Grand Canyon Education (GKD) Risk Analysis

A "third-party servicer" is any person or entity used by "any eligible institution of higher education to administer, through either manual or automated processing, any aspect of such institution's student assistance programs." Third party servicers must comply with a number of requirements. For example, they must conduct and submit to ED compliance audits under 34 C.F.R. § 668.23. In addition, they must comply with the requirements of 34 C.F.R. § 668.25, which requires third-party servicers, in their contracts with institutions, to be contractually obligated to, among other things: - Comply with all statutory provisions of or applicable to Title IV of the HEA, including the requirement to use any funds that the servicer administers under any Title IV program and any interest or other earnings thereon solely for the purposes specified in and in accordance with that program;- Refer to the Office of Inspector General of ED for investigation any information indicating there is reasonable cause to believe that the institution might have engaged in fraud or other criminal misconduct in connection with the institution's administration of any Title IV program or an applicant for Title IV program assistance might have engaged in fraud or other criminal misconduct in connection with his or her application; and - Be jointly and severally liable with the institution to the Secretary for any violation by the servicer of any statutory provision of or applicable to Title IV of the HEA, any regulatory provision prescribed under that statutory authority, and any applicable special arrangement, agreement, or limitation entered into under the authority of statutes applicable to Title IV of the HEA. ED has emphasized increased oversight of third-party servicers and has reiterated that institutions participating in Title IV programs remain responsible for the acts and omissions of their third-party service providers. As a result, ED audits, program reviews, investigations, and enforcement actions involving our university partners may also examine our activities, contractual arrangements, and compliance controls, which could require us to devote additional resources to compliance efforts or result in contractual, financial, or reputational impacts. ED has indicated that it may revisit the scope of third-party servicer requirements through future rulemaking or guidance, which could expand compliance obligations and increase our costs. We are also subject to a number of data security and privacy regulations given our role as a third-party servicer and these standards are evolving. To the extent we continue to provide third party servicer functions, we will be subject to these requirements, the compliance with which can materially impact our business model.

Because our university partner institutions operate in a highly regulated industry, they are subject to program reviews, audits, investigations, claims of non-compliance, and lawsuits by government agencies, regulatory agencies, students, employees, stockholders, and other third parties alleging non-compliance with applicable legal requirements, many of which are imprecise and subject to interpretation. Similarly, we could be subject to those same reviews. If the result of any such proceeding is unfavorable to our university partners, they may lose or have limitations imposed on their state licensing, accreditation, or Title IV program participation; be required to pay monetary damages (including triple damages in certain whistleblower suits); or be subject to fines, injunctions, or other penalties, any of which could have a material adverse effect on their business, prospects, financial condition, and results of operations. Claims and lawsuits, and other regulatory actions, brought or taken against us or our university partners, even if they are without merit, may also result in adverse publicity, negatively affect the market price of our stock, adversely affect student enrollments, and reduce the willingness of third parties to do business with us. Even if we or our university partners adequately address the issues raised by any such proceeding and successfully defend against it, we may have to devote significant financial and management resources to address these issues, which could harm our business. See Part 1, Item 3 – Litigation for a discussion of certain litigation matters to which we are a party.

