or detected on a timely basis. Our evaluation was based on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework (2013). These material weaknesses are as follows:
We lacked a sufficient number of trained professionals with an appropriate level of accounting knowledge, training and experience to appropriately analyze, record and disclose accounting matters, including accounting for capitalized internal-use software development costs, identification of reporting units, translation of foreign currency in consolidation, accounting for deferred compensation, calculation of earnings per share and classification of accounts in the financial statements. Additionally, we did not design and maintain effective controls over verifying the appropriate review and approval of journal entries.
We did not design and maintain effective controls relevant to the preparation of our financial statements with respect to certain IT, general controls for information systems. Specifically, we did not design and maintain (1) program change management controls to ensure that IT program and data changes affecting certain IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; and (2) user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to financial applications, programs and data to appropriate company personnel.
These material weaknesses resulted in misstatements related to capitalized internal-use software development costs, accumulated other comprehensive income, cost of revenue, sales and marketing expenses, research and
52
development expenses, general and administrative expenses, income tax expense, the disclosure of deferred compensation, the classification of revenue, sales and marketing expenses, research and development expenses and general and administrative expenses, the calculation of earnings per share and the disclosure of revenue by geography as of and for the year ended December 31, 2019, which resulted in the restatement of the 2019 consolidated financial statements and a classification adjustment that was recorded to revenue and sales and marketing expenses in the 2020 consolidated financial statements. Additionally, these material weaknesses could result in a misstatement of substantially all of our accounts or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.
We have begun implementing a plan to remediate the material weaknesses described above. In 2020, we implemented a new general ledger accounting system, including the design of permissions within that system which allow for effective restricted access and segregation of duties to govern the preparation and review of journal entries. Additional remediation measures are ongoing and include the following:
enhancing and documenting management review controls over the review of journal entries and the identification and review of complex transactions;
continuing to hire additional personnel with public company experience for our accounting and finance function; and
designing and implementing comprehensive access control protocols for our relevant IT applications to enforce restricted user and privileged access and implementing controls to review the activities for those users who have privileged access.
While we believe these efforts will remediate the material weaknesses, we may not be able to complete our evaluation, testing or any required remediation in a timely fashion, or at all. We cannot assure you that the measures we have taken to date and may take in the future will be sufficient to remediate the control deficiencies that led to the identified material weaknesses in internal control over financial reporting or that the measures will prevent or avoid future material weaknesses. The effectiveness of our internal control over financial reporting is subject to various inherent limitations, including cost limitations, judgments used in decision making, assumptions about the likelihood of future events, the possibility of human error and the risk of fraud. If we are unable to remediate the material weaknesses, our ability to record, process and report financial information accurately, and to prepare financial statements within the time periods required under SEC rules, could be adversely affected. This may in turn adversely affect our reputation and business and the market price of our Class A common stock. In addition, any such failures could result in litigation or regulatory actions by the SEC or other regulatory authorities, loss of investor confidence, delisting of our Class A common stock and diversion of financial and management resources from the operation of our business.
The requirements of being a public company may strain our resources, result in more litigation and divert management’s attention.
We are subject to the requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the New York Stock Exchange and other applicable securities rules and regulations. Complying with these rules and regulations has increased and will continue to increase our legal and financial compliance costs, make some activities more difficult, time consuming or costly and increase demand on our systems and resources. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are required to disclose changes made in our internal control and procedures on a quarterly basis. In order to maintain and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could adversely affect our business and operating results. We may need to hire additional employees or engage outside consultants to comply with these requirements, which will increase our costs and expenses.
In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies, due to ambiguities related to their application and practice or for other reasons, regulatory authorities may initiate legal proceedings against us and our business may be adversely affected.
53
These new rules and regulations may make it more expensive for us to maintain director and officer liability insurance, and in the future, we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.
We are subject to laws and regulations regarding export control, import, economic and trade sanctions, anti-money laundering and counter-terror financing that could impair our ability to compete in international markets or subject us to criminal or civil liability if we violate them.
We plan to expand internationally and will thus become subject to additional laws and regulations for which we will need to implement new regulatory compliance controls. In some cases, our products are subject to export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce, and our activities may be subject to trade and economic sanctions, including U.S. economic and trade sanctions administered by the U.S. Department of Treasury’s Office of Foreign Assets Control, or OFAC, which we collectively refer to as trade controls. As such, a license may be required to export or re-export our products, or provide related services, to certain countries and billers. Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items or certain reporting requirements. The process for obtaining necessary licenses may be time-consuming or unsuccessful, potentially causing delays in sales or losses of sales opportunities.
We have procedures in place designed to ensure our compliance with trade controls, with which failure to comply could subject us to both civil and criminal penalties, including substantial fines, possible incarceration of responsible individuals for willful violations, possible loss of our export or import privileges and reputational harm. For example, we have processes in place to comply with the OFAC regulations as well as similar requirements in other jurisdictions. As part of our compliance efforts, we scan our billers against OFAC and other watchlists. If our platform is accessed from a sanctioned country in violation of trade and economic sanctions, we could be subject to fines or other enforcement action. Although we have no knowledge that our activities have resulted in violations of trade controls, any failure by us or our partners to comply with applicable laws and regulations would have negative consequences for us, including reputational harm, government investigations and penalties.
In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit billers’ ability to implement our products in those countries. Changes in our products or changes in export and import regulations in such countries may create delays in the introduction of our products into international markets, prevent billers with international operations from deploying our products globally or, in some cases, prevent or delay the export or import of our products to certain countries, governments or persons altogether. Any change in export or import laws or regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing export, import or sanctions laws or regulations, or change in the countries, governments, persons or technologies targeted by such export, import or sanctions laws or regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential billers with international operations. Any decreased use of our products or limitation on our ability to export to or sell our products in international markets could adversely affect our business, operating results and financial condition.
We are also subject to various anti-money laundering and counter-terrorist financing laws and regulations around the world that prohibit, among other things, our involvement in transferring the proceeds of criminal activities. There has been increased scrutiny in the United States and globally regarding compliance with these laws and regulations, which may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our billers.
We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business.
We are subject to the FCPA, U.S. domestic bribery laws and other anti-corruption laws. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees and their third-party intermediaries from authorizing, offering or providing, directly or indirectly, improper payments or benefits to recipients in the public sector. These laws also require that we keep accurate books and records and maintain internal controls and compliance procedures designed to prevent any such actions. Although we currently only maintain operations in the United States, Canada and India, as we increase our international cross-border business and expand operations abroad, we may engage with business partners and third-party intermediaries to market our services and to obtain necessary permits, licenses and other regulatory approvals. Our operations are dependent in part upon transmission bandwidth provided by third-party network providers and access to co-location facilities to house our servers, which in some countries may be state owned. Similarly, some of our billers may be state-owned, in each case exposing us to potential risks. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners and
54
agents, even if we do not explicitly authorize such activities. We cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we increase our international business, our risks under these laws may increase.
