Quiver Quantitative

Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - CASH

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. Risk Factors.

We are subject to various risks, including those described below that, individually or in the aggregate, could cause our actual results to differ materially from expected or historical results. Our business could be harmed, perhaps materially, by any of these risks, as well as other risks that we have not identified, whether due to such risks not presently being known to us, because we do not currently believe such risks to be material, or otherwise. The trading price of our common stock could decline due to any of these risks, and you may lose all or part of your investment. Moreover, certain events including geopolitical and financial market turmoil may also have the effect of heightening many of the risks and uncertainties described in the risks discussed below. The risks discussed below also include forward-looking statements, and actual results and events may differ substantially from those discussed or highlighted in these forward-looking statements. In assessing these risks, you should also refer to the other information contained in this Annual Report on Form 10-K, including the Company’s financial statements and related notes. Before making an investment decision with respect to any of our securities, you should carefully consider the following risks and uncertainties described below and elsewhere in this Annual Report on Form 10-K. See “Forward-Looking Statements.”

Table of Contents

Risk Factor Summary

These risks and uncertainties include:

Risks Related to Our Industry and Business

•Our framework for managing risk, including our underwriting practices, may not prevent future losses.

•We are subject to credit risk in connection with our lending and leasing activities, and our financial condition and results of operations may be negatively impacted by factors that adversely affect our borrowers.

•If our actual credit losses exceed our allowance for credit losses, our net income will decrease.

•Our earnings are significantly affected by general business, political and economic conditions.

•Adverse developments or concerns affecting the financial services industry or specific financial institutions could adversely affect our financial condition and results of operations.

•Ineffective liquidity management could adversely affect our financial condition and results of operation.

•Our investments in certain tax-advantaged projects may not generate anticipated returns, causing an adverse impact on our results of operations.

•The residual value of leased equipment at the time of its disposition may be less than forecasted at the time we entered into the lease.

•Changes in interest rates could adversely affect our results of operations and financial condition.

•We operate in an extremely competitive market, and our business will suffer if we are unable to compete effectively.

•Our business could suffer if consumer behaviors, or other factors, in connection with the use of prepaid cards change, or there are adverse developments with respect to the prepaid financial services industry in general.

•Our operations depend upon third-party relationships; our ability to maintain such relationships and such third parties' performances could adversely affect our business.

•We derive a significant percentage of our deposits, total assets and income from deposit accounts that we generate through Payments' customer relationships, of which a limited number of program manager relationships are particularly significant to our operations.

•We are exposed to fraud losses from customer accounts.

•We are exposed to settlement and other losses from payments customers.

•Our business strategy includes plans for organic growth, and our financial condition and results of operation could be adversely affected if we fail to grow or fail to manage our growth effectively.

•Acquisitions and other strategic transactions, or the failure to consummate such transactions, could disrupt our business and harm our financial condition and may not yield the intended benefits.

•New lines of business or new products and services may subject us to additional risks.

•An impairment charge of goodwill or other intangibles could have a material adverse impact on our financial condition and results of operations.

•We may incur losses due to fraudulent and negligent acts, as well as errors, by third parties or our employees.

•Security breaches involving us, the Bank or any third parties with which we do business could expose us to liability and litigation, adversely affecting our reputation and operating revenues.

•Failure to comply satisfactorily with certain privacy and data protection laws, regulations, and standards to which we are subject could adversely affect our reputation and operating revenues.

•Our reputation and financial condition may be harmed by system failures, computer viruses and other technological interruptions to our operations.

•Agency, technological, or human error could lead to tax refund processing delays, which could adversely affect our reputation and operating revenues.

•The Commercial Finance business line generates government-backed loans funded by the Bank, any of which could be negatively impacted by a variety of factors.

•Agreements between the Bank and third parties to market and service Bank-originated consumer loans may subject the Bank to credit, fraud and other risks, as well as claims from regulatory agencies and third parties that, if successful, could negatively impact the Bank's current and future business.

•The OCC's grant of bank charters to fintech companies and special purpose fintech charter could present a market risk to us generally and the Partner Solutions business line specifically.

•The loss or transition of key members of our senior management team or key employees in the Bank's divisions, or our inability to attract and retain qualified personnel, could adversely affect our business.

•We regularly assess our investments in technology, and changes in technology could be costly.

Table of Contents

•

•Unclaimed funds represented by unused value on the cards presents compliance and other risks.

Risks Related to Regulation of the Company and the Bank

•We operate in a highly regulated environment, and our failure to comply with laws and regulations, or changes in laws and regulations to which we are subject, may adversely affect our business, prospects, results of operations and financial condition.

•The Bureau's rulemaking and enforcement of prohibitions against unfair, deceptive or abusive practices have directly impacted, and may continue to impact, the Bank's consumer financial products and service offerings.

•

•Increased scrutiny and evolving expectations from stakeholders with respect to ESG practices may impose additional costs on us or expose us to new or additional risks.

•We will be subject to heightened regulatory requirements if our total assets exceed $10 billion as of December 31 of any calendar year.

•We will become subject to reduced interchange income and could face related adverse business consequences if our total assets exceed $10 billion as of December 31 of any calendar year.

•Any change in the Bank's ability to gather brokered deposits may adversely impact the Bank.

•As a BHC, we are required to serve as a "source of strength" for the Bank.

•If we fail to maintain sufficient capital, our financial condition, liquidity, results of operations, and compliance with regulatory requirements would be adversely affected.

•Changes in federal, state, and local tax laws, interpretations of existing tax laws, or adverse determinations by tax authorities, could increase our tax burden or otherwise have a material adverse effect on our business, financial condition, and results of operations.

General Risk Factors

•The price of our common stock may be volatile, which may result in losses for investors.

•An investment in our common stock is not an insured deposit.

•Future sales or additional issuances of our capital stock may depress prices of shares of our common stock or otherwise dilute the book value of shares then outstanding.

•Changes in accounting policies or accounting standards, or changes in how accounting standards are interpreted or applied, could materially affect how we report our financial results and condition.

•If we fail to maintain proper and effective internal controls, our ability to produce accurate and timely financial statements could be impaired, which could harm our operating results, our ability to operate our business and our reputation.

•Federal regulations and our organizational documents may inhibit a takeover, prevent a transaction you favor or limit our growth opportunities, causing the market price of our common stock to decline.

•We may not be able to pay dividends in the future in accordance with past practice.

•Catastrophic events could negatively impact our operations, the operations of third parties with which we do business, and the communities in which we do business.

•Legal challenges to and regulatory investigations of our, or the Bank's, operations could have a significant material adverse effect on us.

•Our reputation and business could be damaged by negative publicity.

•Existing insurance policies may not adequately protect us and our subsidiaries.

Risks Related to Our Industry and Business

Our framework for managing risk, including our underwriting practices, may not prevent future losses.

We have established processes and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which we are subject, including liquidity risk, credit risk, market risk, interest rate risk, operational risk, legal and compliance risk, and reputational risk, among others. However, as with any risk management framework, there are inherent limitations to our risk management strategies, as there may exist, or develop in the future, risks that we have not appropriately anticipated or identified. For example, if our underwriting practices or criteria fail to adequately identify, price, and mitigate credit risks, such as risks related to economic disruption and the risk in our refund advance loan portfolio that the IRS or the relevant state revenue department does not pay our customer's tax refund in full or the risk that any of our EROs will facilitate or engage in malfeasance or offer the Bank's products

Table of Contents

and services in a manner that does not comply with applicable law or contractual representations, warranties and covenants, it is possible that losses in our loan portfolio will exceed the amounts the Bank has set aside for loss reserves and result in reduced interest income and increased provision for credit loss, which could have an adverse effect on our financial condition and results of operations. Any resulting deterioration in our loan and lease portfolio could also cause a decrease in our capital, which would make it more difficult to maintain regulatory capital compliance. Further, risk mitigation techniques and the judgments that accompany their application cannot anticipate every economic and financial outcome or the specific circumstances and timing of such outcomes, which may result in the Bank or any of its business lines incurring unexpected losses.

We are subject to credit risk in connection with our lending and leasing activities, and our financial condition and results of operations may be negatively impacted by factors that adversely affect our borrowers.

We, through the Bank and its business lines, originate various types of loans and leases, and our financial condition and results of operations are affected by the ability of borrowers to repay their loans or leases in a timely manner. Borrowers may be unable to repay their loans due to various factors, some of which are outside of their control. Similarly, borrowers under our commercial loans and related financing products (typically, small- to medium-sized businesses) may be more susceptible to even mild or moderate economic declines than larger commercial borrowers, which may subject the Bank and, ultimately, us, to a higher risk of loan loss. Many borrowers have been negatively impacted by recent events impacting financial, real estate, and securities markets, including geopolitical turmoil, higher interest rates, inflation, adverse developments in the financial services industry, and other events that have caused market and economic volatility, and may continue to be similarly or more severely affected in the future. The risk of non-payment by borrowers is assessed through our underwriting processes and other risk management practices, which may not be able to fully identify, price and mitigate such risk. See "Our framework for managing risk, including our underwriting practices, may not prevent future losses." Despite those efforts, we do and will experience loan and lease losses, and our financial condition and results of operations will be adversely affected by those loan and lease losses.

