Deluxe (DLX) Risk Analysis

Information security risks have escalated in recent years due to factors such as the proliferation of new technologies, including emerging AI systems, remote work arrangements, and the growing sophistication of cyber threat actors. We rely on internet-based channels to collect, manage, transmit, and process sensitive information, including customers' financial account and payment details, proprietary business data, and personally identifiable information of consumers, employees, contractors, suppliers, and other business partners. Additionally, our technology-driven services, such as merchant services and remittance processing, are essential to our customers' business operations. Cybersecurity is a top risk identified by our Enterprise Risk Management (ERM) Committee, as technology-based organizations like ours are particularly vulnerable to targeted attacks seeking to exploit network and system weaknesses. Additional information regarding our ERM Committee is provided in Part I, Item 1C of this report. The secure and uninterrupted operation of our networks and systems and the protection of the sensitive information they contain is vital to our business operations and strategy. We have implemented a risk-based cybersecurity program, utilizing a defense-in-depth approach with multiple security layers and adherence to the CIA (confidentiality, integrity, and availability) triad model. Despite these measures, our systems and networks remain inherently vulnerable to unauthorized access. A security breach, whether accidental or intentional, could result in unauthorized access to, or misuse of, sensitive information, including personally identifiable or protected health information. Our security measures may be compromised by third-party actions, computer viruses, accidents, or errors by employees or contractors, as well as malicious actions by insiders. Threat actors may circumvent controls and exploit vulnerabilities, leading to the disclosure or misuse of sensitive information. We depend on numerous third parties, including vendors, developers, and partners, who may have access to our customer or employee data. We have established a vendor security program to assess and manage these risks, and certain third-party relationships are governed by contractual security requirements. However, we cannot fully control the actions of third-party providers, and any cyberattacks or breaches they experience could adversely affect our ability to serve customers or conduct business. Techniques used to gain unauthorized access, disrupt service, or sabotage systems are constantly evolving, often difficult to detect, and may not be recognized until after an attack occurs. As a result, we may be unable to implement adequate preventive measures. Threat actors may attempt to access our systems through hacking, fraud, social engineering, or other deceptive methods targeting employees and contractors. Our customers and employees have been, and may continue to be, targeted by phishing and other social engineering attacks. To date, these threats have not materially impacted our business or financial results. However, given the increasing threat landscape, our technologies, systems, and networks are likely to be targeted in future attacks, and we cannot guarantee that future incidents will not be material. Despite our robust cybersecurity systems and processes, there remains a risk that unauthorized parties could bypass our security measures. Such a breach could result in the misappropriation of personal or proprietary information, operational disruptions, damage to our systems or those of our users, and reputational harm. Such events could deter clients and consumers from purchasing our products and services, result in contract terminations, and have widespread impacts if vulnerabilities affect large segments of technology infrastructure. Any of these outcomes would negatively affect our business, financial condition, and results of operations. In the event of a material information security breach, we may need to devote significant management time and financial resources to respond, remediate, and mitigate the effects. We may not be able to resolve the situation promptly, or at all. Under payment card association rules and our contracts with payment processors, a breach involving payment card information could make us liable for costs associated with issuing new cards and other related expenses. We could also lose our ability to process card payments, resulting in customer loss and difficulty attracting new business. We may also face costly and time-consuming litigation, government investigations, and enforcement actions. If we are unsuccessful in defending claims related to information security breaches, we may be required to pay damages, penalties, or fines, and our insurance coverage may not fully compensate us for our losses. Contractual provisions with third parties, including cloud service providers, may limit our ability to recover losses resulting from a partner's security breach. Additionally, some of our data, such as consumer credit profiles, is highly regulated, increasing complexity and potential liability in the event of a breach. International, federal, and state laws and regulations require notification of individuals affected by information security breaches involving personal data, which could be costly. Mandatory disclosure of a breach often leads to negative publicity, potentially eroding client and consumer confidence in our security measures. Publicity about breaches at other companies may also create a perception that e-commerce is not secure, reducing our website traffic, negatively affecting our financial results, and limiting future business opportunities.

