Flywire (FLYW) Risk Analysis

Our business depends on our ability to satisfy our clients and their customers with respect to our solutions as well as the services that are performed to help our clients and their customers use the features and functions of our solutions. Services are usually performed by us, and are also on occasion provided together with a third-party partner. If our clients or their customers are not satisfied with the functionality of our solutions or the services that we or a third-party partner provide, such dissatisfaction could damage our ability to retain our current clients or expand our clients' or their customers' use of our solutions. In addition, any negative publicity and reviews that we may receive which is related to our client relationships may further damage our business and may invite enhanced regulatory scrutiny at the federal and state level in the United States as well as internationally.

We believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new clients and to manage our existing client base. Our ability to increase our client base and achieve broader market acceptance of our solutions will depend to a significant extent on our ability to expand our sales and marketing organizations, and to deploy our sales and marketing resources efficiently. We intend to continue to strategically increase our number of direct sales professionals and to expand our relationships with new strategic channel partners. These efforts will require us to invest significant financial and other resources. New hires require training and take time to achieve full productivity. Similarly, new channel partnerships often take time to develop and may never yield results, as they require new partners to understand the services and solutions we offer, and how to position our value within the market. We cannot be certain that recent and future new hires or partner relationships will become as productive as necessary or that we will be able to hire enough qualified individuals or build effective channel sales in the future. If we are unable to hire, develop, integrate, and retain talented and effective sales personnel, if our new and existing sales personnel are unable to achieve desired productivity levels, or if our sales, channel strategy and marketing programs and advertising are not effective, we may not be able to expand our business and grow our revenue, which may harm our business, operating results and financial condition.

To increase our revenue, in addition to acquiring new clients, we must continue to retain existing clients, increase the volume of payments made by our clients' customers and sell additional functionality to our clients. We expect to derive a significant portion of our revenue from the renewal of existing clients' contracts and sales of additional features and solutions to existing clients. As the market for our solutions matures, solutions evolve, and competitors introduce lower cost or differentiated products or services that are perceived to compete with our solutions, our ability to attract (and our clients' ability to attract) new customers and maintain our current client base and clients' customer usage could be hindered. As a result, we may be unable to retain existing clients or increase the usage of our solutions by them or their customers, which would have an adverse effect on our business, revenue, gross profit, gross margins, and other operating results, and accordingly, on the trading price of our common stock. As the market for our solutions matures, or as new or existing competitors introduce new products or services that compete with our solutions, we may experience pricing pressure. This competition and pricing pressure could have an adverse effect on our ability to retain existing clients or attract new clients at prices that are consistent with our pricing model, operating budget and expected operating margins. In particular, it has become more common in the education sector for competitors to offer generous revenue sharing arrangements for clients we target. Our business could be adversely affected if clients or their customers perceive that features incorporated into alternative products reduce the need for our solutions or if they prefer to use competitive services. If we are unable to attract new clients and increase the number of our clients' customers that use our solutions, our revenue growth and operating results will be adversely affected. Further, in an effort to attract new clients and increase usage by their customers, we may need to offer simpler, lower-priced payment options, which may reduce our revenue and other operating results. Our ability to sell additional functionality to our existing clients may require more sophisticated and costly sales efforts, especially for our larger clients with more senior management and established accounts receivable solutions. Similarly, the rate at which our clients deploy additional solutions from us depends on several factors, including general economic conditions, the availability of client technical personnel to implement our solutions, and the pricing of additional functionality. If our efforts to sell additional functionality to our clients are not successful, our business and growth prospects would suffer. Contracts with our clients generally have a stated initial term of three years, are not subject to termination for convenience and automatically renew for one-year subsequent terms. Our clients may negotiate terms less advantageous to us upon renewal, which may reduce our revenue. If our clients fail to renew their contracts, renew their contracts upon terms less favorable to us or at lower fee levels or fail to purchase new solutions from us, our revenue may decline or our future revenue growth may be constrained. In addition, certain of our clients are subject to requirements to issue requests for proposals (RFPs) to open up competition for their ongoing business notwithstanding their satisfaction with our solutions. In order to retain their business, we may be required to accept terms or pricing conditions less favorable to us than would be the case with automatic renewal of an existing contract. Should any of our clients terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in such implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other clients over that same period of time.

The market for our payment solutions is subject to rapid and significant changes. The market for technology-enabled payment services that empower healthcare clients and their customers is characterized by rapid technological change, new product and service introductions, increasing patient financial responsibility, consumerism and engagement, the ongoing shift to value-based care and reimbursement models, and the entrance of non-traditional competitors. In addition, there may be a limited-time opportunity to achieve and maintain a significant share of this market due in part to the rapidly evolving nature of the healthcare and technology industries and the substantial resources available to our existing and potential competitors. The market for technology-enabled payment services that empower healthcare clients and their customers is relatively new and unproven, and it is uncertain whether this market will achieve and sustain high levels of demand and market adoption. In order to remain competitive, we are continually involved in a number of projects to compete with these new market entrants by developing new solutions, growing our client base and penetrating new markets. Some of these projects include the expansion of our integration capabilities and the expansion of our mobile solutions. These projects carry risks, such as cost overruns, delays in delivery, performance problems and lack of acceptance by our clients. Our integration partners may also decide to develop and offer their own patient engagement solutions that are similar to our solutions. In addition, the decisions we make on allocation of engineering resources, reliance on, integration with or discontinuance of, legacy systems or those acquired in acquisition, or the pace at which we remain technologically current within our internal systems and customer payment platforms, may negatively affect the morale of our engineering teams and the payment experiences our clients wish to feature to their customers. We may lose engineering talent or healthcare clients as a result, which could have a material adverse effect on our business and results of operations. Our success depends on providing high-quality payment solutions that healthcare clients use to improve their financial and operational performance, allowing them to collect payments and enhance their revenue lifecycle management objectives. If we cannot adapt to rapidly evolving industry standards and technology and increasingly sophisticated and varied healthcare client and customer payment needs, our existing technology could become undesirable, obsolete or harm our reputation. We must continue to invest significant resources in our personnel and technology in a timely and cost-effective manner in order to enhance our existing solutions and introduce new high-quality solutions that existing clients and potential new clients will want. Our operating results would also suffer if our innovations are not responsive to the needs of our existing clients or potential new clients, are not appropriately timed with market opportunity, are not effectively brought to market or significantly increase our operating costs. If our new or modified product and service innovations are not responsive to the preferences of healthcare clients and their customers, emerging industry standards or regulatory changes, are not appropriately timed with market opportunity or are not effectively brought to market, we may lose existing clients or be unable to obtain new clients and our results of operations may suffer. We believe demand for our payment solutions in the healthcare industry has been driven in large part by more patient responsibility for out-of-pocket spend, a trend towards higher deductibles for health care services, increased digitization in payments, and the tailoring of payment offers and increased patient engagement. Our success also depends to a substantial extent on the ability of our solutions to increase the volume of our clients' customers payments, and our ability to demonstrate the value of our solutions to our clients. If our existing clients do not recognize or acknowledge the benefits of our solutions or our solutions do not drive payment volume, then the market for our solutions might not develop at all, or it might develop more slowly than we expect, either of which could adversely affect our operating results. A significant decrease in the payment volume and resulting revenue from our clients and their customers in the healthcare industry may have an adverse effect on our business, operating results and financial condition. In addition, we have limited insight into trends that might develop and affect our healthcare business. We might make errors in predicting and reacting to relevant business, legal and regulatory trends and healthcare reform, which could harm our business. If any of these events occur, it could materially adversely affect our business, financial condition or results of operations. Finally, our competitors, including major EHR providers, may have the ability to devote more financial and operational resources than we can to developing new technologies and services, including services that provide improved operating functionality, and adding features to their existing service offerings. Relationships with companies in the EHR space and business focused on revenue lifecycle management are critical to leverage if we are to add to our healthcare customer portfolio. However, intense competition and rising costs experienced by certain major EHR providers has resulted, in certain cases, in increased financial strain on these businesses, and in at least one notable instance, an action to seek bankruptcy protection. To the extent we have outstanding amounts owed to us by companies that seek bankruptcy protection or cease operations, it may become difficult for us to be paid in full in a timely manner, if at all. Many of these companies may offer products and services similar to ours and may have greater name recognition, longer operating histories, stronger and more dependent client relationships, larger marketing budgets, and greater resources than us. If successful, their development efforts could render our solutions less desirable, resulting in the loss of our existing clients or a reduction in the fees we generate from our solutions.