A school that grants degrees or certificates must be authorized by the relevant education agency of the state in which it is located. State authorization is also required for their students to be eligible to receive funding under the Title IV programs. To maintain their state authorization, our university partner institutions must continuously meet standards relating to, among other things, educational programs, facilities, instructional and administrative staff, marketing and recruitment, financial operations, addition of new locations and educational programs, and various operational and administrative procedures. If our university partner institutions fail to satisfy any of these standards, they could lose state authorization to offer educational programs, which would also cause them to lose eligibility to participate in the Title IV programs and have a material adverse effect on us. In addition, almost every state imposes regulatory requirements on educational institutions that have physical facilities located within the state's boundaries. Individual state laws establish standards in areas such as educational programs, facilities, instructional and administrative staff, marketing and recruitment, financial operations, addition of new locations and educational programs, and various operational and administrative procedures, some of which are different than the standards prescribed by other regulators. Several states have sought to assert jurisdiction over educational institutions offering online degree programs that have no physical location in the state but that have some activity in the state, such as enrolling or offering educational services to students who reside in the state, employing faculty who reside in the state, or advertising to or recruiting prospective students in the state. State regulatory requirements for online education have historically varied among the states. To address this issue and to meet new ED requirements many schools have applied and have been approved to be approved institutional participants in SARA. SARA is an agreement among member states, districts and territories that establishes comparable national standards for interstate offering of post-secondary distance education courses and programs. It is intended to make it easier for students to take online courses offered by post-secondary institutions based in another state. SARA is overseen by a national council (NC-SARA) and administered by four regional education compacts. GCU, for example, is a member of SARA in Arizona (AZ-SARA), which is administered by the Western Interstate Commission for Higher Education (referred to as W-SARA). There is a yearly renewal for participating in NC-SARA and AZ-SARA and institutions must agree to meet certain requirements to participate. As of December 31, 2025, all states other than California are members of SARA. Any state that does not participate in SARA may impose regulatory requirements on out-of-state post-secondary institutions operating within its boundaries, such as those having a physical facility or conducting certain academic activities within the state. GCU, for example, enrolls students in all 50 states and the District of Columbia. Although it is currently licensed, authorized, in-process, or exempt in all non-SARA jurisdictions in which it operates, if GCU fails to comply with state licensing or authorization requirements for a non-SARA jurisdiction, or fails to obtain licenses or authorizations when required, it could lose its license or authorization by that jurisdiction or be subject to other sanctions, including restrictions on its activities in, and fines and penalties imposed by, that jurisdiction, as well as fines, penalties, and sanctions imposed by ED. The loss of licensure or authorization in any non-SARA jurisdiction by a university partner institution could prohibit us from recruiting prospective students or offering services to current students in that jurisdiction, which could significantly reduce our university partner's enrollments. Laws, regulations, or interpretations related to doing business over the Internet could also increase our cost of doing business and affect our ability to recruit students in particular states, which could, in turn, negatively affect enrollments and revenues and have a material adverse effect on our business. ED initiated a negotiated rulemaking process addressing state authorization which could have implicated SARA but published a notice in December 2024 terminating that negotiated rulemaking process. ED may revisit state authorization requirements through future rulemaking or other guidance, and any such changes could have a material adverse effect on our business. Additionally, regulatory agencies may sometimes disagree with the way we have interpreted or applied these requirements. Any misinterpretation by us of these regulatory requirements or adverse changes in regulations or interpretations thereof by regulators could materially adversely affect us. If a university partner institution fails to comply with state licensing or authorization requirements for a state in which it operates, or fails to obtain licenses or authorizations when required, it could lose its state licensure or authorization by that state or be subject to other sanctions, including restrictions on its activities in, and fines and penalties imposed by, that state, as well as fines, penalties, and sanctions imposed by ED. The loss of licensure or authorization in a state other than a state in which a university partner institution is physically located could prohibit us from recruiting prospective students or assisting with offering educational services to current students in that state, which could significantly reduce enrollments. Furthermore, our university partners must typically maintain a composite score of at least 1.5 to maintain their membership in SARA. Failure to maintain that score, and loss of eligibility for SARA, could result in the loss of the ability to offer online programs in various states unless the university partner is otherwise eligible to do so. This could greatly affect our ability to market our university partners' online programs.

Our expansion efforts include developing new educational programs for our university partners. If our university partner institutions are unable to obtain the necessary approvals for such new programs or operations, or if our university partner institutions are unable to obtain such approvals in a timely manner, our ability to consummate the planned actions and the ability of our university partner institutions to provide Title IV funds to any affected students would be impaired, which could have a material adverse effect on our expansion plans.

An institution must be accredited by an accrediting commission recognized by ED in order to participate in the Title IV programs. Our primary university partner, GCU, has been regionally accredited by the HLC and its predecessor since 1968, most recently obtaining reaccreditation in 2017 for the ten-year period through 2027. Some of our other university partners are accredited by HLC while the others are accredited by different accrediting bodies that are likely to have standards that are different from those of the HLC. Accrediting bodies review the accredited status of institutions periodically (for example, the HLC reviews institutions every ten years, along with a mid-term report in year four). If any university partner institution fails to satisfy the relevant accrediting standards, it could lose accreditation, which would cause a revocation of its eligibility to participate in the Title IV programs. This could cause a significant decline in student enrollments and could have a material adverse effect on us. In addition, many university partner institutions will have educational programs that are also accredited by specialized accrediting commissions or approved by specialized state agencies. If our university partner institutions fail to satisfy the standards of any of those specialized accrediting commissions or state agencies, the institution could lose the specialized accreditation or approval for the affected programs, which could result in materially reduced student enrollments in those programs and have a material adverse effect on us.