If our actual credit losses exceed our allowance for credit losses, our net income will decrease.

We make various assumptions and subjective judgments about the collectability of our loan and lease portfolio, including the creditworthiness of our borrowers and the value of the assets serving as collateral for the repayment of our loans and leases, which are subject to change. Despite our underwriting and monitoring practices, our loan and lease customers may not repay their loans and leases according to their terms, and the collateral securing the payment of these loans and leases may be insufficient to pay any remaining loan and lease balance. We may experience significant credit losses due to nonpayment by our borrowers, which could have a material adverse effect on our overall financial condition and results of operation, as well as the value of our common stock. Because we must use assumptions to establish our allowance for credit losses, the current allowance for credit losses may not be sufficient to cover actual credit losses, and increases in the allowance, which may be significant, may be necessary. In addition, federal and state regulators periodically review our allowance for credit losses and may require us to increase our provision for credit loss or recognize loan charge-offs. Material additions to our allowance would materially decrease our net income.

Our earnings are significantly affected by general business, political and economic conditions.

Our operations and profitability, including the value of the portfolio of investment securities we hold and the value of collateral securing certain of our loans, are impacted by general business, political and economic conditions in the United States and abroad. These conditions include short-term and long-term interest rates, inflation, commodity pricing, money supply and monetary policy, political issues, legislative and regulatory changes, fluctuations in both debt and equity capital markets, broad trends in industry and finance, the strength of the United States economy, and uncertainty in financial markets globally, all of which are beyond our control.

Additionally, an unpredictable or volatile political environment in the United States, including any social unrest and uncertainty as a result of the 2024 U.S. presidential election, could negatively impact business and market

Table of Contents

conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which could have a material adverse impact on our financial condition and results of operations. It is difficult to predict the legislative and regulatory changes that may result due to the upcoming presidential election. A new administration, or a change in the make-up of either the Senate and/or House of Representatives may cause broader economic changes due to changes in governing ideology and style. New appointments to the Board of Governances of the Federal Reserve could affect monetary policy and interest rates, which could in turn affect economic growth.

The process we use to estimate losses inherent in our credit exposure requires difficult, subjective and complex judgments, including forecasts of economic conditions, and determinations as to whether economic conditions might impair the ability of our borrowers to repay their loans and leases. The level of uncertainty concerning economic conditions may adversely affect the accuracy of our estimates which may, in turn, impact the reliability of our underwriting processes. See also "If our actual loan and lease losses exceed our allowance for credit losses, our net income will decrease."

The electronic payments industry, including the prepaid financial services segment within that industry in which the Partner Solutions business line operates, depends heavily upon the overall level of consumer spending, which may decrease if economic or political conditions in the United States deteriorate and result in a reduction of the number of our prepaid accounts that are purchased or reloaded, the number of transactions involving our cards and the use of our reloadable card products and related services. A sustained reduction in the use of our products and related services, either as a result of a general reduction in consumer spending or as a result of a disproportionate reduction in the use of card-based payment systems, would materially harm our business, results of operations and financial condition.

Adverse developments or concerns affecting the financial services industry or specific financial institutions could adversely affect our financial condition and results of operations.

Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar events, have in the past and may in the future lead to erosion of customer confidence in the banking system, deposit volatility, liquidity issues, stock price volatility, increased regulatory scrutiny and other adverse developments. For example, the closures of Silicon Valley Bank ("SVB") and Signature Bank in March 2023, and First Republic Bank in May 2023, led to disruption and volatility, including deposit outflows and increased need for liquidity, at certain banks. Although depositors of these banks were largely protected, it is not certain that the Federal Reserve or FDIC will treat future bank failures similarly.

Similarly, inflation and rapid increases in interest rates have led to a decline in the trading value of previously issued government securities with interest rates below current market interest rates. Any sale of investment securities that are held in an unrealized loss position by financial institutions for liquidity or other purposes will cause actual losses to be realized. There can be no assurance that there will not be additional bank failures or issues such as liquidity concerns in the broader financial services industry or in the U.S. financial system as a whole. Adverse financial market and economic conditions can exert downward pressure on stock prices, security prices, and credit availability for financial institutions without regard to their underlying financial strength. The volatility and economic disruption resulting from the failures of SVB and Signature Bank particularly impacted the price of securities issued by financial institutions, including us.

While we did not experience any abnormal changes in our total outstanding deposit balances following the bank closures in March and May 2023 and related events, we experienced changes in deposit balances resulting from typical seasonal fluctuations due to the nature of our business. Continued uncertainty regarding or worsening of the severity or duration of the volatility in the banking industry could also adversely impact our estimate of our allowance for credit losses and related provision for credit loss.

Any of these impacts, or any other impacts resulting from the events described above, could have a material adverse effect on our liquidity and our current and/or projected business operations and financial condition and results of operations.

Table of Contents

Ineffective liquidity management could adversely affect our financial condition and results of operation.

Liquidity is essential to our business. We rely on different sources in order to meet our potential liquidity demands. We also utilize wholesale deposit sources to provide temporary funding when necessary or when favorable terms are available. An inability to raise funds through deposits, borrowings, the sale of loans and other sources could have a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities or on terms which are acceptable to us could be impaired by factors that affect us specifically, or the financial services industry or economy generally. Any decline in available funding in amounts adequate to finance our activities or on terms which are acceptable could adversely impact our ability to originate loans, invest in securities, meet our expenses or fulfill our obligations, such as repaying our borrowings or meeting deposit withdrawal demands, any of which could, in turn, have a material adverse effect on our business, financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation – Liquidity and Capital Resources” of this Form 10-K.

Our investments in certain tax-advantaged projects may not generate anticipated returns, causing an adverse impact on our results of operations.

We invest in certain tax-advantaged investments that support renewable energy resources. Our investments in these projects are designed to generate a return in part through the realization of federal and state income tax credits, and other tax benefits, over specified time periods. We are subject to the risk that previously recorded tax credits, which remain subject to recapture by taxing authorities based on compliance features required to be met at the project level, may fail to meet certain government compliance requirements and may not be able to be realized.

The risk of not being able to realize, or of subsequently incurring a recapture of, the tax credits and other tax benefits depends on various factors, some of which are outside of our control, including changes in the applicable tax code, as well as the continued economic viability of the project and project operator. Further, while we engage in due diligence review both prior to the initial investment and on an ongoing basis, our due diligence review may not identify relevant issues or risks that may adversely impact our ability to realize these tax credits or other tax benefits. The possible inability to realize these tax credits and other tax benefits would have a negative impact on our financial results.

The residual value of leased equipment at the time of its disposition may be less than forecasted at the time we entered into the lease.

Through our Commercial Finance business line, we engage in equipment leasing activities. The market value of any given piece of leased equipment could be less than its depreciated value at the time it is sold due to various factors, including factors beyond our control. The market value of used leased equipment depends on several factors, including:

•the market price for new equipment that is similar;

•the age and condition of the leased equipment at the time it is sold;

•the supply of and demand for similar used equipment on the market;

•technological advances relating to the leased equipment or similar equipment; and

•economic conditions in the specific business or industry in which the equipment is used, as well as broader regional or national economic conditions.

We include in income from operations the difference between the sales price and the depreciated value of an item of leased equipment sold. If we sell our used leased equipment at prices significantly below our projections or in lesser quantities than we anticipated at the time we entered into the lease, our results of operations and cash flows may be negatively impacted.

Table of Contents

Changes in interest rates could adversely affect our results of operations and financial condition.

Our earnings depend substantially on our interest rate spread, which is the difference between (i) the interest rates we earn on loans, securities, and other interest-earning assets, and (ii) the interest rates we pay on deposits, other borrowings, and other interest-bearing liabilities. We are exposed to interest rate risk because our interest-earning assets and interest-bearing liabilities do not react uniformly or concurrently to changes in interest rates since the two have different time periods for adjustment and can be tied to different measures of rates. These rates are highly sensitive to many factors beyond our control, including general economic conditions and the policies of various governmental and regulatory authorities, including the Federal Reserve. Throughout 2022, 2023 and 2024, the Federal Reserve raised the target range for the federal funds rate in an effort to curb inflation. In September 2024 and November 2024, the Federal Reserve lowered the target range for the federal funds rate to its current range of 4.50% to 4.75% in light of the progress on inflation. In addition, certain of our noninterest income and noninterest expenses are subject to adverse effect in a rising interest rate environment. The Bank monitors its interest rate risk exposure; however, the Bank can provide no assurance that its efforts will appropriately protect the Bank in the future from interest rate risk exposure. For additional information, see Part II, Item 7A, "Quantitative and Qualitative Disclosures About Market Risk."

