Marqeta (MQ) Risk Analysis

We, our customers, our vendors, and other third parties we do business with are subject to a wide variety of laws, regulations, and industry standards, including supervision and examination with respect to the foregoing by multiple authorities and governing bodies and in multiple countries, which govern numerous areas important to our business. While we currently operate our business in an effort to ensure our business itself is not subject to the same level of regulation or licensing as the Issuing Banks and Card Networks that we contract with, Issuing Banks and Card Networks operate in a highly regulated environment, and there is a risk that those regulations could become directly applicable to or directly impact us. We have structured our business in a manner reasonably designed to comply with applicable laws and regulations, including, but not limited to, applicable laws relating to money laundering, sanctions, consumer protection, and money transmission services; however, it is possible that a relevant regulator may disagree, which could expose us to penalties and/or censure. If a relevant regulator disagreed with our analysis of, and compliance with, applicable laws, we may be required to seek licenses, authorizations, or approvals from those regulators, which may be dependent on us meeting certain capital and other requirements, and may subject us to additional regulation and oversight, all of which could significantly increase our operating costs. As a program manager, we are responsible for aligning compliance with Issuing Bank requirements and Card Network rules, and we help create card programs for our customers designed to comply with applicable legal and regulatory requirements. In some cases, we have in the past and could continue to be exposed to liability or indemnification claims from our customers or other third parties in connection with the services we provide. We are directly, and indirectly through our contractual relationships with customers, Issuing Banks, and Card Networks, subject to regulation in areas which may include, but are not limited to, privacy, data protection and information security, global sanctions regimes and export controls, and anti-bribery, and those relating to payments services (such as payment processing and settlement services), AI, consumer protection, AML, and escheatment, as well as compliance with industry standards, such as PCI DSS. As our business and platform continue to develop and expand, we continue to become subject to additional laws, rules, regulations, and industry standards, including possible additional examination and supervision, in the United States and internationally. For example, in Canada, the Retail Payment Activities Act (the "RPAA") will subject payment service providers ("PSPs"), including a Marqeta subsidiary, to supervision by the Bank of Canada. One of our subsidiaries submitted an application for registration under the RPAA in November 2024, and we and other PSPs must establish, implement, and maintain a risk management and incident response framework that complies with the RPAA by September 8, 2025. New or expanded regulation or changes in interpretation or enforcement of existing regulations may have an adverse effect on our business, results of operations, and financial condition due to increased compliance costs and new restrictions affecting the offering of our platform, products and services. We may not be able to respond quickly or effectively to, or accurately predict the scope or applicability of, regulatory, legislative, or other developments, which may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. For example, regulatory scrutiny over banks that sponsor financial technology programs increased in fiscal 2024, and the heightened regulatory environment contributed to the Issuing Banks we work with focusing more on maintaining existing programs than launching new programs with us. As a result, we launched fewer programs than projected in fiscal 2024, adversely affecting our results of operations and business. In addition, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, or criminal or civil complaints or sanctions, all of which may have an adverse effect on our reputation, business, results of operations, and financial condition. As a result of our business relationships, we may also be subject to direct or indirect supervision and examination by various authorities. The CFPB, for example, has indicated it has dormant authority to examine certain companies whose services may pose risk to consumers, which may include our company. The Board of Governors of the Federal Reserve System, the FDIC, and the Office of the Comptroller of the Currency (the "Federal Banking Agencies") have also issued a growing number of enforcement actions in connection with partnerships between banks and financial technology companies in recent years. The Federal Banking Agencies have also published interagency guidance for banks to develop and implement risk management practices for these arrangements, which clarifies supervisory expectations for banks to oversee the third parties with whom they partner. With respect to payment activities, including card issuing, the Federal Banking Agencies have indicated that they may further clarify their supervisory expectations. Accordingly, as a program manager for Issuing Banks, we are subject to the Issuing Banks' risk management standards for third-party relationships in accordance with supervisory guidance and examination by the Federal Banking Agencies. Should we or the Issuing Banks with whom we work be unable to satisfy these standards, we may have to discontinue certain programs or relationships or be unable to onboard new customers or products to the Issuing Banks, and, it is also possible that regulators could hold us or our customers responsible for actual or perceived deficiencies in connection with our arrangements with Issuing Banks, and our business, financial condition, and results of operations may be adversely affected. New or changing laws or regulations could require us to incur significant expenses and devote significant management attention to ensure compliance and could also prompt our Issuing Banks to alter their dealings with us in ways that may have adverse consequences for our business. In addition, increased supervisory scrutiny has in the past contributed to, and may in the future contribute to, the Issuing Banks with whom we currently have relationships reassessing the details of their arrangement with us and may deter new Issuing Banks from establishing a relationship with us or have other adverse impacts upon our business. Further, while we do not handle or interact with cryptocurrency and we only process transactions on our platform in fiat currencies, certain cryptocurrency businesses use our platform to provide card products to their customers and end users. The regulation of cryptocurrency is rapidly evolving and varies significantly among jurisdictions and is subject to substantial uncertainty. Various legislative and executive bodies in the United States and other countries may adopt laws, regulations, or guidance, or take other actions, which may impact our Issuing Banks and restrain the growth of cryptocurrency businesses and in turn impact the net revenue associated with our cryptocurrency business customers. While we have developed policies and procedures designed to assist in compliance with laws and regulations, no assurance can be given that our compliance policies and procedures will be effective. If we fail to comply or are alleged or perceived to have failed to comply with applicable laws and regulations, we may be subject to litigation or regulatory investigations or other proceedings, we may have to pay fines and penalties or become subject to civil or criminal liability or have additional obligations or restrictions imposed upon our business, and our customer relationships and reputation may be adversely affected, which could have a material adverse effect on our business, results of operations, and financial condition. In some cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals, or make a settlement payment to a given party or regulatory body.