Our operations rely on the continuous performance and availability of our information technology systems and those of our third-party service providers. Any disruption, failure, or security breach affecting our websites, transaction and payment processing, network infrastructure, printing production, or customer service operations could result in reputational harm, customer loss, and negative financial impacts. These disruptions may be caused by human error, software or hardware failures, cyberattacks, power outages, telecommunications issues, natural disasters, or other unforeseen events. Additionally, our ability to deliver products and services depends on the interconnected operations of participants in the global financial system. Disruptions affecting any participant in this system, such as banks, payment processors, or communication networks, could prevent us from completing transactions or providing information, regardless of our own systems' performance. While we collaborate with other participants to mitigate these risks, we cannot guarantee uninterrupted service. Although we have invested in robust technology platforms, including cloud-based systems with redundancy and backup capabilities, these safeguards may not prevent all interruptions or data losses. Our disaster recovery plans may not address every scenario, and system failures could result in data loss, additional costs, liability claims, or negative publicity. Frequent or extended outages may cause customers to perceive our services as unreliable and seek alternatives. Our business interruption insurance may not fully compensate us for losses from such events, and we may face costly and time-consuming claims from affected customers or partners. Any significant disruption to our information technology systems or those of key third parties could materially and adversely affect our business, financial condition, and reputation.

As a provider of transaction processing services, we are subject to the operating rules, standards, and requirements of payment card networks such as Visa, Mastercard, and others, either as a registered member or as a service provider for member institutions. These networks regularly update and interpret their rules, which govern areas such as transaction processing, chargebacks, data security, merchant onboarding, and fee structures. Any changes to, or new interpretations of, these network rules could materially impact our business. For example, modifications to chargeback procedures may limit our ability to contest disputed transactions or increase our exposure to chargeback losses. Changes in fee structures, data security requirements, or merchant onboarding standards could result in higher operating costs, require significant investments in technology or compliance, or restrict our ability to offer certain products and services. In some cases, new or revised rules may conflict with our current business practices, necessitating costly or complex operational adjustments. Failure to comply with network rules or to adapt to changes in a timely manner could result in penalties, increased costs, reputational harm, or an inability to process transactions through certain networks. Any of these outcomes could materially and adversely affect our business, financial condition, and results of operations.

Our ability to achieve and sustain growth is closely tied to our effectiveness in attracting new customers and retaining existing ones in a cost-effective manner. We utilize a variety of marketing and promotional strategies, such as a direct sales force, partner referrals, email campaigns, paid search engine placements, direct mail, broadcast media, online advertising banners, social media engagement, and other digital channels. The efficiency and cost of these methods may fluctuate over time, and certain approaches may become less impactful or more expensive. For example, direct mail campaigns may yield lower response rates, search engine providers may alter their algorithms or increase the cost of paid placements, or the volume of partner referrals may diminish. Furthermore, the increasing adoption of generative artificial intelligence (AI) tools and agentic search technologies, including conversational search engines, autonomous shopping assistants, and AI-driven product recommendations, may change how customers discover, compare, and purchase products and services. As these technologies become more integrated into customer decision-making processes, our visibility within digital platforms that we do not control may decrease, potentially impacting our ability to reach prospective customers. Additionally, our broad range of products and services presents challenges in ensuring that customers are aware of our full portfolio. Initiatives aimed at increasing awareness of our diverse offerings may result in higher marketing expenditures, which may not necessarily translate into increased revenue. We regularly review and adjust our marketing and sales approach to optimize our promotional mix. However, competitive pressures may prevent us from passing increased costs on to customers, and new marketing initiatives may not deliver the expected results, which could weaken our competitive position and negatively impact our financial performance. In addition, as our check supply contracts expire, customers may renegotiate terms or choose alternative suppliers. If we are unable to secure favorable renewals or attract new check supply customers, our revenue could decline. Maintaining a relevant and flexible multichannel experience is essential for customer acquisition and retention. Customers expect to interact with us through their preferred channels, whether by mail, online, phone, or mobile device. While we invest in improving our user experience, there is no guarantee these investments will be successful. The landscape of multichannel marketing is rapidly evolving, and we must keep pace with shifting customer preferences and competitive innovations. If we fail to update our customer-facing technology promptly or if our technology does not function as intended, we may lose the ability to attract and retain customers, which could result in lower revenue.