We operate in an extremely competitive market, and our business will suffer if we are unable to compete effectively.

We encounter significant competition in all of our market areas and national business lines from other commercial banks, savings and loan associations, credit unions, mortgage banking firms, consumer finance companies, factoring companies, card issuers, securities brokerage firms, insurance companies, money market mutual funds and other financial intermediaries, including but not limited to fintech or neobank financial intermediaries. Some of our and the Bank's competitors have substantially greater resources and lending limits, may be subject to less regulation than we are, may offer services that we do not or cannot provide and, due to their size and other factors, may be able to offer services at more competitive rates. Our profitability depends upon both our ability to compete successfully in our market areas and the Bank's and the divisions' ability to compete in their various business markets.

For example, the Commercial Finance business line competes for loans, leases, and other financial services with numerous national and regional banks, thrifts, credit unions, and other financial institutions, as well as other entities that provide financial services, including specialty lenders, securities firms, and mutual funds. Certain larger commercial financing companies do not currently focus their marketing efforts on smaller commercial companies; however, any shift in focus by such larger financing companies may further fragment existing market share in this commercial finance industry. Moreover, some of the financial institutions and financial service organizations with which the Commercial Finance business line competes are not subject to the same degree of regulation as the Commercial Finance business line and the Bank. Many of the Commercial Finance business line's competitors have been in business for many years, have established customer bases, are larger and may offer other services that neither the Commercial Finance business line nor the Bank do.

Several banking institutions have adopted business strategies similar to ours, particularly with respect to the banking-as-a-service ("BaaS") business. This competition, and competition in any of the Bank's other business lines, may increase our costs, reduce our revenues or revenue growth, result in fragmented market share and a failure to enjoy economies of scale or make it difficult for us to compete effectively in maintaining and obtaining additional customer relationships.

Our business could suffer if consumer behaviors, or other factors, in connection with the use of prepaid cards change, or there are adverse developments with respect to the prepaid financial services industry in general.

As the prepaid financial services industry evolves, consumers may either find prepaid financial services to be less attractive than other financial services or may change the way in which they utilize the service prepaid cards provide. Consumers might not use prepaid financial services for any number of reasons. Consumer spend behaviors could increase or decrease, or become more difficult to accurately predict, thereby impacting operating revenues and/or expenses of the Company. Growth of prepaid financial services as an electronic payment mechanism may not

Table of Contents

occur or may occur more slowly than estimated. These factors could have a material adverse effect on our financial condition and results of operations.

Our operations depend upon third-party relationships; our ability to maintain such relationships and such third parties' performances could adversely affect our business.

The Bank has entered into numerous arrangements with third parties with respect to the operations of its business, as described in Part I, Item 1 "Business." Upon the expiration of the then-current term, any such agreements may not be renewed by the third party or may be renewed on terms less favorable to the Bank. In some cases, such agreements may permit the third party to unilaterally prescribe certain business practices and procedures with respect to the Bank and its business lines (as is the case under agreements with Discover, MasterCard, Visa and other card networks) or terminate the agreement early under certain circumstances (as is the case under our program management agreement with Emerald Financial Services, LLC ("EFS") with respect to certain H&R Block financial services if the Bank should lose its exemption from the Durbin Amendment). To the extent any agreement with a service provider is terminated, we may not be able to secure alternate service providers, and, even if we do, the terms with alternate providers may not be as favorable as those currently in place. In addition, were we to lose any of our significant third-party providers, including in our refund advance related business in which we have a limited number of partners, it could cause a material disruption in our ability to service our customers, which also could have an adverse material impact on the Bank, its business lines and, ultimately, us. Moreover, significant disruptions in our ability to provide services could negatively affect the perception of our business, which could result in a loss of confidence and other adverse effects on our business.

In addition, if any of our counterparties is unable to or otherwise does not fulfill (or does not timely fulfill) its obligations to us for any reason (including, but not limited to, bankruptcy, computer or other technological interruptions or failures, personnel loss, negative regulatory actions, or acts of God) or engages in fraud or other misconduct during the course of such relationship, we may need to seek alternative third party service providers, or discontinue certain products or programs in their entirety. We have experienced, and expect to continue to experience, situations where we have been held directly or indirectly responsible, or were otherwise subject to liability, for the inability of our third party service providers to perform services for our customers on a timely basis or at all or for actions of third parties undertaken on behalf of the Bank or otherwise in connection with the Bank's arrangement with such third parties. Any such responsibility or liability in the future may have a material adverse effect on our business, including the operations of the Bank and its divisions, and financial results.

Additionally, although our network of tax preparation partners is expansive, it is possible that our EROs may choose to offer tax-related products of other companies that provide products and services similar to the Bank's if such other companies offer superior pricing or for other competitive reasons.

We derive a significant percentage of our deposits, total assets and income from deposit accounts that we generate through Payments' customer relationships, of which a limited number of program manager relationships are particularly significant to our operations.

We derive a significant percentage of our deposits, total assets and income from deposit accounts we generate through program manager relationships between third parties and Payments. If one of these significant program manager relationships were to be terminated or there is a significant decrease in revenues or deposits associated with any of these business relationships, it could materially reduce our deposits, assets and income. Similarly, if a significant program manager relationship was not replaced, we may be required to seek higher-rate funding sources as compared to the existing program manager relationship or see a significant reduction in fee income.

Table of Contents

We are exposed to fraud losses from customer accounts.

Fraudulent activity involving our products may lead to customer disputed transactions, for which we may be liable under banking regulations and payment network rules. Our fraud detection and risk control mechanisms may not prevent all fraudulent or illegal activity. To the extent we incur losses from disputed transactions, our business, results of operations and financial condition could be materially and adversely affected.

We are exposed to settlement and other losses from payments customers.

Our cardholders can incur charges in excess of the funds available in their accounts, and we may become liable for these overdrafts. While we decline authorization attempts for amounts that exceed the available balance in a cardholder's account, the application of card association rules, the timing of the settlement of transactions and the assessment of the card's monthly maintenance fee, among other things, can result in overdrawn accounts.

In addition, we face settlement risks from our distributors and banking partners, which may increase during an economic downturn. Depending on contract terms, we may prefund partner accounts. If a partner becomes insolvent, files for bankruptcy, commits fraud or otherwise fails to remit proceeds to our card issuing bank from the sales of our products and services, we are liable for any amounts owed to our customers. At September 30, 2024, we had assets subject to settlement risk of $365.9 million.

For one of our programs, the Company pays servicing fees which are primarily offset by estimated card breakage. For cards issued prior to January of 2020, if consumers spend more than projected over the life of the card programs, the Company could experience a material adverse effect on our business, results of operations and financial condition. See “Funding Activities – Deposits” for further breakdown of balances as of September 30, 2024. We are not insured against these settlement or partner risks.

Our business strategy includes plans for organic growth, and our financial condition and results of operation could be adversely affected if we fail to grow or fail to manage our growth effectively.

As part of our general growth strategy, we expect to continue to pursue organic growth, while also continuing to evaluate potential acquisitions and expansion opportunities that we believe provide a strategic or geographic fit with our business. Although we have experienced significant growth in our assets and revenues, we may not be able to sustain our historical growth rate or be able to grow at all. We believe that our future organic growth will depend on competitive factors and on the ability of our senior management to continue to maintain a robust system of internal controls and procedures and manage a growing number of customer relationships. See "We operate in an extremely competitive market, and our business will suffer if we are unable to compete effectively." We may not be able to implement changes or improvements to these internal controls and procedures in an efficient or timely manner and may discover deficiencies in existing systems and controls. Our growth strategy may divert management from our existing business and may require us to incur additional expenditures to expand our administrative and operational infrastructure and, if we are unable to effectively manage our growth, including to the satisfaction of our regulators, we could be materially and adversely affected. In addition, acquiring other companies may involve risks such as exposure to potential asset quality issues, disruption to our normal business activities and diversion of management’s time and attention due to integration and conversion efforts. Consequently, continued organic growth, if achieved, may place a strain on our administrative and operational infrastructure, which could have a material adverse effect on our financial condition and results of operations.

Acquisitions and other strategic transactions, or the failure to consummate such transactions, could disrupt our business and harm our financial condition and may not yield the intended benefits.

We have historically and may continue to evaluate, consider and engage in strategic transactions, combinations, acquisitions and dispositions. These transactions could be material to our financial condition and results of operations if consummated. Identifying appropriate business opportunities can be difficult, time-consuming and costly, and we may not be successful in negotiating favorable terms and/or consummating the transaction. Even if we do consummate such a transaction, we may be unable to obtain the benefits or avoid the difficulties and risks of such transaction, including:

•increased regulatory and compliance requirements;

•implementation or remediation of controls, procedures and policies at the acquired company;

•diversion of management time and focus from operation of our then-existing business;

Table of Contents

•integration and coordination of product, sales, marketing, program and systems management functions;

•integration of the acquired company’s systems and operations generally with ours;

•integration of employees from the acquired company into our organization;

•loss or termination, including costs associated with the termination or replacement, of employees;

•liability for activities of the acquired company prior to the acquisition, including violations of law, commercial disputes and tax and other known and unknown liabilities; and

•increased litigation or other claims in connection with the acquired company, including claims brought by terminated employees, customers, former stockholders or other third parties.