We are required to comply with Mastercard, American Express, and Visa payment card network operating rules and the rules of other regional card (such as China UnionPay or JCB) or payment providers, in connection with our solutions. We have agreed to reimburse our merchant acquirers for any fines they are assessed by payment card networks as a result of any rule violations by us. We may also be directly liable to the payment card networks for rule violations. The payment card networks set and interpret the card operating rules. The payment card networks could adopt new operating rules or interpret or reinterpret existing rules that we or our processors might find difficult or even impossible to follow, or costly to implement. For example, the card networks could adopt new rules or reinterpret existing rules to substantially modify how we offer credit card payment methods to our clients, or impose new fees or costs (including demanding a cash reserve from Flywire) that could negatively impact our margins. Card networks also could modify security or fraud detection methodologies that could have a downstream impact on our business, and force us to change our solutions, payment experience or security protocols, which may increase our operating costs. We also may seek to introduce other card-related solutions in the future, which would entail additional operating rules. As a result of any violations of rules, new rules being implemented, or increased fees, we could lose our ability to offer certain cards as a payment method to our clients' customers, or such payments could become prohibitively expensive for us or for our clients. Additionally, from time to time, American Express and the card networks, including Visa and Mastercard, increase the fees that they charge processors. Changes in pricing, fee structures, or network rules by American Express or other card networks could adversely affect our costs and margins. We rely on global card networks, including American Express, to process certain payment types, and these networks may from time to time modify their interchange rates, assessments, discount fees, or other pricing components, or apply different cost structures based on the nature of an underlying transaction (such as education, travel, healthcare, or other categories) or the manner in which Flywire or our transactions are classified under their rules. If a card network were to reclassify Flywire, our customers, or specific payment flows, or to increase fees applicable to one or more of our core verticals, we may be unable to fully pass those increased costs on to customers without adversely affecting demand, competitiveness, or customer relationships. We could attempt to pass these increases along to our clients and their customers, but this strategy might result in the loss of clients to our competitors who do not pass along the increases. If competitive practices prevent us from passing along the higher fees to our clients and their customers in the future, we may have to absorb all or a portion of such increases, which may increase our operating costs and reduce our profit margins. If we are unable to offer credit cards as a payment method to our clients' customers, our business would be adversely affected.

Our growth strategy is influenced, in part, on our ability to expand into new client verticals and sub-verticals, including our relatively new B2B payment vertical. The B2B payment vertical represents a relatively new market for us, and we have limited prior experience with the key ERP platforms that are critical to the B2B payment vertical. Accordingly, our lack of experience in the B2B payment vertical and with the key ERP platforms may result in operational difficulties, which could cause a delay or failure to integrate and realize the benefits of entering into this vertical. In addition, B2B payments carry a higher risk profile than education or healthcare receivables, and we will be required to devote more resources to manage the increased risk inherent in these payments. Banking and other payment services partners may be more reluctant to support B2B payment flows, and countries with currency controls are less likely to permit payments of a B2B nature. Our payment volume and resulting revenue from serving the B2B vertical is highly sensitive to restrictions on the cross-border commerce on which our clients rely, and declining economic conditions, increases in the costs or unavailability of imported goods and services due to imposition of tariffs, sanctions or other restrictions, could adversely affect our development of this vertical or our overall operating results and financial condition. The payment volume and resulting revenue from our B2B payment vertical during the year ended December 31, 2025 represented, and is expected for the foreseeable future to represent, less than 10% of our total payment volume and revenue. We expect both the payment volume and the revenue from this vertical to grow over time. As such, failure to grow our payment volume and resulting revenue from our B2B payment vertical may have an adverse effect on our business, operating results and financial condition. We may be unable to identify new verticals or sub-verticals that meet our criteria for selecting industries that our solutions are ideally suited to address. In addition, our market validation process may not support entry into selected verticals due to our perception of the overall market opportunity or of the willingness of market participants within those verticals to adopt our solutions. Even if we choose to enter new verticals or sub-verticals, our market validation process does not guarantee our success. We may be unable to tailor our solutions for a new vertical or, in the event that we enter a new vertical by way of a strategic acquisition, we may be unable to leverage the acquired platform in time to take advantage of the identified market opportunity, and any delay in our time-to-market could expose us to additional competition or other factors that could impede our success. In addition, any solution we develop or acquire for a new vertical may not provide the functionality required by potential clients or their customers and, as a result, may not achieve widespread market acceptance within the new vertical. To the extent we choose to enter new verticals, whether organically or via strategic acquisition, we may invest significant resources to develop and expand the functionality of our solutions to meet the needs of customers in those verticals, which investments will occur in advance of our realization of revenue from them.

Many payment processing or enablement industry participants are consolidating to create larger and more integrated financial processing systems with greater market power. We expect regulatory and economic conditions to result in additional consolidation in the healthcare industry in the future. As consolidation accelerates, the economies of scale of our clients' organizations may grow. If a client experiences sizable growth following consolidation, it may determine that it no longer needs to rely on us and may reduce its demand for our solutions. In addition, as payment processing providers consolidate to create larger and more integrated systems with greater market power, these providers may try to use their market power to negotiate fee reductions for our solutions. Finally, consolidation may also result in the acquisition or future development by our clients of products and services that compete with our solutions. Any of these potential results of consolidation could have a material adverse effect on our business, financial condition and results of operations.

