Corpay Inc (CPAY) Risk Analysis

Adverse effects on demand for our business-related products and services, from unfavorable macroeconomic conditions,

The markets for our solutions are highly competitive and characterized by rapid technological change, frequent introduction of new products and services, evolving industry standards and evolving customer needs. We must respond to the technological advances offered by our competitors, including the use of artificial intelligence and the requirements of regulators and our customers and partners, in order to maintain and improve upon our competitive position and fulfill contractual obligations. We may be unsuccessful in expanding our technological capabilities and developing, marketing, selling or encouraging adoption of new or enhanced products and services that meet these changing demands, which could jeopardize our competitive position. Similarly, if new technologies are developed that displace our offerings for use by businesses, we may be unsuccessful in adequately responding to customer practices and our transaction volume may decline. In addition, we regularly engage in significant efforts to upgrade our products, services and underlying technology, which may or may not be successful in achieving market acceptance or their intended purposes, and may require more time or investment than planned. Artificial intelligence technologies, including machine learning and generative AI, are being rapidly adopted across the payments and enterprise software industries to improve automation, analytics, fraud detection, customer support and decision-making. Our competitors, customers and partners may increasingly expect AI-enabled functionality and efficiencies in the solutions they purchase and use. If we do not identify, develop, license, acquire and integrate AI technologies into our products and operations on a timely basis, or if we are unable to obtain the data, computing resources or specialized personnel needed to do so cost-effectively, our products and services may become less competitive, we may experience slower growth, reduced transaction volumes, loss of customers or partners, and pressure on margins. In addition, AI-enabled products offered by competitors or third parties could disintermediate aspects of our offerings or reduce demand for certain of our solutions. The solutions we deliver are designed to process complex transactions and provide reports and other information on those transactions, all at high volumes and processing speeds. New or enhanced offerings can present performance, scalability or interoperability challenges, and any failure to deliver effective and secure products or services, or any performance issue that arises with a new product or service, could result in significant processing or reporting errors, customer dissatisfaction or other losses. We may rely on third parties to develop or co-develop solutions or to incorporate our solutions into broader platforms for commercial payments and adjacent use cases. We may not be able to enter into such relationships on attractive terms, or at all, and these relationships may not be successful. In addition, partners, some of whom may be our competitors or potential competitors, may choose to develop competing solutions on their own or with third parties. In order to remain competitive, we are continually involved in a number of projects, including the development of new platforms, mobile payment applications, e-commerce services and other new offerings emerging in the payments technology industry, including with respect to domestic and international corporate payments, and EVs. These projects carry the risks associated with any development effort, including cost overruns, delays in delivery and performance problems. Additionally,we may be unable to attract, develop and retain personnel with the skills necessary to execute our strategy in key locations and at the pace required. Any delay in the delivery of new services or the failure to differentiate our services could render our services less desirable to customers, or possibly even obsolete.

In the course of our business we contract with domestic and foreign government entities, including state and local government customers, as well as federal government agencies. As a result, we are subject to various laws and regulations that apply to companies doing business with federal, state and local governments. The laws relating to government contracts differ from other commercial contracting laws and our government contracts may contain unique pricing, audit, disclosure, data protection and compliance obligations that are not common among commercial contracts. In addition, we may be subject to investigation from time to time concerning our compliance with the laws and regulations relating to our government contracts. Our failure to comply with these laws and regulations may result in suspension of these contracts or administrative or other penalties. Government budgets, policy shifts, prolonged or recurring government shutdowns and funding delays can affect the timing of awards, renewals and payments, and may reduce or pause spending under existing contracts or impede new awards. Any of the foregoing could adversely affect our business, operating results and financial condition.