In the ordinary course of business, we have been, are currently, and in the future may be, involved in litigation or disputes. We have also received and may in the future receive, inquiries, warrants, subpoenas, and other requests for information in connection with government investigations. Such claims, disputes, lawsuits, proceedings, and investigations could involve matters relating to employment, wage and hour, commercial, antitrust, securities, the duties of officers or directors, regulatory compliance, and other matters. The number and significance of litigation, regulatory, and government or legal investigation matters and disputes has increased and may continue to increase as our business expands. We also had in the past, have currently, and may have in the future indemnification obligations as a result of our contracts with customers and other counterparties that may require us to reimburse or pay for damages, fees, or other expenses associated with claims, lawsuits, proceedings, and investigations such customers and other counterparties face. Further, our liability insurance may not cover all potential claims made against us or third parties or be sufficient to cover us for all liability that may be imposed. A claim brought against us or third parties that is uninsured or under-insured could result in unanticipated costs. The costs associated with litigation, disputes, regulatory actions, and government or legal investigations can also be unpredictable depending on the complexity of the matter, the resources needed to manage it, and length of time devoted to it. These matters may also divert management's attention and operational resources, could harm our reputation regardless of the outcome, and might seriously harm our business, overall financial condition, and operating results. We cannot assure you that any actual or potential litigation, claims, disputes, investigations, or proceedings will not have a material adverse effect on our business, results of operations, and financial condition.

We have incurred substantial net operating losses ("NOLs") and other tax attributes, including research & development ("R&D") credits, during our history. In general, under Section 382 of the Internal Revenue Code of 1986, as amended, a corporation that undergoes an "ownership change" (generally defined as a greater than 50-percentage-point cumulative change (by value) in the equity ownership of certain stockholders over a rolling three-year period) is subject to limitations on a company's ability to utilize its NOLs and other tax attributes to offset taxable income. We have experienced ownership changes since inception and believe that our existing NOLs and other tax attributes, including R&D credit carryforward, will be subject to such limitation. In addition, the amount of NOLs and other tax attributes that we are permitted to deduct may be subject to limitations and our NOLs and other tax attributes may expire before they are fully utilized. Our NOLs and other tax attributes may also be subject to limitations under state law. For example, recently enacted California legislation limits the use of state NOLs for tax years beginning on or after January 1, 2024, and before January 1, 2027. As a result of this or other legislative or regulatory changes, or other unforeseen reasons, our existing NOLs and other tax attributes could expire or otherwise be unavailable to offset future income tax liabilities.

We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws, and contractual restrictions to establish and protect our intellectual property and proprietary rights, which are critical to our success. The steps we take to protect our intellectual property, however, may be inadequate, and various events outside of our control may pose a threat to our intellectual property rights. We cannot assure you that any patents or trademarks will be issued with respect to our currently pending patent and trademark applications. Our patents and trademarks may be contested, circumvented, or found unenforceable or invalid, and we may not be able to prevent third parties from infringing, diluting, or otherwise violating them. There can be no guarantee that others will not independently develop similar products, duplicate any of our products, or design around our patents. As the development, adoption, and use of generative AI technologies grows, our intellectual property may inadvertently be exposed through the use of such technologies. Further, the laws of some foreign countries may not protect our intellectual property rights to the same extent as the laws of the United States, and effective intellectual property protection and mechanisms may not be available in those jurisdictions. We also rely in part on trade secrets, proprietary technology, and other confidential information to maintain our competitive position. Although we enter into confidentiality agreements with our employees, service providers, and other actual or potential strategic business partners, these agreements may not be effective in controlling access to and distribution of our platform, or certain other aspects of our trade secrets, proprietary technology, and other confidential information. To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights, in the U.S. and internationally, and we may not be able to detect infringement by third parties. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property.