Accordingly, any acquisition, disposition or other strategic transaction may not be successful, may not benefit our business strategy or may not otherwise result in the intended benefits. It also may take us longer than expected to fully realize the anticipated benefits and synergies of these transactions, and those benefits and synergies may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results.

Additionally, any acquisition of target financial institutions or other banking assets by us may require approval by, and cooperation from, a number of governmental regulatory agencies, as well as state banking regulators. Such regulators could delay or deny our applications or regulatory approvals may not be granted on terms that are acceptable to us.

To the extent we pay the consideration for any future strategic acquisition in cash, it would reduce the amount of cash available to us for other purposes. Future strategic transactions could also result in dilutive issuances of our equity securities or the incurrence of debt, contingent liabilities, amortization expenses, or goodwill impairment charges, any of which could harm our financial condition and negatively impact our stockholders.

New lines of business or new products and services may subject us to additional risks.

From time to time, we have implemented, and in the future, may implement new lines of business or offer new financial products or services within existing lines of business. Substantial risks and uncertainties are associated with developing and marketing new lines of business or new products or services, particularly in instances where markets are not fully developed or when the laws and regulations regarding a new product are not mature, and we may be required to invest significant time, management and capital resources in connection with such new lines of business or new products or services. Initial timetables for the introduction and development of new lines of business or new products or services may not be achieved. In addition, price and profitability targets for new lines of business or new products or services may not prove feasible, as we, the Bank or any of the Bank's business lines may need to price products and services on less advantageous terms than anticipated to retain or attract customers. External factors, such as regulatory reception, compliance with regulations and guidance, developing laws and regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business or new product or service may be expensive to implement and could also have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could reduce our revenues and potentially generate losses.

An impairment charge of goodwill or other intangibles could have a material adverse impact on our financial condition and results of operations.

From previous acquisitions, the Company has goodwill and intangible assets included in its consolidated assets. Under GAAP we are required to test the carrying value of goodwill and intangible assets at least annually or sooner if events occur that indicate impairment could exist. These events or circumstances could include a significant change in the business climate, legal and regulatory factors, competition, a decrease in our stock price and market capitalization over a sustained period of time, a sustained decline in a reporting unit's fair value or other operating performance indicators. GAAP requires us to assign and then test goodwill at the reporting unit level. If the fair value of our reporting unit is less than its net book value, the shortfall is recognized as impairment and is recognized in current earnings. In addition, if the revenue and cash flows generated from any of our other acquired intangible assets is not sufficient to support its net book value, we may be required to record an impairment charge. The estimation of fair value involves a high degree of judgment and subjectivity in the assumptions used. The amount of any impairment charge could be significant and could have a material adverse impact on our financial condition and results of operations for the period in which the charge is taken.

Table of Contents

We may incur losses due to fraudulent and negligent acts, as well as errors, by third parties or our employees.

We may incur losses due to fraudulent or negligent acts, misconduct or errors on the part of third parties with which we do business, our employees and individuals and entities unaffiliated with us, including unauthorized wire and automated clearinghouse transactions, the theft of customer data, customer fraud concerning the value of any relevant collateral, identity theft, errors in a customer's tax return, tax return fraud, the counterfeiting of cards and "skimming" (whereby a skimmer reads a debit card's encoded mag stripe and a camera records the PIN that is entered by a customer), malicious social engineering schemes (where people are asked to provide a prepaid card or reload product in order to obtain a loan or purchase goods or services) and collusion between participants in the card system to act illegally. Additionally, our employees could hide unauthorized activities from us, engage in improper or unauthorized activities on behalf of our customers, or improperly use confidential information. There can be no assurances that the Bank's program to monitor fraud and other activities will be able to detect all instances of such conduct or that, even if such conduct is detected, we, the Bank, our customers or the third parties with which we do business, including the ATM networks and card payment industry in which the Bank participates, will not be the victims of such activities. Even a single significant instance of fraud, misconduct or other error could result in reputational damage to us, which could reduce the use and acceptance of our cards and other products and services, cause retail distributors or their customers to cease doing business with us or them, or could lead to greater regulation that would increase our compliance costs. Such activities could also result in the imposition of regulatory sanctions, including significant monetary fines, and civil claims which could adversely affect our business, operating results and financial condition.

Security breaches involving us, the Bank or any third parties with which we do business could expose us to liability and litigation, adversely affecting our reputation and operating revenues.

In connection with our business, we collect and retain significant volumes of sensitive business and personally identifiable information, including social security numbers of our customers and other personally identifiable information of our customers and employees, on our data systems. We and the third parties with which we conduct business are subject to security breaches, which may be due to the failure of our data encryption technologies or otherwise, involving the receipt, transmission, and storage of confidential customer and other personally identifiable information, including account takeovers, unavailability of service, computer viruses, or other malicious code, cyberattacks, or other events, any of which may arise from human error, fraud or malice on the part of employees or third parties or from accidental technological failure. If one or more of these events occurs, it could result in the disclosure of confidential customer information, impairment of our ability to provide products and services to our customers, damage to our reputation with our customers and the market, additional costs (such as costs for repairing systems or adding new personnel or protection technologies), regulatory penalties, and financial losses for us, our customers and other third parties. Such events could also cause interruptions or malfunctions in the operations of our customers, or other third parties with which we engage in business. Such events could also damage our reputation with customers and third parties with whom we do business, which could lead to loss of customers and business opportunities and have a material adverse effect on our financial condition and results of operation.

Risks and exposures related to cybersecurity attacks have increased as a result of greater reliance on remote working, and are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, the proliferation of malicious actors internationally, and the expanding use of technology-based products and services by us and our customers. Cybersecurity risk and other security matters are also a major focus of regulatory authorities. We can provide no assurances that the safeguards we have in place or may implement in the future will prevent all unauthorized infiltrations or breaches and that we will not suffer losses related to a security breach in the future, which losses may be material. In addition, we may be required to expend additional resources to enhance our protective measures or to investigate and remediate any information security vulnerabilities or exposures.

Failure to comply satisfactorily with certain privacy and data protection laws, regulations, and standards to which we are subject could adversely affect our reputation and operating revenues.

We are subject to various privacy, information security and data protection laws, regulations and standards. For example, the largest credit card associations in the world created the Payment Card Industry Data Security Standards (the "PCI DSS"), a multifaceted standard that includes data security management, policies and procedures as well as other protective measures to protect the nonpublic personal information of cardholders. These laws, regulations and standards are rapidly evolving and increasing in complexity and could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use,

Table of Contents

sharing, retention and safeguarding of consumer and employee information, and some current or planned business activities. Complying with these laws, regulations and standards may increase our operational costs, restrict our ability to provide certain products and services or have an effect on the profitability of one or more of our business divisions. Additionally, our failure, or perceived failure, to comply with applicable laws and regulations or other obligations to which we may be subject relating to personal information could result in regulatory sanctions, including financial penalties, regulatory investigations, claims for damages by customers and other affected individuals and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.

Our reputation and financial condition may be harmed by system failures, computer viruses and other technological interruptions to our operations.

We rely heavily upon information systems and other operating technologies to efficiently operate and manage our business, including to process transactions through the Internet, including, in particular, in our Partner Solutions business line. Were there to be a failure or a significant impairment in the operation of any of such systems, we may need to develop alternative processes, including to comply with customer safeguard protocols, during which time revenues and profitability may be lower, and there can be no assurance that we could develop or find such an alternative on terms acceptable to us or at all. Any such disruption in the information systems and other operating technologies utilized by the Bank or its divisions, including due to infiltration by hackers or other intruders, power loss, telecommunications failure, physical break-ins, or damage from fire, could also result in negative publicity, have a material adverse effect on our ability to obtain or retain customers, and have a material adverse effect on our financial condition and results of operations.

Agency, technological, or human error could lead to tax refund processing delays, which could adversely affect our reputation and operating revenues.

We and our tax preparation partners rely on the IRS, technology, and employees when processing and preparing tax refunds and tax-related products and services. Any delays during the processing or preparation period could result in reputational damage to us or to our tax preparation partners, which could reduce the use and acceptance of our cards and tax-related products and services, either of which could have a significant adverse impact on our operating revenues and future growth prospects.

The Commercial Finance business line generates government-backed loans funded by the Bank, any of which could be negatively impacted by a variety of factors.