ED certification to participate in the Title IV programs lasts a maximum of six years, and institutions are thus required to seek recertification from ED on a regular basis in order to continue their participation in the Title IV programs. An institution must also apply for recertification by ED if it undergoes a change in control, as defined by ED regulations, and may be subject to similar review if it expands its operations or educational programs in certain ways. Certification can be granted on a full or provisional basis and, in instances where ED is reviewing an application for renewal but does not complete the review by the stated date of expiration, may be continued on a month-to-month basis until the review is complete. For a school that is certified on a provisional basis, ED may revoke the institution's certification without advance notice or advance opportunity for the institution to challenge that action. For a school that is certified on a month-to-month basis, ED may allow the institution's certification to expire at the end of any month without advance notice, and without any formal procedures for review of such action. To our knowledge, such action is very rare and has only occurred upon a determination that an institution is in substantial violation of material Title IV requirements. Our primary university partner, GCU, currently operates under a provisional program participation agreement that expires on June 30, 2026. There can be no assurance that ED will recertify any university partner institution or that it will not impose conditions or other restrictions on any university partner institution as a condition of approving any future recertification. If ED does not renew or withdraws certification to participate in the Title IV programs from any university partners, students at that institution would no longer be able to receive Title IV program funds. Alternatively, ED could renew a university partner institution's certification, but restrict or delay students' receipt of Title IV funds, limit the number of students to whom it can disburse such funds, or place other restrictions on the institution, or it could delay recertification after any university partners' program participation agreement expires, in which case our university partner's certification would continue on a month-to-month basis. Any of these outcomes could have a material adverse effect on our university partners' enrollments and us.

