Marqeta (MQ) Risk Analysis

We, our customers, our vendors, and other third parties we do business with are subject to a wide variety of laws, regulations, and industry standards, including supervision and examination with respect to the foregoing by multiple authorities and governing bodies and in multiple countries, which govern numerous areas important to our business. Issuing Banks and Card Networks operate in a highly regulated environment, and there is a risk that those regulations could become directly applicable to or directly impact us. We have structured our business in a manner reasonably designed to comply with applicable laws and regulations, including, but not limited to, applicable laws relating to money laundering, sanctions, consumer protection, and money transmission services; however, it is possible that a relevant regulator may disagree, which could expose us to penalties and/or censure. If a relevant regulator disagreed with our analysis of, and compliance with, applicable laws, we may be required to seek licenses, authorizations, or approvals from those regulators, which may be dependent on us meeting certain capital and other requirements, and may subject us to additional regulation and oversight, all of which could significantly increase our operating costs. As a program manager, we are responsible for aligning compliance with Issuing Bank requirements and Card Network rules, and we help create card programs for our customers designed to comply with applicable legal and regulatory requirements. In some cases, we have in the past and could continue to be exposed to liability or indemnification claims from our customers or other third parties in connection with the services we provide. We are directly, and indirectly through our contractual relationships with customers, Issuing Banks, and Card Networks, subject to regulation in areas which may include, but are not limited to, privacy, data protection and information security, global sanctions regimes and export controls, and anti-bribery, and those relating to payments services (such as payment processing and settlement services), AI, consumer protection, AML, and escheatment, as well as compliance with industry standards, such as PCI DSS. As our business and platform continue to develop and expand, we continue to become subject to additional laws, rules, regulations, and industry standards, including possible additional examination and supervision, in the United States and internationally. For example, in Canada, the Retail Payment Activities Act (the "RPAA") subjects payment service providers ("PSPs") to supervision by the Bank of Canada and requires PSPs to establish, implement, and maintain a risk management and incident response framework that complies with the RPAA. A Marqeta subsidiary, Marqeta Payments LLC, is registered as a PSP and is subject to these regulatory requirements and supervision. Additionally, TransactPay operates under an EMI license in the UK, Gibraltar, and the EEA. As a result, TransactPay is subject to stringent requirements related to capital adequacy, anti-fraud measures, data security, and transaction monitoring, as well as oversight by relevant European financial authorities. New or expanded regulation or changes in interpretation or enforcement of existing regulations may have an adverse effect on our business, results of operations, and financial condition due to increased compliance costs and new restrictions affecting the offering of our platform, products and services. We may not be able to respond quickly or effectively to, or accurately predict the scope or applicability of, regulatory, legislative, or other developments, which may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. For example, regulatory scrutiny over banks that sponsor financial technology programs increased in fiscal 2024, and the heightened regulatory environment contributed to the Issuing Banks we work with focusing more on maintaining existing programs than launching new programs with us. As a result, we launched fewer programs than projected in fiscal 2024, adversely affecting our results of operations and business. In addition, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, or criminal or civil complaints or sanctions, all of which may have an adverse effect on our reputation, business, results of operations, and financial condition. As a result of our business relationships, we may also be subject to direct or indirect supervision and examination by various authorities. The CFPB, for example, has indicated it may use dormant authority to examine certain companies whose services may pose risk to consumers, which may include our company. The Board of Governors of the Federal Reserve System, the FDIC, and the Office of the Comptroller of the Currency (the "Federal Banking Agencies") have also issued a growing number of enforcement actions in connection with partnerships between banks and financial technology companies in recent years. The Federal Banking Agencies have also published interagency guidance for banks to develop and implement risk management practices for these arrangements, which clarifies supervisory expectations for banks to oversee the third parties with whom they partner. With respect to payment activities, including card issuing, the Federal Banking Agencies have indicated that they may further clarify their supervisory expectations. Accordingly, as a program manager for Issuing Banks, we are subject to the Issuing Banks' risk management standards for third-party relationships in accordance with supervisory guidance and examination by the Federal Banking Agencies. Should we or the Issuing Banks with whom we work be unable to satisfy these standards, we may have to discontinue certain programs or relationships or be unable to onboard new customers or products to the Issuing Banks, and, it is also possible that regulators could hold us or our customers responsible for actual or perceived deficiencies in connection with our arrangements with Issuing Banks, and our business, financial condition, and results of operations may be adversely affected. New or changing laws or regulations could require us to incur significant expenses and devote significant management attention to ensure compliance and could also prompt our Issuing Banks to alter their dealings with us in ways that may have adverse consequences for our business. In addition, increased supervisory scrutiny has in the past contributed to, and may in the future contribute to, the Issuing Banks with whom we currently have relationships reassessing the details of their arrangement with us and may deter new Issuing Banks from establishing a relationship with us or have other adverse impacts upon our business. Further, while we only process transactions on our platform in fiat currencies, certain cryptocurrency businesses use our platform to provide card products to their customers and end users. The regulation of cryptocurrency is rapidly evolving and varies significantly among jurisdictions and is subject to substantial uncertainty. Various legislative and executive bodies in the United States and other countries may adopt laws, regulations, or guidance, or take other actions, which may impact our Issuing Banks and restrain the growth of cryptocurrency businesses and in turn impact the net revenue associated with our cryptocurrency business customers. While we have developed policies and procedures designed to assist in compliance with laws and regulations, no assurance can be given that our compliance policies and procedures will be effective. If we fail to comply or are alleged or perceived to have failed to comply with applicable laws and regulations, we may be subject to litigation or regulatory investigations or other proceedings, we may have to pay fines and penalties or become subject to civil or criminal liability or have additional obligations or restrictions imposed upon our business, and our customer relationships and reputation may be adversely affected, which could have a material adverse effect on our business, results of operations, and financial condition. In some cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals, or make a settlement payment to a given party or regulatory body.