Detecting, investigating and resolving actual or alleged violations of anti-corruption laws can require a significant diversion of time, resources and attention from management. In addition, noncompliance with anti-corruption or anti-bribery laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, enforcement actions, fines, damages, other civil or criminal penalties, injunctions, suspension or debarment from contracting with certain persons, reputational harm, adverse media coverage and other collateral consequences. If any subpoenas are received or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal proceeding, our business, operating results and financial condition could be materially harmed.
Changes in our effective tax rate or tax liability may adversely affect our operating results.
Our effective tax rate could increase due to several factors, including:
changes in the relative amounts of income before taxes in the various jurisdictions in which we operate due to differing statutory tax rates in various jurisdictions;
changes in tax laws, tax treaties and regulations or the interpretation thereof, including the Tax Cuts and Jobs Act of 2017, as modified by the Coronavirus Aid, Relief, and Economic Security Act and the Emergency Coronavirus Relief Act;
changes to our assessment about our ability to realize our deferred tax assets that are based on estimates of our future results, the prudence and feasibility of possible tax planning strategies and the economic and political environments in which we do business;
the outcome of current and future tax audits, examinations or administrative appeals; and
limitations or adverse findings regarding our ability to do business in some jurisdictions.
Any of these developments could adversely affect our operating results.
Risks Related to Our Technology and Intellectual Property
If we are unable to ensure that our platform interoperates with a variety of software suites, applications and other technologies that are developed by others, including our partners, or if there are performance issues with such third-party systems, our solutions will not operate effectively, we may become less competitive and our business, operating results and financial condition may be harmed.
Our platform must integrate with a variety of software suites, applications and other technologies that are developed by third parties, and we need to continuously modify and enhance our platform to adapt to changes in such software and other technologies. In particular, we have developed our platform to be able to easily integrate with key third-party applications of our software partners. We are typically subject to standard terms and conditions of providers of software or other technology, which govern the distribution and operation of such software and other technologies and are subject to change by such providers from time to time. Our business will be harmed if any provider of such software or other technologies:
discontinues or limits our access to its software or other technologies;
modifies its terms of service or other legal terms or policies, including fees charged to, or other restrictions on us;
changes how information is accessed by us or our billers or partners or their consumers;
has performance or other problems that affect the perception of our platform, products or services;
establishes exclusive or more favorable relationships with one or more of our competitors; or
develops or otherwise favors its own competitive offerings over our platform or products.
For example, to deliver a comprehensive solution, our platform integrates with offerings of popular software providers, including Oracle and SAP, through application program interfaces, or APIs, made available by these software providers. If any providers of software or other technologies change the features of their APIs, discontinue their support of such APIs, restrict our access to their APIs or alter the terms governing their use in a manner that is adverse to our business, we will not be able to provide synchronization capabilities, which could significantly diminish the value of our platform and harm our business, operating results and financial condition.
55
Third-party services and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with that of other third parties as they continue to develop or emerge in the future, or we may not be able to make such modifications in a timely and cost-effective manner. In addition, some of our competitors may be able to disrupt the operations or compatibility of our platform with their products or services, or exert strong business influence on our ability to, and terms on which we, operate our platform. Should any of our competitors modify their products or standards in a manner that degrades the functionality of our platform or gives preferential treatment to our competitors or competitive products, whether to enhance their competitive position or for any other reason, the interoperability of our platform with these products could decrease and our business, results of operations and financial condition would be harmed. If we are not permitted or able to integrate with these and other third-party software suites, applications and other technologies in the future, our business, results of operations and financial condition would be harmed.
Furthermore, the functionality of our platform also depends on our and our partners’ ability to integrate our platform with their offerings. These partners periodically update and change their systems, and although we have been able to adapt our platform to their evolving needs in the past, there can be no guarantee that we will be able to do so in the future or in a way such that our billers or partners or their consumers are satisfied with the quality of work performed by us or with the technical support services rendered. In particular, if we are unable to adapt to the needs of our partners’ platforms, software and solutions, our billers’ and partners’ operations may be disrupted, which could result in disputes with our billers or partners or their consumers or other third parties and additional costs to address the situation. Additionally, our billers and partners may terminate their relationship with us and we may lose access to large numbers of consumers and biller referrals as a result.
Any negative publicity related to our solutions, regardless of its accuracy or whether the ultimate cause of any poor performance actually results from our platform, or from the systems of our billers, partners or consumers, may adversely affect our reputation, business, operating results and financial condition.
Interruptions or delays in the services provided by our third-party data centers or internet service providers could impair the delivery of our platform. Any changes in the systems that these providers make available to us that degrade the functionality of our platform, impose additional costs or requirements on us, or give preferential treatment to competitors’ services, including their own services, could materially and adversely affect usage of our products and services.
Our third-party service providers are ultimately responsible for maintaining their own network security, disaster recovery and system management procedures, and our review processes for such providers may be insufficient to identify, prevent or mitigate adverse events. The owners and operators of our current and future hosting facilities do not guarantee that our billers’ or partners’ or their consumers’ access to our solutions will be uninterrupted, error-free or secure. We or our third-party service providers may experience website disruptions, outages and other performance problems. We have periodically experienced service disruptions in the past, and we cannot assure you that we will not experience service interruptions or delays in the future. We depend on our third-party service providers to protect their infrastructure against damage, interruption and other performance problems, maintain their respective configuration, architecture and interconnection specifications and protect information stored by such providers, as well as on internet service providers to transmit data. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the data storage services we use.
Although we have disaster recovery plans that use multiple data storage locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized entry or intrusion, sabotage, criminal acts, intentional acts of vandalism and other misconduct, computer viruses and disabling devices, natural disasters, military actions, terrorist attacks, negligence, infrastructure changes, human or software errors, fraud, spikes in biller, partner or consumer usage and denial of service issues, hardware failures, improper operation, data loss, compromise or corruption, cybersecurity attacks, wars, hurricanes, tornadoes and other similar events beyond our control could negatively affect our platform. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. Any prolonged service disruption affecting our platform for any of the foregoing reasons could result in lengthy interruptions in the delivery of our platform, products or services, cause system interruptions, prevent our billers, partners or consumers from accessing their accounts online, damage our reputation with current and potential billers, partners or consumers, expose us to liability, cause us to lose billers, partners or consumers, cause the loss of critical data, prevent us from supporting our platform, products or services, result in regulatory investigations, enforcement actions and litigation or cause us to incur additional expense in investigating, remediating and responding to these disruptions and arranging for new facilities and support or otherwise harm our business.
Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. System failures or outages, including any potential disruptions due to significantly increased global demand on certain cloud-based systems during the COVID-19 pandemic, could compromise our ability to perform these functions in a timely manner, which could harm our ability to conduct business or delay our financial reporting. Such
56
failures could adversely affect our operating results and financial condition. In addition, certain of our third-party service providers are required to notify us if they experience a security breach or unauthorized disclosure of certain personal information, or, in some cases, confidential data or information of ours or our billers, partners or consumers, and their failure to timely notify us of such a breach or disclosure may cause us to incur significant costs or otherwise harm our business.
Our platform is accessed by many billers, partners and consumers, often at the same time. As we continue to expand the number of our billers, partners and consumers, and products available through our platform, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. In addition, the failure of data centers, internet service providers or other third-party service providers to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to grow our business and scale our operations. If our third-party infrastructure service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity, or damage to data centers, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services.