The continued growth and development of our proprietary global payments network will also depend on our ability to anticipate and adapt to changes in client and customer behavior. For example, behavior may change regarding the use of credit and debit card transactions, including the relative increased use of cash, cryptocurrencies, other emerging or alternative payment methods and credit card systems that may include strong regional preferences that we or our processing partners do not adequately support. Any failure to timely integrate emerging payment methods into our solutions, anticipate behavior changes, or contract with payment processing partners that support such emerging payment technologies could cause our clients to use our solutions less, resulting in a corresponding loss of revenue, in the event such methods become popular among their customers. In particular, the emergence and growing adoption of cryptocurrencies, including stablecoins, and related blockchain-based payment solutions may disrupt the traditional payments ecosystem in ways that could adversely affect our business. These technologies may enable new or existing competitors to offer cross-border payment and settlement services that are faster, lower cost, or otherwise more attractive than our solutions, including direct wallet-to-wallet transfers or alternative settlement rails that bypass intermediary financial institutions. As a result, merchants, payers, or financial institution partners in the verticals we serve may shift volume away from our platform or demand lower pricing, which could erode our revenue and margins. In addition, stablecoin- or cryptocurrency-based payment models may reduce foreign exchange spreads, transaction fees, or other economic components of our offerings, alter customer expectations regarding speed and transparency, and increase competition from fintech companies, payment networks, or technology providers that leverage these technologies. The regulatory treatment of cryptocurrencies and stablecoins remains uncertain and continues to evolve, and new frameworks could accelerate adoption or enable broader participation by competitors. If cryptocurrencies or stablecoins gain broader acceptance as payment or settlement mechanisms, or if we are unable to adapt our platform, pricing, or product strategy effectively in response to these developments, our business, operating results, and financial condition could be harmed. The number and variety of the payment methods we offer or currencies we are able to service may not meet client expectations, or the costs borne by our clients' customers in completing payments may become unsuitable. Accordingly, we may need to change our pricing strategies or reduce our prices, which could harm our revenue, gross profit, and operating results. We utilize a number of payment providers to clear and settle transactions for our clients, including payments providers such as China UnionPay Co. Ltd. and Adyen N.V. If the services provided by these partners become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices, or due to regulatory restrictions or for any other reason, our expenses could increase and our ability to process certain payments could be materially interrupted, all of which could harm our business, financial condition, and results of operations. In addition, our agreements with these providers include certain terms and conditions. These providers have broad discretion to change their terms of service and other policies with respect to our business, and those changes may be unfavorable to us. Therefore, we believe that maintaining successful partnerships with these payment providers is critical to our success.

Our business is subject to risks inherent in conducting business globally, including cross-border payments and domestic payments in the United States and certain other markets. Our handling of domestic and cross-border payments to our clients generates a significant portion of our revenues, with a substantial portion of such revenues coming from payments processed from Asia (including India, China and Korea). We expect that international revenues will continue to account for a significant percentage of total net revenues for the foreseeable future, and that in particular, the proportion of our revenue from Asia will continue to increase. Current events, including the potential implementation of tariffs, the possibility of renegotiated trade deals and international tax law treaties, priorities of the U.S. presidential administration and related changes in laws, regulations or policies, United States-China and Canada-India diplomatic and trade friction, heightened tensions between China and Taiwan and the continuation or escalation of the conflicts between Russia and Ukraine, Israel and Hamas and Israel, the U.S., and Iran, respectively, create a level of uncertainty, and potentially increased complexity, for multinational companies. These uncertainties could have a material adverse effect on our business and our results of operations and financial condition. In addition, international operations are subject to various risks which could have a material adverse effect on those operations or our business as a whole, including: - foreign currency exchange rate volatility;- adverse economic conditions in the United States and globally, including economic slowdown, heightened interest rates, inflation, recession concerns and the disruption, volatility and tightening of credit and capital markets;- risks related to compliance with multiple complex, potentially conflicting and changing governmental laws and regulations;- local licensing and reporting obligations or the imposition of currency controls which make it impossible or increasingly difficult for our clients to collect payments from international customers;- local regulatory and legal obligations related to privacy, data protection, data localization, and user protections;- the need to localize our solutions, including offering clients and their customers the ability to transact business in the local currency and adapting our solutions to local preferences, in markets in which we may have limited or no experience;- trade barriers, tariffs and changes in trade regulations;- the impact of government sanctions on our ability to offer services in a region, such as sanctions issued by the U.S. and other countries against Russia;- difficulties in developing, staffing, and managing a large number of varying foreign operations as a result of distance, language, and cultural differences;- stringent local labor laws and regulations;- limitations on the repatriation of cash, including imposition or increase of withholding and other taxes on remittances and other payments by foreign subsidiaries;- diplomatic friction, political or social unrest, war or other military conflict, including the continuation or escalation of the conflicts between Russia and Ukraine, Israel and Hamas and Israel, the U.S., and Iran, respectively, economic instability, repression, or human rights issues;- natural disasters, global pandemics or other public health emergencies, acts of war, and terrorism;- compliance with U.S. laws and foreign laws prohibiting corrupt payments to government officials, such as the Foreign Corrupt Practices Act (FCPA) and the U.K. Bribery Act, and other local anti-corruption laws;- compliance with U.S. and foreign laws designed to combat money laundering and the financing of terrorist activities;- retaliatory tariffs and restrictions limiting free movement of currency and an unfavorable trade environment, including as a result of political conditions and changes in the laws, regulations or policies in the United States and elsewhere and as described in more detail below;- antitrust and competition regulations;- expanded compliance with potentially conflicting and changing laws of taxing jurisdictions where we conduct business and applicable U.S. tax laws as they relate to international operations, the complexity and adverse consequences of such tax laws, and potentially adverse tax consequences due to changes in such tax laws or levels of enforcement, including the Inflation Reduction Act of 2022, which includes a minimum corporate tax which could result in an additional tax liability in a given year;- expected or actual extended federal government shutdowns or the priorities of the U.S. presidential administration and related changes in laws, regulations or policies;- national or regional differences in macroeconomic growth rates; and - increased difficulties in collecting accounts receivable. Foreign operations may also expose us to political, social, regulatory and economic uncertainties affecting a country or region, or to political hostility to investments by foreign or private equity investors. Many financial markets are not as developed or as efficient as those in the United States, and as a result, liquidity may be reduced and price volatility may be higher in those markets than in more developed markets. The legal and regulatory environment may also be different, particularly with respect to bankruptcy and reorganization, and may afford us less protection as a creditor than we may be entitled to under U.S. law. Financial accounting standards and practices may differ, and there may be less publicly available information in respect of such companies. Restrictions imposed or actions taken by foreign governments could include exchange controls, seizure or nationalization of foreign deposits and adoption of other governmental restrictions which adversely affect the prices of securities or the ability to repatriate profits. For instance, we process a substantial amount of payments from China. The Chinese government imposes controls on the convertibility of the Renminbi the currency of China, into foreign currencies and, in certain cases, the remittance of currency out of China. The Chinese government may at its discretion further restrict access in the future to foreign currencies for current account transactions, or impose regulatory requirements that may require modifications to our business model for our clients' payors located in China. In addition, income received by us from sources in some countries may be reduced by withholding and other taxes. Any such taxes paid by us will reduce the net income or return from such investments. While we will take these factors into consideration in making investment decisions, including when hedging positions, no assurance can be given that we will be able to fully avoid these risks or generate sufficient risk-adjusted returns. Violations of the complex foreign and U.S. laws, rules and regulations that apply to our cross-border operations may result in fines, criminal actions, or sanctions against us, our officers, or FlyMates; prohibitions on the conduct of our business; and damage to our reputation. Although we have implemented policies and procedures designed to promote compliance with these laws, there can be no assurance that our FlyMates, contractors, or agents will not violate our policies. These risks are inherent in our cross-border operations and expansion, may increase our costs of doing business internationally, and could harm our business.

