Payoneer (PAYO) Risk Analysis

We are subject to laws, rules, regulations, policies and legal interpretations in the markets in which we operate, including (but not limited to) those governing cross-border and domestic money transmission, foreign exchange, privacy, data protection, deposit taking, factoring, stored value and payment services (including payment processing and settlement services) and the numerous laws and regulations that govern workforce management services. The legal and regulatory requirements applicable to us are extensive, complex, frequently changing, and increasing in number, and may impose overlapping and/or conflicting requirements or obligations in a variety of jurisdictions. Failure to comply could subject us to material fines and other material adverse consequences. Financial and political events have increased the level of regulatory scrutiny on the payments industry, and regulatory bodies may view matters or interpret laws and regulations differently than they have in the past and in a manner adverse to our business. Our success and increased visibility may result in increased regulatory oversight and tighter enforcement of rules and regulations that may apply to our business. Governments and regulators may impose new regulatory requirements or interpretations in a range of areas that, among other things, may: - prohibit, restrict, and/or impose taxes or fees on our services, including to or from certain countries or with certain individuals, and entities;- impose additional customer identification and due diligence requirements;- impose additional reporting or record keeping requirements, or require enhanced transaction monitoring;- limit or restrict the types of entities capable of providing money transmission services, or impose additional licensing or registration requirements;- impose minimum capital or other financial requirements;- limit or restrict the revenue that may be generated from transmitting money, processing payments, or factoring receivables, including interest earned on customer funds, transaction fees, and revenue generated from foreign exchange transactions;- require enhanced disclosures to customers;- limit the number or principal amount of money transmission transactions that may be sent to or from a jurisdiction, whether by an individual or in the aggregate;- restrict or limit the ability of firms to process transactions using a centralized record keeping system located outside of the jurisdiction in which the customer is located, requiring that data associated be localized in the same jurisdiction as the customer; and - restrict or limit the ability to utilize new technologies, such as artificial intelligence or digital currencies. Any failure or perceived failure to comply with existing or new laws and regulations (including changes to or expansion of the interpretation of those laws and regulations), including those discussed in this risk factor, may subject us to material fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and other enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; increase regulatory scrutiny of our business; restrict our operations; result in the loss of banking relationships; force us to change our business practices, make product or operational changes or delay planned product launches or improvements. The foregoing could, individually or in the aggregate, expose us to significant liability, impose significant costs, require us to expend substantial resources, increase the cost and complexity of compliance, damage our brand and business, harm our reputation, make our products and services less attractive, result in the loss of customers, limit our ability to grow the business, and materially adversely affect our results of operations. The complexity of existing U.S. federal and state and foreign regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving U.S. and international regulatory environment, has in the past and may in the future result in a single event giving rise to multiple overlapping investigations and legal and regulatory proceedings and enforcement actions by multiple government authorities in different jurisdictions. We have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, but there can be no assurance that our employees, contractors, or agents will not violate such laws and regulations. We have obtained licenses to operate in multiple jurisdictions around the world, including the United States, Europe, the United Kingdom, Japan, Australia, Hong Kong, Singapore, and China. From time to time, we interact with our regulators concerning the interpretation or application of certain regulatory requirements. In addition, we are obligated to self-report when we exceed the parameters or constraints of our licenses. In the past, these matters have not had a material adverse effect on our business, but no assurance can be given that future disagreements or disputes will not have a material adverse effect on our business. In the United States, we provide our services through Payoneer Inc. Payoneer Inc. is licensed as a money transmitter (or its equivalent) in all states where such license is required for our business, as well as in the District of Columbia, Puerto Rico and the U.S. Virgin Islands. As a licensed money transmitter, Payoneer Inc. is subject to restrictions with respect to its investment of customer funds, reporting requirements, bonding requirements and inspection by state regulatory agencies. Accordingly, if Payoneer Inc. violates these laws or regulations, we could be subject to material fines or other enforcement action, forced to cease doing business with residents of certain states, forced to change our business practices or be required to obtain additional licenses or regulatory approvals that could impose substantial costs. We provide our services to customers in the EEA through our Irish subsidiary, Payoneer Europe Limited ("Payoneer Europe"). Payoneer Europe is licensed by the Central Bank of Ireland as an Electronic Money Institution and its license is "passported" across all EEA countries. Payoneer Europe is subject to material fines or other enforcement action if it violates the disclosure, reporting, anti-money-laundering, capitalization, funds management, corporate governance, privacy, data protection, information security, taxation, sanctions, or other requirements imposed on Irish e-money institutions. The regulators in any country in which we provide services could seek to persuade the regulators that have granted us a license to require us to operate through a local branch. In addition, EU laws and regulations are typically subject to different and potentially inconsistent interpretations by the countries that are members of the EU. Such actions can make compliance more costly and operationally difficult to manage. In the United Kingdom, Payoneer Payment Services (UK) Ltd. is licensed by the Financial Conduct Authority as an Electronic Money Institution. In Japan, Payoneer Japan Ltd. is licensed as a Registered Fund Transfer Service Provider. In Australia, Payoneer Australia Pty Ltd is licensed by the Australian Securities and Investments Commission as a provider of a non-cash payment products. In Hong Kong, Payoneer Hong Kong Limited is licensed as a Money Service Operator. In Singapore, Payoneer Singapore Private Limited is licensed as a Major Payment Institution License by the Monetary Authority of Singapore. Accordingly, these entities are subject to material fines or other enforcement action if any of the entities violate the product disclosure, reporting, anti-money laundering, capitalization, privacy, data protection, corporate governance or other requirements imposed by their respective regulators. In India, we continue to provide services as an Online Payment Gateway Service Provider, as approved by the Reserve Bank of India ("RBI"), for the purpose of facilitating certain payments for Indian residents, while Payoneer India Private Limited recently received in-principle authorization from the RBI as Payment Aggregator-Cross Border ("PA-CB"), with final authorization pending RBI approval which is subject to completion of certain customary conditions. In China, we obtained a local license in 2025 through the acquisition of Payeco Finance Information Holding Corporation ("PayEco"), the parent company of a locally licensed entity, as more fully described under "Risk Factors – Regulatory Risks Related to Payoneer - As a significant portion of our revenue is generated from China, any material negative impact to our ability to serve customers based in China could materially adversely affect our results and exacerbate the other risks set forth herein." In many of the markets in which we do business, we serve our customers through a company licensed in a different jurisdiction. It is unclear and uncertain whether our services are subject to regulatory oversight only in the jurisdictions in which they are licensed or if our services are subject to the laws of the jurisdiction in which our customer is based. We have been and expect to continue to be required to apply for various licenses, certifications and regulatory approvals in countries other than the ones in which we have already obtained a license. There can be no assurance that we will be able to obtain such licenses in the future, and the failure to obtain such licenses could have a material adverse effect on our business. Even if we can obtain such licenses, there are substantial costs and potential product changes involved in maintaining such licenses, and we could be subject to material fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance or other requirements. In many countries it may not be clear whether we are required to be licensed as a payment services provider, financial institution or otherwise. In such markets, we may rely on local banks or licensed payment service providers to process payments and conduct foreign exchange transactions in local currency. Local regulators may use their power to slow or halt payments to our customers in those jurisdictions. Such regulatory actions or the need to obtain licenses, certifications or other regulatory approvals could impose substantial costs and involve restrictions on our ability to offer our services or considerable delay in the provision or development of our services in a given market, or require significant and costly operational changes, or prevent us from providing any services in a given market. In addition, our planned stablecoin offerings could subject us to additional regulations, licensing requirements, or other obligations. The regulatory landscape with respect to digital currency is rapidly evolving. For example, in July 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (the "GENIUS Act") became the first federal law specifically regulating the issuance of, custody of and other stablecoin-related matters in the United States. We may be subject to inquiries or investigations from regulators and governmental authorities, requiring us to make product changes, restrict or discontinue product offerings, and implement additional and potentially costly controls. If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions and potential fines and other consequences. In addition, financial risks related to our planned stablecoin offerings, such as inappropriate access to or theft or destruction of any stablecoin assets, insufficient insurance coverage to reimburse us for all such losses, or failure to maintain effective controls over the stablecoin activity, could materially and adversely affect our financial performance and significantly harm our business. As we expand our product offerings and localize our international activities, we are increasingly becoming obligated to comply with the laws of the countries or markets in which we operate. In addition, because our services are accessible worldwide and we facilitate sales of goods and services and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws. Any of the foregoing may result in additional costs and regulatory scrutiny, which may have a material adverse effect on our business.