The Commercial Finance business line originates loans backed by numerous state and federal government agencies. Risks inherent in the Bank's participation in such programs, through its Commercial Finance business line, include: (i) some of these programs guarantee only a portion of the commercial loan made by the Bank; as such, if the borrower defaults and losses exceed those guaranteed by the government agency, the Bank could realize significant losses; (ii) certain programs, including some guaranteed by the United States Department of Agriculture, limit the geographic scope of such loans; as such, if the Commercial Finance business line is not able to market these loans to potential borrowers, the Bank's share in this market may be negatively impacted; (iii) the intended beneficiaries of such loan programs may experience a contraction in their credit quality due to local, national, or global economic events or because of factors specific to their business, including, for example, businesses dependent upon the farming and agriculture industry; as such, any negative impact to certain commercial business lines designed to benefit from such government-sponsored loan programs could constrict the Bank's business in these areas; and (iv) nearly all of these guaranteed loan programs are subject to an appropriations process, either at the legislative or regulatory level; this means that funds that may be currently available to guarantee loans or portions of loans could be limited or eliminated in their entirety with little or no advance warning.

Agreements between the Bank and third parties to market and service Bank-originated consumer loans may subject the Bank to credit, fraud and other risks, as well as claims from regulatory agencies and third parties that, if successful, could negatively impact the Bank's current and future business.

The Bank has entered into various agreements with unaffiliated third parties ("Marketers"), whereby the Marketers will market and service unsecured consumer loans underwritten and originated by the Bank. These agreements present potential increased credit, operational, and reputational risks. Because the loans originated under such programs are unsecured, in the event a borrower does not repay the loan in accordance with its terms or otherwise defaults on the loan, the Bank may not be able to recover from the borrower an amount sufficient to pay any

Table of Contents

remaining balance on the loan. See "If our actual loan and lease losses exceed our allowance for credit losses, our net income will decrease." We may also become subject to claims by regulatory agencies, customers, or other third parties due to the conduct of the third parties with which the Bank operates such lending programs if such conduct is deemed not to comply with applicable laws in connection with the marketing and servicing of loans originated pursuant to these programs.

Certain types of these arrangements have been challenged both in the courts and in regulatory actions. In these actions, plaintiffs have generally argued that the "true lender" is the marketer and that the intent of such lending program is to evade state usury and loan licensing laws. Other cases have also included other claims, including racketeering and other state law claims, in their challenge of such programs.

In 2020, the OCC issued final rules designed to clarify when a national bank such as the Bank will be considered the “true lender” in such relationships (the "True Lender Rule"). In June 2021, the True Lender Rule was repealed and the OCC prohibited from issuing any replacement of the True Lender Rule absent Congressional authorization." Additionally, certain parties have initiated litigation in order to obtain court guidance on how particular jurisdictions may weigh loan program facts and rule on “true lender” challenges. In addition, the Consumer Financial Protection Bureau and the Federal Trade Commission have each announced their intention to explore their authority to supervise nonbank lending partnerships in markets for consumer financial products and services.

Consequently, state and federal regulatory authorities may proceed on different paths to promulgate “true lender” restrictions, and – absent binding court rulings or direct legislative action – impacted parties may have little to no advance notice of new restrictions and compliance obligations. In the absence of applicable laws or regulations addressing these matters, true lender disputes will be determined on a case-by-case basis, informed by differing state laws and the facts in each instance. There can be no assurance that lawsuits or regulatory actions in connection with any such lending programs the Bank has entered, or will enter, into will not be brought in the future. If a regulatory agency, consumer advocate group, or other third party were to bring successful action against the Bank or any of the third parties with which the Bank operates such lending programs, there could be a material adverse effect on our financial condition and results of operations.

The OCC's grant of bank charters to fintech companies and special purpose fintech charter could present a market risk to us generally and the Partner Solutions business line specifically.

The OCC announced on July 31, 2018 that it would begin to accept and evaluate charters for entities that wanted to conduct certain components of a banking business pursuant to a federal charter, known as a "special purpose national bank" ("SPNB") charter. Intended to promote economic opportunity and spur financial innovation, SPNBs may engage in paying checks, lending money and taking deposits. While the OCC has not granted any SPNB charters as of the date of this filing, it has granted national bank charters to companies that were previously non-bank fintech companies.

If, in the future, the OCC determines to grant any SPNB applications or continues to grant bank charters to fintech applicants, recipients of such charters may enter the U.S. payments market, BaaS solutions market, and other business lines in which the Bank operates, which could increase the competition we face and have a material adverse effect on the Bank and the Partner Solutions business line.

The loss or transition of key members of our senior management team or key employees in the Bank's divisions, or our inability to attract and retain qualified personnel, could adversely affect our business.

We believe that our success depends largely on the efforts and abilities of our senior executive management team and other key employees. Their experience and industry contacts significantly benefit us. Our future success also depends in part on our ability to attract, retain and motivate key management and operating personnel. The loss of any of our key personnel could have an adverse effect on our business. Management transitions may create uncertainty and involve a diversion of resources and management attention, be disruptive to our daily operations or impact public or market perception, any of which could negatively impact our ability to operate effectively or execute our strategies and result in a material adverse impact on our business, financial condition, results of operations or cash flows.

The competition for

Table of Contents

qualified personnel in the financial services industry is intense, and the loss of any of our key personnel or an inability to continue to attract, retain, and motivate key personnel could adversely affect our business.

We regularly assess our investments in technology, and changes in technology could be costly.

The fintech industry is undergoing technological innovation at a fast pace. To keep up with our competition, we regularly evaluate technology to determine whether it may help us compete on a cost-effective basis. The cost of investing in, implementing and maintaining such technology is high, and there can be no assurance, given the fast pace of change and innovation, that our technology, either purchased or developed internally, will meet our needs, in a timely, cost-effective manner or at all. During the course of implementing new technology into our or the Bank's operations, we may experience system interruptions and failures. In addition, there can be no assurances that we will recognize, in a timely manner or at all, the benefits that we may expect as a result of our implementing new technology into our operations. In connection with our implementation of new lines of business, offering of new financial products or acquisitions, we may experience significant, one-time or recurring technology-related costs. If we are not able to anticipate and keep pace with existing and future technology needs, our business, financial results, or reputation could be negatively impacted.

We are a legal entity separate and distinct from the Bank. Our primary source of cash, other than securities offerings, is dividends from the Bank. These dividends are a principal source of funds to pay dividends on our common stock, interest on our trust preferred securities and interest and principal on our debt. Various laws and regulations limit the amount of dividends that the Bank may pay us, as further described in Part I, Item 1 "Business - Regulation and Supervision - Bank Regulation and Supervision - Limitations on Dividends and Other Capital Distributions" of this Annual Report on Form 10-K. Such limitations could have a material adverse effect on our liquidity and on our ability to pay dividends on common stock. Additionally, if the Bank's earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, we may not be able to make dividend payments to our common shareholders or make payments on our trust preferred securities.

Unclaimed funds represented by unused value on the cards presents compliance and other risks.

The concept of escheatment involves the reporting and delivery of property to states that is abandoned when its rightful owner cannot be readily located and/or identified. In the context of prepaid cards, the customer funds represented by such cards can sometimes be "abandoned" or unused for the relevant period of time set forth in each applicable state's abandoned property laws. There appears, however, to be a movement among some state regulators to more broadly interpret definitions in escheatment statutes and regulations than in the past. State regulators may choose to initiate collection or other litigation action against prepaid card issuers, like Payments, for unreported abandoned property, and such actions may seek to assess fines and penalties and could have an adverse effect on our business.

Risks Related to Regulation of the Company and the Bank

We operate in a highly regulated environment, and our failure to comply with laws and regulations, or changes in laws and regulations to which we are subject, may adversely affect our business, prospects, results of operations and financial condition.

We and the Bank operate in a highly regulated environment, and we are subject to extensive regulation (including, among others, the Dodd-Frank Act, the Basel III Capital Rules, the Bank Secrecy Act and other AML rules), supervision, and examination, including by the OCC and the Federal Reserve, our primary banking regulators. In addition, the Bank is subject to regulation by the FDIC and, to a lesser degree, the Bureau. Prepaid card issuers like the Bank are also subject to heightened regulatory scrutiny based on AML and Bank Secrecy Act concerns, which scrutiny could result in higher compliance costs. See Part I, Item 1 "Business - Regulation and Supervision" herein. Many of the laws, rules, regulations and supervisory policies governing our business are intended primarily for the protection of our depositors, our customers, the financial system and the FDIC insurance fund, not our stockholders

Table of Contents

or other creditors and are subject to regular modification and change.

Banking regulatory authorities have broad discretion in connection with their supervisory and enforcement activities, including, but not limited, to the imposition of restrictions on the operation of an institution, the classification of assets by the institution, and the adequacy of an institution's allowance for credit losses. If any of our banking regulators takes informal or formal supervisory action or pursues an enforcement action, any required corrective steps could result in us being subject to additional regulatory requirements, operational restrictions, a consent order, enhanced supervision and/or civil money penalties. Failure to maintain and implement adequate policies, procedures, and systems to comply with these regulations could also have serious reputational consequences for us.