Our continued growth depends on the efficient operation of our platform. Any significant disruption, outage, data loss, or errors in service on our platform, including events beyond our control, such as infrastructure changes or failures, or human or software errors could have a material and adverse effect on our business and financial condition. We have experienced such performance incidents in the past and expect that we will continue to periodically experience such performance issues in the future. Our platform is designed to process a high number of transactions and deliver reports and other information related to those transactions at high processing speeds. We have in the past and may in the future experience errors, inaccuracies, or omissions in our processing, reconciling, or reporting of transactions. The risk of performance issues has increased in recent periods due to the significant increase in our TPV and increases further with new product launches and geographical expansion. We release regular updates to our platform, which have in the past contained, and may in the future contain, undetected errors, failures, and bugs. Any platform performance issues could lead to claims by customers, vendors, Card Networks, Issuing Banks, or other third parties, or other claims, regulatory fines, or proceedings. It could also damage ours and our customers' businesses and, in turn, hurt our brand and reputation. The performance, availability, and connectivity of the data centers, cloud-based solutions, and other third parties that provide computing and storage infrastructure for our platform are outside of our control. If any of these infrastructure providers fail to provide sufficient capacity to support our platform or otherwise experience service outages, we may experience interruptions in our ability to operate our platform and our business could be adversely affected. We have experienced, and expect to continue to periodically experience, outages of the services provided by these providers. If we are not able to maintain the level of service uptime and performance needed by our customers, they could face longer processing times or downtime as a result. If customers are unable to access our platform within a reasonable amount of time, or at all, we may not be able to meet the service level commitments typically provided for in our customer contracts and we would be contractually obligated to provide service level credits. We have experienced incidents, including incidents outside our control, and expect we may experience incidents in the future requiring us to pay service level credits and other customer service concessions. In addition, our insurance policies may not adequately compensate us for any losses that we may incur as a result of damage or interruption. Further, we are continuing to refine our enterprise resilience functions such as business continuity, crisis management, and disaster recovery. Our disaster recovery plan has not been tested under actual disaster conditions, and we may not have sufficient capacity to recover all data and services in the event of an outage. Therefore, any performance issue, systems failure, outage, or interruption in the availability of our platform would adversely affect our business, and could subject us to financial penalties and liabilities.

If we are unable to attract new customers, retain existing customers on favorable terms, grow and develop those relationships, and expand our platform in a way that serves the needs of these customers to drive increased processing volumes, our business, results of operations, financial condition, and future prospects would be adversely affected. There are a number of factors that affect our ability to attract new customers and retain existing customers, many of which are outside of our control and are difficult to predict, including, but not limited to changing levels of regulatory scrutiny over banks that sponsor financial technology programs and the risk factors included in this section. While historically our customers generally have not been subject to material minimum volume commitments under their contracts and have not had material contractual obligations to continue using our platform, products, or services, we increasingly require contractual obligations related to exclusivity and preferred provider status related to our products and services. Accordingly, our legacy customers that do not have these contractual obligations may have, or may enter into in the future, similar agreements with our competitors, which could adversely affect our ability to drive the processing volume and revenue growth that we seek to achieve. Some of our customer contracts provide for a termination clause that allows our customers to terminate their contract at any time following a limited notice period. The loss of customers or reductions in their processing volumes, particularly any loss of or reductions by Block, may adversely affect our business, results of operations, and financial condition. To achieve continued growth, we must not only maintain our relationships with our existing customers, but also encourage them to renew their contracts with us and to increase adoption and usage of our products. For example, customers can have multiple card programs on our platform across different use cases and geographies. However, we cannot assure you that customers will continue to use our platform or that we will be able to continue processing transactions on our platform at the same rate as we have in the past.

We depend on services from various third-party vendors to provide our products and services. Any disruptions in these services, including as a result of actions outside of our control, could significantly impact the continued performance of our platform. We conduct vendor due diligence and manage such vendors using a risk-based approach intended to determine if relevant vendors have the ability, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report to us any suspected breach of their security measures that may affect our business. If we are unable to timely and accurately identify at-risk vendors or if a service provider fails to properly safeguard our data or intellectual property, fails to meet contractual requirements (including compliance with applicable laws and regulations), suffers a cyberattack, security breach or incident, or other system outage or interruption, or terminates its contract with us, we could be subject to claims from customers or other third parties or regulatory enforcement actions, and such incidents may also put information we process at risk which could in turn adversely affect our business, reputation, financial condition, or results of operations. In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. In the future, these services may not be available to us on commercially reasonable terms, or at all. Any loss of any of these services could adversely affect our business and we may incur additional costs to resolve the issue.