Securities class action lawsuits and derivative lawsuits are often brought against public companies that have entered into merger agreements. Lawsuits or other proceedings may be brought challenging, among other things, the adequacy of the disclosures in the corresponding Proxy Statement, the process conducted by our Board of Directors, the terms of the Merger Agreement, alleged breaches of fiduciary duties by our directors and/or officers, or the fairness of the consideration in connection with the Merger. Even if such lawsuits or other legal or regulatory proceedings are without merit, defending against these claims can result in substantial costs and divert management time and resources. An adverse judgment in any such lawsuits or proceedings could result in monetary damages payable by the Company, which could have a negative impact on our liquidity, results of operations and financial condition. In addition, the pendency of such litigation could create uncertainty and negatively affect our relationships with partners, banks, customers, vendors and others with whom we do business, and could impair our ability to recruit and retain employees. Additionally, if a plaintiff is successful in obtaining an injunction prohibiting completion of the Merger, then that injunction may delay or prevent the Merger from being completed, which may exacerbate the other risks described herein and adversely affect our business, results of operations and financial condition. Any such delay could also result in the Merger not being consummated before June 12, 2027, which could give rise to termination rights under the Merger Agreement. Even if we are ultimately successful in defending against such claims, the costs and distraction of litigation during the pendency of the Merger could materially and adversely affect our business, results of operations and financial condition, as well as the price of our common stock. On August 3, 2026, the Company received a demand letter from a purported shareholder of the Company, alleging that the disclosures in the Company's preliminary proxy statement, dated July 31, 2026, related to the Merger, were deficient, and demanding that the Company issue corrective disclosures. The Company believes the allegations in the demand letter are without merit. Additional demand letters may be received by the Company in connection with the Merger. If additional demand letters are received, absent new or different allegations that are material, the Company will not necessarily announce such additional demands.