Any new requirements or rules, changes in such requirements or rules, changes to or new interpretations of existing requirements or rules, failure to follow requirements or rules, or future lawsuits or rulings could increase our compliance and other costs of doing business, require significant systems redevelopment, render our products or services less profitable or obsolete or otherwise have a material adverse effect on our business, prospects, results of operations, and financial condition. For example, any changes in the U.S. tax laws as a result of pending tax legislation in the U.S. Congress or otherwise may adversely impact our tax refund processing and settlement business, which could reduce customer demand for our strategic partner's refund advance products, thereby reducing the volume of refund advance loans that we may offer. In addition, future regulations could increase the assessment rate we are required to pay to the FDIC, adversely affecting our earnings. It is very difficult to predict future changes in regulation or the competitive impact that any such changes would have on our business.

The Bureau's rulemaking and enforcement of prohibitions against unfair, deceptive or abusive practices have directly impacted, and may continue to impact, the Bank's consumer financial products and service offerings.

The Bureau has broad rulemaking authority to administer and carry out the purposes and objectives of "federal consumer financial laws, and to prevent evasions thereof" with respect to all financial institutions that offer financial products and services to consumers. We cannot predict the impact the Bureau's future actions, including any exercise of its UDAAP authority, will have on the banking industry broadly or us and the Bank specifically. Notwithstanding that insured depository institutions with assets of $10 billion or less (such as the Bank) will continue to be supervised and examined by their primary federal regulators, the full reach and impact of the Bureau's broad rulemaking powers and UDAAP authority on the operations of financial institutions offering consumer financial products or services are currently unknown. The Bureau has initiated enforcement actions against a variety of bank and non-bank market participants with respect to a number of consumer financial products and services that has resulted in those participants expending significant time, money and resources to adjust to the initiatives being pursued by the Bureau. Such enforcement actions may serve as precedent for how the Bureau interprets and enforces consumer protection laws, which may result in the imposition of higher standards of compliance with such laws and, as a result, limit or restrict the Bank with respect to its consumer product offerings. See "Business - Regulation and Supervision - Bank Regulation and Supervision" in Part I, Item 1 of this Annual Report on Form 10-K.

Table of Contents

Increased scrutiny and evolving expectations from stakeholders with respect to ESG practices may impose additional costs on us or expose us to new or additional risks.

As a regulated financial institution and a publicly traded company, we are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company’s reputation, ability to do business with certain partners, and stock price. Both recently adopted and pending government regulations will result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. Additionally, ongoing legislative or regulatory uncertainties and changes regarding ESG, including climate risk, management and practices may result in higher compliance, credit and reputational risks and costs. To the extent that we or our customers experience increases in costs, including with respect to compliance with any additional regulatory or disclosure requirements or expectations, reductions in the value of assets, constraints on operations or similar concerns driven by changes in ESG oversight and regulation, our results of operations, financial condition, and business could be adversely affected.

We will be subject to heightened regulatory requirements if our total assets exceed $10 billion as of December 31 of any calendar year.

While we intend to remain under the $10 billion asset level, our total assets could exceed $10 billion at the end of this or a future calendar year. In addition to our current regulatory requirements, banks with $10 billion or more in total assets are, among other things: examined directly by the Bureau with respect to various federal consumer financial laws; subject to reduced dividends on the Bank’s holdings of Federal Reserve Bank of Minneapolis common stock; subject to limits on interchange fees pursuant to the Durbin Amendment to the Dodd-Frank Act; subject to certain enhanced prudential standards; no longer treated as a “small institution” for FDIC deposit insurance assessment purposes; and no longer eligible to elect to be subject to the Community Bank Leverage ratio. Compliance with these additional ongoing requirements may necessitate additional personnel, the design and implementation of additional internal controls, or the incurrence of other significant expenses, any of which could have a significant adverse effect on our business, financial condition or results of operations. Our regulators may also consider our preparation for compliance with these regulatory requirements in the course of examining our operations generally or when considering any request from us or the Bank.

We will become subject to reduced interchange income and could face related adverse business consequences if our total assets exceed $10 billion as of December 31 of any calendar year.

Debit card interchange fee restrictions set forth in Section 1075 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which is known as the Durbin Amendment, as implemented by regulations of the Federal Reserve, cap the maximum debit interchange fee that a debit card issuer may receive per transaction. Debit card issuers with total consolidated assets of less than $10 billion are exempt from these interchange fee restrictions. The exemption for small issuers ceases to apply as of July 1 of the year following the calendar year in which the debit card issuer has total consolidated assets of $10 billion or more at calendar year-end. While we intend to remain under the $10 billion asset level, and have implemented an off-balance sheet strategy for deposits, growth in deposits and associated loan growth could result in such an increase on our balance sheet. Any reduction in interchange income as a result of the loss of the exemption for small issuers under the Durbin Amendment could have a significant adverse effect on our business, financial condition and results of operations. Moreover, our loss of eligibility under the exemption for small issuers could adversely affect or reduce our ability to maintain certain of our fee-sharing prepaid card partnerships, which have the right to terminate our agreement with respect to certain financial services under such circumstances.

Any change in the Bank's ability to gather brokered deposits may adversely impact the Bank.

Failure to maintain the Bank's status as a "well capitalized" institution could have an adverse effect on us, and our ability to fund our operations. The Bank relies on brokered deposits to assist in funding its loan and other financing products. Should the Bank ever fail to be well capitalized in the future as a result of not meeting the well capitalized requirements or the imposition of an individual minimum capital requirement or similar formal requirement, then, the Bank would be prohibited, absent waiver from the FDIC, from utilizing brokered deposits (i.e., no insured depository

Table of Contents

institution that is deemed to be less than "well capitalized" may accept, renew or rollover brokered deposits absent a waiver from the FDIC). Further, depending on the Bank's condition in the future and its reliance on these deposits as a source of funding, the FDIC could increase the surcharge on our brokered deposits. If we are ever required to pay higher surcharge assessments with respect to these deposits, such payments could be material and therefore could have a material adverse effect on our financial condition and results of operations. In addition, changes to FDIC regulations regarding brokered deposits or interpretations of such regulations by federal banking agencies could have an adverse impact on the Bank’s ability to accept brokered deposits. On July 30, 2024, the FDIC released a notice of proposed rulemaking to revise its regulations regarding brokered deposits, which would significantly change the FDIC’s current approach to brokered deposits. If the FDIC adopts these amendments as proposed, it could have an adverse impact on the Bank’s ability to accept brokered deposits. Additionally, brokered deposits are highly sensitive to changes in interest rates and, accordingly, can be a more volatile source of funding. Use of brokered deposits involves the risk that growth supported by such deposits would be halted, or the Bank’s liquidity adversely impacted, if the rates offered by the Bank were less than those offered by other institutions seeking such deposits, or if depositors were to perceive a decline in the Bank’s safety and soundness, or both.

As a BHC, we are required to serve as a "source of strength" for the Bank.

See Part I, Item 1 "Business - Regulation and Supervision - Holding Company Regulation and Supervision." Given the power provided to the federal banking agencies, we, as a source of strength for the Bank, may be required to contribute capital to the Bank when we might not otherwise voluntarily choose to do so. Specifically, the imposition of such financial requirements might require us to raise additional capital to support the Bank at a time when it is not otherwise prudent for us to do so, including on terms that are not typical or favorable to us. Further, any capital provided by us to the Bank would be subordinate to others with an interest in the Bank, including the Bank's depositors. In addition, in the event of our bankruptcy at a time when we had a commitment to one of the Bank's regulators to maintain the capital of the Bank, the regulators' claims against us may be entitled to priority status over other obligations.

If we fail to maintain sufficient capital, our financial condition, liquidity, results of operations, and compliance with regulatory requirements would be adversely affected.

Both we and the Bank are required to meet regulatory capital requirements and otherwise need to maintain sufficient liquidity to support recent and future growth. We have continued to experience considerable growth recently, having increased our assets from $2.53 billion at September 30, 2015 to $7.55 billion at September 30, 2024, primarily due to strategic transactions, such as the Crestmark Acquisition, through participation in government stimulus programs such as the EIP, and through organic growth. Asset growth, diversification of our lending business, expansion of our financial product offerings and other changes in our asset mix continue to require higher levels of capital, which management believes may not be met through earnings retention alone. Our ability to raise additional capital, when and if needed in the future, to meet such regulatory capital requirements and liquidity needs will depend on conditions in the capital markets, general economic conditions, the performance and prospects of our business and a number of other factors, many of which are outside of our control. We cannot assure you that we will be able to raise additional capital if needed or raise additional capital on terms acceptable to us. If we fail to meet these capital and other regulatory requirements, our financial condition, liquidity and results of operations could be materially and adversely affected.