In addition to other regulations discussed elsewhere (such as those related to the OBBBA), on July 1, 2024 new regulations became effective covering the areas of financial responsibility, administrative capability, certification standards and procedures, and ability to benefit. Financial Responsibility: The final regulations include an expanded list of mandatory and discretionary triggering events that could result in ED determining that an institution lacks financial responsibility and must submit to ED a letter of credit or other form of acceptable financial protection and accept other conditions on the institution's Title IV Program eligibility. The final regulations, among other things, modify and substantially expand the number of triggers and, as a result, increase the likelihood that ED could impose a financial protection requirement and other conditions on our university partners. The final rules require the institution to notify ED of a triggering event and provide information demonstrating why the event does not warrant the submission of a letter of credit or imposition of other requirements. The final rules state that, if ED requires financial protection as a result of more than one mandatory or discretionary trigger, ED will require separate financial protection for each individual trigger, which could substantially increase the amount of financial protection we and other institutions could be required to provide to ED. Examples of mandatory triggering events under the final rules include a lawsuit by a federal or state authority or a qui tam lawsuit in which the Federal government has intervened, where the suit has been pending for 120 days as measured under the regulation; an action where ED seeks to recover the cost of adjudicated claims in favor of borrowers under the borrower defense to repayment regulations and the claims would lower the institution's composite score below 1.0; certain judgments, awards, or settlements in certain lawsuits, mediations, or administrative or arbitration proceedings; certain withdrawals of owner's equity including by dividend; gainful employment issues; accreditor requirements to submit a teach-out plan for reasons related to financial concerns; certain actions taken against a publicly-traded company or failure to timely file certain annual or quarterly reports; 90/10 Rule issues; cohort default rate issues; contributions and distributions occurring near the fiscal year end that materially impact the composite score; certain defaults or other adverse events under a financing arrangement; or certain financial exigencies or receiverships. Examples of discretionary triggering events under the final regulations include certain accrediting agency actions, certain accreditor events, fluctuations in Title IV volume, high annual dropout rates, indicators of significant change in the financial condition of the institution, the formation by ED of a group process to consider borrower defense claims against the institution, the institution's discontinuation of education programs affecting at least 25 percent of enrolled students receiving Title IV funds, the institution's closure of locations that enroll more than 25 percent of its students who receive Title IV funds, certain state licensing agency actions, the loss of institutional or program eligibility in another federal educational assistance program, a requirement to disclose in a public filing that the company is under investigation for possible violations of law, or if the institution is cited and faces loss of education assistance funds from another federal agency if it does not comply with agency requirements. The final regulations also established new rules for evaluating financial responsibility during a change in ownership. Administrative Capability: ED assesses the administrative capability of each institution that participates in Title IV programs under a series of separate standards. Failure to satisfy any of the standards may lead ED to find the institution ineligible to participate in Title IV programs or to place the institution on provisional certification as a condition of its participation. The final rules add more standards related to topics such as the provision of adequate financial aid counseling and career services, ensuring the availability of clinical and externship opportunities, the disbursement of Title IV funds in a timely manner, compliance with high school diploma requirements, preventing substantial misrepresentations, complying with gainful employment requirements, and avoiding significant negative actions with a federal, state, or accrediting agency. Certification Regulations: The final regulations expanded the grounds for placing institutions on provisional certification, expanded the types of conditions ED may impose on provisionally certified institutions, and expanded the number of requirements contained in the institution's program participation agreement with ED (including, among other requirements, an obligation to comply with all state laws related to closure). The final regulations, allow ED to place institutions on provisional certification if, among other reasons, the institution does not meet financial responsibility factors or administrative capability standards, if the institution is required by ED to submit a letter of credit as a result of a mandatory or discretionary triggering event, or if ED deems the institution to be at risk of closure. An institution that is provisionally certified receives fewer due process rights than those received by other institutions in the event ED takes certain adverse actions against the institution, is required to obtain prior ED approvals of new campuses and educational programs and may be subject to heightened scrutiny by ED. Provisional certification makes it easier for ED to revoke or decline to renew an institution's Title IV eligibility without undergoing a formal administrative appeal process. The regulations also expand the conditions to which institutions must agree as part of their participation in the Title IV programs. These final regulations also allow ED to determine whether to certify or impose conditions on an institution based on consideration of factors including, for example, the institution's withdrawal rate, the amounts the institution spent on recruiting activities, advertising, and other pre-enrollment activities, and the passage rate for licensure exams for programs that are designed to meet the educational requirements for a professional license required for employment in an occupation. These final regulations expand the types of conditions ED can impose on provisionally certified institutions including, for example, restrictions on the addition of new programs or locations; restrictions on the rate of growth or new enrollment of students or of Title IV volume; restrictions on the institution providing a teach-out on behalf of another institution; restrictions on the acquisition of another participating institution (including financial protection requirements); additional reporting requirements; limitations on entering into certain written arrangements with institutions or entities for providing part of an educational program, requirements to submit marketing and recruiting materials to ED for approval (if the institution is alleged or found to have engaged in substantial misrepresentations to students, engaged in aggressive recruiting practices, or violated incentive compensation rules); reporting requirements for institutions that received a government formal inquiry such as a subpoena related to its marketing or recruitment or its federal financial aid, and other potential conditions imposed by ED. Additionally, in January 2025, ED published another set of regulations. The regulations include: - A new definition of "distance education course" which provides that a course is considered a distance education course if all instruction occurs exclusively through distance education methods, as defined in existing regulations. This designation applies even if the course includes in-person, non-instructional activities sch as orientation, testing or academic support services;- Technical changes to the TRIO programs that focus on providing services to individuals from disadvantaged backgrounds;- Revisions to the return to Title IV process;- A requirement that an institution is required to document a student's withdrawal date within 14 days of the last date of attendance;- Clarification regarding the academic progressions of students returning from a leave of absence from a clock-hour/non-term credit hour, subscription-based, and eligible prison education programs;- Clarification related to programs offered in modules; and - A requirement that institutions report student enrollment in distance education or correspondence courses. These changes are effective July 1, 2026, except for the reporting requirements related to distance education and correspondence courses, which take effect on July 1, 2027. We are still reviewing the final regulations and cannot predict the ultimate impact of the final regulations discussed above, but the final regulations do impose a broad range of additional requirements on institutions, which increases the possibility that our university partners could be subject to additional reporting requirements, potential liabilities and sanctions, and potential loss of Title IV eligibility if our efforts, or the efforts of our university partners, to modify operations to comply with the new regulations are unsuccessful, which could have a significant impact on our business and results of operations.

