Moneygram International (MGI) Risk Analysis

Our business is subject to certain regulations aimed at preventing money laundering and terrorism. We are subject to U.S. federal anti-money laundering laws, the Bank Secrecy Act and anti-money laundering laws in other countries in which we operate, particularly in the European Union. We are subject to sanctions laws and regulations, promulgated by OFAC. We are also subject to financial services regulations, money transfer and payment instrument licensing regulations, consumer protection laws, currency control regulations, escheatment laws, privacy and data protection laws and anti-bribery laws. Many of these laws are evolving, with requirements that may be unclear and inconsistent across jurisdictions, making compliance challenging. Subsequent legislation, regulation, litigation, court rulings or other events could expose us to increased program costs, liability and reputational damage. We are considered a Money Services Business in the U.S. under the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001. As such, we are subject to reporting, recordkeeping and anti-money laundering provisions in the U.S. as well as other jurisdictions. During 2017 and 2018, there were significant regulatory reviews and actions taken by U.S. and other regulators and law enforcement agencies against banks, Money Services Businesses and other financial institutions related to money laundering. We are also subject to regulatory oversight and enforcement by the U.S. Department of the Treasury Financial Crimes Enforcement Network. Any determination that we have violated any anti-money-laundering laws could have an adverse effect on our business, financial condition and results of operations. The Dodd-Frank Act increases the regulation and oversight of the financial services industry. The Dodd-Frank Act addresses, among other things, systemic risk, capital adequacy, deposit insurance assessments, consumer financial protection, interchange fees, derivatives, lending limits, thrift charters and changes among the bank regulatory agencies. The Dodd-Frank Act requires enforcement by various governmental agencies, including the CFPB. Money transmitters such as the Company are subject to direct supervision by the CFPB and are required to provide additional consumer information and disclosures, adopt error resolution standards and adjust refund procedures for international transactions originating in the U.S. in a manner consistent with the Remittance Transfer Rule (a rule issued by the CFPB pursuant to the Dodd-Frank Act). In addition, the CFPB may adopt other regulations governing consumer financial services, including regulations defining unfair, deceptive, or abusive acts or practices and new model disclosures. We could be subject to fines or other penalties if we are found to have violated the Dodd-Frank Act's prohibition against unfair, deceptive or abusive acts or practices. The CFPB's authority to change regulations adopted in the past by other regulators could increase our compliance costs and litigation exposure. We may also be liable for failure of our agents to comply with the Dodd-Frank Act. The legislation and implementation of regulations associated with the Dodd-Frank Act have increased our costs of compliance and required changes in the way we and our agents conduct business. In addition, we are subject to periodic examination by the CFPB. We are also subject to regulations imposed by the FCPA in the U.S., the U.K. Bribery Act and similar anti-bribery laws in other jurisdictions. Because of the scope and nature of our global operations, we experience a higher risk associated with the FCPA and similar anti-bribery laws than other companies. We are subject to recordkeeping and other requirements imposed upon companies related to compliance with these laws. Between 2016 and 2021, there has been an increase in regulatory reviews and enforcement actions taken by the U.S. and other regulators related to anti-bribery laws, along with increased scrutiny on payments to and relationships with, foreign entities and individuals. We are also subject to the PSD2, as amended by the 4th and 5th Anti-Money Laundering Directives in the EU, which governs the regulatory regime for payment services in the European Union and similar regulatory or licensing requirements in other jurisdictions. The PSD2 and other international regulatory or licensing requirements may impose liability on us for the conduct of our agents and the commission of third-party fraud utilizing our services. If we fail to comply with the PSD2 or such other requirements, we could be subject to fines or penalties or revocation of our licenses, which could adversely impact our business, financial condition and results of operations.

We rely on a variety of technologies to provide security for our systems. Advances in computer capabilities, new discoveries affecting the efficacy of cryptography or other events or developments, including improper acts by third parties, may result in a compromise or breach of the security measures we use to protect our systems. We obtain, transmit and store confidential consumer, employer and agent information in connection with certain of our services. These activities are subject to laws and regulations in the U.S. and other jurisdictions. The requirements imposed by these laws and regulations, which often differ materially among the many jurisdictions, are designed to protect the privacy of personal information and to prevent that information from being inappropriately disclosed. Any security breaches in our or our suppliers' source code, computer networks, systems, databases or facilities could lead to the inappropriate use or disclosure of personally identifiable or proprietary information, which could harm our business and result in, among other things, unfavorable publicity, damage to our reputation, loss in our consumers' confidence in our or our agents' business, fines or penalties from regulatory or governmental authorities, a loss of consumers, lawsuits and potential financial losses. In addition, we may be required to expend significant capital and other resources to protect against these security breaches or to alleviate problems caused by these breaches. Our agents, banks, digital asset exchanges and third-party independent contractors may also experience security breaches involving the storage and transmission of our data as well as the ability to initiate unauthorized transactions, funds transfers or digital asset transfers. If an entity gains improper access to our, our suppliers', agents' banks', digital asset exchanges' or our third-party independent contractors', source code, computer networks, systems, or databases or facilities, they may be able to steal, publish, delete or modify confidential customer information or generate unauthorized money transfers, funds transfers or digital asset transfers. Such a breach could expose us to monetary liability, losses and legal proceedings, lead to reputational harm, cause a disruption in our operations, or make our consumers and agents less confident in our services, which could have a material adverse effect on our business, financial condition and results of operations.

Criminals are using increasingly sophisticated methods to engage in illegal activities such as identity theft, fraud and paper instrument counterfeiting. As we make more of our services available over the internet and other digital media, we subject ourselves to new types of consumer fraud risk because requirements relating to consumer authentication are more complex with internet services. Certain former agents have also engaged in fraud against consumers, and existing agents could engage in fraud against consumers. We use a variety of tools to protect against fraud; however, these tools may not always be successful. Allegations of fraud may result in fines, settlements, litigation expenses and reputational damage. Our industry is under increasing scrutiny from federal, state and local regulators in the U.S. and regulatory agencies in many countries in connection with the potential for consumer fraud. If consumer fraud levels involving our services were to rise, it could lead to further regulatory intervention and reputational and financial damage. This, in turn, could lead to additional government enforcement actions and investigations, reduce the use and acceptance of our services or increase our compliance costs and thereby have a material adverse impact on our business, financial condition and results of operations.

We conduct money transfer transactions in some regions that are politically volatile and economically unstable, which could increase our cost of operating in those regions. For example, it is possible that our money transfer services or other products could be used in contravention of applicable law or regulations. Such circumstances could result in increased compliance costs, regulatory inquiries, suspension or revocation of required licenses or registrations, seizure or forfeiture of assets and the imposition of civil and criminal fees and penalties, inability to settle due to currency restrictions or volatility, or other restrictions on our business operations. In addition to monetary fines or penalties that we could incur, we could be subject to reputational harm that could have a material adverse effect on our business, financial condition and results of operations.