Our business depends heavily on the reliability, availability and security of proprietary and third-party processing systems and cloud infrastructure. A system outage could adversely affect our business, financial condition or results of operations, including by damaging our reputation or exposing us to third-party liability. To successfully operate our business, we must be able to protect our processing and other systems from interruption, including from events that may be beyond our control. Events that could cause system interruptions include, but are not limited to, fire, natural disaster, unauthorized entry, power loss,telecommunications failure, computer viruses, ransomware or other cybersecurity incidents, technology failures, software or other vulnerabilities, terrorist acts and war. Although we have taken steps to protect against data loss and system failures, there is still risk that we may lose critical data or experience system failures, and that our controls may not be effective in all circumstances. Our solutions are based on sophisticated software and computing systems that are constantly evolving. We often encounter delays and cost overruns in developing changes implemented to our systems. In addition, the underlying software may contain undetected errors, viruses or defects. Defects in our software products and errors or delays in our processing of electronic transactions could result in additional development costs, diversion of technical and other resources from our other development efforts, loss of credibility with current or potential customers, harm to our reputation or exposure to liability claims. In addition, we rely on technologies supplied to us by third parties that may also contain undetected errors,vulnerabilities or defects that could adversely affect our business, financial condition or results of operations. Although we attempt to limit our potential liability for warranty claims through disclaimers in our software documentation and limitation of liability provisions in our licenses and other agreements with our customers, we cannot assure that these measures will be successful in limiting our liability or covering all losses. We also operate in an evolving regulatory environment for cybersecurity and data privacy. New or expanded disclosure or notification obligations could increase our compliance costs and exposure to enforcement or litigation following an incident.

If we fail to adequately assess and monitor credit risks or fraud of or by, our customers or third parties, we could experience

Under certain circumstances, when we fund customer transactions, we may bear the risk of substantial losses due to fraudulent use of our payment solutions. We do not maintain insurance to protect us against all of such losses. We bear similar risk relating to fraudulent acts of employees or contractors, for which we maintain insurance. However, the conditions or limits of coverage may be insufficient to protect us against such losses. Criminals are using increasingly sophisticated methods to engage in illegal activities involving financial products, such as skimming and counterfeiting payment cards, account takeovers and identity theft. A single significant incident of fraud, or increases in the overall level of fraud, involving our cards and other products and services, could result in reputational damage to us, which could reduce the use and acceptance of our cards and other payment solutions and services or lead to greater regulation that would increase our compliance costs. Fraudulent activity could also result in the imposition of regulatory sanctions, including significant monetary fines, which could have a material adverse effect on our business, financial condition and results of operations.

A significant source of our revenue comes from processing transactions through the Mastercard networks. In order to offer Mastercard programs to our customers, one of our subsidiaries is registered as a member service provider with Mastercard through sponsorship by Mastercard member banks in both the U.S. and Canada. Registration as a service provider is dependent upon our being sponsored by member banks. If our sponsor banks should stop providing sponsorship for us or determine to provide sponsorship on materially less favorable terms, we would need to find other financial institutions to provide those services or we would need to become a Mastercard member, either of which could prove to be difficult and expensive. Even if we pursue sponsorship by alternative member banks, similar requirements and dependencies would likely still exist . In addition, Mastercard routinely updates and modifies its membership requirements. Changes in such requirements may make it significantly more expensive for us to provide these services, or may require product or process changes within compressed timelines. If we do not comply with Mastercard requirements, it could seek to fine us, suspend us or terminate our registration,which allows us to process transactions on its networks. The termination of our registration, or any changes in the payment network rules that would impair our registration, could require us to stop providing Mastercard payment processing services. If we are unable to find a replacement financial institution to provide sponsorship or become a member, we may no longer be able to provide such services to the affected customers.

