Riskified (RSKD) Risk Analysis

We report under the Exchange Act as a non-U.S. company with "foreign private issuer" status (as such term is defined in Rule 3b-4 under the Exchange Act). Because we qualify as a "foreign private issuer" under the Exchange Act, we are exempt from certain provisions of the Exchange Act that are applicable to U.S. domestic public companies, including (1) the sections of the Exchange Act regulating the solicitation of proxies, consents, or authorizations in respect of a security registered under the Exchange Act; (2) the sections of the Exchange Act requiring insiders to file public reports of their share ownership and trading activities and liability for insiders who profit from trades made in a short period of time; (3) the rules under the Exchange Act requiring the filing with the SEC of current reports on Form 8-K upon the occurrence of specified significant events, although we are subject to Israeli laws and regulations with regards to certain of these matters; and (4) the rules under the Exchange Act requiring the filing with the SEC of quarterly reports on Form 10-Q containing unaudited financial and other specified information, although we are subject to Israeli laws and regulations with regard to certain of these matters and have historically announced, and intend to continue announcing quarterly unaudited results in earnings press releases. In addition, "foreign private issuers" are not required to file their annual report on Form 20-F until four months after the end of each fiscal year, while U.S. domestic issuers that are accelerated filers are required to file their annual report on Form 10-K within 75 days after the end of each fiscal year, and U.S. domestic issuers that are large accelerated filers are required to file their annual report on Form 10-K within 60 days after the end of each fiscal year. "Foreign private issuers" are also exempt from Regulation FD, which prohibits selective disclosures of material information. As a result of all of the above, investors may not have the same protections afforded to shareholders of a company that is not a "foreign private issuer."

Our business heavily relies on artificial intelligence, machine learning and automated decision making. The regulatory framework for this technology is rapidly evolving, and we may not always be able to anticipate how to respond to these laws or regulations. Many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations governing the use of such technologies. There is also an increase in litigation in a number of jurisdictions, including the United States, relating to the development, security and use of artificial intelligence. In the United States, there has been uncertainty regarding the applicable regulations that will apply to the development and use of AI technologies. For instance, the Trump administration has rescinded an executive order relating to the development of artificial intelligence technologies that was previously implemented by the Biden administration. The Trump administration then issued a new executive order that, among other things, requires certain agencies to review, develop and submit to the president action plans to "sustain and enhance America's global AI dominance", and to specifically review and if possible rescind rulemaking taken pursuant to the rescinded Biden executive order. Thus, the Trump administration may continue to rescind other existing federal orders and/or administrative policies relating to artificial intelligence technologies, or may implement new executive orders and/or other rulemaking relating to artificial intelligence technologies in the future. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. U.S. legislation related to artificial intelligence technologies has also been introduced at the federal level and is advancing at the state level. For example, California enacted 17 new laws in 2024 that regulate use of artificial intelligence technologies and provide consumers with additional protections around companies' use of artificial intelligence technologies, such as requiring companies to disclose certain uses of generative artificial intelligence. Other states have also passed artificial-intelligence-focused legislation, such as Colorado's Artificial Intelligence Act, which will require developers and deployers of "high-risk" artificial intelligence systems to implement certain safeguards against algorithmic discrimination, and Utah's Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative artificial intelligence in certain consumer interactions. Such additional regulations may impact our ability to develop, use, procure and commercialize artificial intelligence and machine learning technologies in the future. Additionally, new laws regulating artificial intelligence have been enacted in China and the European Union's Artificial Intelligence Act (the "EU AI Act") entered into force in August 2024, establishing a comprehensive legal framework for the regulation of artificial intelligence across the EU. The majority of obligations under the EU AI Act will apply from August 2026. Once fully applicable, the EU AI Act will have a material impact on the way artificial intelligence is regulated in the EU, including requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose artificial intelligence and foundation models, and fines for breach of up to 7% of worldwide annual turnover. In 2022 and 2023, China implemented a number of regulations to govern generative artificial intelligence, algorithmic recommendation and deep synthesis technologies, namely the Interim Provisions on Management of Generative Artificial Intelligence Services, Administrative Provisions on Algorithm Recommendation for Internet Information Services and Provisions on Management of Deep Synthesis in Internet Information Service, respectively. Such regulations impose strict obligations on service providers, among other entities, with respect to their provision and use of generative artificial intelligence, algorithmic recommendation and deep synthesis technologies. For example, service providers must file the algorithms used and complete a security assessment with the local CAC before the provision of the service. The regulatory framework in China is expected to have a material impact on the way artificial intelligence is regulated in China, and together with developing guidance and/or decisions in this area, may affect our use of artificial intelligence and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. It is possible that the EU AI Act and the US artificial intelligence framework, along with the adoption of new laws and regulations in other jurisdictions, or the interpretation of existing laws and regulations, may affect the operation of our AI-powered ecommerce risk intelligence platform and the way in which we use artificial intelligence and machine learning technology, including with respect to how we train our models, unintentional bias and discrimination. Failure to comply with such laws or regulations could subject us to legal or regulatory liability. Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