We also depend on third-party internet-hosting providers and continuous and uninterrupted access to the internet through third-party bandwidth providers to operate our business. If we lose the services of one or more of our internet-hosting or bandwidth providers for any reason or if their services are disrupted, for example due to viruses, ransomware, denial of service or other attacks on their systems, or due to human error, intentional bad acts, power loss, hardware failures, telecommunications failures, fires, wars, terrorist attacks, floods, earthquakes, hurricanes, tornadoes or similar catastrophic events, we could experience disruption in our ability to offer our solutions and adverse perception of our solutions’ reliability, or we could be required to retain the services of replacement providers, which could increase our operating costs and materially and adversely affect our business, operating results and financial condition.
Furthermore, prolonged interruption in the availability, or reduction in the speed or other functionality, of our platform, products or services could materially harm our reputation and business. Frequent or persistent interruptions in accessing our platform, products and services could cause billers, partners or consumers to believe that our platform, products and services are unreliable, leading them to switch to our competitors or to avoid our platform, products and services, and could permanently harm our reputation and business.
Additionally, as our billers and partners and their consumers may use our platform for critical transactions, any errors, defects or other infrastructure problems could result in damage to such billers’, partners’ or consumers’ businesses. These billers, partners and consumers could seek significant compensation from us for their losses and our insurance policies may be insufficient to cover a claim. Even if unsuccessful, this type of claim may be time-consuming and costly for us to defend. Any of the foregoing could have a material adverse effect on our business, operating results and financial condition.
We may experience software and technology defects, undetected errors, development delays or other performance problems in our software and other technology used as part of our platform, which could damage biller and partner relations, harm our reputation, result in significant costs to us, decrease our potential profitability and expose us to substantial liability.
Our software and other technology used as part of our platform may contain undetected errors, viruses or defects when implemented or when new functionality is released, as we may modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends. Despite extensive testing, from time to time we have discovered and may in the future discover defects or errors in our solutions. Any performance problems or defects in our solutions could materially and adversely affect our business, operating results and financial conditions. Defects, errors or other similar performance problems or disruptions, whether in connection with day-to-day operations or otherwise, could be costly for us, adversely affect our billers’ or partners’ businesses, harm our reputation and result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. In addition, if we have any such errors, defects or other performance problems, our billers or partners could seek to terminate, or elect not to renew, their contracts with us, delay or withhold payment or make claims against us. Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, operating results and financial condition. Additionally, our software uses open-source software and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, operating results and financial condition. In addition, we rely on technologies and software supplied by third parties that may also contain undetected errors, viruses or defects. Software defects and errors or delays in electronic bill presentment or our facilitation of payment processing could result in additional development costs, diversion of technical and other resources from our other development efforts, loss of credibility with current or potential billers, partners and consumers, harm to our reputation and exposure to liability claims, any of which could result in a material adverse effect on our business, operating results and financial condition.
57
We use open source software in our platform and products, which may pose particular risks to our proprietary software in a manner that could subject us to litigation or other actions, negatively affect our ability to sell our products or otherwise adversely affect our business, operating results and financial condition.
Our platform incorporates software modules licensed to us by third-party authors under “open source” licenses, and we expect to continue to incorporate open source software in our products and platform in the future. Some open source licenses contain requirements that those who distribute open source software as part of their own software product also make publicly available all or part of the source code for modifications or derivative works created based on the type of open source software they use, or grant other licenses to their intellectual property on unfavorable terms or at no cost, and we may be subject to such requirements.
The terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to provide, or distribute our platform, products or services related to, the open source software subject to those licenses. In addition, the public availability of such software may make it easier for others to compromise our platform. Although we generally monitor our use of open source software to avoid subjecting our platform to conditions we do not intend and to try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur, or could be claimed to have occurred, in part because open source license terms are often ambiguous. Moreover, we cannot assure you that our processes for controlling our use of open source software in our platform, products and services will be effective. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products. Likewise, we could become subject to lawsuits and face claims from third parties claiming ownership of, or demanding release of, any open source software or derivative works that we have developed using such software, which could include our proprietary source code, or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation and could require us to make our software source code freely available, purchase a costly license or cease offering the implicated products or services. Litigation could be costly for us to defend, have a negative effect on our business, operating results and financial condition or require us to devote additional research and development resources to change our products. If we are held to have breached or failed to fully comply with all the terms and conditions of an open source software license, we could face infringement or other liability, or be required to seek costly licenses from third parties, to continue providing our offerings on terms that are not economically feasible, to re-engineer our platform (which could involve substantial time and resources), to discontinue or delay the provision of our offerings if re-engineering could not be accomplished on a timely basis or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, operating results and financial condition.
In addition to risks related to complying with applicable license requirements, a release of our proprietary code could also allow our competitors to create similar offerings with lower development effort and time and ultimately could result in a loss of our competitive advantages. Furthermore, use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide support, warranties, indemnification or other contractual protections regarding infringement claims or the quality of the code. There is little legal precedent in this area and any actual or claimed requirement to disclose our proprietary source code or pay damages for breach of contract could harm our business and could help third parties, including our competitors, develop products and services that are similar to or better than ours. Any of these risks could be difficult to eliminate or manage, and, if not addressed, could materially and adversely affect our business, operating results and financial condition.
If we fail to adequately obtain, maintain, protect or enforce our intellectual property and proprietary rights, our competitive position could be impaired, our reputation could be harmed and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.
Our success is dependent, in part, upon protecting our intellectual property and proprietary technology. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws and contractual provisions with our employees, independent contractors, consultants and third parties with whom we have relationships to establish and protect our intellectual property and proprietary rights. However, the steps we take to protect our intellectual property may be inadequate, may not afford complete protection and may not adequately permit us to gain or keep any competitive advantage or otherwise fail to prevent unauthorized use or disclosure of our confidential information, intellectual property or technology, and may not provide an adequate remedy in the event of unauthorized use or disclosure of our confidential information, intellectual property or technology.
Various factors outside our control pose a threat to our intellectual property rights, as well as to our products, services and technologies. Although we have been issued patents in the United States and Canada and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications or obtain the coverage originally sought. In addition, any patents issued in the future may not provide us with competitive advantages or may be successfully challenged by third parties, which could result in them being narrowed in
58
scope or declared invalid or unenforceable. For example, it is possible that third parties, including our competitors, may obtain patents relating to technologies that overlap or compete with our technology. If third parties obtain patent protection with respect to such technologies, they may assert that our technology infringes their patents and seek to charge us a licensing fee or otherwise preclude the use of our technology or file suit against us. Any of our patents, trademarks or other intellectual property rights may lapse, be abandoned, be challenged or circumvented by others or invalidated through administrative process or litigation. We also may allow certain of our registered intellectual property rights, or our pending applications for intellectual property rights, to lapse or to become abandoned if we determine that obtaining or maintaining the applicable registered intellectual property rights is not worthwhile. Despite our efforts to protect our intellectual property and proprietary rights, there can be no guarantee that such rights will be sufficient to protect against others offering products or services that are substantially similar to ours, independently developing similar products, duplicating any of our products, designing around our patents, adopting trade names or domain names similar to ours, competing with our business or attempting to copy aspects of our technology and using information that we consider proprietary, thereby impeding our ability to promote our platform and possibly leading to biller or consumer confusion. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and services that compete with ours.
