Marqeta (MQ) Risk Factors

We, our vendors, our partners, and our customers are subject to a wide variety of laws, regulations, and industry standards, including supervision and examination with respect to the foregoing by multiple authorities and governing bodies and in multiple countries, which govern numerous areas important to our business. While we currently operate our business in an effort to ensure our business itself is not subject to the same level of regulation as the Issuing Banks and Card Networks that we partner with, Issuing Banks and Card Networks operate in a highly regulated environment, and there is a risk that those regulations could become applicable to or impact us. As a program manager, we are responsible for aligning compliance with Issuing Bank requirements and Card Network rules, and we help create regulatory compliant card programs for our customers. In some cases, we have in the past and could continue to be exposed to liability or indemnification claims from our customers or partners in connection with the services we provide. We are directly, and indirectly through our contractual relationships with customers, Issuing Banks, and Card Networks, subject to regulation in areas which may include privacy, data protection and information security, global sanctions regimes and export controls, and anti-bribery, and those relating to payments services (such as payment processing and settlement services), AI, consumer protection, AML, escheatment, and compliance with PCI DSS. As our business and platform continue to develop and expand, we may become subject to additional laws, rules, regulations, and industry standards, including possible additional examination and supervision, in the United States and internationally. New or changing laws or regulations could require us to incur significant expenses and devote significant management attention to ensure compliance and could also prompt our Issuing Banks to alter their dealings with us in ways that may have adverse consequences for our business. We may not be able to respond quickly or effectively to, or accurately predict the scope or applicability of, regulatory, legislative, or other developments, which may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business. In addition, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, or criminal or civil sanctions, all of which may have an adverse effect on our reputation, business, results of operations, and financial condition. As a result of our business relationships, we may also be subject to direct or indirect supervision and examination by various authorities. The CFPB, for example, has indicated it has dormant authority to examine certain companies whose services may pose risk to consumers, which may include our company. The CFPB has also published guidance on third party risk management, which places additional vendor compliance oversight expectations for certain companies operating in the financial services industry. As a program manager, we may be viewed as overseeing third party relationships on behalf of our Issuing Banks and, as such, it is possible that regulators could hold us responsible for actual or perceived deficiencies in our oversight and control of third party relationships. New or expanded regulation or changes in interpretation or enforcement of existing regulations may have an adverse effect on our business, results of operations, and financial condition due to increased compliance costs and new restrictions affecting the offering of our platform, products and services. Further, while we do not handle or interact with cryptocurrency and we only process transactions on our platform in fiat currencies, certain cryptocurrency businesses use our platform to provide card products to their customers and end users. The regulation of cryptocurrency is rapidly evolving and varies significantly among jurisdictions and is subject to substantial uncertainty. Various legislative and executive bodies in the U.S. and other countries may adopt laws, regulations, or guidance, or take other actions, which may impact our Issuing Banks and restrain the growth of cryptocurrency businesses and in turn impact the net revenue associated with our cryptocurrency business customers. While we have developed policies and procedures designed to assist in compliance with laws and regulations, no assurance can be given that our compliance policies and procedures will be effective. If we fail to comply or are alleged or perceived to have failed to comply with applicable laws and regulations, we may be subject to litigation or regulatory investigations or other proceedings, we may have to pay fines and penalties or become subject to civil or criminal liability or have additional obligations or restrictions imposed upon our business, and our customer relationships and reputation may be adversely affected, which could have a material adverse effect on our business, results of operations, and financial condition. In some cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals, or make a settlement payment to a given party or regulatory body.

In the ordinary course of business, we have been, are currently, and in the future may be, involved in litigation or disputes. We have also received and may in the future receive, inquiries, warrants, subpoenas, and other requests for information in connection with government investigations. Such claims, disputes, lawsuits, proceedings, and investigations could involve matters relating to employment, wage and hour, commercial, antitrust, securities, the duties of officers or directors, regulatory compliance, and other matters. The number and significance of litigation, regulatory, and government or legal investigation matters and disputes may increase as our business expands. We also had in the past, have currently, and may have in the future indemnification obligations as a result of our contracts with customers and partners that may require us to reimburse or pay for damages, fees, or other expenses associated with claims, lawsuits, proceedings, and investigations such customers and partners face. Further, our liability insurance may not cover all potential claims made against us or third parties or be sufficient to cover us for all liability that may be imposed. A claim brought against us or third parties that is uninsured or under-insured could result in unanticipated costs. The costs associated with litigation, disputes, regulatory actions, and government or legal investigations can also be unpredictable depending on the complexity of the matter, the resources needed to manage it, and length of time devoted to it. These matters may also divert management's attention and operational resources, could harm our reputation regardless of the outcome, and might seriously harm our business, overall financial condition, and operating results. We cannot assure you that any actual or potential litigation, claims, disputes, investigations, or proceedings will not have a material adverse effect on our business, results of operations, and financial condition.

We have incurred substantial net operating losses ("NOLs") and other tax attributes, including research & development ("R&D") credits, during our history. In general, under Section 382 of the Internal Revenue Code of 1986, as amended (the "Code"), a corporation that undergoes an "ownership change" (generally defined as a greater than 50-percentage-point cumulative change (by value) in the equity ownership of certain stockholders over a rolling three-year period) is subject to limitations on a company's ability to utilize its NOLs and other tax attributes to offset taxable income. We have experienced ownership changes since inception and believe that our existing NOLs and other tax attributes, including R&D credit carryforward, will be subject to such limitation. In addition, the amount of NOLs and other tax attributes that we are permitted to deduct may be subject to limitations and our NOLs and other tax attributes may expire before they are fully utilized. Our NOLs and other tax attributes may also be subject to limitations under state law. There is a risk that due to legislative or regulatory changes, or other unforeseen reasons, our existing NOLs and other tax attributes could expire or otherwise be unavailable to offset future income tax liabilities.