We must comply with anti-corruption laws and regulations imposed by governments around the world with jurisdiction over our operations, which may include the U.S. Foreign Corrupt Practices Act of 1977, or the FCPA, the U.K. Bribery Act 2010, or the Bribery Act, and Chapter 9 (sub-chapter 5) of the Israeli Penal Law, 5737-1977 and the Israeli Prohibition on Money Laundering Law, 5760-2000, collectively, the Israeli Anti-Corruption Laws, as well as the laws of the countries where we do business. These laws and regulations apply to companies, individual directors, officers, employees and agents acting on our behalf. Where they apply, the FCPA, the Bribery Act, and the Israeli Anti-Corruption Laws prohibit us and our officers, directors, employees and business partners acting on our behalf, including joint venture partners and agents, from corruptly offering, promising, authorizing or providing anything of value to public officials for the purposes of influencing official decisions or obtaining or retaining business or otherwise obtaining favorable treatment. The Bribery Act also prohibits non-governmental "commercial" bribery and accepting bribes. As part of our business, we may deal with governments and state-owned business enterprises, the employees and representatives of which may be considered public officials for purposes of anti-corruption laws, including the FCPA, the Bribery Act, and the Israeli Anti-Corruption Laws. We also are subject to the jurisdiction of various governments and regulatory agencies around the world, which may bring our personnel and agents into contact with public officials responsible for issuing or renewing permits, licenses or approvals or for enforcing other governmental regulations. In addition, some of the international locations in which we operate lack a developed legal system and have elevated levels of corruption. Our business also must be conducted in compliance with applicable economic and financial sanctions, trade embargoes, and export controls, such as those administered and enforced by the U.S. Department of Treasury's Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council, the State of Israel, and other relevant sanctions and export control authorities. Our global operations expose us to the risk of violating, or being accused of violating, anti-corruption laws, anti-money laundering laws, economic and financial sanctions, trade embargoes and export controls. Our failure to comply with these laws and regulations may expose us to reputational harm as well as significant penalties, including criminal fines, imprisonment, civil fines, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. Despite our compliance efforts and activities we cannot assure compliance by our employees or representatives for which we may be held responsible, and any such violation could materially adversely affect our business or customers, financial condition and results of operations.

The application of indirect taxes (such as sales and use tax, VAT, GST, business tax, and gross receipt tax) to businesses that transact online, such as ours, is a complex and evolving area. An increasing number of states have considered or adopted laws that attempt to impose tax collection obligations on out-of-state companies. Following the U.S. Supreme Court decision in South Dakota v. Wayfair, Inc., U.S. states are now free to levy taxes on sales of goods and services based on an "economic nexus," regardless of whether the seller has a physical presence in the state. As a result, it may be necessary to reevaluate whether our activities give rise to sales, use, and other indirect taxes as a result of any nexus in those states in which we are not currently registered to collect and remit taxes. Additionally, we may need to assess our potential tax collection and remittance liabilities based on existing economic nexus laws' dollar and transaction thresholds. It is possible that we could face sales tax, VAT, or GST audits and that our liability for these taxes could exceed our estimates as state tax authorities could still assert that we are obligated to collect additional tax amounts from our merchants and remit those taxes to those tax authorities. Further, one or more U.S. state or non-U.S. authorities could seek to impose additional sales, use, or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. We could also be subject to tax audits in U.S. states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion by one or more states requiring us to collect taxes where we presently do not do so could result in substantial tax liabilities (including taxes on past sales, as well as penalties and interest), discourage organizations from purchasing our products, or otherwise harm our business, results of operations, and financial condition. We continue to analyze our exposure for such taxes and liabilities, including the need to provide for loss contingencies resulting from these potential taxes and liabilities. There have been, and will continue to be, substantial ongoing costs associated with complying with the various indirect tax requirements in the numerous markets in which we conduct or will conduct business.