We devote significant resources to establish relationships with new clients and deepen relationships with existing clients. The sales cycles of our solutions tend to vary depending on the client industry sector which makes forecasting more complex and uncertain. In addition, sales and sale cycles may be based in part or entirely on factors, or perceived factors, not directly related to the features of our solutions, including, among others, a client or prospective client's projection of business growth, uncertainty about economic conditions (including as a result of heightened inflationary conditions, regulatory concerns, recession concerns, priorities of the U.S. presidential administration and related changes in laws, regulations or policies, and the escalation of hostilities between Russia and Ukraine, or the ongoing conflict between the U.S., Iran and Israel in the Middle East or the failure of an agreed-upon peace in the conflict between Israel and Hamas to become permanent), capital budgets, anticipated cost savings from the implementation of our solution, potential preference for internally-developed software solutions, perceptions about our business and solutions, more favorable terms offered by potential competitors, and previous technology investments. Mid-market and large enterprises tend to have more complex operating environments than smaller businesses, making it often more difficult and time-consuming for us to demonstrate the value of our solutions to prospective clients. The decision to use our solutions may also be an enterprise-wide decision, and require us to provide greater levels of education regarding the use and benefits of our solutions, which may result in additional time, effort, and money spent on our sales cycle without any assurance that our efforts will be successful in generating any sales. Often, major hospital systems and national or state higher education systems will solicit service offers by issuing RFPs, which are generally a time- and resource-intensive process, with no assurances of being selected as a vendor after the RFP process is completed. Additionally, large enterprises typically have longer implementation cycles, especially hospital and education systems, require greater product functionality and scalability and a broader range of services, demand that vendors take on a larger share of risks, sometimes require longer testing periods that delay general availability of our solutions, and expect greater payment flexibility from vendors. All of these factors can add further risk to business conducted with these clients. If we fail to realize an expected sale from a large end-client in a particular quarter or at all, our business, operating results, and financial condition could be materially and adversely affected. In addition, we may face unexpected deployment challenges with enterprise clients. It may be difficult to deploy our software solutions if a client has unexpected database, hardware or software technology issues, or if a client insists on a more customized or unique solution that is time intensive or that we have little prior experience in delivering. Decisions on timing of deployments may also be impacted by cost and availability of personnel. Any difficulties or delays in the initial implementation could cause clients to reject our solutions or lead to the delay or non-receipt of future orders, in which case our business, operating results and financial condition would be harmed.

We devote significant resources to establish relationships with new clients and deepen relationships with existing clients. Our sales cycle for our solutions can be variable, typically ranging from three to nine months from initial contact to contract execution. However, there is potential for our sales cycle to extend beyond three to nine months. During the period of our sales cycle, our efforts involve educating our clients about the use, technical capabilities and benefits of our solutions. Our operating results depend in substantial part on our ability to deliver a successful client experience and persuade our clients to grow their relationship with us over time. As we expect to grow rapidly, our client acquisition costs could outpace our build-up of recurring revenue, and we may be unable to reduce our total operating costs through economies of scale such that we are unable to achieve or maintain profitability. Any increased or unexpected costs or unanticipated delays, including delays caused by factors outside of our control, could cause our operating results to suffer.

Our success is dependent, in part, upon protecting our proprietary technology. We rely on a combination of copyrights, trademarks, service marks, trade secret laws, the domain name dispute resolution mechanism, confidentiality procedures, and contractual provisions to establish and protect our proprietary rights. However, effective protection of intellectual property rights is expensive, both in terms of application and maintenance costs, as well as the costs of defending and enforcing those rights, and the steps we take to protect our intellectual property may be inadequate. We do not have patents covering any of our technology and do not actively pursue patents. Any of our trademarks, or other intellectual property rights may be challenged or circumvented by others, or narrowed or invalidated through administrative process or litigation. There can be no guarantee that others will not independently develop similar solutions or duplicate any of our solutions. Furthermore, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our solutions and use information that we regard as proprietary to create solutions that compete with ours. We pursue registration of copyrights, trademarks, and domain names in the United States and in certain jurisdictions outside of the United States, but doing so may not always be successful or cost-effective. We may be unable or, in some instances, choose not to obtain legal protection for our intellectual property, and our existing and future intellectual property rights may not provide us with competitive advantages or distinguish our solutions from those of our competitors. The laws of some foreign countries may not protect our intellectual property rights to the same extent as the laws of the United States, and effective intellectual property protection and mechanisms may be uncertain or unavailable in those jurisdictions. We may need to expend additional resources to defend our intellectual property in such countries, and the inability to do so could impair our business or adversely affect our international expansion. Particularly given the international nature of the Internet, the rate of growth of the Internet, and the ease of registering new domain names, we may not be able to detect unauthorized use of our intellectual property or take prompt enforcement action. Furthermore, the growing use of generative artificial intelligence presents an increased risk of unintentional and/or unauthorized disclosure or use of our intellectual property rights. We endeavor to enter into agreements with our FlyMates, consultants and contractors and with parties with whom we do business in order to acquire intellectual property rights developed as a result of service to us, as well as to limit access to and disclosure of our proprietary information. No assurance can be given that our intellectual property related agreements with our FlyMates, consultants, contractors clients, their customers, or strategic partners and others will be effective in controlling access to and distribution of our solutions and proprietary information, potentially resulting in the unauthorized use or disclosure of our trade secrets and other intellectual property, including to our competitors, which could cause us to lose any competitive advantage resulting from this intellectual property. Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our solutions. In addition, individuals not subject to invention assignment agreements may make adverse ownership claims to our current and future intellectual property. To protect our intellectual property rights, we may be required to spend significant resources to monitor, protect and defend these rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management's attention and resources, could delay further sales or the implementation of our solutions, impair the functionality of our solutions, delay introductions of new features, integrations, and capabilities, result in our substituting inferior or more costly technologies into our solutions, or injure our reputation. In addition, we may be required to license additional technology from third parties to develop and market new features, integrations, and capabilities, and we cannot be certain that we could license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