Our services are based on sophisticated software and computer systems and we may encounter delays when developing new applications and services. Further, our or our third-party providers' software may contain undetected vulnerabilities, errors or defects. In addition, we may experience difficulties in installing or integrating our technology on systems or with other programs used by our third-party providers. Defects in our or our third-party providers' software, errors or delays in the processing of electronic transactions or other difficulties and errors, including human errors, in administering these systems, services or products, could result in material interruption of business operations, delay in market acceptance, additional development and remediation costs, diversion of technical and other resources, loss of customers or customer data, regulatory impact, negative publicity, reputational damage, or exposure to liability claims. Although we attempt to limit our potential liability through disclaimers and limitation of liability provisions in our license and other agreements, we cannot be certain that these measures will successfully limit our liability. Additionally, electronic payment products and services, including ours, have been, and could continue to be in the future, specifically targeted, and could be penetrated or disrupted by hackers, as described elsewhere in this section. Because the techniques used to obtain unauthorized access to data, products, and services and to disable, degrade, or sabotage them change frequently and may be difficult to detect or remediate for long periods of time, we and our customers may be unable to anticipate these techniques to implement adequate preventative measures to stop them. If we, our customers or third-party service providers are unable to anticipate or prevent these attacks, our customers' businesses may be harmed, our reputation could be damaged, and we could incur significant liability.

We have been, and may in the future be, subject to liability for fraudulent transactions, including electronic payments and card transactions or credits initiated by customers. Examples of fraud include when a party knowingly uses a stolen or counterfeit credit, debit or prepaid card, card number or other credentials to record a false sales transaction, processes an invalid card or intentionally fails to deliver the merchandise or services sold in an otherwise valid transaction. In addition, we are subject to the risk that our employees, counterparties or third-party service providers commit fraudulent activity against us or our customers. Bad actors and criminals around the world are using increasingly sophisticated methods to engage in illegal activities, including those involving personal data, such as counterfeiting, account takeover, fraud, unauthorized use of another's identity or payment information, unauthorized acquisition or use of credit or debit card details and other fraudulent use of another's identity or information. Identity thieves and those committing fraud, may use stolen or fabricated credit card or bank account details, or other deceptive or malicious practices, including unauthorized access of bank accounts, and can potentially steal significant amounts of money from businesses like ours. It is possible that incidents of fraud could increase in the future. In configuring our services, we face an inherent trade-off between security and customer convenience. Failure to effectively manage risk and prevent fraud, or otherwise effectively administer our chargeback responsibilities, would increase our chargeback liability and exposure to material fines or other liabilities and could result in the loss of banking relationships or other operational relationships or expose us to the other risks associated with failure or perceived failure to comply with regulations described elsewhere in this Risk Factors section. The above could have a material adverse effect on our business, results of operations and financial condition.

Global pandemics, such as the COVID-19 pandemic, and other global public health issues may materially and variably impact our operations and the operations of our customers and business partners locally and globally, and therefore our business, results of operations, and financial condition. For example, during the height of the COVID-19 pandemic, we were adversely affected by a decline in global travel and volatile global economy, while at the same time benefited from an increase in e-commerce transactions. The extent and materiality of such impact will depend on developments that are highly uncertain and difficult to predict, including, but not limited to, the duration, location and spread of an outbreak or crises, its severity, the actions to contain the pandemic or crises or treat its impact, the way an outbreak and the remedial measures taken in response affect consumer sentiment and spending behavior, and how quickly and to what extent normal economic and operating conditions can resume.

We are subject to risks related to changes in currency rates as a result of our international operations and multi-currency customer transactions and from revenues generated and costs incurred in currencies other than the United States dollar. These risks include transaction risk, which occurs when the exchange rate we offer to customers differs from the rate at which we execute corresponding trades with financial institutions, leading to potential gains or losses. This risk is further impacted by timing mismatches, bulk currency purchases for liquidity management, and internal customer balance conversions that are not immediately offset by external bank transactions. We also manage translation risk, as we hold assets (primarily cash in banks) and liabilities (primarily customer balances) in multiple currencies, which are revalued into U.S. dollars for financial reporting purposes. Any of the above may materially adversely affect our reported financial position and results of operations. In addition, our ability to optimize foreign exchange revenues as part of the payment delivery process may be adversely affected due to foreign exchange market and regulatory conditions outside of our control, as a result of which revenue and profit may materially decrease as compared to prior periods. In addition, we may become subject to exchange control regulations that restrict or prohibit the conversion of our foreign revenue currencies into United States dollars. Any of these factors could decrease the value of revenues and earnings we derive from our international operations and have a material adverse effect on our business.