We cannot guarantee that our ability to assert our intellectual property rights against potential competitors or to settle current or future disputes will not be limited by our agreements with third parties. Further, no assurance can be given that our agreements will be effective in controlling access to and distribution of our products and proprietary information, and they do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our platform.
We will not be able to protect our intellectual property rights if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property rights. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy, reverse engineer or otherwise obtain and use our products, technology, systems, methods, processes, intellectual property and other information that we regard as proprietary to create products and services that compete with ours. We cannot be certain that we will be able to prevent unauthorized use of our products, technology, systems, methods and processes or infringement, misappropriation or other violation of our intellectual property, particularly in foreign countries where the laws may not protect our proprietary rights as comprehensively as in the United States, if at all. In addition, any changes in, or unexpected interpretations of, intellectual property laws may compromise our ability to enforce our trade secret and intellectual property rights. Failure to obtain or maintain protection of our trade secrets or other proprietary information could harm our competitive position and materially and adversely affect our business, operating results and financial condition.
In addition to registered intellectual property rights such as issued patents and trademark registrations, we rely on non-registered proprietary information and technology, such as copyrights, trade secrets, confidential information, know-how and technical information. In order to protect our proprietary information and technology, we rely in part on confidentiality and intellectual property assignment agreements with our employees and contractors involved in the development of material intellectual property for us, which place restrictions on the employees’ and contractors’ use and disclosure of this intellectual property. However, these agreements may not be self-executing, sufficient in scope or enforceable or may not provide meaningful protection for our trade secrets or other proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements. We cannot guarantee that we have entered into such agreements with each person or entity that may have or have had access to our trade secrets or proprietary information or otherwise developed intellectual property for us, including our technology and processes. Individuals that were involved in the development of intellectual property for us or who had access to our intellectual property but who are not subject to invention assignment agreements may make adverse ownership claims to our current and future intellectual property.
Additionally, these agreements may be insufficient or breached, or this intellectual property, including trade secrets, may otherwise be disclosed or become known to our competitors, which could cause us to lose any competitive advantage resulting from this intellectual property. We may not be able to obtain adequate remedies for such breaches. Additionally, to the extent that our employees, independent contractors or other third parties with whom we do business use intellectual property owned by others in their work for us, disputes may arise as to the rights in related or resulting works of authorship, know-how and inventions. The loss of trade secret protection could make it easier for third parties to compete with our products and services by copying functionality.
Effective patent, copyright, trademark, service mark, trade secret and domain name protection is time-consuming and expensive. We may not be able to obtain protection for our technology and even if we are successful in obtaining effective patent, copyright, trademark, service mark, trade secret and domain name protection, it is expensive to maintain these rights, both in terms of application and maintenance costs, and the time and cost required to defend our rights could be substantial. Moreover, our failure to develop and properly manage and protect new intellectual property could hurt our market position and business opportunities. Furthermore, changes to U.S. or foreign intellectual property laws and
59
regulations may jeopardize the enforceability and validity of our intellectual property portfolio and harm our ability to obtain patent protection, including for some of our unique business methods. We may be unable to obtain trademark protection for our products and brands, and our existing trademark registrations and applications, and any trademarks that may be used in the future, may not provide us with competitive advantages or distinguish our products and services from those of our competitors. We do not and may not own registered trademarks for all trademarks and logos used in our business in the jurisdictions in which we operate or may operate in the future. In addition, our trademarks may be contested or found to be unenforceable, weak or invalid, and we may not be able to prevent third parties from infringing or otherwise violating them. Litigation may be necessary to enforce our intellectual property rights, to protect our trade secrets or to determine the validity and scope of the proprietary rights of others, which could result in substantial costs and diversion of our resources. In addition, our efforts may be met with defenses and counterclaims challenging the validity and enforceability of our intellectual property rights or may result in a court determining that our intellectual property rights are unenforceable. Further, we have and may in the future employ individuals who previously were employed by our competitors, and, as a result, those competitors may bring claims against such individuals or us alleging their intellectual property rights have been infringed, misappropriated or otherwise violated. If we are unable to cost-effectively protect our intellectual property rights, our business would be harmed. If competitors are able to use our technology or develop proprietary technology similar to ours or competing technologies, our ability to compete effectively and our growth prospects would be adversely affected.
We and our billers and partners and their consumers and other third parties that use our platform obtain, provide and process a large amount of sensitive and personal data. Any real or perceived improper or unauthorized use of, disclosure of or access to such data could harm our reputation as a trusted brand, as well as have a material adverse effect on our business, operating results and financial condition.
We and our billers and partners and their consumers and the third-party vendors and data centers that we use obtain, provide and process large amounts of sensitive and personal data, including data provided by and related to consumers and their transactions, as well as other data of the counterparties to their payments. We face risks, including to our reputation as a trusted brand, in the handling and protection of this data, and these risks will increase as our business continues to expand to include new products and technologies.
Cybersecurity threats and attacks, privacy and security breaches and incidents, insider threats or other incidents and malicious internet-based activity continue to increase generally, evolve in nature and become more sophisticated, and providers of cloud-based services have frequently been targeted by such attacks, particularly in the financial technology sector. These cybersecurity challenges, including threats to our own IT infrastructure or those of our billers or partners or their consumers or third-party service providers, may take a variety of forms ranging from stolen bank accounts, business email compromise, biller employee fraud, account takeover, check fraud or cybersecurity attacks, to “mega breaches” targeted against cloud-based services and other hosted software, which could be initiated by individual or groups of hackers or sophisticated cyber criminals. A cybersecurity incident or breach could result in loss, compromise, corruption or disclosure of confidential information, intellectual property and sensitive and personal data or data we rely on to provide our solutions and impair our ability to provide our solutions and meet our billers’ or partners’ or their consumers’ requirements, or cause production downtimes and compromised data. We may be unable to anticipate or prevent techniques used in the future to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. As we increase our biller base and our brand becomes more widely known and recognized, third parties may increasingly seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our billers’ or partners’ or their consumers’ sensitive and personal data. Information security risks for technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties as well as nation-state and nation-state-supported actors. Additionally, geopolitical events and resulting government activity could lead to information security threats and attacks by affected jurisdictions and their sympathizers. Because of our position in the financial services industry, we believe that we are likely to continue to be a target of such threats and attacks.
We have administrative, technical and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection and information security measures. However, if our privacy protection, data protection or information security measures or those of the previously mentioned third parties are inadequate or are breached or otherwise compromised as a result of third-party action, employee or contractor error, malfeasance, malware, phishing, hacking attacks, system error, software bugs or defects in our products, trickery, process failure, or otherwise, and, as a result, there is improper disclosure of, or someone obtains unauthorized access to or exfiltrates funds or accesses, modifies, corrupts, or destroys any sensitive and personal data, including personally identifiable information, on our systems or our partners’ systems, or if we suffer a ransomware or advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our reputation and business could be damaged. Recent high-profile security breaches and
60
related disclosures of sensitive and personal data by large institutions suggest that the risk of such events is significant, even if privacy, data protection and information security measures are implemented and enforced. If sensitive and personal data is unavailable, lost, modified, corrupted, or destroyed without authorization or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with remediation and the implementation of additional security measures, and may incur significant liability and financial loss and be subject to regulatory scrutiny, investigations, proceedings and penalties.