We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws, and contractual restrictions to establish and protect our intellectual property and proprietary rights, which are critical to our success. The steps we take to protect our intellectual property, however, may be inadequate, and various events outside of our control may pose a threat to our intellectual property rights. We cannot assure you that any patents or trademarks will be issued with respect to our currently pending patent and trademark applications. Our patents and trademarks may be contested, circumvented, or found unenforceable or invalid, and we may not be able to prevent third parties from infringing, diluting, or otherwise violating them. There can be no guarantee that others will not independently develop similar products, duplicate any of our products, or design around our patents. As the development, adoption, and use of generative AI technologies grows, our intellectual property may inadvertently be exposed through the use of such technologies. Further, the laws of some foreign countries may not protect our intellectual property rights to the same extent as the laws of the United States, and effective intellectual property protection and mechanisms may not be available in those jurisdictions. We also rely in part on trade secrets, proprietary technology, and other confidential information to maintain our competitive position. Although we enter into confidentiality agreements with our employees, service providers, and other actual or potential strategic business partners, these agreements may not be effective in controlling access to and distribution of our platform, or certain other aspects of our trade secrets, proprietary technology, and other confidential information. To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights, in the U.S. and internationally, and we may not be able to detect infringement by third parties. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property.

Our continued growth depends on the efficient operation of our platform. Any significant disruption, outage, data loss, or errors in service on our platform, including events beyond our control, such as infrastructure changes or failures, or human or software errors could have a material and adverse effect on our business and financial condition. We have experienced such performance incidents in the past and expect that we will continue to periodically experience such performance issues in the future. Our platform is designed to process a high number of transactions and deliver reports and other information related to those transactions at high processing speeds. We have in the past and may in the future experience errors, inaccuracies, or omissions in our processing, reconciling, or reporting of transactions. The risk of performance issues has increased in recent periods due to the significant increase in our TPV and increases further with new product launches and geographical expansion. We release regular updates to our platform, which have in the past contained, and may in the future contain, undetected errors, failures, and bugs. Any platform performance issues could lead to claims by customers, Card Networks, Issuing Banks, or other partners or vendors, or other claims, regulatory fines, or proceedings. It could also damage ours and our customers' businesses and, in turn, hurt our brand and reputation. The performance and availability of the data centers and cloud-based solutions that provide computing and storage infrastructure for our platform is outside of our control. If any of these infrastructure providers fail to provide sufficient capacity to support our platform or otherwise experience service outages, we may experience interruptions in our ability to operate our platform and our business could be adversely affected. We have experienced, and expect to continue to periodically experience, outages of the services provided by these providers. If we are not able to maintain the level of service uptime and performance needed by our customers, they could face longer processing times or downtime as a result. If customers are unable to access our platform within a reasonable amount of time, or at all, we may not be able to meet the service level commitments typically provided for in our customer contracts and we would be contractually obligated to provide service level credits. We have experienced incidents, including incidents outside our control, and expect we may experience incidents in the future requiring us to pay service level credits and other customer service concessions. In addition, our insurance policies may not adequately compensate us for any losses that we may incur as a result of damage or interruption. Further, we are continuing to refine our enterprise resilience functions such as business continuity, crisis management, and disaster recovery. Our disaster recovery plan has not been tested under actual disaster conditions, and we may not have sufficient capacity to recover all data and services in the event of an outage. Therefore, any performance issue, systems failure, outage, or interruption in the availability of our platform would adversely affect our business, and could subject us to financial penalties and liabilities.

If we are unable to attract new customers, retain existing customers on favorable terms, and grow and develop those relationships to drive increased processing volumes, our business, results of operations, financial condition, and future prospects would be adversely affected. If we fail to attract new customers, including customers in new use cases, industry verticals, and geographies, and to expand our platform in a way that serves the needs of these customers, and to onboard them quickly, then we may not be able to continue to grow our net revenue. Our customers generally are not subject to any minimum volume commitments under their contracts and have no obligation to continue using our platform, products, or services. Accordingly, these customers may have, or may enter into in the future, similar agreements with our competitors, which could adversely affect our ability to drive the processing volume and revenue growth that we seek to achieve. Some of our customer contracts provide for a termination clause that allows our customers to terminate their contract at any time following a limited notice period. The loss of customers or reductions in their processing volumes, particularly any loss of or reductions by Block, may adversely affect our business, results of operations, and financial condition. To achieve continued growth, we must not only maintain our relationships with our existing customers, but also encourage them to renew their contracts with us and to increase adoption and usage of our products. For example, customers can have multiple card programs on our platform across different use cases and geographies. However, we cannot assure you that customers will continue to use our platform or that we will be able to continue processing transactions on our platform at the same rate as we have in the past.

We depend on services from various third-party vendors to provide our products and services. Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our platform. We conduct vendor due diligence and manage such vendors using a risk-based approach intended to determine if relevant vendors have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report to us any suspected breach of their security measures that may affect our business. If we are unable to timely and accurately identify at-risk vendors or if a service provider fails to properly safeguard our data or intellectual property, fails to meet contractual requirements (including compliance with applicable laws and regulations), suffers a cyberattack, security breach or incident, or other system outage or interruption, or terminates its contract with us, we could be subject to claims from customers and other third parties or regulatory enforcement actions, and such incidents may also put information we process at risk which could in turn adversely affect our business, reputation, financial condition, or results of operations. In some cases, vendors are the sole source, or one of a limited number of sources, of the services they provide to us. In the future, these services may not be available to us on commercially reasonable terms, or at all. Any loss of any of these services could adversely affect our business and we may incur additional costs to resolve the issue.