Flywire's platform is designed to integrate with a broad ecosystem of ERP and financial management systems, such as Workday and Oracle for B2B payments, Oracle, Workday and Ellucian for education, Epic Systems for healthcare, and Rezdy for travel. These integrations enhance our ability to streamline complex flows, improve operational efficiency, and deepen our value proposition across vertical markets. We automatically synchronize suppliers, clients, client customers, invoices, and payment transactions between our solutions and these systems. This two-way sync eliminates duplicate data entry and provides the basis for managing cash-flow through an integrated solution for accounts receivable, and payments. In addition, we are subject to certain standard terms and conditions with these partners. These partners have broad discretion to change their terms of service and other policies, and those changes may be unfavorable to us. Therefore, we believe that maintaining successful partnerships with these providers is critical to our future success. We also rely on our proprietary global payment network comprised of leading global, regional and local banks and technology and payment partners. If we do not or cannot maintain the interoperability of their products or services or the products or our key software vendors that are integral to our solutions, our business may be materially and adversely affected. These third parties periodically update and change their systems, and although we have been able to adapt our solutions to their evolving needs in the past, there can be no guarantee that we will be able to do so in the future. In particular, if we are unable to adapt to such changes, we may not be able to utilize these strategic partners and we may lose access to large numbers of clients as a result. If any of the third party software providers change the features of their APIs, discontinue their support of such APIs, restrict our access to their APIs, or alter the terms governing their use in a manner that is adverse to our business, we will not be able to provide synchronization capabilities, which could significantly diminish the value of our solutions and harm our business, operating results, and financial condition.

Our operational and systems transformation initiative involves a multi-year roadmap with accelerated focus and planned "go lives" over its first 18-months aimed at rebuilding our foundational enterprise operating systems, consolidating disparate software applications, establishing a certified data architecture, and deploying enterprise-wide agentic artificial intelligence workflows. Because this initiative involves a highly complex, multi-dimensional modification of our people, processes, governance, and technology, it is subject to substantial execution risks. Inadequate or defective implementation of core enterprise software platforms, and shortcomings in the consolidation and/or integration of disparate software applications (and in certain instances replacing legacy applications with new ones) could result in significant project delays, systemic operational disruptions, or total project failure. In addition, we may have challenges implementing these replacement systems and driving efficient and effective adoption and use within our employee base, which can create lapses in productivity and magnify the potential for human error. Furthermore, if our data architecture fails to enforce proper data governance and data contracts, or if there are material errors or discrepancies in data conversion and migration cycles, our upstream business metrics will be compromised. This could lead to a systemic failure to achieve our target "Single Source of Truth," which would severely undermine the performance, reliability, and security of our downstream models and automated forecasting tools. The vast operational scope of the transformation program demands a significant commitment of internal subject matter experts and has resulted in a substantial focus of management and engineering resources away from day-to-day operations and business-as-usual strategic goals. By aligning our core innovation strategies so heavily with specific strategic partners, and centering our digital infrastructure around select technical ecosystems, we face considerable opportunity costs and reliance on third-party vendors to deliver timely on architected solutions. These dependencies could cause us to lose valuable opportunities to spend capital on, or develop, alternative or superior technologies that may emerge in the rapidly evolving artificial intelligence and data management markets. If our management team is unable to successfully balance these competing operational demands, our core product timelines, client relationship management activities, and global payment network support capabilities may suffer, which could materially and adversely affect our competitive positioning, financial health, and overall growth trajectory. Financially, the transformation program requires a substantial financial commitment, including initial capital expenditure alongside millions of dollars in incremental recurring software-as-a-service (SaaS) licensing fees and ongoing platform investments. Despite our efforts to maintain rigid budget discipline, we face the distinct possibility of significant cost overruns due to unforeseen engineering complexities, integration bottlenecks across disparate third-party systems, regional talent constraints, evolving global regulatory standards, or extended vendor deployment timelines. The ultimate commercial success and return on investment of the transformation program are deeply contingent upon our ability to capture significant long-term operational savings and drive aggressive structural productivity gains. If we experience implementation delays, high personnel attrition within our newly reorganized data and systems squads, or an inability to successfully transition historical manual and spreadsheet-based workflows into automated processes, our anticipated cost structure improvements will fail to materialize. Under such circumstances, we may never achieve our projected break-even targets, which would result in material asset impairments and severely harm our operating margins and net income.

We track certain key performance indicators, including metrics such as total payment volume, revenue less ancillary services, FX Neutral Revenue Less Ancillary Services, adjusted gross profit, adjusted gross margin, adjusted EBITDA, and adjusted EBITDA margin, with internal systems and tools and which may differ from estimates or similar metrics published by third parties due to differences in sources, methodologies, or the assumptions on which we rely. Our internal systems and tools have a number of limitations, and our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our key performance indicators, including the metrics we publicly disclose, or our estimates. If the internal systems and tools we use to track these metrics undercount or overcount performance or contain algorithmic or other technical errors, the data we report may not be accurate. While these numbers are based on what we believe to be reasonable estimates for the applicable period of measurement, there are inherent challenges in measuring these metrics across our growing client base. If our key performance indicators are not accurate representations of our business, or if investors, clients or other stakeholders do not perceive our operating metrics to be accurate, or if we discover material inaccuracies with respect to these figures, our reputation may be significantly harmed, and our operating and financial results could be adversely affected.

We use open source software in our solutions and expect to continue to use open source software in the future. There are uncertainties regarding the proper interpretation of and compliance with open source licenses, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to use such open source software, and consequently to provide or distribute our solutions. Although use of open source software has historically been free, several open source providers have begun to charge license fees for use of their software. If our current open source providers were to begin to charge for these licenses or increase their license fees significantly, this would increase our research and development costs and have a negative impact on our results of operations and financial condition. Additionally, we may from time to time face claims from third parties claiming ownership of, or seeking to enforce the terms of, an open source license, including by demanding release of source code for the open source software, derivative works or our proprietary source code that was developed using, or that is distributed with, such open source software. These claims could also result in litigation and could require us to make our proprietary software source code freely available, require us to devote additional research and development resources to change our solutions or incur additional costs and expenses, any of which could result in reputational harm and would have a negative effect on our business and operating results. In addition, if the license terms for the open source software we utilize change, we may be forced to reengineer our solutions or incur additional costs to comply with the changed license terms or to replace the affected open source software. Further, use of certain open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of software or indemnification for third party infringement claims. Although we have implemented policies to regulate the use and incorporation of open source software into our solutions, we cannot be certain that we have not incorporated open source software in our solutions in a manner that is inconsistent with such policies.

