Priority Technology Holdings (PRTH) Risk Analysis

We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. The Company relies upon operational and information systems, some of which are managed by third parties, to process, transmit and store electronic information and to manage or support a variety of our business processes, activities and products. Additionally, we collect and store sensitive data, including the personally identifiable information of our customers and employees, in data centers and on information systems (including systems that may be controlled or maintained by third parties). The Company's business, and in particular, the debit card and cash management solutions business and global payments business, is dependent on its ability to process and monitor, on a daily basis, a large number of transactions, many of which are highly complex, across numerous and diverse markets. These transactions, as well as the information technology services provided to clients, often must adhere to client-specific guidelines, as well as legal and regulatory standards. Due to the breadth and geographical reach of the Company's client base, developing and maintaining its operational and information systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts. Although the Company continues to take protective measures to maintain the confidentiality, integrity and security of our operational and information systems and infrastructure, the techniques used in cyberattacks are becoming increasingly diverse and sophisticated. For example, the Company's operational and information systems or infrastructure, or those of our third-party providers, may be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, computer viruses or other malicious code, cyberattacks and other incidents that could create a cybersecurity event, any of which could remain undetected for an extended period of time. Furthermore, the Company may not be able to ensure that all of its clients, suppliers, counterparties and other third parties have appropriate controls in place to protect themselves from cyberattacks or to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Given the increasingly high volume of transactions, certain errors may be repeated or compounded before they can be discovered and rectified. In addition, the increasing reliance on information systems, and the occurrence and potential adverse impact of attacks on such systems, both generally and in the financial services industry, have encouraged increased government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and incidents. As these threats, incidents and government and regulatory oversight of associated risks continue to evolve, the Company may be required to expend additional resources to enhance or expand upon the security measures it currently maintains. Although the Company has developed, and continues to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks, a breach of its systems and global payments infrastructure or those of our non-bank financial service partners and processors could result in: losses to the Company and its customers; loss of business and/or customers; damage to its reputation; the incurrence of additional expenses (including the cost of notification to consumers, credit monitoring and forensics, and fees and fines imposed by the card networks); disruption to its business; an inability to grow its online services or other businesses; additional regulatory scrutiny or penalties; and/or exposure to civil litigation and possible financial liability - any of which could have a material adverse effect on the Company's business, financial condition and results of operations. We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business, results of operations or financial condition; however, the impacts of such threats or incidents in the future may be material. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For information on our cybersecurity risk management, strategy and governance, see Part I, Item 1C., Cybersecurity

We depend on the efficient and uninterrupted operation of our computer systems, software, data centers and telecommunications networks, as well as the systems and services of third parties. A system outage or data loss could have a material adverse effect on our business, financial condition, results of operations and cash flows. Not only could we suffer damage to our reputation in the event of a system outage or data loss, but we may also be liable to third parties. Many of our contractual agreements with FIs and certain other customers require the payment of penalties if we do not meet certain operating standards. Our systems and operations or those of our third-party providers could be exposed to damage or interruption from, among other things, fire, natural disaster, power loss or telecommunications failure.

Our business is affected by laws and regulations and examinations that affect us and our industries. Regulation and proposed regulation of the payments industry has increased significantly in recent years. Failure to comply with regulations or guidelines may result in the suspension or revocation of a license or registration, the limitation, suspension or termination of service, including money transmission services, and the imposition of civil and criminal penalties, including fines, or may cause customers or potential customers to be reluctant to do business with us, any of which could have an adverse effect on our financial condition. Interchange fees are subject to intense legal, regulatory and legislative scrutiny. In particular, the Dodd-Frank Act limits the amount of debit card fees charged by certain issuers, allowing merchants to set minimum dollar amounts for the acceptance of credit cards and allowing merchants to offer discounts or other incentives for different payment methods. These types of restrictions could negatively affect the number of debit transactions, which would adversely affect our business. The Dodd-Frank Act also created the CFPB, which has assumed responsibility for enforcing federal consumer protection laws, and the FSOC, which has the authority to determine whether any non-bank financial company, which may include us within the definitional scope, should be supervised by the Federal Reserve because it is systemically important to the U.S. financial system. Any such designation would result in increased regulatory burdens on our business, which increases our risk profile and may have an adverse impact on our business, financial condition and results of operations. We and many of our merchants may be subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices. That statement and other laws, rules and or regulations, including the Telemarketing Sales Act, may directly impact the activities of certain of our merchants and, in some cases, may subject us, as the merchant's electronic processor or provider of certain services, to investigations, fees, fines and disgorgement of funds if we were deemed to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of the merchant through our services. Various federal and state regulatory enforcement agencies, including the Federal Trade Commission and state attorneys general, have authority to take action against non-banks that engage in unfair or deceptive practices or violate other laws, rules and regulations and to the extent we are processing payments or providing services for a merchant that may be in violation of laws, rules and regulations, we may be subject to enforcement actions and as a result may incur losses and liabilities that may impact our business. Our business may also be subject to the FCRA, which regulates the use and reporting of consumer credit information and also imposes disclosure requirements on entities that take adverse action based on information obtained from credit reporting agencies. We could be liable if our practices under the FCRA are not in compliance with the FCRA or regulations under it. Separately, the Housing Assistance Tax Act of 2008 included an amendment to the Internal Revenue Code that requires the filing of yearly information returns by payment processing entities and third-party settlement organizations with respect to payments made in settlement of Electronic Payment transactions and third-party payment network transactions occurring in that calendar year. Transactions that are reportable pursuant to these rules are subject to backup withholding requirements. We could be liable for penalties if our information returns do not comply with these regulations. These and other laws and regulations, even if not directed at us, may require us to make significant efforts to change our products and services and may require that we incur additional compliance costs and change how we price our services to merchants. Implementing new compliance efforts may be difficult because of the complexity of new regulatory requirements and may cause us to devote significant resources to ensure compliance. Furthermore, regulatory actions may cause changes in business practices by us and other industry participants which could affect how we market, price and distribute our products and services, which could limit our ability to grow, reduce our revenues or increase our costs. In addition, even an inadvertent failure to comply with laws and regulations, as well as rapidly evolving social expectations of corporate fairness, could damage our business or our reputation.

