I3 Verticals (V1K) Risk Analysis

Since the enactment of the Dodd-Frank Act, there have been substantial reforms to the supervision and operation of the financial services industry, including numerous new regulations that have imposed additional compliance costs and, in some cases, limited revenue sources for us and our financial institution partners and customers. Among other things, the Dodd-Frank Act established the CFPB, which is empowered to conduct rule-making and supervision related to, and enforcement of, federal consumer financial protection laws. The CFPB has issued guidance that applies to "supervised service providers," which the CFPB has defined to include service providers, like us, to CFPB supervised banks and nonbanks. In that regard the CFPB July 25, 2024 report entitled The Cost of Electronic Payments in K-12 Schools, the report included discussion on the CFPB's Fall 2023 edition of their Supervisory Highlights report and a 2014 USDA Policy Memorandum regarding school lunch fees. The CFPB report concluded that certain payment processing practices utilized by the Company and other participants in our industry may violate consumer financial protection laws. The appearance of being involved in unfair trade practices and violating consumer protection laws when offering payment processing services to our customers could harm our reputation with our customers. Further, compliance with emerging sector-specific regulations may negatively impact our business, financial condition and results of operations by requiring us to alter our fee structure or payment processing practices. The CFPB's focus on these payment processing practices has led to litigation against the Company. For example, on May 16, 2025, Suzanne Hess, individually and on behalf of a putative class of citizens of the State of New York, filed a class action compliant in the Supreme Court of the State of New York, Nassau County, against i3 Verticals, LLC and CP-DBS, LLC d/b/a "PaySchools", a subsidiary of i3 Verticals, LLC, seeking monetary damages and injunctive relief related to services offered by PaySchools that enable parents, guardians and caregivers to fund lunches for students in certain New York school districts and allegedly unlawful practices by PaySchools related to the fees charged for these school lunch services. For additional information about this litigation, see Note 17 to our consolidated financial statements. In addition, federal and state agencies have recently proposed or enacted cybersecurity regulations, such as the Cybersecurity Requirements for Financial Services Companies issued by the New York State Department of Financial Services and the Cyber Security Resource Guide for Financial Institutions issued November 2022 by the Federal Financial Institutions Examination Council replacing the 2018 Cyber Security Resource Guide. Cybersecurity regulations and guidance are applicable to large bank holding companies and their subsidiaries, as well as to service providers to those organizations. Any new rules and regulations implemented by the CFPB, state or other authorities or in connection with the Dodd-Frank Act could, among other things, slow our ability to adapt to a rapidly changing industry, require us to make significant additional investments to comply with them, redirect time and resources to compliance obligations, modify our products or services or the manner in which they are provided, or limit or change the amount or types of revenue we are able to generate. Interchange fees, which the payment processor typically pays to the card issuer in connection with credit and debit card transactions, are subject to legal, regulatory and legislative scrutiny. In particular, the Dodd-Frank Act regulates and limits debit card fees charged by certain card issuers and allows businesses and organizations to set minimum dollar amounts for the acceptance of credit cards. Specifically, under the commonly known "Durbin Amendment" to the Dodd-Frank Act, the interchange fees that certain issuers charge businesses and organizations for debit transactions are regulated by the Federal Reserve and must be "reasonable and proportional" to the cost incurred by the issuer in authorizing, clearing and settling the transactions. Rules released by the Federal Reserve in July 2011 to implement the Durbin Amendment mandate a cap on debit transaction interchange fees for card issuers with assets of $10 billion or greater. Effective October 1, 2012, debit card issuers are permitted a fraud-prevention adjustment. Since October 2011, a payment network may not prohibit a card issuer from contracting with any other payment network for the processing of electronic debit transactions involving the card issuer's debit cards, and card issuers and payment networks may not inhibit the ability of businesses and organizations to direct the routing of debit card transactions over any payment networks that can process the transactions. Rules implementing the Dodd-Frank Act also contain certain prohibitions on payment network exclusivity and merchant routing restrictions. These restrictions could negatively affect the number of debit transactions processed, and prices charged per transaction, which would negatively affect our business.