New income, sales, use, or other tax laws, regulations, or ordinances could be enacted or new interpretations of existing tax laws, regulations, or ordinances could be adopted at any time. Those changes could adversely affect our domestic and international business operations, results of operations and financial condition. These events could require us or our merchants to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our merchants to pay fines and/or penalties and interest for past amounts deemed to be due. If we are required to collect such additional tax amounts from our merchants and are unsuccessful in collecting such taxes due from our merchants, we could be held liable for such costs, thereby adversely affecting our results of operations and harming our business. If we raise our prices to offset the costs of these changes, existing and potential future merchants may elect not to purchase our products in the future. Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our merchants' and our compliance, operating, and other costs. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business, results of operations, and financial condition. In addition, we are subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. We have in the past been and are currently the subject of routine tax audits in Israel, administered by the Israel Tax Authority. As a result of these audits or a review of our tax returns by the tax authorities in any other jurisdiction in which we do business, certain additional tax, interest or penalties have been, and may in the future be, imposed on us. Tax authorities in these jurisdictions may also assert that various withholding requirements apply to us or our subsidiaries or that benefits of tax treaties are not available to us or our subsidiaries. Moreover, given the multijurisdictional developments under the Organization for Economic Co-operation and Development's, or the OECD, efforts to standardize and modernize global corporate tax policy described further below, it is generally expected that tax authorities in various jurisdictions in which we operate may increase their audit activity and may seek to challenge some of the tax positions we have adopted. It is difficult to assess if and to what extent such challenges, if raised, might impact our effective tax rate. Any of these actions by tax authorities could harm our business and our results of operations.