As a result of the regulations applicable to our business, we could be subject to investigations and resulting liability, including governmental fines, restrictions on our business, or other sanctions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses or regulatory approvals. For example, because a majority of voters in the U.K. approved an exit from the E.U. (commonly referred to as Brexit), we were required to obtain a license from a member state of the EEA which would allow us to continue to provide our solutions to clients located in the EEA under a principle known as "passporting". We were able to obtain a license as an authorized payment institution from the Bank of Lithuania in September 2019 and subsequently obtained the right to passport our solutions to other EEA member states. Government agencies may impose new or additional rules on money transmission, which may increase our costs of doing business, including, but not limited to regulations that: - prohibit, restrict, and/or impose taxes or fees on money transmission transactions in, to or from certain countries or with certain governments, individuals, and entities;- impose additional client identification and client due diligence requirements;- impose additional reporting or recordkeeping requirements, or require enhanced transaction monitoring;- limit the types of entities capable of providing money transmission services, or impose additional licensing or registration requirements;- impose minimum capital or other financial requirements;- limit or restrict the revenue that may be generated from money transmission, including revenue from the transaction value associated with the payment method used by our clients' customers and platform-related fees for access to our solutions and invoice and payment plan fees;- require enhanced disclosures to our money transmission clients or their customers;- require the principal amount of money transmission transactions originated in a country to be invested in that country or held in trust until paid;- limit the number or principal amount of money transmission transactions that may be sent to or from a jurisdiction, whether by an individual or in the aggregate; and - restrict or limit our ability to process transactions using centralized databases, for example, by requiring that transactions be processed using a database maintained in a particular country or region.

We are currently required to comply with U.S. economic and trade sanctions administered by OFAC and we have processes in place designed to comply with the OFAC regulations as well as similar requirements in the foreign jurisdictions in which we already operate. As part of our compliance efforts, we scan our clients and their customers against watch lists promulgated by OFAC and certain other international agencies. Our application can be accessed from nearly anywhere in the world, and if our service is accessed from a sanctioned country or otherwise accessed or used in violation of applicable trade and economic sanctions, we could be subject to fines or other enforcement actions. In the course of enhancing our sanctions compliance function, we initiated an internal review that identified issues related to our compliance with sanctions, including payments that may have originated from sanctioned jurisdictions or sanctioned persons. We have made voluntary submissions to OFAC to report the apparent violations and to provide supplemental information. Flywire is currently engaging with OFAC to resolve these matters. Although the internal investigation completed to date suggests that any loss incurred as a result of this matter would not be material to our business, if OFAC ultimately concludes any violation has occurred in connection with these or other transactions, it could result in penalties, fines, costs, and restrictions on our ability to do business, which could also harm our operating results. We are also subject to various AML and CFT laws and regulations around the world that prohibit, among other things, our involvement in transferring the proceeds of criminal or terrorist activities. In the United States, most of our solutions are subject to AML laws and regulations, including the BSA, and similar laws and regulations. The BSA, among other things, requires MSBs to develop and implement risk-based AML programs, to report large cash transactions and suspicious activity, and in some cases, to collect and maintain information about clients who use their services and maintain other transaction records. Regulators and third-party auditors have identified gaps in how similar businesses have implemented AML programs, and we could likewise be subject to significant fines, penalties, inquiries, audits, investigations, enforcement actions, and criminal and civil liability if our AML program is found to be insufficient by a regulator. Our business operations in other parts of the world such as the U.K., Lithuania, Canada, Australia, Hong Kong, New Zealand, Indonesia and Singapore are subject to similar laws and requirements. Regulators in the United States and globally continue to increase their scrutiny of compliance with these obligations, which may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our clients and to monitor transactions on our system, including payments to persons outside of the United States. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or verify identities of clients, and any change in such thresholds could result in greater costs for compliance. Similarly, as a condition to doing business with us, our banking and other strategic partners also impose ongoing obligations on us related to AML and CFT and sanctions screening. Any failure on our part to maintain the necessary processes and policies to comply with these regulations and requirements, or to adapt our processes and policies to changes in laws, would subject us to penalties, fines, or loss of key relationships which would have a material adverse effect on our business and results of operations. Furthermore, government sanctions imposed with respect to Russia's invasion of Ukraine in early 2022 are impacting our ability to offer our services in the region, and additional sanctions could be imposed in the future. Further instability or tension in Russia, Ukraine, and the surrounding region could also cause us to adjust our operating model, which would increase our costs of operations.