The development of AI is complex and uncertain, and presents various risks and uncertainties, including as the result of the rapidly evolving legal, ethical and regulatory landscape associated with the use of AI. Our inability to successfully or effectively implement AI initiatives, or other deficiencies or failures in our AI systems or initiatives, could subject us to competitive harm, legal and regulatory risk, and increase our cybersecurity, intellectual property, and privacy risks. Additionally, AI-generated outputs may be misleading, insecure, inaccurate, harmful, or otherwise flawed. Further, if we fail to leverage AI technologies as effectively or rapidly as our peers, our competitiveness and financial results could be adversely impacted. There is also uncertainty about the extent to which data privacy laws apply to AI technologies, and any delay in addressing those concerns may result in liability or regulatory investigations and fines, as well as harms to our business and reputation. In addition, issues related to intellectual property rights in AI technologies have not been fully addressed by the courts or regulators. As such, to the extent we implement generative AI technologies into our products and/or services, we may face resulting exposure to claims related to copyright infringement or other intellectual property misappropriation.

The healthcare industry is governed by extensive and complex laws and regulations at the federal, state and local government levels. These laws and regulations address, among other issues, billing and coding for services and properly handling overpayments, fraud and abuse, and the confidentiality, maintenance, interoperability, exchange and security of health-related and other confidential information. In connection with the healthcare-related operations, including the sale of revenue cycle management software solutions, that we conducted prior to the sale of our Healthcare RCM Business, we could be adversely affected by violations of these laws and regulations. Further, pursuant to the Healthcare RCM Purchase Agreement, we agreed to indemnify Infinx with respect to certain matters, which could result in liability to us. We strived to structure our Healthcare RCM Business to comply with applicable healthcare laws, regulations and other requirements applicable to us directly and to our customers and contractors, but there can be no assurance that we will not be challenged or impacted by enforcement initiatives with respect to conduct occurring prior to the sale of our Healthcare RCM Business. We have been, and in the future may become, involved in governmental investigations, audits, reviews and assessments. Violation of these laws may result in criminal and/or civil penalties, including substantial monetary penalties. Even an unsuccessful challenge by regulatory and other authorities or private whistleblowers could be expensive and time-consuming, could result in loss of business, exposure to adverse publicity and injury to our reputation and could adversely affect our ability to retain and attract customers.

We and many of our customers are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices (referred to as "UDAAP"), provisions of the Dodd-Frank Act that prohibit UDAAP, the Telemarketing Sales Act, the Electronic Fund Transfer Act and other laws, rules and or regulations, which may directly impact the activities of certain of our customers. These rules may subject us, as the electronic payment processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we are deemed to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of the customer through our services. Various federal and state regulatory enforcement agencies including the Federal Trade Commission and state attorneys general have authority to take action against non-banks that engage in UDAAP, or violate other laws, rules and regulations. To the extent we are processing payments or providing products and services for a customer that may be in violation of laws, rules and regulations, we may be subject to enforcement actions and as a result may incur losses and liabilities that may adversely affect our business.

Because of our international operations we could be adversely affected by violations of the US Foreign Corrupt Practices Act (the "FCPA") and similar anti-bribery laws of other countries in which we provide services or have employees. The FCPA and similar anti-bribery laws generally prohibit companies and their intermediaries from making improper payments to government officials or other third parties for the purpose of obtaining or retaining business or gaining any business advantage. While our policies mandate compliance with these anti-bribery laws, we cannot provide assurance that our internal control policies and procedures always protect us from reckless or criminal acts committed by our employees, contractors or agents. Failure to comply with the FCPA could result in the imposition of civil or criminal fines and penalties and could disrupt our business and adversely affect our results of operations, cash flows and financial condition.