We and certain of our third-party service providers are subject to federal, state, and international laws relating to the collection, use, storage, disclosure, retention, security, transfer and other processing of Personal Information. The regulatory framework worldwide for privacy and security, particularly as they relate to the use of data in artificial intelligence and machine learning is rapidly evolving and as a result implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. We publicly post documentation regarding our data processing practices. Although we endeavor to ensure that our public statements are complete, accurate and fully implemented, we may at times fail to do so or be alleged to have failed to do so. We may be subject to potential regulatory or other legal action if such policies or statements are found to be deceptive, unfair or misrepresentative of our actual practices. Complying with these data, data protection, privacy or security laws, regulations, or industry standards has required and may continue to require us to incur substantial operational costs and Company resources. Because the interpretation and application of many privacy and data protection laws and contractually imposed industry standards are uncertain, it is possible that these laws may be inconsistent or conflicting with each other or interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our products and AI-powered ecommerce risk intelligence platform capabilities. If so, in addition to the possibility of fines, lawsuits, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our products and platform capabilities, which could have an adverse effect on our revenues, our results of operations and financial condition. Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy and data security laws, regulations, policies, industry standards, or social expectations of corporate fairness, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our revenues, our results of operations and financial condition. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our merchants may limit the use and adoption of, and reduce the overall demand for, our products. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and foreign countries. If we are not able to adjust to changing laws, regulations, and standards related to the Internet, our business, financial condition and results of operations may be adversely affected. United States In the United States, risks of actual or perceived non-compliance include enforcement actions under federal and state laws, rules and regulations. In addition, privacy advocates and industry groups have approved, and may propose and approve in the future, self-regulatory standards with which we must comply or that contractually apply to us. If we fail to follow applicable security standards even if no consumer information is compromised, we may incur significant fines or experience a significant increase in costs or reputational damage. U.S. state laws in this area are complex and developing rapidly. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to consumers whose Personal Information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also constantly amending existing laws, requiring attention to frequently changing regulatory requirements. The California Consumer Privacy Act, or the CCPA, among other things, gives California residents rights over their Personal Information, provides for civil penalties for violations (as well as a private right of action certain for data breaches) and establishes a dedicated California privacy regulator, the California Privacy Protection Agency. Following the enactment of the CCPA, numerous comprehensive privacy statutes that share similarities with the CCPA have been enacted or are being considered in a number of states. Any failure or perceived failure by us to comply with these laws could result in proceedings or actions against us. These laws demonstrate a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our revenues, our results of operations and financial condition. European Economic Area, United Kingdom and Israel. The European Economic Area's ("EEA") and United Kingdom's data protection landscape is evolving, resulting in possible significant and operational costs for internal compliance and risks to our business. The General Data Protection Regulation 2016/679 (the "EU GDPR"), and the UK Data Protection Act 2018 and the UK General Data Protection Regulation (together the "UK GDPR") (the EU GDPR and UK GDPR together referred to as the "GDPR"), impose robust obligations on controllers and processors for the processing of Personal Information. Failure to comply with these obligations can result in significant fines and other liability under applicable law. In particular, since we are under the supervision of relevant data protection authorities in both the EEA and the United Kingdom, we may be fined under both the EU GDPR and UK GDPR in respect of the same breach. Additional enforcement action may be taken, such as enforcement notices, assessment notices (for a compulsory audit), orders to cease/change our data processing activities. Further adverse consequences of an infringement of the GDPR may include civil claims for material and immaterial damages from the affected individuals. Implementing legislation of individual Member States also provides for criminal sanctions for specific violations, which may also entail the loss of any profits realized as a result of infringements of the EU GDPR. Finally, in addition to these regulatory risks, any infringement of such legislation could lead to reputational risk and significantly undermine customers' trust in our business. There is currently complexity and uncertainty regarding transfers of Personal Information from the EEA or UK to countries outside the EEA or UK, as applicable. We expect this complexity and uncertainty, and enhanced scrutiny by regulators, to continue and we cannot guarantee the ongoing efficacy and longevity of our data transfer mechanisms (including the European Commission's standard contractual clauses, or SCCs, and the UK Addendum to the SCCs, as well as the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework). These recent developments may require us to review and amend the legal mechanisms by which we transfer Personal Information from the EEA and the United Kingdom. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer Personal Information between and among countries and regions in which we operate, it could affect the manner in which we provide our products, the geographical location or segregation of our relevant systems and operations, and could adversely affect our business, financial condition and results of operation. The GDPR also imposes stringent rules and restrictions on automated decision making including profiling, that results in a legal or similarly significant effect on an individual. A decision of the Court of Justice of the European Union ("CJEU") has introduced uncertainty in the interpretation of these rules, and may bring certain of our functionalities into scope of these rules on automated decision making. Following a referral from a German court, the CJEU has expanded the scope for automated decision making under the GDPR by finding that automated decision making activities (such as credit scoring) can fall within the GDPR's restrictions even if the legal or similarly significant effect for the individual is carried out by a third party (such as a bank declining an application for a loan), in the certain circumstances. According to the CJEU, the concept of a ‘decision' (in automated decision making) needs to be interpreted broadly. The judgment concluded that a decision may include a number of acts which produce a legal effect concerning an individual and also acts which similarly significantly affect the individual. Depending on how regulators and courts apply this judgment going forward, it may have a significant impact on our business operations including our use of automated data processing to enable merchants to accept or decline an order. In addition to the GDPR, we are subject to evolving EU and UK laws on cookies, tracking technologies and e-marketing. European and regulator court decisions are driving increased attention to cookies and tracking technologies. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to additional costs, and could require significant systems changes, limit the effectiveness of our fraud detection capabilities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target individuals, may lead to broader restrictions and impairments on our marketing and personalization activities, may negatively impact our efforts to understand users, and, as a result of us being able to process less data, make our automated decisioning process less accurate. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies, as well as civil claims including class actions, and reputational damage. On November 1, 2022, the Digital Markets Act, or the DMA, entered into force and on November 16, 2022, the Digital Services Act, or the DSA, followed. For the DSA, most provisions became applicable on February 17, 2024. The DSA and the DMA focus on creating a safer digital space, protecting fundamental rights of all users of digital services, and establishing a level playing field for businesses and consumers with regards to online platforms. The DSA and DMA, to the extent applicable, may require us to modify our practices and policies and we could incur substantial costs as a result. In addition, we are also subject to the Israeli Privacy Protection Law, 5741-1981, and its regulations, including the Israeli Privacy Protection Regulations (Data Security), 5767-2017, or the Data Security Regulations, as well as the guidelines of the Israeli Privacy Protection Authority ("PPA"), (together the "PPL"), which impose obligations with respect to the manner Personal Information is processed, maintained, transferred, disclosed, accessed, and secured. In this respect, the Data Security Regulations may require us to adjust our data protection and data security practices, information security measures, certain organizational procedures, applicable positions (such as an information security manager) and other technical and organizational security measures. In this context, material amendments to the PPL were approved by the Israeli Parliament in August 2024 and will take effect on August 14, 2025 ("Amendment 13"). Among other things, Amendment 13 expands the PPA's authority to investigate incidents where there is concern of privacy violation and to impose monetary sanctions that are considerably higher than those currently available under the PPL and its regulations. Additionally, Amendment 13 introduces new obligations for parties processing Personal Information, which may require us to modify our data practices and policies, appoint mandatory positions, and consequently, to incur substantial costs to align our privacy and data protection practices in Israel. Moreover, in January 2025, the Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 2023 ("EU Regulations") came into effect, also with respect to Personal Information related to Israeli individuals. As a result, we may need to adjust our practices, particularly those concerning data subjects' rights. Failure to comply with the PPL may expose us to administrative fines, civil claims (including class actions) and in certain cases criminal liability. Upon Amendment 13 taking effect in August 2025, the sanctions for non-compliance with the PPL and its regulations (including the Data Security Regulations and the EU Regulations) will be significantly increased and, in certain cases, may reach substantial amounts in the millions of NIS. In addition, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs. While it is generally the laws of the jurisdiction in which a business is located that apply, there is a risk that data protection regulators of other countries may seek jurisdiction over our remote activities in locations in which we process data or serve merchants or shoppers but do not have an operating entity. Where the local data protection and privacy laws of a jurisdiction apply, we may be required to register our operations in that jurisdiction or make changes to our business so that shopper data is only collected and processed in accordance with applicable local law. In addition, because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with their privacy and data protection laws, including in jurisdictions where we have no local entity, employees or infrastructure. In such cases, we may require additional legal review and resources to ensure compliance with any applicable privacy or data protection laws and regulations. In addition, in many jurisdictions there may in the future be new legislation that may affect our business and require additional legal review. China We are subject to various Chinese laws and regulations which impose strict requirements on cybersecurity, data handling and Personal Information protection. For example, under China's Cybersecurity Law ("CSL"), any collection, use, transfer and storage of Personal Information of a Chinese citizen through a network by the network operator should be based on the three principles of legitimacy, justification and necessity and requires the consent of the data subject. China's Data Security Law ("DSL") regulates data activities and entities and individuals carrying out data (including those relating to Personal Information) activities must abide by various data security obligations, including, to classify and protect data based on the importance of data to the state's economic development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The CSL and DSL both have a data localization requirement and require Personal Information processed by operators of critical information infrastructure ("CIIOs") and for important data collected and generated from within China to be stored locally in China unless a security assessment organized by the relevant authorities is passed. Finally, China's Personal Information Protection Law ("PIPL") clarifies the scope of application, the definitions of Personal Information and sensitive Personal Information (which includes medical and health information), the legality of Personal Information processing and the basic requirements of notice and consent, among other things. The PIPL also requires Personal Information processors to rely on a data export mechanism and comply with certain requirements prior to the transfer of Personal Information outside of China, such as compliance with a security assessment or certification by an agency designated by the relevant authorities or entering into standard form model contracts approved by the relevant authorities with the overseas recipient, unless an exemption under the Provisions for Promoting and Regulating Cross-Border Data Flows applies. In addition to the CSL, DSL and the PIPL, the Chinese government authorities promulgated several regulations or released a number of draft regulations for public comments which are designed to provide further implemental guidance in accordance with the laws mentioned above. For example, the Regulations on Network Data Security Management ("Regulations"), which recently took effect on January 1, 2025 in China, have extraterritorial effect and apply broadly to any network data processing activities (not only personal data processing activities). The Regulations reiterate and expand on the existing obligations on data processors under the CSL, DSL and PIPL and introduce new network and data security obligations, such as a requirement to report any risks arising from network products and services that may endanger national security or public interest to the relevant authorities within 24 hours. We cannot predict what impact Chinese laws and regulations, in particular the CSL, DSL and PIPL, or the increased costs of compliance, if any, will have on our operations in China due to their recent enactment and the limited guidance available, which entities are awaiting further guidance on. It is also generally unclear how the laws will be interpreted and enforced in practice by the relevant government authorities as often the abovementioned laws are drafted broadly and thus leaves great discretion to the relevant government authorities to exercise.