Our clients and their customers store personal and business information, financial information and other sensitive information through our solutions. In addition, we collect, store, and process personal and business information and other data from and about actual and prospective clients, their customers, our FlyMates and our service providers and other business partners, as well as their personnel. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (FTC), and various state, local, and foreign agencies. Our data handling is also subject to contractual obligations and industry standards. The U.S. federal and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use, and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising, and other communications with individuals and businesses. In the United States, various laws and regulations apply to the collection, processing, disclosure, and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act, FERPA, HIPAA, and the now in question E.U.-U.S. and Swiss-U.S. Privacy Shield protections, as well as state laws relating to privacy and data security. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data. For example, California enacted the CCPA, which took effect on January 1, 2020 and became enforceable by the California Attorney General on July 1, 2020, and broadly defines personal information. The CCPA creates new individual privacy rights for consumers (as that term is broadly defined) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to California consumers about its data collection, use and sharing practices, provide such consumers with ways to opt-out of certain sales or transfers of personal information, provides for civil penalties for violations, and allows for a new private right of action for data breaches that has resulted in an increase in data breach litigation. It remains unclear, however, how the CCPA will be interpreted. As currently written, it will likely impact our business activities and exemplifies the vulnerability of our business to not only cyber threats but also the evolving regulatory environment related to personal data and protected health information. CCPA and CPRA enforcement actions have resulted in significant penalties, and the California Privacy Protection Agency has continued to expand its enforcement activities. Additionally, the California Privacy Rights Act (CPRA), which was passed in November 2020 and became effective on January 1, 2023, imposed additional obligations on companies covered by the legislation and significantly modified the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information. The CPRA also created a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. The effects of the CCPA and the CPRA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. The CCPA, in particular, has prompted a number of proposals for new federal and state-level privacy legislation, which could increase our potential liability and adversely affect our business. Several states in the U.S. have proposed or enacted laws that contain obligations similar to the CCPA and CPRA that have taken effect or will take effect in coming years. The U.S. federal government also is contemplating federal privacy legislation. The effects of recently proposed or enacted legislation potentially are far-reaching. Such legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. Many of the foreign jurisdictions where we or our clients operate or conduct business, including the E.U., have laws and regulations dealing with the collection, use, storage, and disclosure and other handling (collectively, processing) of personal information, which in some cases are more restrictive than those in the U.S. In addition to regulating the processing of personal information within the relevant jurisdictions, these legal requirements often also apply to the processing of personal information outside these jurisdictions, where there is some specified link to the relevant jurisdiction. For example, we have multiple offices in Europe and serves clients and their customers throughout the E.U., where the GDPR went into effect in 2018. The GDPR, which is also the law in Iceland, Norway, Liechtenstein, and-to a large degree-the U.K., has an extensive global reach and imposes robust obligations relating to the processing of personal information, including documentation requirements, greater control for data subjects (e.g., the "right to be forgotten" and data portability), security requirements, notice requirements, restrictions on sharing personal information,data governance obligations, data breach notification requirements, and restrictions on the export of personal information to most other countries. The solutions that we currently offer subject us to many of these laws and regulations in many of the foreign jurisdictions where we operate or conduct business, and these laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Legal developments have created compliance uncertainty regarding some transfers of personal information from the U.K. and EEA to locations where we or our clients operate or conduct business, including the United States and potentially Singapore, particularly with respect to cross-border transfers. Under the GDPR, such transfers can take place only if certain conditions apply or if certain data transfer mechanisms are in place. In July 2020, the Court of Justice of the E.U. ruled in its "Schrems II" decision (C-311/18), that the Privacy Shield, a transfer mechanism used by thousands of companies to transfer data between those jurisdictions and United States (and also used by us), was invalid and could no longer be used due to the strength of United States surveillance laws. In September 2020, the Federal Data Protection and Information Commissioner of Switzerland (where the law has a similar restriction on the export of personal information) issued an opinion concluding that the Swiss-U.S. Privacy Shield Framework does not provide an adequate level of protection for data transfers from Switzerland to the United States pursuant to Switzerland's Federal Act on Data Protection. We and our clients continue to use alternative transfer strategies, including SCCs, while the authorities interpret the Schrems II decision and the validity of alternative data transfer mechanisms. The SCCs, though previously approved by the European Commission, have faced challenges in European courts (including being called into question in the Schrems II decision), and may be further challenged, suspended or invalidated for transfers to some or all countries. For example, guidance regarding Schrems II issued by the European Data Protection Board (which is comprised of representatives from every E.U. member state's top data protection authority) have cast serious doubt on the validity of SCCs for most transfers of personal information to the United States. At present, there are few if any viable alternatives to the Privacy Shield and the SCCs, so such developments may necessitate further expenditures on local infrastructure, changes to internal business processes, changes to clients and clients' customer facing solutions, or may otherwise affect or restrict our sales and operations. On June 4, 2021, the European Commission released the final Implementing Decision on SCCs (New SCCs) for the transfer of personal data from the E.U. to "third countries" such as the US. The New SCCs will repeal and replace the existing SCCs (dating from 2001, 2004 and 2010) and address the entry into force of the GDPR) and the July 2020 decision of the CJEU in Schrems II, which invalidated the E.U.-U.S. Privacy Shield. The New SCCs broadly follow the draft implementing decision on standard contractual clauses (Draft SCCs) issued by the European Commission on November 12, 2020, but there are some material differences. The Draft SCCs' significant and extensive new requirements for data importers that act as controllers (for example, obligations to give notice to data subjects and to notify personal data breaches to EU authorities) remain, but have been aligned more closely with the GDPR requirements. While the New SCCs are not immediately in force, compliance with them will be required for new transfer agreements entered into from late September 2021. SCCs then in effect were required to be replaced with the New SCCs by December 27, 2022. On July 10, 2023, the European Commission formally approved the new EU-U.S. Data Privacy Framework (the "Framework"), under which European entities will now be able to transfer personal data to Framework participants in the U.S. without having to put in place additional data protection safeguards or use the Standard Contractual Clauses for data transfers. We are in the process of evaluating how we may self-certify as a participating organization with the U.S. Department of Commerce. E.U. data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of a corporate family's total worldwide global turnover for the preceding fiscal year, whichever is higher. Such penalties are in addition to any civil litigation claims by clients, data subjects or other third parties. We believe that the solutions that we currently offer subject us to the GDPR and other laws and regulations relating to privacy, data protection, and information security, and these may be modified or subject to new or different interpretations in the future. We will need to take steps to address compliance obligations in this rapidly evolving legal environment, but we cannot assure you that we will be able to implement changes in a timely manner or without significant disruption to our business, or that such steps will be effective, and we may face the risk of liability and loss of business. In addition, further to the U.K. exit from the E.U. on January 31, 2020, the GDPR ceased to apply in the U.K. at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the U.K.'s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain U.K. specific amendments) into U.K. law (referred to as the U.K. GDPR). The U.K. GDPR and the U.K. Data Protection Act 2018 set out the U.K.'s data protection regime, which is independent from but aligned to the E.U.'s data protection regime. Non-compliance with the U.K. GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. Like the GDPR, the U.K. GDPR restricts personal data transfers outside the U.K. to countries not regarded by the U.K. as providing adequate protection (this means that personal data transfers from the U.K. to the EEA remain free flowing). On June 28, 2021, the European Commission adopted an adequacy decision under the GDPR, thereby recognizing that the U.K.'s data protection system continues to provide the same protections with respect to personal data as when it was an EU member state, and enabling the continued exchange of personal data between the E.U. and the U.K. The adequacy decision facilitates the implementation of the E.U.-U.K. Trade Cooperation Agreement, which foresaw the need for bilateral data flow and continued cooperation. The adequacy decision included a ‘sunset clause', limiting its duration to four years. On December 19, 2025, the European Commission formally renewed its data adequacy decisions for the U.K., reaffirming that the U.K. maintains an equivalent level of personal data protection under its post-Brexit framework, including updates made by the U.K.'s Data (Use and Access) Act 2025. Following a technical six-month extension granted in June 2025 to review the new legislation, this decision allows personal data to continue flowing freely between the European Economic Area (EEA) and the U.K. without requiring additional transfer safeguards through December 27, 2031. The U.K.'s Data (Use and Access) Act 2025 overhauled the U.K. data governance framework by establishing Digital Verification Services standards, creating "Smart Data" sharing schemes, and updating U.K. GDPR rules to streamline automated decision-making and subject access requests. In certain respects, these regulatory changes ease administrative data burdens and facilitate digitized identity verification across our U.K. education and healthcare client networks, while requiring updates to customer complaint handling timelines and data privacy compliance workflows. This lack of clarity on future U.K. laws and regulations and their interaction with E.U. laws and regulations could add legal risk, uncertainty, complexity and cost to our handling of E.U. personal information and our privacy and data security compliance programs. It is possible that over time the U.K. Data Protection Act 2018 could become less aligned with the GDPR, which could require us to implement different compliance measures for the U.K. and the E.U. and result in potentially enhanced compliance obligations for E.U. personal data. In Asia, there has been an increase in both regulation and enforcement of privacy laws. The Act on Protection of Personal Information originally enacted in June 2020 by the Japanese government, was amended and came into effect on April 1, 2022 (Amended APPI). Since the passage of the Amended APPI, a number of implementing regulations and supporting documents have been released, addressing the requirements for transferring personal data outside Japan, notifying security breaches and creating pseudonymous information exempt from certain obligations under the Amended APPI. On April 7, 2026, the Japanese Cabinet approved and submitted to the Diet a bill to amend the APPI, which includes both deregulatory measures and strengthened regulatory provisions. Key highlights among other matters include: a new consent exemption for statistical processing (e.g., AI development); broader relaxation of consent requirements; specific protections for children's personal data; new rules on biometric data; and regulatory relief for entrusted data processors. Assuming the bill passes the Diet in 2026, the new rules are expected to take full effect by 2028 at the latest. We have taken steps to address compliance obligations that apply to us under the Amended APPI, but cannot assure you that such steps will be effective, and we may face the risk of increased costs, liability and loss of business. China (home to the most online users in the world) passed its DSL and its PIPL in 2021. The DSL applies to a wide range of data processing activities including, but not limited to, processing personal information. With extraterritorial scope and severe fines and penalties, these laws are set to impose an increasingly complex and comprehensive legal framework for processing personal information when doing business in China. The PIPL is enforced and administered by the Cyberspace Administration of China and relevant state and local government departments. The law draws from the GDPR, with heavy penalties up to the greater of 5% of the previous year's revenue (possibly global) or $7.7 million. Chinese authorities have demonstrated a willingness to impose significant fines for violations of PIPL and other privacy laws, as evidenced by enforcement actions against Alibaba Group Holding Ltd and Didi Global Inc. in 2022. As a reaction to data security concerns, in 2022, the Australian parliament approved a bill to amend the country's privacy legislation, significantly increasing the maximum penalties for companies and data controllers who suffer large-scale data breaches to the greater of: (i) AU$50 million, (ii) three times the value of any benefit obtained through the misuse of information, and (iii) 30% of a company's adjusted turnover in the relevant period. Previously, the penalty for severe data exposures was AU$2.22 million, considered by the current parliament to be wholly inadequate to incentivize companies to improve their data security mechanisms. The Office of the Australian Information Commissioner has new regulatory tools and flexibility that should, together with an ongoing focus on funding enforcement, see a more proactive regulator with capacity and capability to investigate and litigate more privacy incidents in Australia. We have taken steps to address compliance obligations that apply to us under the Amended APPI, the DSL, the PIPL and applicable Australian regulations, but cannot assure you that such steps will be effective, and we may face the risk of increased costs, liability and loss of business. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that, if adopted, may apply to us, or which clients or clients' customers may require us to adopt. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our solutions. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business. Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions, litigation, fines and penalties, or adverse publicity, and could cause our clients and partners to lose trust in us, which could have an adverse effect on our reputation and business. We expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, marketing, consumer communications, and information security, and we cannot determine the impact such future laws, regulations, and standards may have on our business. Future laws, regulations, standards, and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our client base and increase revenue. Future restrictions on the collection, use, sharing, or disclosure of data, or additional requirements for express or implied consent of our clients, partners, or end users for the use and disclosure of such information could require us to incur additional costs or modify our solutions, possibly in a material manner, and could limit our ability to develop new functionality. If we are not able to comply with these laws or regulations, or if we become liable under these laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability. This may require us to expend substantial resources or to discontinue certain solutions, which would negatively affect our business, financial condition, and operating results. In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise adversely affect the growth of our business. Furthermore, any costs incurred as a result of this potential liability could harm our operating results.