In addition, because we leverage third-party service providers, including cloud, software, data center and other critical technology vendors to deliver our solutions to our billers, partners or consumers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party service providers. Such third-party service providers have access to sensitive and personal data and other data about our billers, partners and employees, as well as consumers using our products and services to pay the bills of our billers, and some of these providers in turn subcontract with other third-party service providers. Our ability to monitor our third-party service providers’ data security is limited. There have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our third-party service providers’ software or systems have not been breached or compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems or the systems of third parties that support us and our services. A vulnerability in our third-party service providers’ software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions. Techniques used to sabotage or obtain unauthorized access to systems are constantly evolving and our third-party service providers may face difficulties or delays in identifying breaches and compromises, and notifying us of any such breaches and compromises. This could cause us to face delays in responding to any such breach or compromise and providing any required notifications to consumers or other third parties.
In addition, our financial institution strategic partners conduct regular audits of our cybersecurity program, and if any of them were to conclude that our systems and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business would be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of payment information that we store, we could be liable to the partner for their losses and related expenses. Additionally, if our own confidential business information were improperly disclosed, our business could be materially and adversely affected. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security or security incident, regardless of how it occurs or the extent of the breach or incident, could have a significant impact on our reputation as a trusted brand, cause us to lose existing billers, partners and consumers, prevent us from obtaining new billers, partners and consumers, require us to expend significant funds to remedy problems caused by breaches and incidents and implement measures to prevent further breaches and incidents, and expose us to legal risk and potential liability including those resulting from governmental or regulatory investigations, class action litigation, indemnity obligations, damages for contract breach or penalties for violation of security obligations and costs associated with remediation, such as fraud monitoring and forensics, all of which could divert resources and attention of our management and key personnel away from our business operations and materially and adversely affect our business, operating results and financial condition. Any actual or perceived security breach or incident at a third-party service provider providing services to us or our billers, partners or consumers could have similar effects. Further, as the current COVID-19 pandemic continues to result in a significant number of people working from home, these cybersecurity risks may be heightened by an increased attack surface across our business and those of our partners and service providers. We cannot guarantee that our efforts, or the efforts of those upon whom we rely and partner with, will be successful in preventing any such information security incidents or protecting sensitive and personal data that they obtain and process on our behalf.
Federal, state and international regulations may require us or our billers or partners to notify governmental entities and individuals of data security incidents involving certain types of personal and sensitive data or information technology systems. Security compromises experienced by others in our industry, our billers or partners or their consumers, our third-party service providers or us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode consumer, biller or partner confidence in the effectiveness of our security measures, negatively impact our ability to attract new billers, partners and consumers, cause existing billers, partners and consumers to elect not to renew or expand their use of our platform, services and products or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, which could materially and adversely affect our business, operating results and financial condition.
In addition, some of our billers and partners contractually require notification of data security compromises and include representations and warranties in their contracts with us that our platform, products and services comply with certain legal and technical standards related to data security and privacy and meet certain service levels. In our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a biller’s or partner’s right to terminate their contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to
61
prevent billers or partners from potentially terminating their contracts with us. Furthermore, although our contracts typically include limitations on our potential liability, we cannot ensure that such limitations of liability would be adequate or apply to data security compromises.
While we maintain cybersecurity insurance, our insurance may be insufficient or may not cover all liabilities incurred by any security breach or incident. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, litigation to pursue claims under our insurance policies or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, or denials of coverage, could have a material adverse effect on our business, reputation, operating results and financial condition.
We may in the future become subject to or initiate intellectual property disputes, which are costly and time-consuming to defend against or pursue, and may subject us to significant liability and increased costs of doing business.
We may in the future become subject to and involved in lawsuits, disputes, legal proceedings or claims to protect or enforce our intellectual property rights, and we may be subject to claims by third parties that we have infringed, misappropriated or otherwise violated their intellectual property. Even if we believe that particular intellectual property-related claims are without merit, litigation may be necessary to determine the scope and validity of intellectual property or proprietary rights of others or to protect or enforce our intellectual property rights. The ultimate outcome of any allegation is often uncertain and, regardless of the outcome, lawsuits, with or without merit, are time-consuming and expensive to resolve and they divert management’s time and attention and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships. Although we carry insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed. We cannot predict the outcome of lawsuits and cannot assure you that the results of any such actions will not have an adverse effect on our business, operating results or financial condition.
The software industry is characterized by the existence of many patents, copyrights, trademarks, trade secrets and other intellectual property rights. Companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. Our technologies may not be able to withstand any third-party claims against their use. We could also face trade name or trademark or service mark infringement claims brought by owners of other registered or unregistered trademarks or service marks, including trademarks or service marks that may incorporate variations of our brand names. Any claims related to our intellectual property or biller or consumer confusion related to our marketplace could damage our reputation and adversely affect our growth prospects. In addition, many companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them than we do. Any litigation may also involve patent holding companies or other adverse patent owners that have no relevant product revenue, and therefore, our patents may provide little or no deterrence as we would not be able to assert them against such entities or individuals.
If a third party is able to obtain an injunction preventing us from accessing such third-party’s intellectual property rights, or if we cannot license or develop alternative technology for any infringing aspect of our business, we would be forced to limit or stop sales of our products or cease business activities related to such intellectual property. Any inability to license third-party technology in the future would have an adverse effect on our business or operating results and would adversely affect our ability to compete.
We also are, and may in the future become, contractually obligated to indemnify our billers and partners in the event of infringement, misappropriation or other violation of a third party’s intellectual property rights. Responding to such claims, regardless of their merit, can be time-consuming, costly to defend and damaging to our reputation and brand.
Our business and platform depend in part on intellectual property and proprietary rights and technology licensed from or otherwise made available to us by third parties.
Much of our business and our platform rely on key technologies developed or licensed by third parties. These third-party software components may become obsolete, defective or incompatible with future versions of our services, relationships with the third-party licensors or technology providers may deteriorate, or our agreements with the third-party licensors or technology providers may expire or be terminated. Additionally, some of these licenses or other grants of rights may not be available to us in the future on terms that are acceptable, or at all, or that allow our platform, products and services to remain competitive. Our inability to obtain licenses or rights on favorable terms could have a material and adverse effect on our business and results of operations. Furthermore, incorporating intellectual property or proprietary rights licensed from or otherwise made available to us by third parties on a non-exclusive basis in our products or services
62
could limit our ability to protect the intellectual property and proprietary rights in our services and our ability to restrict third parties from developing, selling or otherwise providing similar or competitive technology using the same third-party intellectual property or proprietary rights.
We believe we have all the necessary licenses and other grants of rights from third parties to use technology and software that we do not own. A third party could, however, allege that we are infringing its rights, which may deter our ability to obtain licenses or other grants of rights on commercially reasonable terms from the third party, if at all, or cause the third party to commence litigation against us. Our failure to obtain necessary licenses or other rights, or litigation or claims arising out of intellectual property matters, may harm or restrict our business. Even if we were able to obtain a license or other grant of rights, it could be non-exclusive, thereby giving our competitors and other third parties access to the same technologies licensed to or otherwise made available to us. In addition, we could be found liable for significant monetary damages, including treble damages and attorneys’ fees, if we are found to have willfully infringed a patent or other intellectual property right. Any such litigation or the failure to obtain any necessary licenses or other rights could adversely impact our business, financial position, results of operations and liquidity.
Risks Related to Our Class A Common Stock
The market price of our Class A common stock may be volatile or may decline steeply or suddenly regardless of our operating performance, and we may not be able to meet investor or analyst expectations.
Prior to our initial public offering, or IPO, in May 2021, there was no public market for our Class A common stock. The lack of an active market for our Class A common stock may impair investors’ ability to sell their shares at the time they wish to sell them or at a price that they consider reasonable, may reduce the market value of their shares and may result in significant price and volume fluctuations. The market price of our Class A common stock may fluctuate or decline significantly in response to numerous factors, many of which are beyond our control, including:
the continued impact of the COVID-19 pandemic, including but not limited to market volatility and economic disruption caused by the pandemic;
actual or anticipated fluctuations in our operating results;
variations between our actual operating results and the expectations of securities analysts, investors and the financial community;
any forward-looking financial or operating information we may provide to the public or securities analysts, any changes in this information or our failure to meet expectations based on this information;
actions of securities analysts who initiate or maintain coverage of us, changes in financial estimates by any securities analysts who follow our company or our failure to meet these estimates or the expectations of investors;
whether investors or securities analysts view our stock structure unfavorably, particularly our dual-class structure and the significant voting control of Accel-KKR, or AKKR, and our founder and chief executive officer;
additional shares of our Class A common stock being sold into the market by us or our existing stockholders, or the anticipation of such sales, including if existing stockholders sell shares into the market when applicable “lock-up” periods end;
announcements by us or our competitors of significant products or features, technical innovations, acquisitions, strategic partnerships, joint ventures or capital commitments;
changes in operating performance and stock market valuations of companies in our industry, including our competitors;
price and volume fluctuations in the overall stock market, including as a result of trends in trading patterns or the economy as a whole;
lawsuits, claims or investigations threatened, filed or initiated against us;
developments in new legislation and pending lawsuits or regulatory actions, including interim or final rulings by judicial or regulatory bodies; and
other events or factors, including those resulting from war or incidents of terrorism, or responses to these events.
In addition, extreme price and volume fluctuations in the stock markets have affected and continue to affect many other technology companies’ stock prices. Often, their stock prices have fluctuated in ways unrelated or disproportionate to the companies’ operating performance. In the past, stockholders have filed securities class action litigation following
63
periods of market volatility. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and seriously harm our business.
Moreover, because of these fluctuations, comparing our operating results on a period-to-period basis may not be meaningful. You should not rely on our past results as an indication of our future performance. This variability and unpredictability could also result in our failing to meet the expectations of industry or financial analysts or investors for any period. If our revenue or operating results fall below the expectations of analysts or investors or below any forecasts we may provide to the market, or if the forecasts we provide to the market are below the expectations of analysts or investors, the price of our Class A common stock could decline substantially. Such a stock price decline could occur even when we have met any previously publicly stated revenue or earnings forecasts that we may provide.
Future sales of shares, or the perception that such sales could occur, could cause our stock price to decline.
As of June 30, 2021, we had outstanding a total of 13,880,950 shares of Class A common stock and 103,479,239 shares of Class B common stock. All shares of Class A common stock sold in our IPO are freely tradeable without restriction or further registration under the Securities Act of 1933, as amended, or the Securities Act, unless acquired through the directed share program by our executive officers. The resale of 2,516,663 shares of Class A common stock and 103,479,239 shares of Class B common stock, or approximately 90.3% of our outstanding shares in the aggregate, is currently prohibited or otherwise restricted as a result of securities law provisions, market stand-off agreements entered into by our stockholders with us or lock-up agreements entered into by our stockholders with the underwriters in our IPO However, subject to Rule 144 limitations applicable to affiliates, these shares will be able to be sold in the public market beginning on November 22, 2021. Sales of a substantial number of such shares upon expiration of the lock-up and market stand-off agreements, the perception that such sales may occur or the early release of these agreements, could cause the market price of our Class A common stock to fall or make it more difficult for you to sell your Class A common stock at a time and price that you deem appropriate.
In addition, 5,952 shares of Class A common stock and 7,560,820 shares of Class B common stock were subject to outstanding stock options as of June 30, 2021 and up to 509,370 shares of Class A common stock may be issuable pursuant to our warrant agreement with JPMC Strategic Investments I Corporation. These shares will become eligible for sale in the public market to the extent permitted by the provisions of various vesting agreements, the lock-up agreements and Rules 144 and 701 of the Securities Act. On May 26, 2021, we registered the offer and sale of all shares of Class A common stock and Class B common stock subject to stock options outstanding and reserved for issuance under our 2012 Equity Incentive Plan and 2021 Equity Incentive Plan. The shares covered by that registration statement are eligible for sale in the public markets, subject to Rule 144 limitations applicable to affiliates and the lock-up agreements described above. If these additional shares are sold, or if it is perceived that they will be sold in the public market, the market price of our Class A common stock could decline.
The dual class structure of our common stock and our stockholders agreement have the effect of concentrating voting control with AKKR and our founder and chief executive officer, which limits or precludes your ability to influence corporate matters for the foreseeable future and may depress the market price of our Class A common stock.
Our Class B common stock has ten votes per share and our Class A common stock has one vote per share. Because of the ten-to-one voting ratio between our Class B common stock and Class A common stock, the holders of our Class B common stock, including AKKR and our founder and chief executive officer, collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders so long as the shares of Class B common stock represent at least 9.1% of all outstanding shares of our Class A common stock and Class B common stock, including the election of directors, amendments of our organizational documents, compensation matters and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future.
Further, the stockholders agreement we have entered into with AKKR provides that, for so long as AKKR or certain of its permitted transferees hold more of our outstanding common stock than Mr. Sharma and certain of his affiliates, AKKR will have the right to nominate (x) five directors to our board of directors for so long as AKKR beneficially owns at least 10% of our outstanding common stock and (y) two directors to our board of directors for so long as AKKR beneficially owns at least 5% but less than 10% of our outstanding common stock. Moreover, after such time as AKKR ceases to hold more of our outstanding common stock than Mr. Sharma and certain of his affiliates, AKKR will continue to have the right to nominate two directors to our board of directors until such time as AKKR ceases to beneficially own at least 5% of our outstanding common stock.
Future transfers by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as transfers to affiliates, members or partners of AKKR and transfers for estate planning purposes so long as the transferring holder retains exclusive voting and dispositive power with respect to the shares transferred. The conversion of Class B common stock to Class A common stock will have the effect, over
64
time, of increasing the relative voting power of those holders of Class B common stock who retain their shares in the long term.
In addition, certain index providers have implemented restrictions on including companies with multiple-class share structures in certain of their indices. The FTSE Russell requires new constituents of its indices to have greater than 5% of the company’s voting rights in the hands of public stockholders, and S&P Dow Jones does not admit companies with multiple-class share structures to certain of its indices. Affected indices include the Russell 2000 and the S&P 500, S&P MidCap 400 and S&P SmallCap 600, which together make up the S&P Composite 1500. The dual class structure of our common stock will make us ineligible for inclusion in these indices and we cannot assure you that other stock indices will not take similar actions. It is unclear what effect, if any, these policies have on the valuations of publicly traded companies excluded from such indices, but it is possible that they may depress valuations, as compared to similar companies that are included. Further, given the sustained flow of investment funds into passive strategies that seek to track certain indices, exclusion from certain stock indices will likely preclude investment by many of these funds and could make our Class A common stock less attractive to other investors. As a result, the market price of our Class A common stock could be adversely affected.
AKKR controls us and its interests may conflict with ours or yours in the future.
As of June 30, 2021, AKKR controlled approximately 79.4% of the voting power of our outstanding common stock. As a result, AKKR will have the ability to elect all of the members of our board of directors and thereby control our policies and operations, including the appointment of management, future issuances of our Class A common stock or other securities, the payment of dividends, if any, on our Class A common stock, the incurrence of debt by us, amendments to our certificate of incorporation and bylaws, and the entering into extraordinary transactions, and the interests of AKKR may not in all cases be aligned with our or your interests.
AKKR may have an interest in pursuing acquisitions, divestitures and other transactions that, in its judgment, could enhance its investment in us, even though such transactions might involve risks to you. For example, AKKR could cause us to make acquisitions that increase our indebtedness or cause us to sell revenue-generating assets. Moreover, AKKR will be able to determine the outcome of all matters requiring stockholder approval and will be able to cause or prevent a change of control of our company or a change in the composition of our board of directors and could preclude any acquisition of our company. This concentration of voting control could deprive you of an opportunity to receive a premium for your shares of Class A common stock as part of a sale of our company and ultimately might affect the market price of our Class A common stock.
So long as AKKR continues to beneficially own a sufficient number of shares of Class B common stock, even if it beneficially owns significantly less than 50% of the shares of our outstanding common stock, it will continue to be able to effectively control our decisions. For example, if our Class B common stock amounted to 15% of our outstanding common stock, beneficial owners of our Class B common stock (including AKKR), would collectively control approximately 64% of the voting power of our common stock. Moreover, AKKR will continue to have the right to nominate directors to our board of directors under our stockholders agreement for so long as AKKR beneficially owns at least 5% of our outstanding common stock.
Our certificate of incorporation contains provisions renouncing our interest and expectation to participate in certain corporate opportunities identified by, or presented to, AKKR or its affiliates, which could create conflicts of interest and have a material adverse effect on our business, results of operations, financial condition and prospects if attractive corporate opportunities are allocated by AKKR to itself, its affiliates or third parties instead of to us.
AKKR, our controlling stockholder, is in the business of making investments in companies and may from time to time acquire and hold interests in businesses that compete directly or indirectly with us or that would be complementary to our business if we acquired them. Our certificate of incorporation provides that, to the fullest extent permitted by law, none of AKKR or its affiliates, or any of their respective directors, partners, principals, officers, members, managers or employees, including any of the foregoing who serve as our officers or directors (all of whom we refer to as the “Exempted Persons”), will have any duty to refrain from engaging directly or indirectly in the same or similar business activities or lines of business as us or any of our affiliates. In addition, to the fullest extent permitted by law, in the event that any Exempted Person is presented with a business opportunity, even if the opportunity is one that we or our affiliates might reasonably be deemed to have pursued or had the ability or desire to pursue if granted the opportunity to do so, such Exempted Person will have no duty to communicate or offer such business opportunity to us or any of our affiliates. No Exempted Person will be liable to us, any of our affiliates or our stockholders for breach of any fiduciary or other duty, solely by reason of the fact that any such Exempted Person pursues or acquires such business opportunity, sells, assigns, transfers or directs such business opportunity to another person or fails to present such business opportunity, or information regarding such business opportunity, to us or any of our affiliates. These provisions could create conflicts of interest and have a material adverse effect on our business, results of operations, financial condition and prospects if
65
attractive business opportunities are allocated by AKKR or another Exempted Person to itself, its affiliates or third parties instead of to us.
If securities or industry analysts either do not publish research about us or publish inaccurate or unfavorable research about us, our business or our market, or if they adversely change their recommendations regarding our Class A common stock, the market price or trading volume of our Class A common stock could decline.
The trading market for our Class A common stock will be influenced in part by the research and reports that securities or industry analysts may publish about us, our business, our market or our competitors. If one or more of the analysts initiate research with an unfavorable rating or downgrade our Class A common stock, provide a more favorable recommendation about our competitors or publish inaccurate or unfavorable research about our business, our Class A common stock price would likely decline. If any analyst who may cover us were to cease coverage of us or fail to regularly publish reports on us, we could lose visibility in the financial markets, which in turn could cause the market price or trading volume of our Class A common stock to decline.
We are an emerging growth company, and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to emerging growth companies could make our Class A common stock less attractive to investors.
We are an emerging growth company, and for as long as we continue to be an emerging growth company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies but not to “emerging growth companies,” including:
presentation of only two years of audited financial statements and related financial disclosure;
exemption from the requirement to have our registered independent public accounting firm attest to management’s assessment of our internal control over financial reporting;
exemption from compliance with the requirement of the PCAOB regarding the communication of critical audit matters in the auditor’s report on the financial statements;
reduced disclosure about our executive compensation arrangements; and
exemption from the requirement to hold non-binding advisory votes on executive compensation or golden parachute arrangements.
In addition, the JOBS Act provides that an emerging growth company may take advantage of an extended transition period for complying with new or revised accounting standards, delaying the adoption of these accounting standards until they would apply to private companies unless it otherwise irrevocably elects not to avail itself of this exemption. We have elected to use this extended transition period until we are no longer an emerging growth company or until we affirmatively and irrevocably opt out of the extended transition period. As a result, our consolidated financial statements may not be comparable to the financial statements of companies that comply with new or revised accounting pronouncements as of public company effective dates.
We could be an emerging growth company for up to five years following the completion of our IPO in May 2021. Our status as an emerging growth company will end as soon as any of the following takes place:
the last day of the fiscal year in which we have at least $1.07 billion in annual revenue;
the date we qualify as a “large accelerated filer,” with at least $700.0 million of equity securities held by non-affiliates;
the date on which we have issued, in any three-year period, more than $1.0 billion in non-convertible debt securities; or
the last day of the fiscal year during which the fifth anniversary of the completion of our IPO occurs, which would be December 31, 2026.
We cannot predict if investors will find our Class A common stock less attractive if we choose to rely on any of the exemptions afforded emerging growth companies. If some investors find our Class A common stock less attractive because we rely on any of these exemptions, there may be a less active trading market for our Class A common stock and the market price of our Class A common stock may be more volatile.
We have elected to take advantage of the “controlled company” exemption to the corporate governance rules for New York Stock Exchange-listed companies, which could make our Class A common stock less attractive to some investors or otherwise harm our stock price.
66
AKKR controls a majority of the voting power of our outstanding common stock. Because we qualify as a “controlled company” under the corporate governance rules for New York Stock Exchange-listed companies, we are not required to have a majority of our board of directors be independent, nor are we required to have an independent compensation committee or an independent nominating function. In light of our status as a controlled company, in the future we could elect not to have a majority of our board of directors be independent or not to have an independent compensation committee or nominating and corporate governance committee. Accordingly, should the interests of our management and AKKR differ from those of other stockholders, the other stockholders may not have the same protections afforded to stockholders of companies that are subject to all of the corporate governance rules for New York Stock Exchange-listed companies. Our status as a controlled company could make our Class A common stock less attractive to some investors or otherwise harm our stock price.
Future securities issuances could result in significant dilution to our stockholders and impair the market price of our Class A common stock.
Future issuances of shares of our Class A common stock or the conversion of a substantial number of shares of our Class B common stock, or the perception that these sales or conversions may occur, could depress the market price of our Class A common stock and result in dilution to existing holders of our Class A common stock. Also, to the extent outstanding options to purchase shares of our Class B common stock are exercised or options or other equity-based awards are issued or become vested, there will be further dilution. The amount of dilution could be substantial depending upon the size of the issuances or exercises. Furthermore, we may issue additional equity securities that could have rights senior to those of our Class A common stock.
As of June 30, 2021, there were 7,566,772 shares of Class B common stock subject to outstanding options. All of the shares of Class B common stock subject to outstanding options are registered for public resale under the Securities Act. Accordingly, these shares will be able to be freely sold in the public market upon issuance as permitted by any applicable vesting requirements, lockup agreements, and subject to compliance with applicable securities laws.
In addition, as of June 30, 2021, the holders of up to 105,666,751 shares of our common stock, or certain permitted transferees, are entitled to require us to file registration statements for the public resale of the shares of Class A common stock, including shares issuable upon conversion of their shares of Class B common stock, or to include such shares in registration statements that we may file, subject to certain conditions. If we register the offer and sale of shares for the holders of registration rights, those shares can be freely sold in the public market upon registration, subject to the restrictions of Rule 144 under the Securities Act in the case of our affiliates.
Anti-takeover provisions in our charter documents and under Washington law could make an acquisition of us difficult, limit attempts by our stockholders to replace or remove our current management and depress the market price of our Class A common stock.
In addition to AKKR controlling approximately 79.4% of the voting power of our common stock as of June 30, 2021, our certificate of incorporation and bylaws contain provisions that could depress the market price of our Class A common stock by acting to discourage, delay or prevent a change of control of our company or changes in our management that the stockholders of our company may deem advantageous. Among other things, these provisions provide that:
we have a dual class common stock structure, with differing voting rights;
the authorized number of directors may be changed only by resolution of the board of directors;
any vacancies on the board of directors and any newly created directorships may only be filled by the affirmative vote of a majority of directors then in office, even if less than a quorum;
our board of directors is divided into three classes, each of which stands for election once every three years;
there is no cumulative voting;
the board of directors may issue “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;
the board of directors may adopt, alter or repeal our bylaws;
the forum for certain litigation against us is restricted to Delaware; and
stockholders seeking to present proposals before a meeting of stockholders or to nominate candidates for election as directors at a meeting of stockholders must provide notice in writing in a timely manner, and also meet specific requirements as to the form and content of a stockholder’s notice.
67
Additional provisions will become effective on such date when AKKR and its affiliates cease to beneficially own in the aggregate, directly or indirectly, at least 50% of the voting power of our capital stock, which, among other things, provide that:
stockholders may not call special meetings of stockholders or act by written consent;
directors may only be removed from office for cause and with the affirmative vote of at least a majority of the voting power of our outstanding capital stock; and
amending certain provisions of our certificate of incorporation and bylaws will be subject to super-majority voting thresholds.
Moreover, our certificate of incorporation contains a provision that provides us with protections similar to Section 203 of the General Corporation Law of the State of Delaware, or the DGCL, and prevents us from engaging in a business combination with certain interested stockholders (excluding AKKR, certain of its direct or indirect transferees and any group as to which AKKR is a party), including a person who owns 15% or more of our voting stock for a period of three years from the date such person acquired such common stock, unless approval from our board of directors or stockholders is obtained prior to the acquisition and subject to other exceptions.
In addition, because our principal executive offices are located in Washington, the anti-takeover provisions of the Washington Business Corporation Act may apply to us under certain circumstances now or in the future. These provisions prohibit a “target corporation” from engaging in any of a broad range of business combinations with any stockholder constituting an “acquiring person” for a period of five years following the date on which the stockholder became an “acquiring person.”
Any provision of our certificate of incorporation or bylaws, or under Washington law, that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our Class A common stock.
Our bylaws designate a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, and also provide that the federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, each of which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, stockholders or employees.
Our bylaws provide that, unless we consent in writing to the selection of an alternative forum, the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, stockholders, officers or other employees to us or our stockholders, (3) any action arising pursuant to any provision of the DGCL, our certificate of incorporation or our bylaws or (4) any other action asserting a claim that is governed by the internal affairs doctrine shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, another State court in Delaware or the federal district court for the District of Delaware), except for any claim as to which such court determines that there is an indispensable party not subject to the jurisdiction of such court (and the indispensable party does not consent to the personal jurisdiction of such court within ten days following such determination), which is vested in the exclusive jurisdiction of a court or forum other than such court or for which such court does not have subject matter jurisdiction. This provision does not apply to any action brought to enforce a duty or liability created by the Exchange Act and the rules and regulations thereunder.
Section 22 of the Securities Act establishes concurrent jurisdiction for federal and state courts over Securities Act claims. Accordingly, both state and federal courts have jurisdiction to hear such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our bylaws also provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States will be the sole and exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.
Any person or entity purchasing or otherwise acquiring or holding or owning (or continuing to hold or own) any interest in any of our securities shall be deemed to have notice of and consented to the foregoing bylaw provisions. Although we believe these exclusive forum provisions benefit us by providing increased consistency in the application of Delaware law and federal securities laws in the types of lawsuits to which each applies, the exclusive forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our current or former directors, officers, stockholders or other employees, which may discourage such lawsuits against us and our current and former directors, officers, stockholders and other employees. Our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder as a result of our exclusive forum provisions.
68
Further, the enforceability of similar exclusive forum provisions in other companies’ organizational documents has been challenged in legal proceedings, and it is possible that a court of law could rule that these types of provisions are inapplicable or unenforceable if they are challenged in a proceeding or otherwise. If a court were to find either exclusive forum provision contained in our bylaws to be inapplicable or unenforceable in an action, we may incur significant additional costs associated with resolving such action in other jurisdictions, all of which could harm our results of operations.