Over the past few years, ED has regularly promulgated new regulations and guidance that impact our university partners and our business directly. These and other regulations and guidance documents, including those discussed above under "Regulation of our Education Services Business," can increase our operating costs and, in some cases, change the manner in which we operate our business. In addition, because certain of these regulations have been vacated or blocked as a result of litigation challenging the regulations, there remains substantial uncertainty regarding their present or future effectiveness or enforcement. New or amended regulations in the future, particularly regulations focused on third-party service providers, could further negatively impact our business. On July 4, 2025, President Trump signed the OBBBA, which makes a variety of changes to federal student aid programs, including loan limits, accountability measures for programs based on low earning outcomes, loan repayment, Pell Grant eligibility, and regulatory changes. As one example, OBBBA creates the "Do No Harm" accountability framework, effective July 2026, that institutions must satisfy at the program level in order for students to continue to receive Federal Direct Loans for such programs. Under this framework, OBBBA requires that an undergraduate program become ineligible for Federal Direct Loans if, in two out of three consecutive years, the median earnings of a cohort of program completers are less than the median earnings of working adults aged 25-34 with only a high school diploma, either in the state where the institution is located or, if fewer than 50% of students at the institution reside in the institution's state, the national average. OBBBA requires that a graduate or professional program become ineligible for Federal Direct Loans if, in two out of three consecutive years, the median earnings of a cohort of program completers are less than the median earnings of working adults aged 25–34 with only a bachelor's degree. Both the undergraduate and graduate/professional accountability provisions apply to the cohort of students who completed the program four years prior, are working, are not enrolled at any institution, and who received Federal Direct Loan funds for enrollment in the program. If a cohort is less than 30 students, the Secretary of Education may aggregate additional years of programmatic data. Based on data provided by the ED for students that graduated in 2015-2016, all of the programs that we provide services to our university partners passed this metric except GCU's Masters in Mental and Social Health programs. GCU is currently analyzing the data related to these programs and it appears that most universities that provide these programs online to working adult students fail this metric. To the extent that these or any other programs offered by our university partners pursuant to our services agreements fail these metrics, then this would have an adverse effect on our university partners and thus an adverse effect on our business. We cannot predict with certainty how all of these regulatory requirements under the OBBBA will be applied or what their ultimate impact on our business will be.

To participate in the Title IV programs, a school must be authorized by the appropriate state post-secondary agency or agencies, be accredited by an accrediting commission recognized by ED, and be certified as an eligible institution by ED. In addition, the operations and programs of our university partners, and any future university partners, are regulated by other state education agencies and additional specialized accrediting commissions. As a result of these requirements, we are subject to extensive regulation from state entities, institutional accrediting commissions, specialized accrediting commissions, and ED. These regulatory requirements cover many of our operations, as well as the operations of our university partners. These include regulations related to educational programs, instructional and administrative staff, administrative procedures, marketing, recruiting, financial operations, and financial condition of any university partner. These regulatory requirements also affect our ability to assist university partner institutions with adding new educational programs and changing existing educational programs. The agencies that regulate higher education periodically revise their requirements and modify their interpretations of existing requirements. Regulatory requirements are not always precise and clear, and regulatory agencies may sometimes disagree with the way we have (or any university partner has) interpreted or applied these requirements. Any misinterpretation of regulatory requirements could materially adversely affect us. If we fail, or any university partner institution fails, to comply with any of these regulatory requirements, we or any university partner could suffer financial penalties, limitations on operations, or other sanctions, each of which could materially adversely affect us. In addition, if we or any university partner are charged with regulatory violations, our reputation could be damaged, which could have a negative impact on our stock price and enrollments at university partner institutions. ED and other regulators have increased the frequency and severity of their enforcement actions against post-secondary schools, including our primary university partner. In some cases, these enforcement actions have resulted in material sanctions, loss of Title IV eligibility, or closure in schools. We cannot predict with certainty how all of these regulatory requirements will be applied, or whether we will be able to comply with all of the applicable requirements in the future.