Our agreements with Issuing Banks, Card Networks, customers, vendors, lessors, and other third parties include indemnification provisions under which we agree to indemnify them for losses or expenses suffered or incurred in certain circumstances, including, for example, in relation to claims arising out of the breach of such agreements, services to be provided by us, or from intellectual property infringement claims made by third parties. Some of these agreements provide for uncapped liability for indemnification claims and some indemnity provisions survive termination or expiration of the applicable agreement. We have in the past been, and could continue to be, exposed to liability or indemnification claims from our customers, Card Networks, or Issuing Banks in connection with the services we provide. Large payments to customers, Card Networks, or Issuing Banks could harm our business, results of operations, and financial condition. Any dispute with a customer, Card Network, or Issuing Bank with respect to these obligations could have adverse effects on our relationship with that counterparty and other existing or prospective customers, Card Networks, or Issuing Banks, and harm our business and results of operations. Further, although we carry insurance, our liability insurance may not cover all potential claims made against us or be sufficient to cover us for all liability that may be imposed, and any such coverage may not continue to be available to us on acceptable terms or at all.

We have incurred substantial net operating losses ("NOLs") and other tax attributes, including research & development ("R&D") credits, during our history. In general, under Section 382 of the Internal Revenue Code of 1986, as amended, a corporation that undergoes an "ownership change" (generally defined as a greater than 50-percentage-point cumulative change (by value) in the equity ownership of certain stockholders over a rolling three-year period) is subject to limitations on a company's ability to utilize its NOLs and other tax attributes to offset taxable income. We have experienced ownership changes since inception and believe that our existing NOLs and other tax attributes, including R&D credit carryforward, will be subject to such limitations. In addition, the amount of NOLs and other tax attributes that we are permitted to deduct may be subject to limitations and our NOLs and other tax attributes may expire before they are fully utilized. Our NOLs and other tax attributes may also be subject to limitations under state law. For example, recently enacted California legislation limits the use of state NOLs for tax years beginning on or after January 1, 2024, and before January 1, 2027. As a result of this or other legislative or regulatory changes, or other unforeseen reasons, our existing NOLs and other tax attributes could expire or otherwise be unavailable to offset future income tax liabilities.

We have in the past and may in the future be accused of infringing, misappropriating, or otherwise violating the intellectual property or other proprietary rights of third parties. Although we seek to comply with the statutory, regulatory, and judicial frameworks and the terms and conditions of statutory licenses, we cannot assure you that we are not infringing or violating any third-party intellectual property rights, or that we will not do so in the future. The costs of litigation can be considerable, and we cannot assure you that we will achieve a favorable outcome of any such claim. Although we carry insurance, our insurance may not cover potential claims of this type or may not be adequate to cover us for all liability that may be imposed. If any such claim is valid, we may be required to stop using such intellectual property or other proprietary rights and pay damages, which could adversely affect our business. Even if such claims were not valid, defending them could be expensive and distract our management team. We have agreed to defend, indemnify, and hold harmless certain of our customers and other counterparties from damages and costs arising from the infringement or claimed infringement by our products of third-party intellectual property rights. The scope of these indemnity obligations varies. Even if we are not a party to any litigation between a customer or other counterparty and a third party relating to alleged infringement in relation to our products, an adverse outcome in any such litigation could make it more difficult for us to defend our solutions against intellectual property infringement claims in any subsequent litigation where we are a named party. Any of these results could harm our brand and adversely affect our results of operations.