We have potential liability for chargebacks associated with the transactions we process. If a billing dispute between a merchant and a cardholder is not ultimately resolved in favor of the merchant, the disputed transaction is "charged back" to the merchant's bank and credited or otherwise refunded to the cardholder. The risk of chargebacks is typically greater with those merchants that promise future delivery of goods and services rather than delivering goods or rendering services at the time of payment. If we or our bank sponsors are unable to collect the chargeback from the merchant's account or reserve account (if applicable), or if the merchant refuses or is financially unable (due to bankruptcy or other reasons) to reimburse the merchant's bank for the chargeback, we may bear the loss for the amount of the refund paid to the cardholder. Any increase in chargebacks not paid by our merchants could increase our costs and decrease our revenues. Similarly, if a return is made against a customer for whom we have collected an ACH payment and that customer does not have adequate funds to offset such a return, we may incur a loss. We have policies to manage merchant-related credit risk and often mitigate such risk by requiring collateral and monitoring transaction activity. Notwithstanding our programs and policies for managing credit risk, it is possible that a default on such obligations by one or more of our customers could have a material adverse effect on our business.

The Electronic Payments industry in which we compete is subject to rapid technological changes and is characterized by new technology, product and service introductions, evolving industry standards, changing customer needs and the entrance of non-traditional competitors. We are subject to the risk that our existing products and services become obsolete, and that we are unable to develop new products and services in response to industry demands. Our future success will depend in part on our ability to develop or adapt to technological changes and the evolving needs of our resellers, customers and the industry at large. In addition, new products and offerings may not perform as intended or generate the business or revenue growth expected. Defects in our software and errors or delays in our processing of electronic transactions could result in additional development costs, diversion of technical and other resources from our other development efforts, loss of credibility with current or potential distribution partners and merchants, harm to our reputation, fines imposed by regulatory agencies, card networks, or exposure to liability claims. Any delay in the delivery of new products or services or the failure to differentiate our products and services could render them less desirable, or possibly even obsolete, to our merchants. Additionally, the market for alternative payment processing products and services is evolving, and we may develop too rapidly or not rapidly enough for us to recover the costs we have incurred in developing new products and services.

From time to time, card associations and debit networks increase the organization and/or processing fees (known as interchange fees) that they charge. It is possible that competitive pressures will result in us absorbing a portion of such increases in the future, which would increase our operating costs, reduce our profit margin, and adversely affect our business, operating results, and financial condition. In addition, the various card associations and networks prescribe certain capital requirements. Any increase in the capital level required would further limit our use of capital for other purposes.

The Electronic Payments industry depends heavily on the overall level of consumer, commercial and government spending. We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits. A sustained deterioration in general economic conditions or increases in interest rates could adversely affect our financial performance by reducing the number or aggregate dollar volume of transactions made using Electronic Payments. If our customers make fewer sales of their products and services using Electronic Payments, or consumers spend less money through Electronic Payments, we will have fewer transactions to process at lower dollar amounts, resulting in lower revenue. In addition, a weakening in the economy could force customers to close at higher than historical rates, resulting in exposure to potential losses and a decline in the number of transactions that we process. We also have material fixed and semi-fixed costs, including rent, debt service, contractual minimums and salaries, which could limit our ability to quickly adjust costs and respond to changes in our business and the economy.