To protect our proprietary technology, we rely on copyright, trade secret, patent and other intellectual property laws and confidentiality agreements with employees and third parties, all of which offer only limited protection. Despite our precautions,it may be possible for third parties to obtain and use without our consent confidential information or infringe on our intellectual property rights, and our ability to police that misappropriation or infringement is uncertain, particularly in countries outside of the U.S. In addition, our confidentiality agreements with employees, vendors, customers and other third parties may not effectively prevent disclosure or use of proprietary technology or confidential information and may not provide an adequate remedy in the event of such unauthorized use or disclosure. Protecting against the unauthorized use of our intellectual property and confidential information is expensive, difficult and not always possible. Litigation may be necessary in the future to enforce or defend our intellectual property rights, to protect our confidential information, including trade secrets, or to determine the validity and scope of the proprietary rights of others. This litigation could be costly and divert management resources, either of which could harm our business, operating results and financial condition. Accordingly, despite our efforts, we may not be able to prevent third parties from infringing upon or misappropriating our intellectual property and proprietary information. We cannot be certain that the steps we have taken will prevent the unauthorized use or the reverse engineering of our proprietary technology. Moreover, others may independently develop technologies that are competitive to ours or infringe our intellectual property. The enforcement of our intellectual property rights also depends on our legal actions against these infringers being successful, and we cannot be sure these actions will be successful, even when our rights have been infringed. Furthermore, effective patent, trademark, service mark, copyright and trade secret protection may not be available in every country in which we may offer our products and services.

We electronically receive, process, store and transmit data and sensitive information about our customers and merchants,including bank account information, social security numbers, expense data and credit card, debit card and checking account numbers. We endeavor to keep this information confidential; however, our websites, networks, information systems, services and technologies may be targeted for sabotage, disruption or misappropriation. The uninterrupted operation of our information systems and our ability to maintain the confidentiality of the customer and consumer information that resides on our systems are critical to the successful operation of our business. Unauthorized access to our networks and computer systems could result in the theft or publication of confidential information or the deletion or modification of records or could otherwise cause interruptions in our service and operations. We are not aware of any recent m aterial breach of our or our associated third parties' computer systems, although we and others in our industry are regularly the subject of attempts by bad actors to gain unauthorized access to these computer systems and data or to obtain, change or destroy confidential data (including personal consumer information of individuals) through a variety of means. Because techniques used to sabotage or obtain unauthorized access to our systems and the data we collect change frequently and may not be recognized until launched against a target, especially considering heightened threats and risks associated with artificial intelligence and other technologies, we may be unable to anticipate these techniques or to implement adequate preventative measures. An incident may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered. Our ability to address incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies. Threats to our systems and our associated third parties' systems can derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure. Computer viruses can be distributed and could infiltrate our systems or those of our associated third parties. In addition, denial of service or other attacks could be launched against us for a variety of purposes, including to interfere with our services or create a diversion for other malicious activities. Although we believe we have sufficient controls in place to prevent disruption and misappropriation and to respond to such attacks, any inability to prevent security breaches could have a negative impact on our reputation, expose us to liability, decrease market acceptance of electronic transactions and cause our present and potential clients to choose another service provider. In addition, the risk of cyber-attacks has increased in connection with the military and geopolitical conflicts around the world,including between Russia and Ukraine and within the Middle East. In light of those and other geopolitical events, nation-state actors or their supporters may launch retaliatory cyber-attacks and may attempt to cause supply chain and other third-party service provider disruptions, or take other geopolitically motivated retaliatory actions that may disrupt our business operations,result in data compromise, or both. Nation-state actors have in the past carried out, and may in the future carry out, cyber-attacks to achieve their aims and goals, which may include espionage, information operations, monetary gain, ransomware,disruption and destruction. We could also be subject to liability for claims relating to misuse of personal information, such as unauthorized marketing purposes and violation of data privacy laws. For example, we are subject to a variety of U.S. and international statutes,regulations and rulings relevant to the direct email marketing and text-messaging industries. If we were ever found to be in violation, our business, financial condition, operating results and cash flows could be materially adversely affected. We cannot provide assurance that the contractual requirements related to security and privacy that we impose on our service providers who have access to customer and consumer data will be followed or will be adequate to prevent the unauthorized use or disclosure of data. In addition, we have agreed in certain agreements to take certain protective measures to ensure the confidentiality of customer data. The costs of systems and procedures associated with such protective measures, as well as the cost of deploying additional personnel, training our employees and hiring outside experts, may increase and could adversely affect our ability to compete effectively. Any failure to adequately enforce or provide these protective measures could result in liability, protracted and costly litigation, governmental and card network intervention and fines, remediation costs and with respect to misuse of personal information of our customers, lost revenue and reputational harm. While we maintain insurance covering certain security and privacy damages and claim expenses above a certain financial retention level, we may not carry insurance or maintain coverage sufficient to compensate for all liability and such insurance may not be available for renewal on acceptable terms or at all, and in any event, insurance coverage would not address the reputational damage that could result from a security incident. In addition, under payment network rules, regulatory requirements and related obligations, we may be responsible for the acts or failures to act of certain third parties, such as third-party service providers, vendors, partners and others, which we refer to collectively as associated participants. The failure of our associated participants to safeguard cardholder data and other information in accordance with such rules, requirements and obligations could result in significant fines and sanctions and could harm our reputation and deter existing and prospective customers from using our services. We cannot assure you that there are written agreements in place with every associated participant or that such written agreements will ensure the adequate safeguarding of such data or information or allow us to seek reimbursement from associated participants. Any such unauthorized use or disclosure of data or information also could result in litigation that could result in a material adverse effect on our business, financial condition and results of operations.