A school participating in the Title IV programs must calculate the amount of unearned Title IV program funds that it has disbursed to students who withdraw from their educational programs before completing such programs and must return those unearned funds to the appropriate lender or ED in a timely manner, generally within 45 days of the date the school determines that the student has withdrawn. To the extent our services for a university partner include conducting returns to Title IV, as they do with our primary university partner, GCU, we would likely be jointly and severally liable to ED, along with the relevant university partner, for return of those funds. Further, we could be fined or otherwise sanctioned by ED, which could increase our cost of regulatory compliance and materially adversely affect us. Further, a failure to comply with these regulatory requirements could result in termination of our ability to continue providing these services to other university partner institutions, which would materially adversely affect us.

The HEA prohibits an institution that participates in Title IV programs from engaging in "substantial misrepresentation" of the nature of its educational program, its financial charges, or the employability of its graduates. Under these rules, a misrepresentation is any statement made by the institution or a third party that provides educational programs, marketing, advertising, recruiting, or admissions services to the institution that is false, erroneous or has the likelihood or tendency to deceive or confuse. A substantial misrepresentation is any misrepresentation on which the person to whom it was made could reasonably be expected to rely, or has reasonably relied, to that person's detriment. The regulation also covers statements made by any representative of an institution, including agents, employees and subcontractors, and statements made directly or indirectly to any third party, including state agencies, government officials or the public, and not just to students or prospective students. Considering the breadth of the definition of "substantial misrepresentation," it is possible that despite our efforts to prevent such misrepresentations, our employees or contractors may make statements on behalf of our university partner institutions that could be construed as substantial misrepresentations for which our current and any future university partners would be held responsible by ED. We and our employees and subcontractors, as agents of our university partners, must use a high degree of care to comply with such rules and are prohibited by contract from making any false, erroneous or misleading statements about our university partners. To avoid an issue under the misrepresentation rule and similar rules, we assure that all marketing materials are approved in advance by our university partners before they are used by our employees and we carefully monitor our employees and subcontractors in their conversations with students and prospective students. Despite our best efforts, we or our university partners may face complaints from our university partners' students and prospective students over statements made by us and our agents throughout the conduct of our services that would expose our university partners, and derivatively us, to increased risk of enforcement action and applicable sanctions or other penalties and increased risk of private qui tam actions under the Federal False Claims Act. Also, if ED determines that an institution (including its contractors) has engaged in substantial misrepresentation, ED may revoke an institution's program participation agreement, impose limitations on the institution's participation in Title IV programs, deny applications from the institution for approval of new programs or locations or other matters, or initiate proceedings to fine the institution or limit, suspend, or terminate its eligibility to participate in Title IV programs. If ED or another regulator determines that statements made by us or on our university partners' behalf are in violation of the regulations, we could be subject to sanctions, legal actions, and other liability, which could have a material adverse effect on our business.

To continue participating in the Title IV programs, an institution must demonstrate to ED that the institution is capable of adequately administering the Title IV programs under specific standards prescribed by ED. These administrative capability criteria require, among other things, that the institution have an adequate number of qualified personnel to administer the Title IV programs, have adequate procedures for disbursing and safeguarding Title IV funds and for maintaining records, submit all required reports and consolidated financial statements in a timely manner, and not have significant problems that affect the institution's ability to administer the Title IV programs. As a service provider, we assist our university partners with some facets of these areas. As such, we must be mindful of, and compliant with, the administrative capability requirements. If our university partner institutions fail to satisfy any of these criteria, ED may assess financial penalties against such institutions, restrict the manner in which those institutions receive Title IV funds, require them to post a letter of credit, place them on provisional certification status, or limit or terminate participation in the Title IV programs, any of which could materially adversely affect us. These regulations were also recently revised, as discussed above, and there may be additional restrictions or requirements that may create additional hurdles to compliance or otherwise materially adversely affect us. As a third-party servicer, if we are the cause of the administrative deficiency, we may also face monetary sanctions and actions to limit, suspend, or terminate our ability to offer those and other services to institutions of higher education.