We use machine learning, artificial intelligence and automated decision making technologies throughout our business, and are making significant investments to continuously improve our use of such technologies. For example, we use machine learning and artificial intelligence technologies (including generative artificial intelligence) to power our AI-powered ecommerce risk intelligence platform. As with many technological innovations, there are significant risks and challenges involved in developing, maintaining and deploying these technologies and there can be no assurance that the usage of such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability. Further, changes and ongoing development in how we use artificial intelligence and machine learning technologies and how we train our models, in particular if those artificial intelligence or machine learning models are (i) incorrectly designed or implemented; (ii) trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; and/ or (iii) are adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, could negatively impact the performance of our AI-powered ecommerce risk intelligence platform and business, as well as our reputation and the reputations of our customers and partners, or we could incur liability through the violation of laws or contracts to which we are a party or through civil claims. The market for artificial intelligence and machine learning technologies is rapidly evolving and remains unproven in many industries, including our own. We cannot be sure that the market will continue to grow or that it will grow in ways we anticipate. We are in varying stages of development in relation to our products or services which utilize proprietary artificial intelligence and machine learning technologies, and we may not be successful in our ongoing development of these technologies in the face of novel and evolving technical, reputational and market factors. Our failure to successfully develop and commercialize our products or services which utilize proprietary machine learning and artificial intelligence technologies could depress the market price of our stock and impair our ability to (i) raise capital; (ii) expand our business; (iii) provide, improve and diversify our product offerings; (iv) continue our operations and efficiently manage our operating expenses; and (v) respond effectively to competitive developments. We also use AI technologies licensed from third parties in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to specific third-party software and infrastructure. We cannot control the availability or pricing of such third-party AI technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, to the extent any third party AI technologies are used as a hosted service, any disruption, outage, or loss of information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider. The continuous development, maintenance and operation of our artificial intelligence and machine learning technologies is expensive and complex, and may involve unforeseen difficulties including material performance problems, undetected defects or errors. For instance, a machine learning model can experience decay (also known as "model drift") in which its performance and accuracy decreases over time without further human intervention to correct such decay. We may encounter technical obstacles, and it is possible that we may discover additional problems that may prevent our proprietary technologies from operating properly, which could adversely affect our business, customer relationships and reputation. We face significant competition from other companies in our industry in relation to the development and deployment of artificial intelligence and machine learning technologies. Those other companies may develop artificial intelligence technologies that are similar or superior to ours and/or are more cost-effective and/or quicker to develop and deploy. If we cannot develop, offer or deploy new artificial intelligence or machine learning technologies as effectively, as quickly and/ or as cost-efficiently as our competitors, we could experience a material adverse effect on our operating results of operation, customer relationships and growth. Further, our ability to continue to develop or use such technologies may be dependent on access to specific third-party software, services and infrastructure, such as processing hardware, and we cannot control the availability or pricing of such third-party software and infrastructure, especially in a highly competitive environment.

We outsource substantially all of the infrastructure relating to our cloud offerings to Public Cloud Providers, such as Amazon Web Services. Merchants of our cloud-based SaaS products need to be able to access our AI-powered ecommerce risk intelligence platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Our cloud-based SaaS products depend on protecting the virtual cloud infrastructure hosted by Public Cloud Providers by maintaining its configuration, architecture, features and interconnection specifications, as well as maintaining the information stored in these virtual data centers and transmitted by third-party internet service providers. While our Public Cloud Providers typically have robust backup and disaster recovery plans and processes in place, any incident affecting our Public Cloud Providers' infrastructure that may be caused by fire, flood, severe storm, earthquake or other natural disasters, viruses, cyberattacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our cloud-based SaaS products. Certain of these events may become more frequent or severe as a result of climate change. Climate change may also result in certain chronic changes to the physical environment, such as changes to temperature/precipitation patterns or sea-level rise, which may adversely impact the infrastructure we rely on or otherwise adversely impact our operations. A prolonged service disruption affecting our cloud-based offerings for any of the foregoing reasons would negatively impact our ability to serve our merchants and could damage our reputation with current and potential merchants, expose us to liability, cause us to lose merchants or otherwise have an adverse effect on our business, financial condition, and results of operations. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the Public Cloud Provider services we use. In the event that our service agreements with our Public Cloud Providers are terminated, or there is a lapse of service, elimination of services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our AI-powered ecommerce risk intelligence platform as well as significant delays and additional expenses in arranging or creating new facilities and services and/or re-architecting our cloud offering for deployment on a different cloud infrastructure service provider, which may adversely affect our business, financial condition and results of operations.

We rely on our proprietary machine learning models, which are statistical models built using a variety of data-sets. Our machine learning models rely on a wide variety of data sources, including data collected from our merchants as part of our automated decisioning process and in some cases data collected from third parties. Under our agreements with certain merchants, we receive licenses to use data collected directly from those merchants' consumers' internet browsers. Such licenses may impose restrictions on how such data may be used, including, for example, restrictions on the collection or use of data from certain jurisdictions. If we are unable to access and use data collected from our merchants or their consumers as part of our automated decisioning process, or other third-party data used in our machine learning models, or our access to such data is limited, for example, due to new or changing laws,regulations or policies of third parties, commercial disputes, or access disruptions to third-party data sources due to DDoS attacks, or other security-related incidents or attacks impacting those third-party data sources, our ability to accurately evaluate potential transactions, detect fraud and verify consumers' data would be compromised. In addition, technology strategies employed by certain merchants, including "headless commerce", which refers to the decoupling of a merchant's front-end customer experience technology from their back-end ecommerce platform, may result in the fragmentation of consumer data points across sources. If our merchants are unable to capture all the data points from their consumers that our machine learning models require, the accuracy of our machine learning models may be affected, or we may not be able to do business with merchants employing this, or similar, technology strategies. Third-party data sources on which we rely include Maxmind, Ekata and Emailage. The data received from these third-parties is used by our machine learning models, including to evaluate transactions for potential fraud. Data collected from our merchants as part of our automated decisioning process and other information that we receive from third parties may not accurately detect fraud for a variety of reasons, including errors or inconsistencies in the information collected, changing methods of perpetrating fraud (including through the use of generative artificial intelligence and other emerging technologies) or lack of available information upon which to make a decision. For example, if the information provided by a merchant is inaccurate, it may cause us to inaccurately link a legitimate order with other fraudulent orders. In addition, if third-party data used to train and improve our machine learning models is inaccurate, or access to such third-party data is limited or becomes unavailable to us, our ability to continue to improve our machine learning models would be adversely affected. Although we believe that there are commercially reasonable alternatives to the third-party data we currently license available, this may not always be the case, or it may be difficult or costly to migrate to other third-party data. Our use of additional or alternative third-party data would require us to enter into license agreements with third parties. In addition, integration of the third-party data used in our machine learning models with new third-party data may require significant work and require substantial investment of our time and resources. Additionally, we may not be able to obtain third party data sets required to support new or alternate payment methods. Any of the foregoing could negatively impact our product offerings and our relationships with our merchants, impair our ability to grow our merchant base, subject us to financial liabilities and our business, financial condition and results of operations may be adversely affected.

Our continued growth depends in part on the ability of our existing and potential merchants to access our products and AI-powered ecommerce risk intelligence platform capabilities at any time and within an acceptable amount of time. Interruptions in our products or performance problems, for whatever reason, could undermine our merchants' confidence in our products and cause us to lose merchants or make it more difficult to attract new ones. We have experienced, and may in the future experience, disruptions, outages, and other performance problems due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, capacity constraints due to an overwhelming number of users accessing our products and platform capabilities simultaneously, DDoS attacks, or other security-related incidents or attacks. It may become increasingly difficult to maintain and improve our performance, especially during peak usage times and as our products and platform capabilities become more complex and our user traffic increases. If our products and platform capabilities are unavailable or if our merchants are unable to access our products and platform capabilities within a reasonable amount of time or at all, our revenues, our results of operations and financial condition may be adversely affected. We provide credits to our merchants for consumer transactions that our platform approves that are subsequently determined to be fraudulent and for which our merchants receive a chargeback. Any performance malfunction in our platform could result in us approving fraudulent consumer transactions in excess of anticipated levels and, to the extent chargebacks are received by our merchants, require us to issue a significant amount of credits to merchants. Issuing a significant amount of credits or refunds to merchants would negatively impact our financial position. To the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, this may cause merchants to terminate their agreements with us, impair our ability to grow our merchant base, subject us to financial liabilities and our business, financial condition and results of operations may be adversely affected.

Our sales cycle can vary substantially from merchant to merchant, but with large enterprises it typically requires 25 to 55 weeks on average from the time we designate a merchant as a sales qualified lead to execution of an agreement with that merchant. Our ability to forecast revenue accurately is affected by our ability to forecast new merchant acquisitions. Lengthy sales cycles make it difficult to predict the quarter in which revenue from a new merchant may first be recognized. If we overestimate new merchant growth in a particular period or generally, our revenue will not grow as quickly as our forecasts, our costs and expenses may continue to exceed our revenue, and our results of operations will be adversely affected. In addition, we may not meet or may be required to revise guidance that we have provided to the public, if any. In addition, we plan our operating budget, including sales and marketing expenses, and our hiring needs, in part, based on our forecasts of new merchant growth and future sales. If new merchant growth or sales for a particular period is lower than expected, we may not be able to proportionately reduce our operating expenses for that period, which could harm our operating results for that period. Delays in our sales cycles could cause significant variability in our revenue and operating results for any particular period.

Our growth strategy is dependent, in large part, upon the continued increase of sales to large enterprises. For the year ended December 31, 2024, we estimate that over 90% of our Billings were derived from merchants generating over $75 million in online sales per year. Sales to large enterprises involve risks that may not be present or that are present to a lesser extent with sales to smaller entities, such as longer sales cycles, more complex merchant requirements, substantial upfront sales costs, and less predictability in completing some of our sales. For example, large enterprises may require considerable time to evaluate and test our applications and those of our competitors prior to making a purchase decision and placing an order. A number of factors influence the length and variability of our sales cycle, including the need to educate potential merchants about the uses and benefits of our products, the discretionary nature of purchasing and budget cycles, and the competitive nature of evaluation and purchasing approval processes. As a result, the length of our sales cycle may vary significantly from merchant to merchant, and sales to large enterprises typically take longer to complete. Moreover, large enterprises often request pilot periods or begin by deploying our products on a limited basis, but nevertheless require configuration, integration services, and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these merchants will deploy our products widely enough across their organization to justify the substantial upfront investment. Our ability to improve our sales to such large enterprises is also partially dependent on our ability to continue to attract, train and retain sales personnel with experience selling to large enterprises, and competition for such personnel can be intense. In addition, as security breaches with respect to larger, high-profile enterprises are likely to be heavily publicized, there is an increased reputational risk associated with serving such merchants. If we are unable to continue to increase sales of our products to large enterprises while mitigating the risks associated with serving such merchants, our business, financial condition, and results of operations may be adversely affected.

We typically charge our merchants a percentage of the value of the transactions that we approve. The fee we charge our merchants is a risk-adjusted price (based on a variety of factors including historical fraud levels, approval rate commitment, industry vertical and geographic region), which is expressed as a percentage of the GMV dollars that we approve. We expect we may need to change our pricing models and pricing structures from time to time, including as a response to updates or enhancements to our product suite, and in response to changes in global economic conditions, competitive pressures, and trends or reductions in our merchants' spending levels generally. Any changes to our pricing models or pricing structures resulting in decreased revenue from, or loss of, any merchant, could negatively impact our business operations and financial performance. Through our Chargeback Guarantee product, we provide a Chargeback Guarantee to our merchants for transactions that our AI-powered ecommerce risk intelligence platform approves that are subsequently determined to be fraudulent and for which a valid chargeback reimbursement request is received by our merchant. Pursuant to our Chargeback Guarantee, we may be required to issue a significant amount of credits to merchants. The credit issued via the invoice we provide to our merchants generally equates to the approved transaction amount, which exceeds the fee we charge for the associated transaction. This business model requires us to accurately predict the amount of credits we expect to issue in order to determine the appropriate pricing structure for our products, and failure to do so may negatively affect our financial condition. While chargebacks are intended as a consumer protection mechanism from fraudulent transactions, they are also susceptible to abuse and "friendly fraud". For example, friendly fraud may occur when a consumer, rather than returning an order they are dissatisfied with, instead initiates the chargeback process to avoid a complicated returns process. Friendly fraud may violate the merchant's cancellation policies and, depending on the jurisdiction, may also be unlawful. Nevertheless, to the extent a chargeback reimbursement request is received by our merchants, even in instances of friendly fraud or other chargeback abuse, we may be required to issue significant credits to our merchants in respect of these transactions. In addition, the increasing availability and adoption of generative artificial intelligence tools and other emerging technologies by fraudsters is changing the way that fraud, including friendly fraud, is perpetrated. While we employ a variety of strategies to minimize our exposure to friendly fraud and other chargeback abuses, it is often difficult to differentiate friendly fraud and other chargeback abuses from "true" fraud. Any increase in chargeback abuse, including friendly fraud, may impact our ability to accurately predict the amount of credits we expect to issue in order to determine the appropriate pricing structure for our products, which could negatively impact our business operations and financial performance. Similarly, as we introduce new products, or as a result of the evolution of our existing products, including reviewing ACH payments,uncovered decisioning, and covering non-fraud related chargebacks, and as the methods and techniques used to perpetrate fraud evolve (including through the use of generative artificial intelligence and other emerging technologies), we may have difficulty determining the appropriate pricing structure for our products. Any failure by us to appropriately price our products could negatively impact our business operations and financial performance. In addition, as new and existing competitors introduce new products that compete with ours, or revise their pricing structures, we may be unable to attract new merchants or retain existing merchants at the same price, or based on the same pricing model as we have used historically. Moreover, as we continue to target selling our products to large enterprises, these large enterprises may demand substantial price concessions. As a result, we may be required, from time to time, to revise our pricing structure or reduce our prices, which could adversely affect our business, financial condition and results of operations.

We have in the past had, and may in the future have, merchants, including significant merchants, whose financial condition deteriorates significantly, or who become subject to bankruptcy proceedings. In particular, merchants who are highly leveraged, operate on narrow margins, or are otherwise susceptible to changes in economic, competitive and market conditions, may be at an increased risk of bankruptcy in a recessionary environment. In addition to a reduction in these merchants' ecommerce sales volumes, possibly to zero, we are not always able to recover amounts due to us from these merchants, which can have a material adverse impact on our business, financial condition, and results of operations.

To execute our growth plan, we must attract and retain highly qualified personnel. Competition for qualified personnel is intense, especially for software engineers experienced in designing and developing software as a service ("SaaS") applications and experienced sales professionals. In particular, competition for talent in Israel has in the past been and remains intense. If we are unable to attract such personnel remotely or in cities or countries where we are located, we may need to hire in other locations which may add to the complexity and costs of our business operations. In particular, we established a research and development hub in Portugal, and are implementing additional offshoring strategies in order to enhance and expand our talent pool and to help rationalize our labor costs. There can be no guarantee that these strategies will be successful, or that such initiatives will lead to meaningful and sustainable cost savings. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources. In addition, prospective and existing employees often consider the value of the equity awards they receive in connection with their employment, in addition to their cash compensation. The market price of our stock has experienced significant volatility. Significant declines in the value of our stock, has, and may in the future, impact our ability to compensate employees appropriately and to attract and retain talent. If the total compensation, including the amount or value of equity awards offered to employees is perceived to be less favorable than total compensation or equity awards offered by other companies with whom we compete for talent, or the perceived value of our equity awards declines, experiences significant volatility, or increases such that prospective employees believe that they are not being fairly compensated or that there is limited upside to the value of the Company's equity awards, it may adversely affect our ability to recruit and retain key employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business, financial condition and results of operations may be adversely affected. In the event of continued stock price volatility in the future, we may determine that it is necessary to grant equity awards to our employees, outside of ordinary ranges, to recalibrate total compensation and help recruit and retain talent. Existing shareholders may experience significant dilution of their ownership interests as a result of such grants.