data centers and call centers, including technology and network systems managed by multiple third parties, which could

Our ability to provide reliable service to customers, cardholders and other network participants depends upon uninterrupted operation of our data centers and call centers as well as third-party labor and services providers. Incidents affecting these third parties, including disruptions, system outages, technology failures or vulnerabilities, capacity constraints, insolvency, or other cybersecurity incidents could disrupt our services and extend recovery times beyond our control. Our business involves processing large numbers of transactions, the movement of large sums of money and the management of large amounts of data. We rely on the ability of our employees, contractors, suppliers, systems and processes to complete these transactions in a secure, uninterrupted and error-free manner. Our subsidiaries operate in various countries and country-specific factors, such as power availability, telecommunications carrier redundancy, embargoes and regulations can adversely impact our information processing by, or for, our local subsidiaries. We engage backup facilities for each of our processing centers for key systems and data. However, there could be material delays in fully activating backup facilities depending on the nature of the breakdown, security breach, cyberattack or catastrophic event (such as fire, explosion, flood, pandemic, natural disaster, power loss, telecommunications failure or physical break-in). Although, we have controls and documented measures to mitigate these risks, these mitigating controls might not reduce the duration, scope or severity of an outage in time to avoid adverse effects. Disruptions could result in transaction delays or failure, financial losses, contractual penalties, regulatory scrutiny and damage to our reputation. In addition, evolving regulatory frameworks focused on operational resilience and incident reporting may increase our obligations and potential exposure arising from such events.

Derivatives regulations have added costs to our business and any additional requirements, such as future registration

requirements and increased regulation of derivative contracts, may result in additional costs or impact the way we conduct

Our success depends, in part, on our executive officers and other key personnel. Our senior management team has significant industry experience and would be difficult to replace. The market for qualified individuals is competitive, especially in certain fields, including information technology, and we may not be able to attract and retain qualified personnel or candidates to replace or succeed members of our senior management team or other key personnel. The loss of key personnel could materially adversely affect our business.

Changes in laws, regulations and enforcement activities may adversely affect our products and services and the markets in

Failure to comply with the FCPA, AML regulations, economic and trade sanctions regulations and similar laws and