To grow our business, we will need to maintain and expand our network of global, regional and local banking partners. Our proprietary network of strategic relationships with global, regional and local banking partners is a material asset to our business, which took more than a decade to build. Establishing and maintaining our strategic partner relationships, particularly with our banking partners entails extensive and highly specific efforts, with little predictability and various ancillary requirements. These partners and suppliers have contractual and regulatory requirements and conditions that we must satisfy and continue to comply with in order to continue and grow the relationships. For example, our financial institution partners generally require us to submit to an exhaustive security and anti-financial crime audit including adherence to AML policies and KYC procedures. If we are not able to comply with those obligations or if our agreements with our banking partners or our network partners are terminated for any reason, we could experience service interruptions as well as delays and additional expenses in arranging new services, potentially interfering with our existing client relationships or making us less attractive to potential new clients. In addition, our existing banking partners may at any time and from time to time cease serving certain categories of payments due to perceived risk or similar reasons as well as payments originating from, or being paid to, certain high-risk jurisdictions. These partners may also impose additional requirements on Flywire, or with respect to their own internal procedures, as a condition of processing such payments in partnership with us. If we cease to be able to process payments from corridors or within certain of our verticals, or we are unable to comply with new requirements or only at considerable expense, our client relationships and ability to grow our revenue could be adversely affected. Instability and volatility in the banking and financial services sectors, including bank failures, have increased and may in the future increase uncertainty in the global economy and the risk of a global recession. Volatility in the banking and financial services sectors may adversely impact our bank partnerships and could negatively impact our business. We may face difficulty establishing or maintaining banking relationships due to instability in the global banking system and increasing regulatory uncertainty and scrutiny. If these financial institutions are subject to suspension of operations, receivership, closure or similar action, or if our banking relationships become severely limited or unavailable in a certain country, there could be temporary delays in or unavailability of services in such country that are critical to our or our clients' operations. This could potentially lead to reduced use of our platform and lower payment volume which may adversely impact our business, operating results, and financial condition. We may not be able to attract new network partners to our existing network of global, regional and local banking partners, which could adversely affect our ability to expand to additional countries and territories and transact in additional currencies. In addition, our potential partners may choose to work with our competitors' or choose to compete with our solutions directly, which could have an adverse effect on our business, financial position, and operating results. Further, many of our network partners have greater resources than we do and could choose to develop their own solutions to replace or compete with ours. If we are unsuccessful in establishing, growing, or maintaining our relationships with network partners, our ability to compete or to grow our revenue could be impaired, and our results of operations may suffer.