Although we comply with all current applicable capital requirements, we may be subject to more stringent regulatory capital requirements in the future, and we may need additional capital in order to meet those requirements. If we or the Bank fail to meet applicable minimum capital requirements or cease to be well capitalized, such failure would cause us and the Bank to be subject to regulatory restrictions and could adversely affect customer confidence, our ability to grow, our costs of funds and FDIC insurance costs, our ability to pay dividends on common stock and/or repurchase shares, our ability to make distributions on our trust preferred securities, our ability to make acquisitions, and our business, results of operations and financial condition, generally.

Table of Contents

Changes in federal, state, and local tax laws, interpretations of existing tax laws, or adverse determinations by tax authorities, could increase our tax burden or otherwise have a material adverse effect on our business, financial condition, and results of operations.

We are subject to taxation at the federal state and local levels. The governing tax laws and applicable tax rates vary by jurisdiction and are subject to interpretation and changes. We may be subject to examination by the tax authorities and such authorities may disagree with our tax positions, which could adversely affect our financial condition. Additionally, the amount of tax payable in a given financial statement period may be impacted by sudden or unforeseen changes in tax laws, changes in the mix and level of earnings by taxing jurisdictions, or changes to existing accounting rules or regulations. For example, the Tax Cuts and Jobs Act (the “Tax Act”) enacted in December 2017, made broad and complex changes to the U.S. tax code.

General Risk Factors

The price of our common stock may be volatile, which may result in losses for investors.

The market price for shares of our common stock has been volatile in the past, and several factors, including factors outside of our control and unrelated to our performance, could cause the price to fluctuate substantially in the future. These factors include:

•announcements of developments related to our business;

•the initiation, pendency or outcome of litigation, regulatory reviews, inquiries and investigations, and any related adverse publicity;

•fluctuations in our results of operations;

•sales of substantial amounts of our securities into the marketplace;

•general conditions in the financial services industry or the worldwide economy;

•operating and stock price performance of comparable companies, as deemed by investors;

•geopolitical conditions, such as acts or threats of terrorism, military conflicts, the effects (or perceived effects) of pandemics and trade relations;

•a shortfall in revenues or earnings compared to securities analysts' expectations;

•lack of an active trading market for the common stock;

•new technology used, or services offered, by competitors;

•changes in analysts' recommendations or projections; and

•announcement of new acquisitions, dispositions or other projects by the Company or our competitors.

General market price declines or market volatility in the future could adversely affect the price of our common stock, and the current market price may not be indicative of future market prices. Stock price volatility also may make it more difficult for our stockholders to resell their common stock when desired. General market fluctuations, industry factors, political conditions, and general economic conditions and events, such as economic slowdowns, recessions, interest rate changes or credit loss trends, could cause our common stock price to decrease regardless of operating results. Further, volatility in our stock price also impacts the value of our equity compensation, which may impact our ability to recruit and retain employees.

Moreover, in the past, securities class action lawsuits have been instituted against some companies following periods of volatility in the market price of its securities. In the future, we could be the target of similar litigation. Securities litigation could result in substantial costs and divert management’s attention and resources from our normal business.

An investment in our common stock is not an insured deposit.

Our common stock is not a bank deposit and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund, or by any other public or private entity. Investment in our common stock is inherently subject to risks, including those described in this "Risk Factors" section, and is subject to forces that affect the financial markets in general. As a result, if you hold or acquire our common stock, it is possible that you may lose all or a portion of your investment.

Table of Contents

Future sales or additional issuances of our capital stock may depress prices of shares of our common stock or otherwise dilute the book value of shares then outstanding.

Sales of a substantial amount of our capital stock in the public market or the issuance of a significant number of shares could adversely affect the market price for shares of our common stock. We were also authorized to issue up to 3,000,000 shares of preferred stock and 3,000,000 shares of non-voting common stock, none of which were outstanding or reserved for issuance. Future sales or additional issuances of stock may affect the market price for shares of our common stock.

Changes in accounting policies or accounting standards, or changes in how accounting standards are interpreted or applied, could materially affect how we report our financial results and condition.

Our accounting policies are fundamental to determining and understanding our financial results and condition. From time to time, the Financial Accounting Standards Board (the "FASB") and the SEC change the financial accounting and reporting standards that govern the preparation of our financial statements. In addition, those that set accounting standards and those that interpret the accounting standards (such as the FASB, the SEC, banking regulators, and our outside auditors) may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond our control, can be difficult to predict, and could materially affect how we report our financial results and condition. We may be required to apply a new or revised standard retroactively or apply an existing standard differently and retroactively, which may result in us being required to restate prior period financial statements, which restatements may reflect material changes. Such changes could also require us to incur additional personnel and technology costs.

If we fail to maintain proper and effective internal controls, our ability to produce accurate and timely financial statements could be impaired, which could harm our operating results, our ability to operate our business and our reputation.

We incur significant costs and demands upon management and accounting and finance resources as a result of complying with the laws and regulations affecting public companies. As a SEC reporting company, we are required to, among other things, maintain a system of effective internal control over financial reporting, which requires annual management and independent registered public accounting firm assessments of the effectiveness of our internal controls. Ensuring that we have adequate internal financial and accounting controls and procedures in place so that we can produce accurate financial statements on a timely basis is a costly and time-consuming effort that needs to be re-evaluated frequently. We have historically dedicated a significant amount of time and resources to implement our internal financial and accounting controls and procedures. Substantial work may continue to be required to further implement, document, assess, test, and, if necessary, remediate our system of internal controls. We may also need to retain additional finance and accounting personnel in the future.

Control failures, including failures in our controls over financial reporting, could result from human error, fraud, breakdowns in information and computer systems, lapses in operating processes, or natural or man-made disasters. If a significant control failure or business interruption were to occur, it could materially damage our financial condition and results of operations. We may not be able to foresee, prevent, mitigate, reverse, or repair the negative effects of such failures or interruptions.

We have identified control deficiencies in our internal controls over financial reporting in the past, and if our internal controls over financial reporting are not effective in the future, we may be unable to issue our financial statements in a timely manner, we may be unable to obtain the required audit or review of our financial statements by our independent registered public accounting firm in a timely manner, or we may otherwise be unable to comply with the periodic reporting requirements of the SEC. Additionally, our common stock listing on the NASDAQ Global Select Market® could be suspended or terminated and our stock price could materially suffer. In addition, we or members of our management team could be subject to investigation and sanction by the SEC or other regulatory authorities and to claims by stockholders, which could impose significant additional costs on us and divert our management's attention. See also Part II. "Item 9A. Controls and Procedures - Inherent Limitations on the Effectiveness of Controls" in this Annual Report on Form 10-K for inherent limitations in a control system.

Table of Contents

Federal regulations and our organizational documents may inhibit a takeover, prevent a transaction you favor or limit our growth opportunities, causing the market price of our common stock to decline.

Certain provisions of our organizational documents and federal regulations could have the effect of making it more difficult for a third party to acquire, or of discouraging a third party from attempting to acquire, control of us. In addition, we may need to obtain approval from regulatory authorities before we can acquire control of any other company. Such approvals could involve significant expenses related to diligence, legal compliance, and the submission of required applications and could be conditioned on acts or practices that limit or otherwise constrain our operations.

We may not be able to pay dividends in the future in accordance with past practice.

We have historically paid a quarterly dividend to stockholders. The payment of dividends is subject to legal and regulatory restrictions. Any payment of dividends in the future will depend, in large part, on our earnings, capital requirements, financial condition, regulatory review, and other factors considered relevant by our Board of Directors.

Catastrophic events could negatively impact our operations, the operations of third parties with which we do business, and the communities in which we do business.

Catastrophic events (including natural disasters, severe weather conditions, pandemics, terrorism and other geopolitical events), which are beyond our control, could have an adverse impact on the Bank's ability and the ability of our vendors and other third parties with which we do business, to provide necessary services to support the operation of the Bank and provide products and services to the Bank's customers. Natural disasters and severe weather conditions could harm our operations through interference with communications, including the interruption or loss of our computer systems, which could prevent or impede us from gathering deposits, originating loans, and processing and controlling the flow of business, as well as through the destruction of facilities and our operational, financial and management information systems. Although insurance coverage may provide some protection in light of such events, there can be no assurance that any insurance proceeds would adequately compensate the Bank for the losses it incurred as a result of such events. See also "Existing insurance policies may not adequately protect us and our subsidiaries." Moreover, the damage caused by such events may not be directly compensable from insurance proceeds or otherwise, such as damage to our reputation as a result of such events. Additionally, such catastrophic events may negatively impact economic activity, which could lead to an adverse effect on our customers and impact the communities in which we do business. Such catastrophic events could each negatively impact our employees, our business operations or the stability of our deposit base, cause significant property damage, adversely impact the values of collateral securing our loans and/or interrupt our borrowers’ abilities to conduct their business in a manner to support their debt obligations, which could result in losses and increased provision for credit loss. There is no assurance that our business continuity and disaster recovery program can adequately mitigate the risks of such business disruptions and interruptions.