As we continue to expand our business internationally, we may continue to expand into certain foreign countries, particularly those with developing economies, where companies often engage in business practices that are prohibited by U.S., U.K. and other foreign regulations, including the FCPA, the U.K. Bribery Act, Canada's PCMLTFA and Australia's AML/CTF Act. These laws and regulations generally prohibit our employees, consultants and agents from bribing, being bribed or making other prohibited payments to government officials or other persons to obtain or retain business or gain some other business advantage. We have implemented policies to discourage such practices; however, there can be no assurances that all of our employees, consultants and agents, including those that may be based in or from countries where practices that violate these laws may be customary, will not take actions in violation of our policies for which we may be ultimately responsible. In addition, we are subject to AML laws and regulations, including the BSA. Among other things, the BSA requires money services businesses (such as money transmitters and providers of prepaid access) to develop and implement risk-based AML programs, verify the identity of our customers, report large cash transactions and suspicious activity and maintain transaction records. We are also subject to certain economic and trade sanctions programs that are administered by OFAC, which prohibit or restrict transactions to or from or dealings with specified countries, their governments, and in certain circumstances, their nationals, and with individuals and entities that are specially designated nationals of those countries, narcotics traffickers and terrorists or terrorist organizations. Other group entities may be subject to additional foreign or local sanctions requirements in other relevant jurisdictions. Similar AML and counter-terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified in lists maintained by the country equivalent to OFAC lists in several other countries and require specific data retention obligations to be observed by intermediaries in the payment process. Our businesses in those jurisdictions are subject to those data retention obligations. Violations of these laws and regulations may result in severe criminal or civil sanctions and, in the U.S., suspension or debarment from U.S. government contracting. Likewise, any investigation of any potential violations of these laws and regulations by U.S. or foreign authorities could also have an adverse impact on our reputation and operating results. In addition,we cannot predict the nature, scope or effect of future regulatory requirements to which our international operations might be subject or the manner in which existing laws and regulations might be administered or interpreted.

Laws, governmental regulations and contractual obligations designed to protect or limit access to personal information

Any decrease in our receipt of fees and charges, or limitations on our fees and charges, could adversely affect our business,

A portion of our revenue is generated by network processing fees charged to merchants, known as interchange fees, associated with transactions processed using our Mastercard-branded cards. Interchange fee amounts associated with our Mastercard network cards are affected by a number of factors, including regulatory limits in the U.S. and Europe and fee changes imposed by Mastercard. In addition, interchange fees are the subject of intense legal, political and regulatory scrutiny and competitive pressures in the electronic payments industry, which could result in lower interchange fees generally in the future.

We have foreign operations in, or provide services for customers in more than 200 countries throughout North America, South America, Europe, Africa and Asia. We also expect to seek to expand our operations into various additional countries in Asia, Europe and Latin America as part of our growth strategy. Some of the countries where we operate, and other countries where we will seek to operate, have undergone significant political, economic and social change and events (such as the military conflicts in Ukraine and the Middle East) in recent years,including the U.S. In addition, changes in laws or regulations, including with respect to payment service providers, taxation,tariffs, information technology, data transmission and revenues from non-U.S. operations, or in the interpretation of such existing laws or regulations, whether caused by a change in government or otherwise, could materially adversely affect our business, operating results and financial condition. We are actively monitoring the changes and events and assessing the impact on our business. The extent, severity, duration and outcome of market disruptions could be significant and could potentially have substantial impact on the global economy and our business for an unknown period of time. Responses by countries , such as sanctions, export controls and tariffs, will adversely affect the global economy and financial markets and could adversely affect our business, financial condition and results of operations or otherwise aggravate the other risk factors that we identify herein. We cannot predict the scope of macroeconomic factors because these measures are complex and evolving, and may require rapid changes to our products,services or customer onboarding and screening processes. Our efforts to comply with changes may be costly and time consuming and will divert the attention of management. Any alleged or actual failure to comply with these measures may subject us to government scrutiny, civil or criminal proceedings, sanctions and other liabilities, which may have a material and adverse effect on our business, financial condition and results of operations. We continue to refine our business continuity plan,which includes crisis response materials designed to mitigate the impact of significant disruptions to our business, but there can be no assurance that our plan will successfully mitigate all disruptions. In addition, conducting and expanding our international operations subjects us to other political, economic, technological,operational and regulatory risks and difficulties that we do not generally face in the U.S. including exchange controls, capital repatriation restrictions, shifting import and export regimes, evolving local payments regulations and heightened enforcement uncertainty. We cannot be certain that the investment and additional resources required to establish, acquire or integrate operations in other countries will produce desired levels of revenue or profitability.