Our continued growth depends on the efficient operation of our platform. Any significant disruption, outage, data loss, or errors in service on our platform, including events beyond our control, such as infrastructure changes or failures, or human or software errors could have a material and adverse effect on our business and financial condition. We have experienced such performance incidents in the past and expect that we will continue to periodically experience such performance issues in the future. Our platform is designed to process a high number of transactions and deliver reports and other information related to those transactions at high processing speeds. We have in the past and may in the future experience errors, inaccuracies, or omissions in our processing, reconciling, or reporting of transactions. The risk of performance issues has increased in recent periods due to the significant increase in our TPV and increases further with new product launches and geographical expansion. We release regular updates to our platform, which have in the past contained, and may in the future contain, undetected errors, failures, and bugs. Any platform performance issues could lead to claims by customers, vendors, Card Networks, Issuing Banks, or other third parties, or other claims, regulatory fines, or proceedings. It could also damage ours and our customers' businesses and, in turn, hurt our brand and reputation. The performance, availability, and connectivity of the data centers, cloud-based solutions, and other third parties that provide core services such as computing and storage infrastructure for our platform are outside of our control. If any of these infrastructure providers fail to provide sufficient capacity to support our platform or otherwise experience service outages, we may experience interruptions in our ability to operate our platform and our business could be adversely affected. We have experienced, and expect to continue to periodically experience, outages of the services provided by these providers. If we are not able to maintain the level of service uptime and performance needed by our customers, they could face longer processing times or downtime as a result. If customers are unable to access our platform within a reasonable amount of time, or at all, we may not be able to meet the service level commitments typically provided for in our customer contracts and we would be contractually obligated to provide service level credits. We have experienced incidents, including incidents outside our control, and expect we may experience incidents in the future requiring us to pay service level credits and other customer service concessions. In addition, our insurance policies may not adequately compensate us for any losses that we may incur as a result of damage or interruption. Further, we are continuing to refine our enterprise resilience functions such as business continuity, crisis management, and disaster recovery. Our disaster recovery plan has not been tested under actual disaster conditions, and we may not have sufficient capacity to recover all data and services in the event of an outage. Therefore, any performance issue, systems failure, outage, or interruption in the availability of our platform would adversely affect our business, and could subject us to financial penalties and liabilities.

If we are unable to attract new customers, retain existing customers on favorable terms, grow and develop those relationships, and expand our platform in a way that serves the needs of these customers to drive increased processing volumes, our business, results of operations, financial condition, and future prospects would be adversely affected. There are a number of factors that affect our ability to attract new customers and retain existing customers, many of which are outside of our control and are difficult to predict, including, but not limited to changing levels of regulatory scrutiny over banks that sponsor financial technology programs and the risk factors included in this section. While historically our customers generally have not been subject to material minimum volume commitments under their contracts and have not had material contractual obligations to continue using our platform, products, or services, we increasingly require contractual obligations related to exclusivity and preferred provider status related to our products and services. Accordingly, our legacy customers that do not have these contractual obligations may have, or may enter into in the future, similar agreements with our competitors, which could adversely affect our ability to drive the processing volume and revenue growth that we seek to achieve. Some of our customer contracts provide for a termination clause that allows our customers to terminate their contract at any time following a limited notice period. The loss of customers or reductions in their processing volumes, particularly any loss of or reductions by Block, may adversely affect our business, results of operations, and financial condition. To achieve continued growth, we must not only maintain our relationships with our existing customers, but also encourage them to renew their contracts with us and to increase adoption and usage of our products. For example, customers can have multiple card programs on our platform across different use cases and geographies. However, we cannot assure you that customers will continue to use our platform or that we will be able to continue processing transactions on our platform at the same rate as we have in the past.

We depend on services from various third-party vendors to provide our products and services. Any disruptions in these services, including as a result of actions outside of our control, could significantly impact the continued performance of our platform. We conduct vendor due diligence and manage such vendors using a risk-based approach intended to determine if relevant vendors have the ability, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report to us any breach of their security measures that may affect our business. If we are unable to timely and accurately identify at-risk vendors or if a service provider fails to properly safeguard our data or intellectual property, fails to meet contractual requirements (including compliance with applicable laws and regulations), suffers a cyberattack, security breach or incident, or other system outage or interruption, or terminates its contract with us, we could be subject to claims from customers or other third parties or regulatory enforcement actions, and such incidents may also put information we process at risk which could in turn adversely affect our business, reputation, financial condition, or results of operations. In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. In the future, these services may not be available to us on commercially reasonable terms, or at all. Any loss of any of these services could adversely affect our business and we may incur additional costs to resolve the issue.