Legal challenges to and regulatory investigations of our, or the Bank's, operations could have a significant material adverse effect on us.

From time to time, we, the Bank or our other subsidiaries are subject to regulatory supervision and investigation, legal proceedings and claims in the ordinary course of business. An adverse resolution in litigation or a regulatory action, including litigation or other actions brought by our shareholders, customers or another third party, such as a state attorney general or one of our regulators, could result in substantial damages or otherwise negatively impact our business, reputation and financial condition. Moreover, our involvement in such matters, even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation, result in substantial expense, and divert management attention from the operations of our business. See Part I, Item 1 "Business - Regulation and Supervision" and Item 3, "Legal Proceedings."

Our reputation and business could be damaged by negative publicity.

Reputational risk, including as a result of negative publicity, is inherent in our business. Negative publicity or reputational harm can result from actual or alleged conduct in a number of areas, including legal and regulatory compliance, lending practices, corporate governance, litigation, inadequate protection of customer data, illegal or unauthorized acts taken by third parties that supply products or services to us or the Bank, the behavior of our employees, the customers with whom we have chosen to do business, and negative publicity for other financial institutions. Damage to our reputation could adversely impact our ability to attract new, and maintain existing, loan

Table of Contents

and deposit customers, employees and business relationships, and, particularly with respect to our Partner Solutions business line, could result in the imposition of new regulatory requirements, operational restrictions, enhanced supervision and/or civil money penalties. Such damage could also adversely affect our ability to raise additional capital, and otherwise have a material adverse effect on our financial condition and results of operations.

Existing insurance policies may not adequately protect us and our subsidiaries.

Fidelity, business interruption, cybersecurity, and property insurance policies are in place with respect to our operations. Should any event triggering such policies occur, however, it is possible that our policies would not fully reimburse us for the losses we could sustain due to deductible limits, policy limits, coverage limits, or other factors. We generally renew our insurance policies on an annual basis. If the cost of coverage becomes too high, we may need to reduce our policy limits, increase the deductibles or agree to certain exclusions from our coverage in order to reduce the premiums to an acceptable amount.

Item 1B. Unresolved Staff Comments.

None.

Cybersecurity.

Information Security Program

Pathward maintains a comprehensive Information Security Program to promote the principles of sound information security governance and to ensure risk-taking activities are in line with the Company’s strategic objectives, risk appetite, and regulatory requirements. The Information Security Program governs the confidentiality, integrity, and availability of data, and defines the responsibilities of departments and individuals for such data. The Information Security Program is designed to protect information resources from a wide range of threats to ensure business continuity and minimize business risk.

Risk Management and Strategy

The goal of the Information Security Program is to prevent cybersecurity incidents. The Information Security Program aligns to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Information Security Policy is designed to address compliance by Pathward and its personnel with applicable laws and regulations. Information security controls are designed to follow the Center for Internet Security ("CIS") controls framework. Policies and program standards that align with CIS and Payment Card Industry Data Security Standard ("PCI-DSS") are also in place.

The Information Security teams include experienced, highly qualified architects, engineers and analysts who support all aspects of cybersecurity including security architecture, identity and access management, vulnerability management, security operations, as well as governance, risk and compliance. The majority of the Information Security staff holds at least one cybersecurity-related certification.

Pathward has a formal Enterprise Risk Management ("ERM") department. The Company’s Chief Risk Officer is responsible for developing and executing the risk framework and ERM plan for the Company. The Company has implemented a three lines of defense model. The first line of defense ("1LOD") is responsible for owning, measuring, and managing the risks and controls. The second line of defense ("2LOD") is responsible for monitoring risk and controls in support of management. The third line of defense ("3LOD") is the independent audit function.

Based on the risk appetite of the Company, the ERM department monitors enterprise-wide risk and control profiles. The ERM department provides monthly and quarterly risk reporting to management and the Board of Directors. The ERM department ensures accurate and timely risk assessments are prepared throughout the organization. The ERM department and compliance team also administer a documented regulatory change control process when new and revised regulations need to be implemented.

Table of Contents

Role of Management

Pathward’s Information Security Program is managed by the Company’s Chief Product and Technology Officer (“CPTO”) and Chief Information Security Officer (“CISO”). The current CPTO has over 30 years of experience in senior leadership positions in the areas of information technology, technology innovation and enterprise architecture, and has been recognized for various technology and leadership awards. The current CISO reports to the CPTO and has extensive years of experience in information security both at Pathward and at other companies as well as many years of executive management experience. The CISO regularly reports to executive management, the Risk Committee of the Board of Directors (the “Board Risk Committee”) and the Board of Directors regarding all aspects of information security including cybersecurity risk and incidents. The Information Technology Committee and Executive Risk Committee provide governance and oversight of the Information Security Program. These Committees convene at least four times annually, reporting significant activities and issues upward to the Board Risk Committee and the Board of Directors as necessary.

Role of the Board of Directors

The Board of Directors has delegated oversight of all enterprise risks relevant to the Company, including information technology and cybersecurity risk, to the Board Risk Committee, which consists of three independent non-employee directors. The CISO provides quarterly updates on information security and cybersecurity risk to the Board Risk Committee, as well as an annual cybersecurity overview and information security report to the full Board of Directors. The Risk Committee oversees the Information Security Program including through the annual review and approval of any material changes to the Information Security Policy.

Security Awareness Training

All Pathward employees play a crucial role in cybersecurity defense. Pathward has implemented a security awareness training program that includes annual mandatory training for employees and contractors as well as ongoing phishing resiliency testing. The security awareness program also includes periodic videos and educational articles that are shared with employees through a partnership with corporate communications.

Third Party Risk Management Program

The Information Security third party risk management program is a piece of the overarching enterprise third party risk management program. The Information Security team’s reviews of third parties include initial and periodic security assessments, documentation and audit report reviews, and consultation on any security enhancements recommended based on the results of the completed reviews.

Incident Response Program

Management has developed and implemented a risk-based incident response program to minimize the impact to Pathward and its customers in the event of an information security incident. The incident response program has defined protocols to declare and respond to an identified incident and includes appropriate containment and restoration strategies. Pathward maintains a documented Cybersecurity Incident Response Plan and has identified Information Technology and Information Security staff who are responsible for assisting with a data breach incident response event. Team members have defined roles, responsibilities and must participate in incident response training and walk-through events at least annually. Pathward has contracted with an incident response provider in the event of a security breach. In addition, Pathward has acquired a cybersecurity insurance policy.

Pathward has established a Crisis Management Team ("CMT"), which is comprised of executive leadership and key senior stakeholders and is engaged immediately following a cybersecurity incident. The CMT provides leadership and maintains ultimate executive level oversight during each phase of the incident.

Pathward has robust cybersecurity measures in place. Pathward is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pathward, including its business strategy, results of operations or financial condition, during the fiscal year ended September 30, 2024. Yet, in this modern, evolving world cybersecurity remains a high risk regardless. For further information about the cybersecurity risks Pathward faces, and potential impacts, see Item 1A.

Table of Contents

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
CLSK	14 hours ago
ALCO	1 day, 19 hours ago
ALTX	4 days, 9 hours ago
DBMM	4 days, 10 hours ago
TMRC	4 days, 10 hours ago
FLNC	4 days, 11 hours ago
EACO	4 days, 12 hours ago
ESE	4 days, 13 hours ago
SNEX	4 days, 17 hours ago
UNEX	4 days, 20 hours ago
CNBX	4 days, 20 hours ago
CENT	6 days, 10 hours ago
LESL	6 days, 10 hours ago
DSRO	6 days, 10 hours ago
SANM	6 days, 12 hours ago
CFFN	6 days, 12 hours ago
BDX	6 days, 13 hours ago
SPH	6 days, 15 hours ago
MOG-A	6 days, 18 hours ago
ENTA	6 days, 18 hours ago
HOLX	6 days, 19 hours ago
LGYV	6 days, 19 hours ago
LEDS	6 days, 20 hours ago
AZTA	1 week ago
UGI	1 week ago
JJSF	1 week ago
RJF	1 week ago
NJR	1 week ago
ARWR	1 week ago
CASH	1 week ago
BERY	1 week ago
ADI	1 week ago
ABQQ	1 week ago
ABC	1 week ago
WWD	1 week ago
LEXX	1 week ago
SMG	1 week ago
PNNT	1 week, 1 day ago
PFLT	1 week, 1 day ago
AEHA	1 week, 1 day ago
CRNC	1 week, 1 day ago
IIIV	1 week, 1 day ago
BLBD	1 week, 1 day ago
GLDM	1 week, 1 day ago
GLD	1 week, 1 day ago
ROAD	1 week, 1 day ago
J	1 week, 1 day ago
ENRT	1 week, 4 days ago
VVV	1 week, 4 days ago
GEOS	1 week, 4 days ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CASH

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CASH

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing