UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

FORM 10-K

(Mark One)

For the fiscal year ended December 31 2021, 2023

OR

Commission File Number 001-38531

Repay Holdings Corporation

(Exact name of Registrant as specified in its Charter)

Registrant’s telephone number, including area code: (404) (404) 504-7472

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes☒No☐No☒

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes☐No☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒No☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes☒No☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes☐No☒

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the Registrant, based on the closing price of the shares of common stock on The NASDAQ Stock Market on June 30, 2021,2023, was $2,120,867,217.$696,574,746.

As of February 22, 2022,2024, there were 90,455,31596,160,465 shares of the registrant’s Class A common stock, par value $0.0001 per share, outstanding (which number includes 1,904,6175,356,481 of unvested restricted stock that have voting rights) and 100 shares of the registrant’s Class V Common Stock, par value of $0.0001 per share, outstanding. As of February 22, 2021,2024, the holders of such outstanding shares of Class V common stock also hold 7,926,5765,844,095 units in a subsidiary of the registrant and such units are exchangeable into shares of the registrant’s Class A common stock on a one-for-one basis.

DOCUMENTS INCORPORATED BY REFERENCE

Auditor Firm ID: 248Auditor Name: Grant Thornton LLPAuditor Location: Philadelphia, PennsylvaniaAtlanta, Georgia

Table of Contents

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

This report contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). These forward-looking statements reflect our current views with respect to, among other things, the expected impact of the COVID-19 pandemic,macroeconomic conditions, the expected demand on our product offering, including further implementation of electronic payment options and statements regarding our market and growth opportunities, the expected benefits of our recent acquisitions, our financial performance, our business strategy and the plans and objectives of management for future operations. You generally can identify these statements by the use of words such as “outlook,” “potential,” “continue,” “may,” “seek,” “approximately,” “predict,” “believe,” “expect,” “plan,” “intend,” “estimate” or “anticipate” and similar expressions or the negative versions of these words or comparable words, as well as future or conditional verbs such as “will,” “should,” “would,” “likely” and “could.” These statements may be found under Part II, Item 7 “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and elsewhere and are subject to certain risks and uncertainties that could cause actual results to differ materially from those included in the forward-looking statements. These risks and uncertainties include, but are not limited to, those risks described under Part I, Item 1A “Risk Factors” of this Form 10-K. The forward-looking statements speak only as of the date on which they are made, and, except to the extent required by federal securities laws, we disclaim any obligation to update any forward-looking statement to reflect events or circumstances after the date on which the statement is made or to reflect the occurrence of unanticipated events. In light of these risks and uncertainties, there is no assurance that the events or results suggested by the forward-looking statements will in fact occur, and you should not place undue reliance on these forward-looking statements.

RISK FACTOR SUMMARY

Our business involves significant risks and uncertainties that make an investment in us speculative and risky. The following is a summary list of the principal risk factors that could materially adversely affect our business, financial condition, liquidity and results of operations. These are not the only risks and uncertainties we face, and you should carefully review and consider the full discussion of our risk factors in the section titled “Risk Factors”, together with the other information in this Annual Report on Form 10-K.

Risks Related to Our Business

Risks Related to Regulation

2

Risks Related to Our Indebtedness

Risks Related to Our Ownership Structure

Risks Related to Our Class A Common Stock

PART i

Item 1. Business

Organizational Structure and Corporate Information

Repay Holdings Corporation was incorporated as a Delaware corporation on July 11, 2019 in connection with the closing of a transaction (the “Business Combination”) pursuant to which Thunder Bridge Acquisition Ltd., a special purpose acquisition company organized under the laws of the Cayman Islands (“Thunder Bridge”), (a) domesticated into a Delaware corporation and changed its name to “Repay Holdings Corporation” and (b) consummated the merger of a wholly owned subsidiary with and into Hawk Parent Holdings, LLC, a Delaware limited liability company (“Hawk Parent”).

Unless otherwise noted or unless the context otherwise requires, the terms “we”, “us”, “Repay” and the “Company” and similar references refer (1) before the Business Combination, to Hawk Parent and its consolidated subsidiaries and (2) from and after the Business Combination, to Repay Holdings Corporation and its consolidated subsidiaries. Unless otherwise noted or unless the context otherwise requires, “Thunder Bridge” refers to Thunder Bridge Acquisition. Ltd. prior to the consummation of the Business Combination.

We are headquartered in Atlanta, Georgia. Our legacy business was founded as M & A Ventures, LLC, a Georgia limited liability company doing business as REPAY: Realtime Electronic Payments (“REPAY LLC”), in 2006 by current executives John Morris and Shaler Alias. Hawk Parent was formed in 2016 in connection with the acquisition of a majority interest in the successor entity of REPAY LLC and its subsidiaries (the “2016 Recapitalization”) by certain investment funds sponsored by, or affiliated with, Corsair Capital LLC (“Corsair”).

Business Overview

Since a significant portion of our revenue is derived from volume-based payment processing fees on card transactions, card payment volume is a key operating metric that we use to evaluate our business. We are a leading payments technology company. We provide integrated payment processing solutions to industry-oriented vertical markets in which businesses or other organizations have specific and bespoke transaction processing needs. We refer to these markets as “vertical markets” or “verticals.”

We are a payments innovator, differentiated by our proprietary, integrated payment technology platform and our ability to reduce the complexity of electronic payments for businesses. We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our clients’ needs, our deep knowledge of our vertical markets and the embedded nature of our integrated payment solutions will drive strong growth by attracting new clients and fostering long-term client relationships.

Since a significant portion of our revenue is derived from volume-based payment processing fees, card payment volume is a key operating metric that we use to evaluate our business. We processed approximately $20.5$25.7 billion of total card payment volume in 2021. Our year-over-year card payment volume growth was approximately 35% in 2021 and 42% in 2020. As of December 31, 2021, we had over 18,000 clients.2023. Our top 10 clients, with an average tenure of approximately fourseven years, contributed to approximately 14%18% and 18%15% of total gross profit during the year ended December 31, 20212023 and the year ended December 31, 2020,2022, respectively.

Our leading competitive position and differentiated solutions have enabled us to realize unique advantages in fast-growing and strategically-importantstrategically important segments of the payments market. We provide payment processing solutions to clients primarily operating in the personal loans, automotive loans, receivables management, and business-to-business verticals. Our payment processing solutions enable consumers and businesses in these verticals to make payments using electronic payment methods, rather than cash or check, which have historically been the primary methods of payment in these verticals. We believe that a growing number of consumers and businesses prefer the convenience and efficiency of paying with cards and other electronic methods and that we are poised to benefit as these verticals continue to shift from cash and check to electronic payments. The personal loans vertical is predominately characterized by installment loans, which are typically utilized by consumers to finance everyday expenses. The automotive loans vertical predominantly includes subprime automotive loans, automotive title loans and automotive buy-here-pay-here loans and also includes near-prime and prime automotive loans.a diversified client base across the entire credit spectrum. Our receivables management vertical relates to consumer loan collections, which typically enter the receivables management process due to delinquency on credit card bills or as a result of major life events, such as job loss or major medical issues. The business-to-business vertical relates to transactions occurring between a wide variety of enterprise clients, many of which operate in the manufacturing, wholesale, distribution,automotive, field services, healthcare, homeowner association (“HOA”) management and education industries.hospitality industries, as well as educational institutions and governments and municipalities.

4

Our go-to-market strategy combines direct sales with integrations with key software providers in our target verticals. The integration of our technology with key software providers in the verticals that we serve, including loan management systems, dealer management systems (“DMS”), collection management systems, and enterprise resource planning software

systems, allows us to embed our omni-channel payment processing technology into our clients’ critical workflow software and ensure seamless operation of our solutions within our clients’ enterprise management systems. We refer to these software providers as our “software integration partners.” An integration allows our sales force to readily access new client opportunities or respond to inbound leads because, in many cases, a business will prefer, or in some cases only consider, a payments provider that has already integrated or is able to integrate its solutions with the business’ primary enterprise management system. We have successfully integrated our technology solutions with numerous, widely-used enterprise management systems in the verticals that we serve, which makes our platform a more compelling choice for the businesses that use them. Moreover, our relationships with our software integration partners help us to develop deep industry knowledge regarding trends in client needs. Our integrated model fosters long-term relationships with our clients, which supports our volume retention rates that we believe are above industry averages. As of December 31, 2021,2023, we maintained approximately 222262 integrations with various software providers.

Strategic acquisitions are another important partSegments

We report our financial results based on two reportable segments, Consumer Payments and Business Payments. For additional information on our segments, see Note 15. Segments to our consolidated financial statements and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

Consumer Payments

Our Consumer Payments segment provides payment processing solutions (including debit and credit card processing, Automated Clearing House (“ACH”) processing and other electronic payment acceptance solutions, as well as our long-term strategy. Our acquisitions have enabled usloan disbursement product) that enable our clients to further penetrate existing vertical markets, access newcollect payments and disburse funds to consumers and includes our clearing and settlement solutions (“RCS”) offering. RCS is our proprietary clearing and settlement platform through which we market customizable payment processing programs to other ISOs and payment facilitators. The strategic vertical markets broadenserved by our technologyConsumer Payments segment primarily include personal loans, automotive loans, receivables management, credit unions, mortgage servicing, consumer healthcare and diversified retail. Our Consumer Payments segment also previously included our Blue Cow Software business (“BCS”), which was sold on February 15, 2023. Our Consumer Payments segment represented approximately 87% of our total revenue after any intersegment eliminations for the year ended December 31, 2023.

Business Payments

Our Business Payments segment provides payment processing solutions suite,(including accounts payable automation, debit and expandcredit card processing, virtual credit card processing, ACH processing and other electronic payment acceptance solutions) that enable our client base. We continueclients to focus on identifyingcollect or send payments to other businesses. The strategic acquisition candidates in an effort to drive accretive growth.vertical markets served within our Business Payments segment primarily include retail automotive, education, field services, governments and municipalities, healthcare, HOA management and hospitality. Our growth strategy is to continue to buildBusiness Payments segment represented approximately 13% of our company through a disciplined combination of organic and acquisitive growth.total revenue after any intersegment eliminations for the year ended December 31, 2023.

Growth Strategies

We intend to drive future growth in the following ways:

Increase Penetration in Existing Verticals

We expect to grow meaningfully by continuing to provide innovative payment solutions and client support to our existing clients as well as new clients in the verticals that we currently serve. For new clients, we intend to continue to focus a significant portion of our sales efforts on large enterprise clients. In addition, our business model allows us to benefit from the growth of our clients and software integration partners. As our clients’ payment volumes and transactions increase, our revenues increase as a result of the fees we charge for processing these payments. Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment. We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.

New Vertical and Geographic Expansion

We also expect that we will find attractive growth potential in certain verticals in which we currently have limited operations or do not operate. Though we offer highly customized payment solutions to our clients, our core technology platform is comprehensive and can be utilized to penetrate other strategic vertical markets. Additionally, we envision growing our geographic footprint, as new territories continue to present new business opportunities. For example, we are focused on expanding our Canadian operations, as the demand for our solutions among existing and prospective Canadian clients remains strong.

Strengthen and Extend Our Solution Portfolio through Continued Innovation.Innovation

As we further integrate our solution into our clients’ workflows, we will look to continue to innovate on our solution set and broaden our suite of services. Our acquisition of TriSource Solutions, LLC (“TriSource”) and our continued investment in our technology capabilities position(including our RCS platform) positions us to provide value-added services and emerging payment solutions that will address the evolving needs of our clients as they seek to best serve their customers. The ability to serve clients across verticals and to be integrated across various software platforms enables us to better understand the needs of clients across verticals and to scale our innovative solutions to a broad segment of the market.

Continue to Drive Operational Efficiencies

As we continue to grow, we expect to become a more significant partner to our sponsor banks, third party processors and software integration partners,other key vendor relationships, which we expect will give us greater leverage as we expand our contractual relationships with them. We plan to continue to drive operating leverage in our non-technology personnel expenditures, as we believe that, in general, we can process larger payment volumes without significant increases to our personnel and operating expenses.

5

Strategic Acquisitions

From January 1, 2016 through December 31, 2021,2023, we have successfully acquired eleven businesses. Given the large size and attractive growth trends of our current addressable market, we are primarily focused on growing our business organically. However, we may selectively pursue strategic acquisitions as opportunities arise that meet our internal requirements for the use of capital and return on investment. Some of these opportunities may include those that enable us to acquire new capabilities that may be harder to develop in-house, gain entrance into new segments of the market, enter new markets, or consolidate our existing market.

Solutions

We provide our clients with comprehensive solutions, relatingwhich can generally be categorized as follows:

The above payment acceptance and funding methods are processed through our proprietary payment channels:

•        

Sales and Distribution

Our sales effort primarily consists of two strategies: first, our direct sales representatives, who focus on each of our core verticals, and second, our software integration partners, which enable the direct salesforcesales force to more effectively access new client opportunities and respond to inbound leads.

Direct Sales Representatives

Our sales representatives are generally organized by vertical market and account size. Direct sales representatives work with our clients and software integration partners to understand our clients’ desired payment solutions and then communicate those desires to our product and technology teams, who build a customized suite of products and payment channels tailored to our clients’ specific needs. We also maintain a sales support team that supports the onboarding process.

Software Integration Partners

As of December 31, 2021,2023, we were integrated with approximately 222262 software partners that are providers of our clients’ primary enterprise management systems. Our integrations are intended to ensure seamless delivery of our full suite of payment processing capabilities to our clients. These integrations are also a critical part of our marketing strategy, as many clients willwould prefer to award their payments business to payments processors who have worked to integrate their solutions into the client’s enterprise management systems.

Operations

We believe that we have developed an effective operations system, including our proprietary onboarding, compliance and client oversight processes, which is structured to enhance the performance of our platform and support our clients.

Client and Transaction Risk Management

We target clients that we identify as low-risk through the development of underwriting policies and transaction management procedures to manage approval of new accounts and to establish ongoing monitoring of client accounts. Effective risk management aids us in minimizing client losses, such as those relating to chargebacks or similar rejected transactions, and avoiding fraud for the mutual benefit of our clients, our sponsor banks and ourselves.

Proprietary Compliance Management System. We have developed proprietary onboarding, compliance, and client oversight processes, of which our Compliance Management System (“CMS”) is a part. Our CMS, developed in conjunction with the Third Party Payment Processors Association, is basedfocuses on four main components — board and management oversight, a compliance program with written policies and procedures and employee training and monitoring, responsiveness to consumer complaints and annual compliance audits from an independent third party — and is inclusive of the Electronic Transaction Association guidelines on underwriting and risk.

Client Onboarding. We believe we maintain rigorous underwriting standards. Prospective clients submit applications to our credit underwriting department, which performs verification and credit-related checks on all applicants. Each client is assigned a risk profile based on sponsor bank requirements, as well as additional criteria specified by us. Our sponsor banks periodically review and approve of our underwriting policies to ensure compliance with applicable law, regulations and payment network rules. Upon approval, the ongoing risk level of a client is monitored and adjusted on a monthly basis based on additional data relating to such client.

Client Monitoring. Each client’s file is assigned one of three risk levels (low, medium or high) corresponding to several client behaviors. We review and adjust these risk levels on a monthly basis and additionally subject them to more in-depth quarterly reviews. We also engage third parties and rely on internal reporting to identify and monitor credit/fraud risk. We generate client-specific reports that compile daily and historical transactions, which may include average ticket, transaction volume, refund and chargeback levels and authorization history, which we utilize in order to identify suspicious processing activity. We review these reports on a daily basis and suspend any irregular processing activity, which is subject to review, remediation and, as appropriate, suspension of either an individual or batch of transactions or a particular client, as applicable.

Investigation and Loss Prevention. If a client exceeds the parameters established by our underwriting and/or risk management team or we determine that a client has violated the payment network rules or the terms of its service agreement with us, one of our team members will identify and document the incident. We then review the incident to determine the

7

actions taken or that we can take to reduce our exposure to loss and the exposure of our client to liability. As a part of this process, we may request additional transaction information, withhold or divert funds, verify delivery of merchandise or, in some circumstances, deactivate the client account, include the client on the Network Match List to notify our industry of the client’s behavior or take legal action against the client.

Collateral. We require some of our clients to establish cash or non-cash collateral reserves, which may include certificates of deposit, letters of credit, rolling merchant reserves or upfront cash. This collateral is utilized in order to offset potential credit or fraud risk liability that we may incur. We attempt to hold such collateral reserves for as long as we are exposed to a loss resulting from a client’s payment processing activity.

Chargebacks. The payment networks permit the reversal of a money transfer, a chargeback, up to six months (or in rare cases, a longer time frame) after the later of the date the transaction is processed or the delivery of the product or service to the cardholder. If the client incurring the chargeback is unable to fund the refund to the card-issuing bank, we are required to do so by the rules of the payment networks and our contractual arrangements with our sponsor banks. During the year ended December 31, 2021,2023, we believe our chargeback rate was under 1% of our payment volume.

Security, Disaster Recovery, and Back-up Systems

We adhere to industry security standards to protect the payment information that we process. We regularly scan and update our network, systems and apply operating system security releasesapplication code and malware defenses. We use a third party vendor solution for security education materials. Every employee and contractor is required to successfully complete annual security awareness training. We routinely retain external parties to audit our systems’ compliance with current security standards as established by the Payment Card Industry Data Security Standards (“PCI DSS”), Service Organization Control ("SOC1 Type II,” “SOC2 Type II”), Health Insurance Portability and Accountability Act (“HIPAA”) and International Organization for Standardization (“ISO 27001”) and to test our systems against vulnerability to unauthorized access. We utilize third party vendors for internal and external penetration testing. Further, we use one of the most advanced commercially available technologies to encrypt the cardholder numbers and client data that we store in our databases. Additionally, we have a dedicated team responsible for continuous monitoring and security incident response. This team also develops, maintains, tests and verifies our incident

response plan. Disaster recovery is built into our infrastructureprimary payment gateway through redundant hardware and software applications hosted in two distinct cloud regions. Our primary cloud region for the payment gateway infrastructure is set up to be replicated, substantially on a real time basis, by our secondary cloud region such that if our primary cloud region becomes impaired or unavailable, operations are redirected to the secondary cloud region. Our incident response team tests these systems each quarter to assess the effectiveness of our disaster recovery plan, including staff readiness and operational capability.

Third Party Processors and Sponsor Banks

We partner with institutions in the payment chain to provide authorization, settlement and funding services in connection with our clients’ transactions. These institutions include third party processors and sponsor banks, who sit between us, acting as the merchant acquirer or payment processor, and the payment networks, such as Visa MasterCard and Discover.MasterCard. These processors and vendors in turn have agreements with the payment networks, which permit them to route transaction information through their networks in exchange for fees.

When we facilitate a transaction as a merchant acquirer, we utilize third party processors primarily for authorization such as Total Systems Services, Inc. (a subsidiary of Global Payments, Inc.). Under such processing arrangements, the third-party processors and vendors receive processing fees, which are typically based on a percentagethe number of the payment volume they process.transactions processed.

In order for us to process and settle transactions for our clients, we have entered into sponsorship agreements with banks that are members of the payment networks. We are required to register with the payment networks through these bank partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks. Our member bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (for example, known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions. Our relationships with multiple sponsor banks give us the flexibility to shift payment volumes between them, which helpsis designed to help us to secure more competitive pricing for our clients and to maintain redundancy.

When we facilitate a client’s payment to its suppliers or vendors, we typically utilize the services of third party program managers, such as Wex Inc. and Comdata Inc. (a subsidiary of FleetCor Technologies, Inc.), who have arrangements with banks to operate card issuance programs. Under such arrangements, the program manager and issuing bank retain a portion of the interchange generated by each transaction. Under the applicable contractual arrangements, our clients are

8

generally required to prefund these payments. Because we are not a licensed money transmitter, we have entered into custodial agreements with banks or other financial institutions who will hold our clients’ funds in trust.

See “Risk Factors—Risks Related to Our Business – We rely on other service and technology providers. If such providers fail in or discontinue providing their services or technology to us, our ability to provide services to clients may be interrupted, and, as a result, our business, financial condition and results of operations could be adversely impacted.” in Part I, Item 1A of this Annual Report on Form 10-K for further discussion of our arrangements with certain service providers.

Competitive Conditions and Market Trends

We compete with a variety of payment processing companies that have different business models, go-to-market strategies and technical capabilities. We compete with a large number of small payments processing companies that provide integrated payments solutions and/or related hardware to clients withinIn our existing verticals. More broadly in the overall payments industry,Consumer Payments segment, our payment and software solutions compete against many forms of financial services and payment systems, including Open Edge (a division of Global Payments),primary competitors include ACI Worldwide, Inc., Paya, Inc., Paymentus, Corporation, AvidXchange, Corporate Spending Innovations (a division of Edenred), Nvoicepay (a division of FleetCor Technologies, Inc.)PayNearMe, PayScout and Zelis.TabaPay. We also compete in our Consumer Payments segment against many traditional merchant acquirers, such as financial institutions, affiliates of financial institutions and payment processing companies, in the payment processing industry, including Bank of America Merchant Services, Elavon Inc. (a subsidiary of U.S. Bancorp), Wells Fargo Merchant Services, Global Payments, Inc.WorldPay and Fiserv. In our Business Payments segment, our primary competitors include AvidXchange, Edenred Pay (a division of Edenred), WorldPay, Inc.Corpay (a subsidiarydivision of Fidelity National Information Services, Inc.)FleetCor Technologies), Paya (a division of Nuvei Corporation) and Total Systems Services, Inc. (a subsidiary of Global Payments, Inc.).Fortis. We believe the most significant competitive factors in the markets in which we compete are: (1) economics, including fees charged to merchants and commission payouts to software integration partners; (2) product offering, including emerging technologies and development by other participants in the payments ecosystem; (3) service, including product functionality, value-added solutions and strong client support for both clients and software integration partners; and (4) reliability, including a strong reputation for quality service and trusted software integration partners. Our competitors include large and well-established companies, including banks, credit card providers, technology and ecommerce companies and traditional retailers, many of which are larger than we are, have a dominant and secure position in the markets in which they operate or offer other products and services to consumers and clients which we do not offer. Moreover, we compete against all forms of payments, including credit cards, bank transfers, and traditional payment methods, such as cash and check.

We believe there is a significant digital shift in our industry. Many of the vertical markets in which we compete are continuing to shift from legacy payment mediums — primarily cash and check — to electronic forms of payment. In addition,

the COVID-19 pandemic and the resulting changes in consumer behavior has led to an accelerated shift to electronic payments. We expect to benefit from this trend as our clients increasingly opt to process payments via the electronic forms of payment in which we specialize.

We have experienced in the past, and may continue to experience, seasonal fluctuations in our volumes and revenues as a result of consumer spending patterns. Volumes and revenues during the first quarter of the calendar year tend to increase in comparison to the remaining three quarters of the calendar year on a same store basis. This increase is due to consumers’ receipt of tax refunds and the increases in repayment activity levels that follow.

Acquisitions

Our historical acquisition activity has allowed us to access new markets, expand our presence in existing markets, acquire industry talent, broaden our product suite, and supplement organic growth. Our current acquisition strategy focuses on integrated payments companies serving attractive vertical markets and opportunities to broaden our product offerings. From January 1, 2016 through December 31, 2021,2023, we have completed eleven acquisitions, which are described below. These acquisitions were of payment companies and are representative of the acquisitions we envision consummating in the future.

Sigma Acquisition

Effective as of January 1, 2016, we acquired substantially all of the assets of Sigma Payment Solutions, Inc. (“Sigma”). Sigma was an electronic payment solutions provider to the automotive finance industry. The transaction marked our expansion into the automotive finance space. We have benefittedbenefited greatly from Sigma’s deep integrations with automotive finance software platforms, or DMS.

PaidSuite Acquisition

On September 28, 2017, we acquired substantially all of the assets of PaidSuite, Inc. and PaidMD, LLC (collectively, “PaidSuite”). PaidSuite was an electronic payment solutions provider to the accounts receivable management industry. The transaction accelerated our growth into the accounts receivable management space via client and software integration partner relationships.

9

Paymaxx Acquisition

On December 15, 2017, we acquired substantially all of the assets of Paymaxx Pro, LLC (“Paymaxx”). The acquisition of Paymaxx has been highly complementary to our earlier acquisition of Sigma and has bolstered our position in the niche automotive finance market. As part of the acquisition, we acquired increased distribution capabilities in the form of an internal sales force and numerous DMS integrations.

TriSource Acquisition

On August 14, 2019, we acquired all of the equity interests of TriSource.TriSource Solutions, LLC (“TriSource”). Since 2012, we have used TriSource as one of our primary third-party processors for settlement solutions when we facilitate transactions as a merchant acquirer. The acquisition of TriSource has provided further control over our transaction processing ecosystem and accelerated product delivery capabilities. We now generally refer to our clearing and settlement product offerings as RCS.

APS Acquisition

On October 14, 2019, we acquired substantially all of the assets of American Payment Services of Coeur D’Alene, LLC, North American Payment Solutions LLC, and North American Payment Solutions Inc. (collectively, “APS”). The acquisition of APS meaningfully expanded our addressable market by enabling us to access the business-to-business vertical.

Ventanex Acquisition

On February 10, 2020, we acquired all of the equity interests of CDT Technologies, LTD. d/b/a Ventanex (“Ventanex”). The acquisition of Ventanex accelerated our entry into the mortgage and healthcare payments vertical.verticals.

cPayPlus Acquisition

On July 23, 2020, we acquired all of the equity interest of cPayPlus, LLC (“cPayPlus”). The acquisition of cPayPlus further expanded our business-to-business automation and payment offering to include accounts payable automation and payment solutions for both existing and prospective clients across all business lines.

CPS Acquisition

On November 2, 2020, we acquired all of the equity interests of CPS Payment Services, LLC, Media Payments, LLC, and Custom Payment Systems, LLC (collectively, “CPS”). The acquisition of CPS enhanced our business-to-business accounts payable automation offerings and introduced our solutions to new verticals including education, government, and media sectors.

BillingTree Acquisition

On June 15, 2021, we acquired all of the equity interests of BT Intermediate, LLC (together with its subsidiaries, “BillingTree”). The acquisition of BillingTree further expanded our position in the healthcare, credit union, and accounts receivable managementindustries and significantly enhanced our scale and our client diversification.

Kontrol Acquisition

On June 22, 2021, we acquired substantially all of the assets of Kontrol LLC (“Kontrol”). The acquisition of Kontrol grew our accounts payable automation business and enabled us to leverage our existing B2B technology infrastructure to increase our virtual card volume.optimize processing costs.

Payix Acquisition

On December 29, 2021, we acquired Payix Holdings Incorporated (together with its subsidiary, “Payix”). The acquisition of Payix expanded our position in the largepersonal and growing automotive finance markets, as well as accelerated our expansion in the buy now, pay later (“BNPL”) market, and provided further access to software integrations with leading loan management systemsystems and DMS integrations.

Government Regulation

We operate in an increasingly complex and ever evolving legal and regulatory environment. Our and our clients’ businesses are subject to a variety of federal, state and local laws and regulations, as well as the rules and standards of the payment networks that we utilize to provide our electronic payment services. While in some cases payment processors such

10

as Repay are not directly regulated by governmental agencies, because of the rules and regulations enacted at the state and federal level that affect our clients and sponsor banks, we have developed and continually evaluate and update our compliance models to keep up with the rapid evolution of the legal and regulatory regime our clients and sponsor banks face. We are also subject to legal and regulatory requirements which govern the use, storage and distribution of the information we collect from our clients and cardholdersaccountholders while processing transactions.

Dodd-Frank Act

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) and its related rules and regulations have resulted in significant changes to the regulation of the financial services industry, including the electronic payment industry. Under the Dodd-Frank Act, debit interchange transaction fees that a card issuer receives and are established by a payment card network for an electronic debit transaction are regulated by the Board of Governors of the Federal Reserve System (the “Federal Reserve”). The Dodd-Frank Act and the Federal Reserve’s implementing regulations require that such interchange fees be “reasonable and proportional” to the cost incurred by the issuer in processing the transactions. Federal Reserve regulations implementing this “reasonable and proportional” requirement have capped debit interchange rates for card issuers operating in the United States with assets of $10 billion or more. In addition, the regulations contain certain prohibitions on card brand network exclusivity and merchant routing restrictions of debit card transactions. As a result of the Dodd-Frank Act, merchants are also allowed to set minimum dollar amounts (within certain parameters) for the acceptance of a credit card, and they are allowed to provide discounts or incentives to entice consumers to pay with an alternative payment method, such as cash, checks or debit cards.

The Dodd-Frank Act also created the Consumer Financial Protection Bureau (the “CFPB”), which has rulemaking authority over consumer protection laws, including the authority to regulate consumer financial products in the United States, including consumer credit, deposit, payment, and similar products. The CFPB may also have authority over us as a provider of services to regulated financial institutions in connection with consumer financial products. Any new rules or regulations implemented by the CFPB, and other similar regulatory agencies in other jurisdictions, or pursuant to the Dodd-Frank Act that

are applicable to us or our clients’ businesses, or any adverse changes thereto, could increase our cost of doing business or limit our current offerings of integrated payment solutions.

Privacy and Information Security Regulations

We provide services that may be subject to various state and federal data privacy and information security laws and regulations. Relevant federal data privacy and information security laws include the Gramm-Leach-Bliley Act of 1999, which (along with its implementing regulations) restricts certain collection, processing, storage, use and disclosure of personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These rules also impose requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. Our business may also be subject to the Fair Credit Reporting Act of 1970, as amended by the Fair and Accurate Credit Transactions Act of 2003, which regulates the use and reporting of consumer credit information and imposes disclosure requirements on entities who take adverse action based on information obtained from credit reporting agencies. All fifty states have enacted data breach notification laws requiring businesses that experience a security breach of their computer databases that contain personal information to notify affected individuals, consumer reporting agencies and governmental agencies. In addition, there are state laws governing the collection of personal information, including those restrictingthat restrict the ability to collect and utilize certain types of personal information, such as Social Security and driver’s license numbers.numbers, and impose secure disposal requirements for personal data. Certain state laws impose similarmandate businesses to implement reasonable data security measures. In addition, various states have recently enacted laws concerning privacy, obligations as well as obligations to provide notification of security breaches of computer databases that contain personaldata protection and information to affected individuals, state officers and others.security. For example, the California Consumer Privacy Act (“CCPA”) of 2018 (the “CCPA”), which became effectivewent into effect on January 1, 2020 imposes more stringent requirements with respect toand was amended by the California data privacy. The CCPA includesPrivacy Rights Act of 2020 (the “CRPA”), for which most provisions were effective on January 1, 2023, requires companies that giveprocess personal information of California residents expandedto make certain disclosures to consumers about data practices, grants consumers specific access rights to access and delete certain personal information,their data, allows consumers to opt out of certain personal informationdata sharing activities and receive detailed information about how certain personal information is used.creates a private right of action for data breaches. The CPRA also establishes a privacy enforcement agency known as the California Privacy Protection Agency. At least 12 other states have enacted similar laws and regulations, and other states are expected to enact new similar laws and regulations in the near future.

Health Insurance Portability and Accountability Act & Health Information Technology for Economic and Clinical Health Act

HIPAA and its related rules and regulations establish policies and procedures for maintaining the privacy and security of individually identifiable health information (“Protected Health Information”). The Health Information Technology for Economic and Clinical Health Act and its related rules and regulations extended the privacy and security provisions of HIPAA to “Business Associates” of “Covered Entities” (each as defined by HIPAA).

Some of our clients are Covered Entities. In providing certain services for our Covered Entity clients, we may receive, maintain, and transmit Protected Health Information on their behalf, and we may be a Business Associate. To the extent we are a Business Associate, we are subject to HIPAA rules and regulations regarding privacy and security of Protected Health Information. In connection with certain services, we may enter into Business Associate Agreements with

11

our Covered Entity clients, requiring compliance with HIPAA rules and regulations, and defining permissible uses and disclosures of Protected Health Information.

Anti-Money Laundering and Counter-Terrorism Regulation

Our business is subject to U.S. federal anti-money laundering laws and regulations. We are also subject to certain economic and trade sanctions programs that are administered by OFACOffice of Foreign Assets Control (“OFAC”) that prohibit or restrict transactions to or from (or transactions dealing with) narcotics traffickers, terrorists, terrorist organizations, certain individuals, specified countries, their governments and, in certain circumstances, their nationals. Similar anti-money laundering, counter-terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified on lists maintained by organizations similar to OFAC in several other countries and which may impose specific data retention obligations or prohibitions on intermediaries in the payment process. We have developed and continue to enhance compliance programs and policies to monitor and address related legal and regulatory requirements and developments.

Unfair or Deceptive Acts or Practices

We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws similar in scope and subject matter thereto. In addition, laws prohibiting these activities and other laws, rules and or regulations, including the Telemarketing Sales Rule, may directly impact the activities of certain of our clients, and in some cases may subject us, as the client’s payment processor or provider of certain services, to

investigations, fees, fines and disgorgement of funds if we are deemed to have aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services. Various federal and state regulatory enforcement agencies, including the Federal Trade Commission (“FTC”) and the states attorneys general, have authority to take action against payment processors who violate such laws, rules and regulations. To the extent we are processing payments or providing services for a client suspected of violating such laws, rules and regulations, we may face enforcement actions and, as a result, incur losses and liabilities that may adversely affect our business.

In addition, the Dodd-Frank Act gave the CFPB broad authority to prohibit “unfair, deceptive or abusive acts or practices” (“UDAAP”) in connection with the provision of consumer financial products and services. The CFPB has extended certain UDAAP-related provisions of the Dodd-Frank Act to directly apply to payment processors.

Indirect Regulatory Requirements

Certain of our clients and our sponsor banks are financial institutions that are directly subject to various regulations and compliance obligations issued by the CFPB, the Federal Reserve, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration and other agencies responsible for regulating financial institutions, which includes state financial institution regulators. While these regulatory requirements and compliance obligations do not apply directly to us, many of these requirements materially affect the services we provide to our clients and us overall. The financial institution regulators have imposed requirements on regulated financial institutions to manage their third-party service providers. Among other things, these requirements include performing appropriate due diligence when selecting third-party service providers; evaluating the risk management, information security, and information management systems of third-party service providers; imposing contractual protections in agreements with third-party service providers (such as performance measures, audit and remediation rights, indemnification, compliance requirements, confidentiality and information security obligations, insurance requirements and limits on liability); and conducting ongoing monitoring, diligence and audit of the performance of third-party service providers. Accommodating these requirements applicable to our clients impose additional costs and risks in connection with our relationships with financial institutions. We expect to expend significant resources on an ongoing basis in an effort to assist our clients in meeting their legal requirements.

Additionally, our clients, particularly those in the personal loans, automotive loans and receivables management verticals, are subject to various federal, state and local laws and regulations that impose restrictions and requirements on their businesses. For personal lenders and automotive lenders, these laws and regulations could include limitations on interest rates and fees, maximum loan amounts and the number of simultaneous or consecutive loans, imposition of required waiting periods between loans, loan extensions and refinancing, requiring payment schedules (including maximum and minimum loan durations) or repayment plans for borrowers claiming inability to repay loans, mandating disclosures, security for loans, licensing requirements and, in certain jurisdictions, database reporting and loan utilization information. For receivables management companies, these laws and regulations could include laws and regulations (including the federal Fair Debt Collection Practices Act (“FDCPA”) and comparable state laws) regarding the time, place and manner of communications

12

with consumers regarding debt collection and prohibitions or limitations on certain debt collection practices. Lastly, some of our clients are subject to various state laws and regulations that prohibit or limit the imposition of a surcharge or convenience fee in connection with their customers use of a payment card or other form of electronic payment.

Payment Network Rules and Standards

Payment networks, such as Visa, MasterCard, Discover and American Express, establish their own rules and standards that allocate liabilities and responsibilities among the payment networks and their participants. These rules and standards, including the Payment Card Industry Data Security Standards, govern a variety of areas, including how consumers and customers may use their cards,whether (and the terms under which) convenience fees or surcharges may be imposed in connection with the use of their cards, the security features of cards, security standards for processing, data security and allocation of liability for certain acts or omissions, including liability in the event of a data breach. The payment networks may change these rules and standards from time to time as they may determine in their sole discretion and with or without advance notice to their participants. These changes may be made for any number of reasons, including as a result of changes in the regulatory environment, to maintain or attract new participants, or to serve the strategic initiatives of the networks, and may impose additional costs and expenses on or be disadvantageous to certain participants. Participants are subject to audit by the payment networks to ensure compliance with applicable rules and standards. The networks may fine, penalize or suspend the registration of participants for certain acts or omissions or the failure of the participants to comply with applicable rules and standards.

In order for us to process and settle transactions for our clients, we have entered into sponsorship agreements with banks that are members of the payment networks. We are required to register with the payment networks through these bank

partners because we, as a payment processor, are not a “member bank” as defined by the major payment networks’ rules and standards governing access to those networks. Our bank partners sponsor our adherence to the rules and standards of the payment networks and enable us to route transactions under the sponsor banks’ control and identification numbers (known as BIN for Visa and ICA for MasterCard) across the card and ACH networks to authorize and clear transactions. Payment network rules restrict us from performing funds settlement and require that merchant settlement funds be in the possession of the member bank until the merchant is funded. These restrictions place the settlement assets and liabilities under the control of the member bank.

Our sponsorship agreements give our sponsor banks substantial discretion in approving certain aspects of our business practices, including our solicitation, application and qualification procedures for clients and the terms of our agreements with clients, and provide them with the right to audit our compliance with the payment network rules and guidelines. We are also subject to network operating rules and guidelines promulgated by the National Automated Clearing House Association (“NACHA”) relating to payment transactions we process using the Automated Clearing House Network. Like the payment networks, NACHA may update its operating rules and guidelines at any time, which can require us to take more costly compliance measures or to develop more complex monitoring systems. Similarly, our ACH sponsor banks have the right to audit our compliance with NACHA’s rules and guidelines, and are given wide discretion to approve certain aspects of our business practices and terms of our agreements with ACH clients.

Other Regulation

We are subject to U.S. federal and state unclaimed or abandoned property (escheat) laws, which require us to turn over to certain government authorities the property of others we hold that has been unclaimed for a specified period of time, such as account balances that are due to a software integration partner or client following discontinuation of its relationship with us. The Housing Assistance Tax Act of 2008 requires certain merchant acquiring entities and third-party settlement organizations to provide information returns for each calendar year with respect to payments made in settlement of electronic payment transactions and third-party payment network transactions occurring in that calendar year. Reportable transactions are also subject to backup withholding requirements.

The foregoing is not an exhaustive list of the laws and regulations to which we are subject and the regulatory framework governing our business is changing continuously. See “Risk Factors — Risks Related to Our Business” in Part I, Item 1A of this Annual Report on Form 10-K.

Intellectual Property

Certain of our products and services are based on proprietary software and related payment systems solutions. We rely on a combination of copyright, trademark, and trade secret laws, as well as employee and third-party non-disclosure, confidentiality, and other contractual arrangements to establish, maintain, and enforce our intellectual property rights in our

13

technology, including with respect to our proprietary rights related to our products and services. In addition, we license technology from third parties that is integrated into some of our solutions.

We own a number of registered service marks, including REPAY® and REPAY REALTIME ELECTRONIC PAYMENTS®, and we have other pending applications. We also own a number of domain names, including www.repay.com. For additional information regarding some of the risks relating to our intellectual property see “Risk Factors — Risks Related to Our Business — We may not be able to successfully manage our intellectual property and may beare subject to infringement claims.” in Part I, Item 1A of this Annual Report on Form 10-K.

Human Capital

Our employees are a critical component of our success. As of December 31, 2021,2023, we employed approximately 552512 full-time employees throughout the U.S. and Canada. We have 147 office locations in the U.S.with an employee presence and have a remote employee presence in 3733 states. During 2021, we added 266new employees (including 161 through acquisitions). None of our employees are represented by a labor union or covered by a collective bargaining agreement.

We strive to create and maintain a special culture at REPAY that focuses on empowerment, driving performance, collaboration,our values of excellence, passion, integrity, respect, innovation, and transparency.positive attitude. Our strong emphasis on culture is intended to empower our employees to make decisions and develop themselves personally and professionally. Particularly in light of our acquisition strategy, oneOne of our priorities is to maintain and enhance our culture as we grow in employee size and integrate new team members.

We participate in an annual employee engagement and feedback survey which allows all full-time employees to anonymously give us feedback on our workplace culture, employee programs, and more. In 2021, we had 90%2023, 83% of participants say we areresponded that REPAY is a great place to work. Our employees’ feedback from the annual surveys have allowed us to be

certified as a Great Place to Work® for the last fiveseven consecutive years. In 2021, we were recognized by Fortune® as a Best Workplace in Financial Services and Insurance. We take employee feedback seriously and share the results of the survey, along with an action plan of how we can continue to improve, towith all employees.

Attracting, developing, and retaining top talent is a priority at REPAY and we have a dedicated human resources team that focuses on these initiatives. To ensure we stay competitive in the current talent market, we strive to make it clear to our peopleemployees that we value and appreciate them. The majority of our workforce is offered flexible or fully remote work flexible schedules.them, and reward high performance. We foster a culture of rewards and recognition and incentivize our peopleemployees with opportunities for growth within the company. New employees are welcomed through our new hire onboarding experience, which consists of a comprehensive equipment package, welcome gift packages, an onboarding plan with consistent communication, human resources orientation, and formalized 30-60-90 day check-ins with their manager, ensures our new hires have the support they need. Additionally, new hire spotlights are socialized in our monthly newsletters to ensure new team members are introduced to the Company and receive a warm welcome and every one of our new employees has the opportunity to meet with our CEO for a “coffee chat” within their first month of employment.

REPAY’s leadership empowers each team member to make a difference and stretch to their fullest potential. Our dedication to frequent, transparent communication is shown with company-wide meetings where our leaders share Company vision and encourage employees to ask questions. Several departments across the Company hold annual training summits where team members have an opportunity to collaborate with fellow colleagues, participate in department-specific training and further enhance their skillsets. We also believe it is important to celebrate exceptional employees so we provide multiple opportunities for performance-based awards and peer-to-peer recognition. We continue to develop formal career pathing, allowing us to create a roadmap for an individual’s career progression within the organization. Our compensation strategy gives us competitive advantages by offering competitive salaries, bonus potential and employee ownership opportunities for a meaningful portion of our employees through equity incentive grants. New

We recognize the importance of giving back to the communities in which we live. Participating in community outreach initiatives and volunteer opportunities is extremely important to our employees are welcomed through our virtual new hire onboarding experience, which consists of at-home equipment, welcome gift packages, consistent communication, and human resources orientation, and ensures our new hires have the support they need when starting with a new company. Additionally, every onehas become an integral part of our new employees hascorporate culture. Throughout the opportunityyear, we provide multiple ways for team members to meet with our CEO for a “coffee chat” within their first month of employment.volunteer and positively impact the surrounding communities.

We value diverse backgrounds, perspectives and experiences, and we are committed to providing an inclusive environment where all individuals are heard and respected. In 2021, we implementedWe maintain an Employee Resource Group aimed at connecting and creating a network for women at REPAY. This group meets several times throughout the year to discuss relevant topics and connect with others at the Company. We have also partnered with diverse organizations and higher education programs to identify a more diverse pool of qualified candidates for recruitment. Our diversity and inclusion initiatives are periodically reviewed and discussed at the board level.

We offer a comprehensive benefits package, which includesgoes into effect on a person’s first day of employment, including 100% coverage of employee healthcare premiums and several benefits at no cost to our employees, including life insurance, telehealth, mental health and work-life balance resources. We perform a thorough review of our benefits package annually. In 2021,Among other benefits, we made changescontinue to our benefits package including offering lower insurance premiums for family coverage, offering a more generous time off policy, and implementingoffer an Employee Stock Purchase Plan (“ESPP”). The ESPP is highly valued because it gives our employees the opportunity to become shareholders in REPAY at a discounted price. The financial future of our employees is important to us, which is why we have a generous 401(k)-employer match and performance-based bonus program. To promote personal and professional growth, we encourage our employees to pursue ongoing training and career development opportunities, and we provide tuition assistance and reimbursement for certain pre-approved continuing education programs and professional certifications.

As we continue to navigate the COVID-19 pandemic, our employees’ health and safety continue to remain a priority for us. We understand the pandemic impacted all our employees’ personal lives in different ways. Because of this, we provide flexible work schedules. We have also enhanced our employee benefits package to increase the quantity of free mental health support and telehealth options.

14

Available Information

We maintain a website at www.repay.com, through which you may access our public filings free of charge as soon as reasonably practicable after they are electronically filed with, or furnished to, the Securities and Exchange Commission (“SEC”). Information contained on our website is not a part of this Annual Report on Form 10-K and the inclusion of our website address in this report is an inactive textual reference only.

Item 1A. Risk Factors

Our business involves significant risks. In addition to the risks and uncertainties discussed above under “Cautionary Note Regarding Forward-Looking Statements,” you should carefully consider the specific risks set forth herein. If any of these risks actually occur, it may materially harm our business, financial condition, liquidity and results of operations. As a result, the market price of our securities could decline, and you could lose all or part of your investment. Additionally, the risks and uncertainties described in this Annual Report on Form 10-K or in any document incorporated by reference herein are not the only risks and uncertainties that we face. Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial may become material and adversely affect our business.

Unless the context requires otherwise, “we,” “us,” “our,” “Repay” and the “Company” refer to the business of Repay Holdings Corporation and its subsidiaries. In the sections of the Risk Factors entitled “Risks Related to Our Ownership Structure” and “Risks Related to Our Class A Common Stock,” “we,” us” and “our” refer only to Repay Holdings Corporation excluding, unless the context requires otherwise or as expressly stated, its subsidiaries.

Risks Related to Our Business

The COVID-19 pandemic and the measures implemented to mitigate the spread of the virus has had and may continue to have an adverse effect on our business, results of operations and financial condition.

The COVID-19 pandemic and the mitigation efforts by governments and other parties to attempt to control the spread of the virus (including its variants) have adversely impacted the U.S. and global economy, leading to significant changes in consumer and business spending and economic activity and disruptions and volatility in the U.S. and global capital markets. We are diligently working to ensure that we can continue to operate with minimal disruption, mitigate the impact of the pandemic on our employees’ health and safety, and address potential business interruptions on ourselves and our clients. However, we cannot assure you that we will continue to be successful in these efforts.

Although we have experienced increased demand for some of our service offerings as a result of an accelerated shift to electronic payments, we believe that the COVID-19 pandemic, the mitigation efforts and the resulting economic impact have had, and may continue to have, an overall adverse effect on our business, results of operations and financial condition. The actual further effect in any given future period is difficult to estimate, and it will depend on numerous evolving factors and future developments that we are not able to predict, including: the duration, spread and severity of the outbreak (including whether there are continued variants or other waves of infection); the nature, extent and effectiveness of mitigation measures; the administration of vaccines and the availability of therapeutic treatments; the extent and duration of the effect on the economy, unemployment, consumer confidence and consumer and business spending; and how quickly and to what extent normal economic and operating conditions can resume.  

The effects of the COVID-19 pandemic, the mitigation efforts and the resulting economic impact on our business, results of operations and financial condition have included and may continue to include the following with respect to the key industry-oriented “vertical” markets that we serve:

The above effects have resulted in and are likely to continue to result in an adverse impact on the amount of fees we can earn for processing payments and other transactions on behalf of our clients. There may be a delay in the timing of when our business is impacted by these matters. As an example, we earned incremental fees from processing loan payments or

15

payoffs that result from consumers’ receipt of additional government stimulus or extra unemployment benefits, but our business, results of operations and financial condition in subsequent periods were and could continue to be adversely affected from reduced loan originations as result of such combination of government action and consumer behavior.

In addition, the ongoing reduction or suspension of non-essential travel and cancellation or postponement of various tradeshows has resulted in and is expected to continue to result in challenges in attracting new clients and growing relationships with existing clients.

To the extent the COVID-19 pandemic, the mitigation efforts and the resulting economic impact continues to adversely affect our business, results of operations and financial condition, such matters may also have the effect of heightening many of the other risks described in the risk factors disclosed herein, such as those relating to our responsibility for the prevention of unauthorized disclosure of consumer data and our ability to minimize losses relating to chargebacks, fraud and similar losses.

The payment processing industry is highly competitive. Such competition could adversely affect the fees we receive, and as a result, our margins, business, financial condition and results of operations.

The market for payment processing services is highly competitive. There are other payment processing service providers that have established a sizable market share in the markets in which we compete and service more clients than we do. Our growth will depend, in part, on a combination of the continued growth of the electronic payment market and our ability to increase our market share.

Many of our competitors have substantially greater financial, technological, management and marketing resources than we have. Accordingly, if these competitors target our business model and, in particular, the vertical markets that we serve, they may be able to offer more attractive fees or payment terms and advances to our clients and more attractive compensation to our software integration partners. They also may be able to offer and provide services and solutions that we do not offer. There are also a large number of small providers of processing services, including emerging technology and non-traditional payment processing companies, that provide various ranges of services to our existing and potential clients. This competition may effectively limit the prices we can charge, cause us to increase the compensation we pay to our software integration partners and require us to control costs aggressively in order to maintain acceptable profit margins.

Unauthorized disclosure of client or consumer data, whether through breach of our computer systems, computer viruses or otherwise, could expose us to liability and protracted and costly litigation and damage our reputation.

We are responsible for data security for us and for third parties with whom we partner, including with respect to rules and regulations established by the payment networks, such as Visa, MasterCard, Discover and Discover,American Express, and debit card networks. These third parties include our clients, software integration partners and other third-party service providers and agents. We and other third parties collect, process, store and/or transmit sensitive data, such as names, addresses, social security numbers, credit or debit card numbers, expiration dates, driver’s license numbers, bank account numbers and protected health information. We have ultimate liability to the payment networks and our sponsor banks that register us with the payment networks for our failure or the failure of other third parties with whom we contract to protect this data in accordance with payment network requirements. The loss, destruction or unauthorized modification of client or consumer data by us or our contracted third parties could result in significant fines, sanctions, proceedings or actions against us by the payment networks, governmental bodies, consumers or others.

Threats may result from human error, fraud or malice on the part of employees or third parties, or from accidental technological failure. For example, certain of our employees have access to sensitive data that could be used to commit identity theft or fraud. Concerns about security increase when we transmit information electronically because such transmissions can be subject to attack, interception or loss. Also, computer viruses can be distributed and spread rapidly over the Internet and could infiltrate our systems or those of our contracted third parties. Denial of service or other attacks could be launched against us for a variety of purposes, including interfering with our services or to create a diversion for other malicious activities. These types of actions and attacks and others could disrupt our delivery of services or make them unavailable.

We and our contracted third parties could be subject to breaches of security by hackers. Our encryption of data and other protective measures may not prevent unauthorized access to or use of sensitive data. A systems breach may subject us to material losses or liability, including payment network fines, assessments and claims for unauthorized purchases with misappropriated credit, debit or card information, impersonation or other similar fraud claims. A misuse of such data or a

cybersecurity breach (including a ransomware attack) could harm our reputation and deter clients from using electronic payments generally and our services specifically, thus reducing our revenue. In addition, any such misuse or breach could

16

cause us to incur costs to correct the breaches or failures, expose us to uninsured liability, increase our risk of regulatory scrutiny, subject us to lawsuits and result in the imposition of material penalties and fines under state and federal laws or by the payment networks or limitations on our ability to process payment transactions on such payment networks. While we maintain cyber insurance coverage (which, in certain cases, is required pursuant to certain of our contractual commitments) that may, subject to policy terms and conditions, cover certain aspects of these risks, our insurance coverage may be insufficient to cover all losses. Additionally, we may be required to increase our cyber insurance coverage pursuant to our contractual commitments entered into in the future. Our cyber insurance costs have increased significantly following well-publicized ransomware attacks involving other organizations. The costs to maintain or increase our cyber insurance coverage could have a material adverse effect on our business, financial condition and results of operations.

Any human error, fraud, malice, accidental technological failure or attacks against us or our contracted third parties could hurt our reputation, force us to incur significant expenses in remediating the resulting impacts, expose us to uninsured liability, result in the loss of our sponsor bank relationships or our ability to participate in the payment networks, subject us to lawsuits, fines or sanctions, distract our management, increase our costs of doing business and/or materially impede our ability to conduct business.

Although we generally require that our agreements with our software integration partners or service providers include confidentiality obligations that restrict these parties from using or disclosing any client or consumer data except as necessary to perform their services under the applicable agreements, we cannot guarantee that these contractual measures will prevent the unauthorized use, modification, destruction or disclosure of data or allow us to seek reimbursement from the contracted party. In addition, many of our clients are small and medium-sized businesses that may have limited competency regarding data security and handling requirements and may thus experience data breaches. Any unauthorized use, modification, destruction or disclosure of data could result in protracted and costly litigation and the incurrence of significant losses by us.

In addition, our agreements with our sponsor banks and our third-party payment processors (as well as payment network requirements) require us to take certain protective measures to ensure the confidentiality of client and consumer data. Any failure to adequately comply with these protective measures could result in fees, penalties, litigation or termination of our sponsor bank agreements. Further, certain of our sponsor banks have experienced, and could in the future experience, cybersecurity incidents that could disrupt our operations, expose us to liability and protracted and costly litigation and damage our reputation.

Security breaches may be subject to scrutiny from governmental agencies such as the CFPB, the FTC and the U.S. Department of Health and Human Services Office for Civil Rights. See “Risks Related to Regulation” below.

If we cannot keep pace with rapid developments and changes in our industry, the use of our products and services could decline, causing a reduction in our revenues.

The electronic payments market is subject to constant and significant changes. This market is characterized by rapid technological evolution, new product and service introductions, evolving industry standards, changing client needs and the entrance of new competitors, including products and services that enable card networks and banks to transact with consumers directly. For example, in July 2023, the U.S. Federal Reserve launched its FedNow Service that enables individuals and businesses to send instant payments through their depositary institution accounts. To remain competitive, we continually pursue initiatives to develop new products and services to compete with these new market entrants. These projects carry risks, such as difficulty in determining market demand and timing for delivery, cost overruns, delays in delivery, performance problems and lack of client acceptance, and some projects may require investment in non-revenue generating products or services that our software integration partners and clients expect to be included in our offerings. In addition, new products and offerings may not perform as intended or generate the business or revenue growth expected.

The continued growth and development of our payment processing services and solutions will depend on our ability to anticipate and adapt to changes in consumer and business behavior. Any failure to timely integrate emerging payment methods into our software, to anticipate consumer or business behavior changes or to contract with processing partners that support such emerging payment technologies could cause us to lose traction among our clients or referral sources, including industry associations, resulting in a corresponding loss of revenue, if those methods become popular among end-users of their services.

Our products and services are designed to process complex transactions and provide reports and other information on those transactions, all at very high volumes and processing speeds. Our technology offerings must also integrate with a variety of network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our

products and services to adapt to changes and innovation in these technologies. Any failure to deliver an effective, reliable and secure service or any performance issue that arises with a new product or service could result in significant processing or reporting errors or other losses. If we do not deliver a promised new product or service to our clients or software integration partners in a timely manner or the product or service does not perform as anticipated, our

17

development efforts could result in increased costs and a loss in business, reducing our earnings and causing a loss of revenue. We also rely in part on third parties, including some of our competitors and potential competitors, for the development of and access to, or production of, new technologies, including software and hardware. For example, we rely on our software integration partners to integrate our services and products into the software platforms being used by our clients. Our future success will depend in part on our ability to develop or adapt to technological changes and evolving industry standards. If we are unable to develop, adapt to or access technological changes or evolving industry standards on a timely and cost-effective basis, our business, financial condition and results of operations could be materially adversely affected.

If our vertical markets do not increase their acceptance of electronic payments or if there are adverse developments in the electronic payment industry in general, our business, financial condition and results of operations may be adversely affected.

The vertical markets we primarily serve have traditionally not historically utilized electronic payments.payments to the same extent as traditional markets such as retail and travel. If consumers and businesses in theseour primary vertical markets do not increase their use of cards as payment methods for their transactions or if the mix of payment methods changes in a way that is adverse to us, such developments may have a material adverse effect on our business, financial condition and results of operations. Regulatory changes may also result in our clients seeking to charge their own clients additional fees for use of credit or debit cards which may result in such clients using other payment methods. Additionally, in recent years, increased incidents of security breaches have caused some consumers to lose confidence in the ability of businesses to protect their information, causing certain consumers to discontinue use of electronic payment methods. Security breaches could result in financial institutions canceling large numbers of credit and debit cards, or consumers or businesses electing to cancel their cards following such incidents.

Potential clients or software integration partners may be reluctant to switch to, or develop a relationship with, a new payment processor, which may adversely affect our growth.

Many potential clients and software integration partners worry about potential disadvantages associated with switching payment processing providers, such as a loss of accustomed functionality, increased costs and business disruption. There can be no assurance that our strategies for overcoming potential reluctance to change payment processing providers or to initiate a relationship with us will be successful, and this resistance may adversely affect our growth and our business overall.

Our sales efforts to large enterprises involve considerable time and expense with long and unpredictable sales cycles.

One of the factors affecting our growth and financial performance is the adoption of our solutions by large enterprise clients. As part of our sales efforts, we invest considerable time and expense evaluating the specific organizational needs of potential clients and educating these potential clients about the technical capabilities and value of our solutions. Because large enterprises tend to have more consumers impacted by a change in payment processing providers, they often evaluate our solutions and our technology platform at multiple levels within their organization, each of which often have specific requirements, and typically involve their senior management. As a result, our sales efforts to large enterprises span over considerable time and require greater expense with long and unpredictable sales cycles, which may cause our results of operations to fluctuate.

Our revenue is sensitive to shifts in payment mix.

Most of our revenues are derived from volume-based payment processing fees and other related fixed per transaction fees. In general, we receive more revenue for card-based payments than for ACH payments. Accordingly, if more of our client’s customers start paying by ACH or other payment methods with lower transaction fees, it may have a material and adverse impact on our results of operations.

If we fail to comply with the applicable requirements of payment networks and industry self-regulatory organizations, those payment networks or organizations could seek to fine us, suspend us or terminate our registrations through our sponsor banks.

We rely on sponsor banks and, in certain cases, third-party processors to access the payment card networks, such as Visa MasterCard and Discover,MasterCard, that enable our ability to offer to our clients the acceptance of credit cards and debit cards, and we must pay fees for such services. To provide our merchant acquiring services, we are registered through our sponsor banks with the Visa MasterCard and DiscoverMasterCard networks as a service provider for member institutions. As such, we, our sponsor banks and many of our

clients are subject to complex and evolving payment network rules. The payment networks routinely update and modify requirements applicable to merchant acquirers, including rules regulating data integrity, third-party relationships (such as those with respect to sponsor banks and independent sales organization (“ISOs”)), merchant chargeback standards and PCI DSS. The rules of the card networks are set by their boards, which may be influenced by card issuers, some of which offer competing transaction processing services. Any changes in payment network rules or standards may be imposed on highly compressed timelines and may have a negative impact on our results of operations.

If we or our sponsor banks fail to comply with the applicable rules and requirements of any of the payment networks, such payment network could suspend or terminate our registration. Further, our transaction processing capabilities, including with respect to settlement processes, could be delayed or otherwise disrupted, and recurring non-compliance could result in the payment networks seeking to fine us or suspend or terminate our registrations that allow us to process transactions on their networks, which would make it impossible for us to conduct our business on its current scale.

Under certain circumstances specified in the payment network rules, we may be required to submit to periodic audits, self-assessments or other assessments with regard to our compliance with the PCI DSS. Such audits or assessments may reveal that we have failed to comply with the PCI DSS. In addition, even if we comply with the PCI DSS, there is no assurance that we will be protected from a security breach. The termination of our registrations with the payment networks, or any changes in payment network or issuer rules that limit our ability to provide merchant acquiring services, could have an adverse effect on our payment processing volumes, revenues and operating costs. If we are unable to comply with the requirements applicable to our payment processing activities, the payment networks could no longer allow us to provide these

18

solutions, which would render us unable to conduct our business. If we were precluded from processing Visa and MasterCard electronic payments, we would lose a substantial portion of our revenues.

We are also subject to the operating rules of the NACHA. NACHA is a self-regulatory organization which administers and facilitates private-sector operating rules for ACH payments and defines the roles and responsibilities of financial institutions and other ACH network participants. The NACHA Rules and Operating Guidelines impose obligations on us and our partner financial institutions. These obligations include audit and oversight by the financial institutions and the imposition of mandatory corrective action, including termination, for serious violations. If an audit or self-assessment under PCI DSS or NACHA identifies any deficiencies that we need to remediate, the remediation efforts may distract our management team and be expensive and time consuming.

We rely on sponsor banks in order to process electronic payment transactions, and such sponsor banks have substantial discretion with respect to certain elements of our business practices. If these sponsorships are terminated and we are not able to secure new sponsor banks, we will not be able to conduct our business.

Because we are not a bank, we are not eligible for membership in the Visa, MasterCard and other payment networks, and are, therefore, unable to directly access these payment networks, which are required to process transactions. We are currently registered with payment networks through our sponsor banks.

If these sponsorships are terminated and we are unable to secure a replacement sponsor bank within the applicable wind down period, we will not be able to process electronic payment transactions. While we maintain relationships with multiple sponsor banks for flexibility in the processing of payment volume and in the pricing of our clients’ solutions, the loss of or termination of a relationship with a sponsor bank or a significant decrease in the amount of payment volume that a sponsor bank processes for us could reduce such flexibility and negatively affect our business. To the extent the number of our sponsor banks decreases, we will become increasingly reliant on our remaining sponsor banks, which would materially adversely affect our business should our relationship with any of such remaining banks be terminated or otherwise disrupted. Furthermore, our agreements with our sponsor banks provide the sponsor banks with substantial discretion in approving certain elements of our business practices, including our solicitation, application and underwriting procedures for clients. Our sponsor banks’ actions under these agreements could be detrimental to us.

To acquire and retain clients, we depend on our software integration partners that integrate our services and solutions into software used by our clients.

We rely heavily on the efforts of our software integration partners to ensure our services and solutions are properly integrated into the software that our clients use. Generally, our agreements with software integration partners are not exclusive and these partners retain the right to refer potential clients to other payment processors. In addition, our agreements with

software integration partners do not generally prohibit these partners from providing payment processing solutions to clients (including by acquiring a competing payment processing business).

We may need to provide financial concessions to maintain or enhance relationships with current software integration partners or to attract potential software integration partners from our competitors. We have been required, and expect to be required in the future, to make concessions when renewing contracts with our software integration partners (including when renewing contracts or when needed to incentivize the software integration partner to update or enhance the integration), and such concessions can have a material impact on our financial condition or operating performance.

If our software integration partners focus more heavily on working with other payment processors, acquire or develop their own payment processing capabilities, cease operations or become insolvent, we may be at risk of losing existing clients with whom these software integration partners have relationships. If we are unable to maintain our existing base of software integration partners or develop relationships with new software integration partners, our business, financial condition and results of operations would be materially adversely affected. In addition, our efforts to form relationships with new software integration partners may be hindered to the extent they perceive that integrating with a new payment processor or switching to us from another payment processor is too costly or time-consuming. Many software providers choose to integrate with only a small number of payments processors due to the requisite time and cost of integrating their systems with a payment processor’s solutions.

Failure to effectively manage risk and prevent fraud could increase our chargeback liability and other liability.

We are potentially liable for losses caused by fraudulent card transactions or business fraud. Card fraud occurs when a merchant’s customer uses a stolen card (or a stolen card number in a card-not-present transaction) to purchase merchandise or services. In a traditional card-present transaction, if the merchant swipes the card, receives authorization for the transaction from the card issuing bank and verifies the signature on the back of the card against the paper receipt signed by its customer,

19

the card issuing bank remains liable for any loss. In a fraudulent card-not-present transaction, even if the merchant receives authorization for the transaction, the merchant may be liable for any loss arising from the transaction. In addition, consumers may dispute repayments on a loan by claiming it was unlawful under applicable law.

Business fraud occurs when a business or organization, rather than a cardholder, opens a fraudulent merchant account and conducts fraudulent transactions or when a business, rather than a consumer (though sometimes working together with a consumer engaged in fraudulent activities), knowingly uses a stolen or counterfeit card or card number to record a false sales transaction, intentionally fails to deliver the merchandise or services sold in an otherwise valid transaction, or provides services in violation of applicable law. Business fraud also occurs when employees of businesses change the business demand deposit accounts to their personal bank account numbers, so that payments are improperly credited to the employee’s personal account.

Certain of these types of fraud present potential liability for chargebacks associated with our clients’ processing transactions. If a billing dispute between a client and a consumer is not ultimately resolved in favor of our client, the disputed transaction is “charged back” to the client’s bank and credited to the consumer’s bank. Anytime our client is unable to satisfy a chargeback, we are responsible for that chargeback. We have a number of contractual protections and other means of recourse to mitigate those risks, including collateral or reserve accounts that we may require our clients to maintain for these types of contingencies. Nonetheless, if we are unable to collect the chargeback from the clients’ account or reserve account (if applicable), or if the client refuses or is financially unable due to bankruptcy or other reasons to reimburse us for the chargeback, we bear the loss for the amount of the refund paid to the cardholder’s bank. We have established systems and procedures to detect and reduce the impact of business fraud, but these measures may not be effective, and incidents of fraud could increase in the future. During the year ended December 31, 2021,2023, we believe our chargeback rate was less than 1% of payment volume. Any increase in chargebacks not paid by our clients could have a material adverse effect on our business, financial condition and results of operations.

Our processes to reduce fraud losses depend in part on our ability to restrict the deposit of processing funds while we investigate suspicious transactions. We could be sued by parties alleging that our restriction and investigation processes violate federal and state laws on consumer protection, and unfair business practice.practices or other applicable laws. If we are unable to defend any such claim successfully, we could be required to restructure our anti-fraud processes in ways that would harm our business or pay substantial fines.

As part of our program to reduce fraud losses, we may temporarily restrict the ability of clients to access certain processing deposits if those transactions or their account activity are identified by our anti-fraud models as suspicious. We could be sued by parties alleging that our restriction and investigation processes violate federal and state laws on consumer protection andor unfair business practice.practices. If we are unable to defend any such claim successfully, we could be required to restructure our anti-fraud processes in ways that could harm our business and to pay substantial fines. Even if we are able to

defend a claim successfully, the litigation could damage our reputation, consume substantial amounts of our management’s time and attention, and require us to change our client service and operations in ways that could increase our costs and decrease the effectiveness of our anti-fraud program. In addition, if a client has filed for bankruptcy protection, then our normal processes may be limited by applicable bankruptcy laws.

We receive savings related to favorable pricing or incentives on certain interchange and other payment network fees. To the extent we cannot maintain such savings and cannot pass along any corresponding increases in such fees to our clients, our operating results and financial condition may be materially adversely affected.

We bear interchange, assessment, transaction and other fees set by the payment networks to the card issuing banks and the payment networks for each transaction we process as a merchant acquirer. Under certain circumstances, the payment networks afford us preferential rates or incentives with respect to such fees, which helps us to control our operating costs. From time to time, the payment networks increase the interchange fees and other fees that they charge payment processors and the sponsor banks. At their sole discretion, our sponsor banks have the right to pass any increases in interchange and other fees on to us, and they have consistently done so in the past. We are generally permitted under the contracts into which we enter with our clients, and in the past have been able to, pass these fee increases along to our clients through corresponding increases in our processing fees. However, if we are unable to pass through these and other fees in the future (which could be the result of the structure of “flat rate” or convenience fee pricing under certain contracts), or if the payment networks decline to offer us preferential rates or incentives on such fees as compared to those charged to other payment processors, our business, financial condition and results of operations could be materially adversely affected.

Our systems and those of our third-party providers may fail due to factors beyond our control, which could interrupt our service, resulting in our inability to process payments or provide ancillary services, loss of business, increase in costs and exposure to liability.

20

We depend on the efficient and uninterrupted operation of numerous systems, including our computer network systems, software, data centers and telecommunication networks, as well as the systems and services of our sponsor banks, the payment networks, third-party providers of processing services and other third parties. Our systems and operations, or those of our third-party providers, such as our provider of dial-up authorization services, or the payment networks themselves, could be exposed to damage or interruption from, among other things, hardware and software defects or malfunctions, telecommunications failure, computer denial-of-service and other cyberattacks, unauthorized entry, computer viruses or other malware, human error, natural disaster, power loss, acts of terrorism or sabotage, financial insolvency of such providers and similar events. These threats, and errors or delays in the processing of payment transactions, system outages or other difficulties, could result in failure to process transactions or provide ancillary services, additional operating and development costs, diversion of technical and other resources, loss of revenue, clients and software integration partners, loss of client and cardholderaccountholder data, harm to our business or reputation, exposure to fraud losses or other liabilities and fines and other sanctions imposed by payment networks. Our property and business interruption insurance may not be adequate to compensate us for all losses or failures that may occur.

At present, our critical operational systems, such as our payment gateway, are fully redundant, while certain of our less critical systems are not. Therefore, certain aspects of our operations may be subject to interruption. Also, while we have disaster recovery policies and arrangements in place, they have not been tested under actual disasters or similar events. Maintaining and upgrading our system is costly and time-consuming, involves significant technical risk and may divert our resources from new features and products, and there can be no assurances that such systems will be effective. Frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties and mandatory and costly changes to our business practices.

In addition, we are continually improving and upgrading our information systems and technologies. Implementation of new systems and technologies is complex, expensive and time-consuming. If we fail to timely and successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies, or if such systems and technologies do not operate as intended, this could have an adverse impact on our business, internal controls (including internal controls over financial reporting), results of operations and financial condition.

We rely on other service and technology providers. If such providers fail in or discontinue providing their services or technology to us, our ability to provide services to clients may be interrupted, and, as a result, our business, financial condition and results of operations could be adversely impacted.

We rely on third parties to provide or supplement card processing services and for infrastructure hosting services. We also rely on third parties for specific software and hardware used in providing our products and services. The termination by our service or technology providers of their arrangements with us or their failure to perform their services efficiently and

effectively may adversely affect our relationships with our clients and, if we cannot find alternate providers quickly, may cause those clients to terminate their relationships with us.

Our third-party processors and third-party program managers, which provide us with front-end authorization services, card issuance program services and certain other services, compete with us or may compete with us in the future in the vertical markets that we serve. There can be no assurance that these processors will maintain their relationships with us in the future or that they will refrain from competing directly with the solutions that we offer.

If we are unable to renew our existing contracts with our most significant vendors, we might not be able to replace the related products or services at the same cost, which would negatively impact our profitability. Additionally, while we believe we would be able to locate alternative vendors to provide substantially similar services at comparable rates, or otherwise replicate such services internally, no assurance can be made that a change would not be disruptive to our business, which could potentially lead to a material adverse impact on our revenue and profitability until resolved.

We also rely in part on third parties for the development of and access to new technologies, and updates to existing products and services for which third parties provide ongoing support, which reliance increases the cost associated with new and existing product and service offerings. Failure by these third-party providers to devote an appropriate level of attention to our products and services could result in delays in introducing new products or services, or delays in resolving any issues with existing products or services for which third-party providers provide ongoing support.

We are subject to economic and political risk, the business cycles of our clients and software integration partners and the overall level of consumer and commercial spending, which could negatively impact our business, financial condition and results of operations.

21

The electronic payment industry depends heavily on the overall level of consumer and commercial spending. We are exposed to general economic conditions that affect consumer confidence, consumer spending, consumer discretionary income and changes in consumer purchasing habits, including natural disasters and health emergencies, including earthquakes, fires, power outages, typhoons, floods, pandemics or epidemics (such as the COVID-19 pandemic) and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars and critical infrastructure attacks. A sustained deterioration in general economic conditions, particularly in the United States, continued uncertainty for an extended period of time, due to the COVID-19 pandemicpersistent inflation or otherwise, orfurther increases in interest rates, could adversely affect our financial performance by reducing the number or aggregate volume of transactions made using electronic payments. Our consumer finance and mortgage clients may be disproportionately impacted by further increased interest rates or a general economic downturn, which could result in a decrease to our revenue and profits. If our consumer finance or mortgage clients make fewer sales of products and services using electronic payments,or smaller loans (or their borrowers fail to make required payments), or consumers and businesses spend less money through electronic payments, we will have fewer transactions to process at lower dollar amounts, resulting in lower revenue. Smaller tax refunds to consumers, due to the absence of additional stimulus or similar impacts or otherwise, could also negatively impact our results of operations.

The changesU.S. and international markets are experiencing uncertain and volatile economic conditions, including from the impacts of sustained inflation, recession concerns and supply chain disruptions. These conditions make it extremely difficult for us to accurately forecast and plan future business activities. Together, these circumstances create an environment in the economy as a result of the COVID-19 pandemic has had and maywhich it is challenging for us to predict future operating results. If these uncertain business, macroeconomic or political conditions continue to have various types of impact on our business.  See the risk factor entitled “The continued impact of the COVID-19 outbreak and the measures implemented to mitigate the spread of the virus onor further decline, our business, financial condition and results of operations and financial condition will depend on future developments, which are highly uncertain and largely without precedent.”could be materially adversely affected.

Our risk management policies and procedures may not be fully effective in mitigating our risk exposure in all market environments or against all types of risks associated with providing payment processing solutions.

We operate in a rapidly changing industry. Accordingly, our risk management policies and procedures may not be fully effective to identify, monitor, manage and remediate our risks associated with providing payment processing solutions. Some of our risk evaluation methods depend upon information provided by others and public information regarding markets, clients or other matters that are otherwise inaccessible by us. In some cases, that information may not be accurate, complete or up-to-date. Additionally, our risk detection system is subject to a high degree of “false positive” risks being detected, which makes it difficult for us to identify real risks in a timely manner. If our policies and procedures are not fully effective or we are not always successful in capturing all risks to which we are or may be exposed, we may suffer harm to our reputation or be subject to litigation or regulatory actions that materially increase our costs and limit our ability to grow and may cause us to lose existing clients.

We may not be able to continue to expand our share in our existing vertical markets or continue to expand into new vertical markets, which would inhibit our ability to grow and increase our profitability.

Our future growth and profitability depend, in part, upon our continued expansion within the vertical markets in which we currently operate, the emergence of other vertical markets for electronic payments and our integrated solutions, and our ability to penetrate new vertical markets and our current software integration partners’ client bases. As part of our strategy to expand into new vertical markets and increase our share in our existing vertical markets, we look for acquisition opportunities and partnerships with other businesses that will allow us to increase our market penetration, technological capabilities, product offerings and distribution capabilities. We may not be able to successfully identify suitable acquisition or partnership candidates in the future, and if we do identify them, they may not provide us with the benefits we anticipated. In addition, our ability to continue to grow and profitably service clients in Canada is uncertain and will require additional resources and controls, and we may encounter unanticipated challenges.

Our expansion into new vertical markets also depends on our ability to adapt our existing technology or to develop new technologies to meet the particular needs of each new vertical market. We may not have adequate financial or technological resources to develop effective and secure services or distribution channels that will satisfy the demands of these new vertical markets. Penetrating these new vertical markets may also prove to be more challenging or costly or may take longer than we may anticipate. If we fail to expand into new vertical markets and increase our penetration into existing vertical markets, we may not be able to continue to grow our revenues and earnings.

We may not be able to successfully manage our intellectual property and may beare subject to infringement claims.

We rely on a combination of contractual rights and copyright, trademark, patent and trade secret laws to establish and protect our proprietary technology, which is critical to our success, particularly in our strategic verticals where we may offer proprietary software solutions to our clients. Third parties have, and in the future may, challenge, circumvent, infringe or misappropriate our intellectual property, or such intellectual property may not be sufficient to permit us to take advantage of current market trends or otherwise to provide competitive advantages, which could result in costly redesign efforts, discontinuance of service offerings or other competitive harm. Other parties, including our competitors, may independently develop similar technology and duplicate our services or design around our intellectual property and, in such cases, we may not be able to assert our intellectual property rights against such parties. Further, our contractual arrangements may be subject

22

to termination or renegotiation with unfavorable terms to us, and our third-party licensors may be subject to bankruptcy, insolvency and other adverse business dynamics, any of which might affect our ability to use and exploit the products licensed to us by such third-party licensors. Additionally, our contractual arrangements may not effectively prevent disclosure of our confidential information or provide an adequate remedy in the event of unauthorized disclosure of our confidential information. We may have to litigate to enforce or determine the scope and enforceability of our intellectual property rights and know-how, which is expensive, could cause a diversion of resources and may not prove successful. Also, because of the rapid pace of technological change in our industry, aspects of our business and our services rely on technologies developed or licensed by third parties, and we may not be able to obtain or retain licenses and technologies from these third parties on reasonable terms or at all. The loss of intellectual property protection or the inability to license or otherwise use third-party intellectual property could harm our business and ability to compete.

We mayare also be subject to costly litigation if our services and technology are alleged to infringe upon or otherwise violate a third party’s proprietary rights. Third parties may have, or may eventually be issued, patents that could be infringed by our products, services or technology. AnySome of these third parties have made, and any of these third parties could make in the future, a claim of infringement, breach or other violation of third-party intellectual property rights against us with respect to our products, services or technology. Any claim from third parties may result in a limitation on our ability to use the intellectual property subject to these claims. Additionally, in recent years, individuals and groups have been purchasing intellectual property assets for the sole purpose of making claims of infringement or other violations and attempting to extract settlements from companies like us. Even if we believe that intellectual property related claims are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees. Claims of intellectual property infringement or violation also may require us to redesign affected products or services, enter into costly settlement or license agreements, pay costly damage awards, or face a temporary or permanent injunction prohibiting us from marketing or selling certain of our products or services. Even if we have an agreement for indemnification against such costs, the indemnifying party, if any in such circumstance, may be unable to uphold its contractual obligations. If we cannot or do not license the infringed technology on reasonable terms or substitute similar technology from another source, our revenue and earnings could be adversely impacted.

The loss of key personnel or the loss of our ability to attract, recruit, retain and develop qualified employees, could adversely affect our business, financial condition and results of operations.

We depend on the ability and experience of a number of our key personnel who have substantial experience with our operations, the rapidly changing payment processing industry and the vertical markets in which we offer our products and services. Many of our key personnel have worked for us for a significant amount of time or were recruited by us specifically due to their experience. Our success depends in part upon the reputation and influence within the industry of our senior managers who have, over the years, developed long standing and favorable relationships with our software integration partners, vendors, card associations, sponsor banks and other payment processing and service providers. It is possible that the loss of the services of one or a combination of our senior executives or key managers could have a material adverse effect on our business, financial condition and results of operations. In addition, contractual obligations related to confidentiality assignment of intellectual property rights, non-solicitation and non-competition may be ineffective or unenforceable, and departing employees may share our proprietary information with competitors or seek to solicit our software integration partners or clients or recruit our key personnel to competing businesses in ways that could adversely impact us.

Further, in order for us to continue to successfully compete and grow, we must attract, recruit, develop and retain personnel who will provide us with the expertise we need. Our success also depends on the skill and experience of our sales force, which we must continuously work to maintain. While we have a number of key personnel who have substantial experience with our operations, we must also develop our personnel so that our personnel are capable of maintaining the continuity of our operations, supporting the development of new services and solutions and expanding our client base. The market for qualified personnel is highly competitive, and we may not succeed in recruiting additional personnel or may fail to effectively replace current personnel who depart with qualified or effective successors. Our efforts to retain and develop personnel may also result in significant additional expenses, which could adversely affect our profitability.

We have been the subject of various claims and legal proceedings and may become the subject of claims, litigation or investigations which could have a material adverse effect on our business, financial condition or results of operations.

In the ordinary course of business, we are the subject of various claims and legal proceedings and may become the subject of claims, litigation or investigations, including commercial disputes and employee claims, such as claims of age discrimination, sexual harassment, gender discrimination immigration violations or other local, state and federal labor law violations, and from time to time may be involved in governmental or regulatory investigations or similar matters arising out of our current or future business. Any claims asserted against us or our management, regardless of merit or eventual outcome,

23

could harm our reputation and have an adverse impact on our relationships with our clients, software integration partners and other third parties and could lead to additional related claims. In light of the potential cost and uncertainty involved in litigation, we have in the past and may in the future settle matters even when we believe we have a meritorious defense. Certain claims may seek injunctive relief, which could disrupt the ordinary conduct of our business and operations or increase our costs of doing business. Our insurance or indemnities may not cover all claims that may be asserted against us. Furthermore, there is no guarantee that we will be successful in defending pending or future litigation or similar matters under various laws. Any judgments or settlements in any pending or future claims, litigation or investigations could have a material adverse effect on our business, financial condition and results of operations.

We may not be able to successfully execute our strategy of growth through acquisitions.

A significant part of our growth strategy is to enter into new vertical markets through platform acquisitions of vertically-focused integrated payment and software solutions providers, to expand within our existing vertical markets through selective tuck-in acquisitions and to otherwise increase our presence in the payments processing market.

Although we expect to continue to execute our acquisition strategy:

The occurrence of any of these factors could adversely affect our growth strategy.

Our acquisitions subject us to a variety of risks that could harm our business and the anticipated benefits from our acquisitions may not be realized on the expected timeline or at all.

We may experience various challenges associated with our acquired businesses, such as:

24

These challenges and costs and expenses may adversely affect our business, financial condition and results of operations.

Actual or perceived adverse developments affecting financial institutions could have a material and adverse impact on our business, financial condition or results of operations.

In our business, we maintain relationships with financial institutions in various capacities. Our cash and cash equivalents are held in accounts with banks or other financial institutions that are insured by the Federal Deposit Insurance Corporation (“FDIC”). In most cases, the amounts held in these accounts exceed the FDIC insurance limits. We also rely on financial institutions to act as our sponsor banks in order to enable us to process electronic payment transactions for our clients. In this regard, we maintain relationships with multiple sponsor banks in an effort to secure competitive pricing for our clients and to maintain redundancy. In addition, our clients include credit unions, banks and non-bank lenders who utilize our payment technology solutions in exchange for processing fees.

Since March 2023, Silicon Valley Bank, Signature Bank and First Republic Bank were each closed by their applicable regulators and the FDIC was appointed as receiver. We did not use Silicon Valley Bank, Signature Bank or First Republic Bank for any of our depository or investment accounts nor did we have any payment processing relationships with these particular financial institutions. However, we cannot guarantee that there will not be similar issues with any of the financial institutions with whom we maintain relationships.

The failure of or any other adverse development impacting one or more of our financial institution relationships (or rumors or concerns about such events) could adversely affect our liquidity, our ability to process transactions for our clients or our client relationships. Similarly, our clients could be adversely affected by any bank failure or other adverse event involving

their financial institution relationships, which could result in a decrease in the amount of payment volume we receive from these clients.

Risks Related to Regulation

We and our clients are subject to extensive government regulation, and any new laws and regulations, industry standards or revisions made to existing laws, regulations or industry standards affecting our business, our clients’ businesses or the electronic payments industry, or our or our clients’ actual or perceived failure to comply with such obligations, may have an unfavorable impact on our business, financial condition and results of operations.

We and the clients we serve are subject to numerous federal and state regulations that affect the electronic payments industry. Regulation of our industry has increased significantly in recent years and is constantly evolving. Changes to statutes, regulations or industry standards, including interpretation and implementation of statutes, regulations or standards, could increase our cost of doing business or affect the competitive balance. Failure to comply with regulations may have an adverse effect on our business, including the limitation, suspension or termination of services provided to, or by, third parties, and the imposition of penalties or fines. To the extent these regulations negatively impact the business, operations or financial condition of our clients, our business and results of operations could be materially and adversely affected because, among other matters, our clients could have less capacity to purchase products and services from us, could decide to avoid or abandon certain lines of business, or could seek to pass on increased costs to us by negotiating price reductions. We could be required to invest a significant amount of time and resources to comply with additional regulations or oversight or to modify the manner in which we contract with or provide products and services to our clients; and those regulations could directly or indirectly limit how much we can charge for our services. We may not be able to update our existing products and services, or develop new ones, to satisfy our client’ needs. Any of these events, if realized, could have a material adverse effect on our business, results of operations and financial conditioncondition..

Interchange fees, which are typically paid to the card issuer in connection with credit and debit card transactions, are subject to increasingly intense legal, regulatory and legislative scrutiny. In particular, the Dodd-Frank Act significantly changed the U.S. financial regulatory system by regulating and limiting debit card fees charged by certain issuers, allowing merchants to set minimum dollar amounts for the acceptance of credit cards and allowing merchants to offer discounts or other incentives for different payment methods. These regulations (as well as any related modifications or changes in interpretation) could negatively affect the number of debit transactions, and prices charged per transaction, which would negatively affect our business.

Many of our clients desire to impose a convenience fee or a surcharge in connection with their customers’ use of a credit or debit card or other form of electronic payment. Various state laws and regulations impose prohibitions or other limitations on those types of fees or charges, and interpretation of those state laws and regulations is constantly evolving. State laws and regulations (as well as any related modifications or changes in interpretation in the payment network rules related to those fees and costs) could negatively the willingness of some of our clients to accept credit or debit card or other electronic payment or result in less favorable terms to us in exchange for our clients to absorb those fees and costs, all of which would negatively affect our business.

Laws and regulations, even if not directed at us, may require us to take significant efforts to change our services and solutions and may require that we incur additional compliance costs and change how we price our products and services to our clients and software integration partners. Implementing new compliance efforts is difficult because of the complexity of new regulatory requirements, and we are devoting and will continue to devote significant resources to ensure compliance. Furthermore, regulatory actions may precipitate changes in business practices by us and other industry participants which could affect how we market, price and distribute our products and services, and which could materially adversely affect our business, financial condition and results of operations. In addition, even an inadvertent failure to comply with laws and regulations or evolving public perceptions of our business could damage our business or our reputation.

Depending on how our products and services evolve, we may be subject to a variety of additional laws and regulations, including those governing money transmission, gift cards and other prepaid access instruments, electronic funds

25

transfers, anti-money laundering, counter-terrorist financing, restrictions on foreign assets, gambling, banking and lending, and import and export restrictions.

Our efforts to comply with these laws and regulations could be costly and result in diversion of management time and effort and may still not guarantee compliance. In addition, to the extent we decide to offer our products and services in additional jurisdictions (for example, our expansion into Canada), we may incur additional compliance-related costs with respect to operating in such jurisdictions. Additionally, as our products and services evolve, and as regulators continue to increase their scrutiny of compliance with these obligations, we may be subject to a variety of additional laws and regulations, or we may be

required to further revise or expand our compliance management system, including the procedures we use to verify the identity of our clients and their end customers and to monitor transactions. If we are found to be in violation of any such legal or regulatory requirements, we may be subject to monetary fines or other penalties, such as a cease and desist order, or we may be required to alter the nature or packaging of our services and solutions, any of which could adversely affect our business or operating results.

The businesses of many of our clients are strictly regulated in every jurisdiction in which they operate, and such regulations, and our clients’ failure to comply with them, could have an adverse effect on our clients’ businesses and, as a result, our results of operations.

A meaningful portion of our clients are consumer lenders that provide personal loans and automotive loans to consumers that have varying degrees of credit risk. The regulatory environment that these clients operate in is very complex because applicable regulations are often enacted by multiple agencies in the state and federal governments. For example, the CFPB previously proposed new rules applicable to such loans that could have an adverse effect on our clients’ businesses, and numerous state laws impose similar requirements. Such clients are also subject to negative public perceptions that their consumer lending activities constitute predatory or abusive lending to consumers, and concerns raised by consumer advocacy groups and government officials may lead to efforts to further regulate the industry in which many of our clients operate.

Similarly, our clients in the receivables management industry are typically subject to federal and state rules and regulations that establish specific requirements and procedures that debt collectors must follow when collecting consumer accounts. The CFPB and the FTC devote substantial attention to debt collection activities, and, as a result, the CFPB and the FTC have brought multiple investigations and enforcement actions against debt collectors for violations of the FDCPA and other applicable laws. Continued regulatory scrutiny by the CFPB and the FTC over debt collection practices may result in additional investigations and enforcement actions against our clients in the receivables management industry. The FDCPA also provides for private rights of action against debt collectors, and permits debtors to recover actual damages, statutory damages and attorneys’ fees and costs for violations of its terms.

The combination of these factors, and in particular any changes implemented at the CFPB under the Biden administration, could materially adversely affect the business of our clients and may force our consumer lender or receivables management clients to change their business models. As a result, we may need to be nimble and quickly respond to the evolving needs of the vertical markets that we serve.

If the business of our clients is materially adversely affected by the uncertainties described above and if we or our clients fail to respond to such changes in the industry in a timely manner, or if there are significant changes in such vertical markets that we do not anticipate, our business, financial condition and results of operations would be materially adversely affected.

We may be required to become licensed under state money transmission statutes.

We provide payment processing services through our various operating subsidiaries. We, along with our third party service providers, use structural arrangements designed to remove our activities from the scope of money transmitter regulation. There can be no assurance that these structural arrangements will remain effective as money transmitter laws continue to evolve or that the applicable regulatory bodies, particularly state agencies, will view our payment processing activities as compliant. Any determination that we are in fact required to be licensed under the state money transmission statutes may require substantial expenditures of time and money and could lead to liability in the nature of penalties or fines, which would have a materially adverse effect on our business and our financial results.

We must comply with laws and regulations prohibiting unfair or deceptive acts or practices, and any failure to do so could materially and adversely affect our business.

We and many of our clients are subject to Section 5 of the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and various state laws that are similar in scope and subject matter. In addition, provisions of the

26

Dodd-Frank Act that prohibit unfair, deceptive or abusive acts or practices, the Telemarketing Sales Act and other laws, rules and/or regulations, may directly impact the activities of certain of our clients, and in some cases may subject us, as the electronic payment processor or provider of payment settlement services, to investigations, fees, fines and disgorgement of funds if we are found to have improperly aided and abetted or otherwise provided the means and instrumentalities to facilitate the illegal or improper activities of a client through our services. Various federal and state regulatory enforcement agencies, including the FTC and state attorneys general have authority to take action against non-banks that engage in UDAAP, or violate other laws, rules and regulations. To the extent we are processing payments or providing products and services for a client suspected of

violating such laws, rules and regulations, we may face enforcement actions and incur losses and liabilities that may adversely affect our business.

Governmental regulations designed to protect or limit access to or use of consumer information could adversely affect our ability to effectively provide our products and services.

In addition to those regulations discussed previously that are imposed by the card networks and NACHA, governmental bodies in the United States have adopted, or are considering the adoption of, laws and regulations restricting the use, collection, storage, transfer and disposal of, and requiring safeguarding of, non-public personal information. Our operations are subject to certain provisions of these laws. Applicable federal privacy laws may restrict our collection, processing, storage, use and disclosure of personal information, may require us to notify individuals of our privacy practices and provide individuals with certain rights to prevent the use and disclosure of protected information, and mandate certain procedures with respect to safeguarding and proper description of stored information. Certain state laws impose similar privacy obligations as well as obligations to provide notification of security breaches of personal information to affected individuals, state officers, consumer reporting agencies and businesses and governmental agencies. The applicable regulatory framework for privacy issues is evolving and is likely to continue doing so for the foreseeable future, which creates uncertainty. For example, the California Consumer Privacy Act (“CCPA”) of 2018, which became effective January 1, 2020, imposes more stringent requirements with respect to California data privacy. The CCPA includes provisions that give California residents expanded rights to accessstate privacy law framework is described under “Privacy and delete certain personal information, opt out of certain personal information sharing, and receive detailed information about how certain personal information is used. On November 2, 2020, California voters passed Proposition 24, enacting the California Privacy Rights Act (“CPRA”), which will become effective on January 1, 2023. CPRA amends and expands the CCPA to create additional consumer privacy rights, such as the right of correction and the right to limit the use and disclosure of sensitive personal information.Information Security Regulations” in Item 1. Business above.

Further, we are obligated by our clients, sponsor banks and software integration partners to maintain the confidentiality and security of non-public consumer information that our clients and their end customers share with us. Our contracts may require periodic audits by independent parties regarding our compliance with applicable standards, and may permit our counterparties to audit our compliance with best practices established by regulatory guidelines with respect to confidentiality and security of non-public personal information. Our ability to maintain compliance with these standards and satisfy these audits will affect our ability to attract, grow and maintain business in the future, and any failure to do so could subject us to contractual liability, each of which could have a material effect on our business and results of operations.

If we fail to comply with these laws, regulations or contractual terms, or if we experience security breaches, we could face regulatory enforcement proceedings, suits for breach of contract and monetary liabilities. Additionally, any such failure could harm the relationships and reputation we depend on to retain existing clients and software integration partners and obtain new clients and software integration partners. If federal and state governmental bodies adopt more restrictive privacy laws in the future, our compliance costs could increase, and it could make our due diligence reviews and monitoring regarding the risk of our clients more difficult, complex and expensive. As our business grows, we may also be required to invest in a more substantive and complex compliance management system than the one we currently employ.

Changes in tax laws or their judicial or administrative interpretations, or becoming subject to additional U.S., state or local taxes that cannot be passed through to our clients, could negatively affect our business, financial condition and results of operations.

Our operations are subject to extensive tax liabilities, including federal and state and transactional taxes such as excise, sales/use, payroll, franchise, withholding and ad valorem taxes. Changes in tax laws or their judicial or administrative interpretations could decrease the amount of revenues we receive, the value of any tax loss carryforwards and tax credits recorded on our balance sheet and the amount of our cash flow, and may have a material adverse impact on our business, financial condition and results of operations. Some of our tax liabilities are subject to periodic audits by the applicable taxing authority which could increase our tax liabilities. Furthermore, companies in the payment processing industry, including us, may become subject to incremental taxation in various taxing jurisdictions. Taxing jurisdictions have not yet adopted uniform positions on this topic. If we are required to pay additional taxes and are unable to pass the tax expense through to our clients,

27

our costs would increase and our net income would be reduced, which could have a material adverse effect on our business, financial condition and results of operations.

Failure to maintain effective systems of internal and disclosure control could have a material adverse effect on our results of operation and financial condition.

Following the issuance of SEC guidance relating to warrant accounting, on April 30, 2021, our management and our audit committee concluded that, it was appropriate to restate certain of our previously issued financial statements. As part of such process, we identified a material weakness in our internal controls over financial reporting,which has since been remediated. Effective internal and disclosure controls are necessary for us to provide reliable financial reports and effectively prevent fraud, and to operate successfully as a public company. If we cannot provide reliable financial reports or prevent fraud, our reputation and operating results would be harmed. As part of our ongoing monitoring of internal control, we have discovered in the past and may discover in the future material weaknesses or significant deficiencies in internal control that require remediation. A “material weakness” is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

We have in the past discovered, and may in the future discover, material weaknesses and other areas of our internal controls that need improvement. We continue to work to improve our internal controls. We cannot be certain that these measures will ensure that we implement and maintain adequate controls over our financial processes and reporting in the future. Any failure to maintain effective controls or to timely implement any necessary improvement of our internal and disclosure controls could, among other things, result in losses from fraud or error, harm our reputation, or cause investors to lose confidence in the reported financial information, all of which could have a material adverse effect on our results of operation and financial condition.

We may face litigation and other risks In addition, as a result of the material weakness in our internal control over financial reporting.

As part of our review of accounting and internal controls we undertook in connection with the restatement, we identified a material weakness in our internal controls over financial reporting.

As a result of such material weakness, the restatement described above, the change in accounting for warrants,weaknesses and other matters raised or that may in the future be raised by the SEC, we face potential for litigation or other disputes which may include, among others, claims invoking the federal and state securities laws, contractual claims or other claims arising from the restatement and material weaknesses in our internal controls over financial reporting and the preparation of our financial statements. As of the date of this Form 10-K, we have no knowledge of any such litigation or dispute arising due to restatement or material weakness of our internal controls over financial reporting. However, we can provide no assurance that such litigation or dispute will not arise in the future. Any such litigation or dispute, whether successful or not, could have a material adverse effect on our business, results of operations and financial condition.disputes.

Risks Related to Our Indebtedness

Our level of indebtedness could adversely affect our ability to meet our obligations under our indebtedness, react to changes in the economy or our industry and to raise additional capital to fund operations.

On December 29, 2021, we increased our existing senior secured credit facilities to a $185.0 million revolving credit facility pursuant to an amendment to the revolving credit agreement with Truist Bank and certain other lenders (as amended, the “Amended Credit Agreement”). On January 19, 2021, we issued $440.0 million in aggregate principal amount of our 0.00% convertible senior notes due 2026 (the “2026 Notes”). Our ability to service our obligations under our indebtedness, including the 2026 Notes and any indebtedness we may incur under the Amended Credit Agreement, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control. If we are unable to generate the necessary cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.obligations, and such level of indebtedness could have important consequences to our stockholders.

We may also incur future debt obligations that might subject us to additional restrictive covenants that could affect our financial and operational flexibility.

28

Our indebtedness under the Amended Credit Agreement bears interest at a variable rate, currently based on adjusted LIBOR. LIBOR is expected to be eliminated as a benchmark rate for commercial loans, and the Amended Credit Agreement provides for the replacement of LIBOR with an alternative benchmark rate, which may include term Secured Overnight Financing Rate (“SOFR”). The benchmark replacement may be higher than the adjusted LIBOR currently available under the Amended Credit Agreement, which could in turn increase our interest expense.  Any benchmark replacement may also include administrative and operational changes that affect our borrowing practices under the Amended Credit Agreement.  

Future operating flexibility is limited by the restrictive covenants in the Amended Credit Agreement, and we may be unable to comply with all covenants in the future.

The Amended Credit Agreement imposes restrictions that could impede our ability to enter into certain corporate transactions, as well as increases our vulnerability to adverse economic and industry conditions, by limiting our flexibility in planning for, and reacting to, changes in our business and industry. These restrictions will limit our ability to, among other things:

In addition, the Amended Credit Agreement contains certain negative covenants that restrict the incurrence of indebtedness unless certain incurrence-based financial covenant requirements are met. The restrictions may prevent us from taking actions that we believe would be in the best interests of the business and may make it difficult for us to successfully execute our business strategy or effectively compete with companies that are not similarly restricted. Our ability to comply with these restrictive covenants in future periods will largely depend on our ability to successfully implement our overall business strategy. The breach of any of these covenants or restrictions could result in a default, which could result in the acceleration of our debt. In the event of an acceleration of our indebtedness, we could be forced to apply all available cash flows to repay such debt, which would reduce or eliminate distributions to us, which could also force us into bankruptcy or liquidation.

We may not have the ability to raise the funds necessary to settle conversions of the 2026 Notes, or to repurchase the 2026 Notes upon a fundamental change, and our future debt may contain, limitations on our ability to pay cash upon conversion or repurchase of the 2026 Notes.

Holders of the 2026 Notes have the right to require us to repurchase their 2026 Notes upon the occurrence of a fundamental change at a repurchase price equal to 100% of their principal amount, plus accrued and unpaid interest, if any. In addition, upon conversion of the 2026 Notes, unless we elect to cause to be delivered solely shares of our Class A common stock to settle such conversion, we will be required to make cash payments in respect of the 2026 Notes being converted. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the 2026 Notes surrendered therefor or to pay cash with respect to the 2026 Notes being converted.

In addition, our ability to repurchase the 2026 Notes or to pay cash upon conversion of the 2026 Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase the 2026 Notes at a time when the repurchase is required by the indenture governing the 2026 Notes (the “indenture”) or to pay any cash payable on future conversions of the 2026 Notes as required by the indenture, would constitute a default under the indenture. A default under the indenture, or the fundamental change itself, could also lead to a default under our Amended Credit Agreement and other agreements governing our existing or future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness, repurchase, make interest payments on or make cash payments upon conversion of the 2026 Notes.

The conditional conversion feature of the 2026 Notes, if triggered, may adversely affect our financial condition and operating results.

In the event the conditional conversion feature of the 2026 Notes is triggered, holders of the 2026 Notes will be entitled to convert their 2026 Notes at any time during specified periods at their option. If one or more holders elect to convert their 2026 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock, we would be required to settle a portion or all of our conversion obligation through the payment of cash,

29

which could adversely affect our liquidity. In addition, even if holders do not elect to convert their 2026 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2026 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The accounting method for convertible debt securities that may be settled in cash, such as the 2026 Notes, could have a material effect on our reported financial results.

In May 2008, the Financial Accounting Standards Board, which we refer to as FASB, issued FASB Staff Position No. APB 14-1, Accounting for Convertible Debt Instruments That May Be Settled in Cash Upon Conversion (Including Partial Cash Settlement), which has subsequently been codified as Accounting Standards Codification 470-20, Debt with Conversion and Other Options, which we refer to as Accounting Standards Codification (“ASC”) 470-20. Under ASC 470-20, an entity must separately account for the liability and equity components of the convertible debt instruments (such as the notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost. The effect of ASC 470-20 on the accounting for the 2026 Notes is that the equity component is required to be included in the additional paid-in capital section of shareholders’ equity on our consolidated balance sheet, and the value of the equity component would be treated as original issue discount for purposes of accounting for the debt component of the 2026 Notes. As a result, we will be required to record a greater amount of non-cash interest expense in current periods presented as a result of the amortization of the discounted carrying value of the notes to their face amount over the term of the notes. We will report lower net income (or larger net losses) in our financial results because ASC 470-20 will require interest to include both the current period’s amortization of the debt discount and the instrument’s coupon interest, which could adversely affect our reported or future financial results, the trading price of our common stock and the trading price of the notes. In August 2020, FASB published an Accounting Standards Update 2020-06, which we refer to as ASU 2020-06, eliminating the separate accounting for the debt and equity components as described above. ASU 2020-06 will be effective for us for the fiscal year 2022, including interim periods within fiscal years. When effective, we expect the elimination of the separate accounting described above to reduce the interest expense that we expect to recognize for the 2026 Notes under current accounting principles.

In addition, under certain circumstances, convertible debt instruments (such as the 2026 Notes) that may be settled entirely or partly in cash are currently accounted for utilizing the treasury stock method, the effect of which is that the shares issuable upon conversion of the 2026 Notes are not included in the calculation of diluted earnings per share except to the extent that the conversion value of the notes exceeds their principal amount. Under the treasury stock method, for diluted earnings per share purposes, the transaction is accounted for as if the number of shares of common stock that would be necessary to settle such excess, if we elected to settle such excess in shares, are issued. ASU 2020-06 described above amends these accounting standards, effective as of the date referred to above, to instead require entities to apply the “if-converted” method under which diluted earnings per share are generally calculated assuming that all the 2026 Notes were converted solely into shares of common stock at the beginning of the reporting period, unless the result would be anti-dilutive. The application of the if-converted method may result in a reduction of our reported diluted earnings per share.

Provisions in the indenture could delay or prevent an otherwise beneficial takeover of the Company

Certain provisions of the 2026 Notes and the indenture could make a third party attempt to acquire us more difficult or expensive. For example, if a takeover constitutes a fundamental change, then we will be required to make an offer to the holders of the 2026 Notes to repurchase for cash all or part of their outstanding 2026 Notes. In addition, if a takeover constitutes a make-whole fundamental change, then we may be required to increase the conversion rate temporarily. In either case, and in other cases, our obligations under the 2026 Notes could increase the cost of acquiring us or otherwise discourage a third party from acquiring us or removing incumbent management, including in a transaction that you may view as favorable.

Risks Related to Our Ownership Structure

We are a holding company and our only material asset is our interest in Hawk Parent, and we are accordingly dependent upon distributions made by our subsidiaries to pay taxes, make payments under the Tax Receivable Agreement, meet our financial obligations under the 2026 Notes and pay dividends.

We are a holding company with no material assets other than our ownership of limited liability company interests of Hawk Parent (the “Post-Merger Repay Units” and holders of such Post-Merger Repay Units other than the Company, the “Repay Unitholders”) and our managing member interest in Hawk Parent, and we have no independent means of generating revenue or cash flow. Upon the completion of the Business Combination, we entered into that certain Tax Receivable Agreement (the “Tax Receivable Agreement” or “TRA”) with the Repay Unitholders. Our ability to pay taxes, make payments under the Tax Receivable Agreement, meet our financial obligations under the 2026 Notes and pay dividends will

30

depend on the financial results and cash flows of Hawk Parent and its subsidiaries and the distributions we receive from Hawk Parent. Deterioration in the financial condition, earnings or cash flow of Hawk Parent and its subsidiaries, including its operating subsidiaries, for any reason could limit or impair Hawk Parent’s ability to pay such distributions. Additionally, to the extent that we need funds and Hawk Parent and/or any of its subsidiaries are restricted from making such distributions under applicable law or regulation or under the terms of any financing arrangements, or Hawk Parent is otherwise unable to provide such funds, it could materially adversely affect our liquidity and financial condition.

Hawk Parent is treated as a partnership for U.S. federal income tax purposes and, as such, generally is not subject to any entity-level U.S. federal income tax. Instead, taxable income is allocated to Repay Unitholders (including us). Accordingly, we will be required to pay income taxes on our allocable share of any net taxable income of Hawk Parent. Under the terms of Hawk Parent’s Amended and Restated Operating Agreement, Hawk Parent is obligated to make tax distributions to Repay Unitholders (including us) calculated at certain assumed tax rates. In addition to tax expenses, we will also incur expenses related to our operations, including payment obligations under the Tax Receivable Agreement (and the cost of administering such payment obligations), which could be significant. We intend to cause Hawk Parent to make distributions to Repay Unitholders in amounts sufficient to cover all applicable taxes (calculated at assumed tax rates), relevant operating expenses, payments under the Tax Receivable Agreement and dividends, if any, declared by Hawk Parent. However, as discussed below, Hawk Parent’s ability to make such distributions may be subject to various limitations and restrictions including, but not limited to, restrictions on distributions that would either violate any contract or agreement to which Hawk Parent is then a party, including debt agreements, or any applicable law, or that would have the effect of rendering Hawk Parent insolvent. If our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement and to fund our obligations, we may be required to incur additional indebtedness to provide the liquidity needed to make such payments, which could materially adversely affect our liquidity and financial condition and subject us to various restrictions imposed by any such lenders. To the extent that we are unable to make payments under the Tax Receivable Agreement for any reason, such payments will be deferred and will accrue interest until paid; provided, however, that nonpayment for a specified period may constitute a material breach of a material obligation under the Tax Receivable Agreement and therefore accelerate payments due under the Tax Receivable Agreement.

Additionally, although Hawk Parent generally is not subject to any entity-level U.S. federal income tax, it may be liable under recent federal tax legislation for adjustments to its tax return, absent an election to the contrary. In the event Hawk Parent’s calculations of taxable income are incorrect, its members, including us, in later years may be subject to material liabilities pursuant to this federal legislation and its related guidance.

We anticipate that the distributions we will receive from Hawk Parent may, in certain periods, exceed our actual tax liabilities and obligations to make payments under the Tax Receivable Agreement. Our board of the directors, in its sole discretion, will make any determination from time to time with respect to the use of any such excess cash so accumulated, which may include, among other uses, to acquire additional newly issued Post-Merger Repay Units from Hawk Parent at a per unit price determined by reference to the market value of the Class A common stock; to pay dividends, which may include special dividends, on our Class A common stock; to fund repurchases of Class A common stock; or any combination of the foregoing. We will have no obligation to distribute such cash (or other available cash other than any declared dividend) to our stockholders. To the extent that we do not distribute such excess cash as dividends on Class A common stock or otherwise undertake ameliorative actions between Post-Merger Repay Units and shares of Class A common stock and instead, for example, hold such cash balances, Repay Unitholders that hold interests in Hawk Parent pre-Business Combination may benefit from any value attributable to such cash balances as a result of their ownership of Class A common stock following an exchange of their Post-Merger Repay Units, notwithstanding that such holders may previously have participated as holders of Post-Merger Repay Units in distributions by Hawk Parent that resulted in such excess cash balances being held by us.

Dividends on our common stock, if any, will be paid at the discretion of our board of directors, which will consider, among other things, our business, operating results, financial condition, current and expected cash needs, plans for expansion and any legal or contractual limitations on our ability to pay such dividends. Financing arrangements may include restrictive covenants that restrict our ability to pay dividends or make other distributions to our stockholders. In addition, Hawk Parent is generally prohibited under Delaware law from making a distribution to a member to the extent that, at the time of the distribution, after giving effect to the distribution, liabilities of Hawk Parent (with certain exceptions) exceed the fair value of its assets. Hawk Parent’s subsidiaries are generally subject to similar legal limitations on their ability to make distributions to Hawk Parent. If Hawk Parent does not have sufficient funds to make distributions, our ability to declare and pay cash dividends may also be restricted or impaired.

Under the Tax Receivable Agreement, we will be required to pay 100% of the tax benefits relating to tax depreciation or amortization deductions as a result of the tax basis step-up we receive in connection with the exchanges (including an

31

exchange in a sale for cash) of Post-Merger Repay Units into our Class A common stock and related transactions, and those payments may be substantial.

The Repay Unitholders may exchange their Post-Merger Repay Units for shares of Class A common stock pursuant to the Exchange Agreement, subject to certain conditions as set forth therein and in Hawk Parent’s Amended and Restated Operating Agreement, or in an exchange in a sale for cash. These exchanges are expected to result in increases in our allocable share of the tax basis of the tangible and intangible assets of Hawk Parent. These increases in tax basis may increase (for tax

purposes) depreciation and amortization deductions and therefore reduce the amount of income or franchise tax that we would otherwise be required to pay in the future had such exchanges never occurred.

In connection with the Business Combination, we entered into the Tax Receivable Agreement, which generally provides for the payment to the Repay Unitholders by us of 100% of certain tax benefits, if any, that we realize (or in certain cases are deemed to realize) (a portion of which will be paid in turn to certain service providers on behalf of them in respect of certain transaction expenses) as a result of these increases in tax basis and certain other tax attributes of Hawk Parent and tax benefits related to entering into the Tax Receivable Agreement, including tax benefits attributable to payments under the Tax Receivable Agreement. These payments are our obligation and not an obligation of Hawk Parent. The actual increase in our allocable share of Hawk Parent’s tax basis in its assets, as well as the amount and timing of any payments under the Tax Receivable Agreement, will vary depending upon a number of factors, including the timing of exchanges, the market price of the Class A common stock at the time of the exchange, the extent to which such exchanges are taxable and the amount and timing of the recognition of our income. While many of the factors that will determine the amount of payments that we will make under the Tax Receivable Agreement are outside of our control, we expect that the payments we will make under the Tax Receivable Agreement will be substantial and could have a material adverse effect on our financial condition. Any payments made by us under the Tax Receivable Agreement will generally reduce the amount of overall cash flow that might have otherwise been available to us. To the extent that we are unable to make timely payments under the Tax Receivable Agreement for any reason, the unpaid amounts will be deferred and will accrue interest until paid. Furthermore, our future obligation to make payments under the Tax Receivable Agreement could make us a less attractive target for an acquisition, particularly in the case of an acquirer that cannot use some or all of the tax benefits that may be deemed realized under the Tax Receivable Agreement.

In certain cases, payments under the Tax Receivable Agreement may exceed the actual tax benefits we realize or be accelerated.

Payments under the Tax Receivable Agreement will be based on the tax reporting positions that we determine, and the Internal Revenue Service or another taxing authority may challenge all or any part of the tax basis increases, as well as other tax positions that we take, and a court may sustain such a challenge. In the event any tax benefits initially claimed by us are disallowed, the current Repay Unitholders will not be required to reimburse us for any excess payments that may previously have been made under the Tax Receivable Agreement, for example, due to adjustments resulting from examinations by taxing authorities. Rather, excess payments made to such holders will be netted against any future cash payments otherwise required to be made by us, if any, after the determination of such excess. However, a challenge to any tax benefits initially claimed by us may not arise for a number of years following the initial time of such payment or, even if challenged early, such excess cash payment may be greater than the amount of future cash payments that we might otherwise be required to make under the terms of the Tax Receivable Agreement and, as a result, there might not be future cash payments from which to net against. As a result, in certain circumstances, we could make payments under the Tax Receivable Agreement in excess of our actual income or franchise tax savings, which could materially impair our financial condition.

Moreover, the Tax Receivable Agreement provides that, in the event that (i) we exercise our early termination rights under the Tax Receivable Agreement, (ii) we become bankrupt or undergo a similar insolvency event, (iii) certain changes of control of us occur (as described in the Tax Receivable Agreement) or (iv) we are more than three months late in making of a payment due under the Tax Receivable Agreement (unless we in good faith determine that we have insufficient funds to make such payment), our obligations under the Tax Receivable Agreement will accelerate and we will be required to make an immediate lump-sum cash payment to the Repay Unitholders equal to the present value of all forecasted future payments that would have otherwise been made under the Tax Receivable Agreement, which lump-sum payment would be based on certain assumptions, including those relating to our future taxable income. The lump-sum payment to the Repay Unitholders could be substantial and could exceed the actual tax benefits that we realize subsequent to such payment because such payment would be calculated assuming, among other things, that we would be able to use the assumed potential tax benefits in future years, and that tax rates applicable to us would be the same as they were in the year of the termination.

There may be a material negative effect on our liquidity if the payments under the Tax Receivable Agreement exceed the actual income or franchise tax savings that we realize. Furthermore, our obligations to make payments under the

32

Tax Receivable Agreement could also have the effect of delaying, deferring or preventing certain mergers, asset sales, other forms of business combinations or other changes of control. We may need to incur additional indebtedness to finance payments under the Tax Receivable Agreement to the extent our cash resources are insufficient to meet our obligations under the Tax Receivable Agreement as a result of timing discrepancies or otherwise. Such indebtedness may have a material adverse effect on our financial condition.

Risks Related to our Class A Common Stock

Future issuances or sales of substantial amounts of our Class A common stock in the public market, or the perception that such issuances or sales may occur, could cause the market price for our Class A common stock to decline.

Hawk Parent has outstanding an aggregate of 7,926,5765,844,095 Post-Merger Repay Units as of February 22, 2022.2024. Pursuant to the Exchange Agreement, Repay Unitholders have the right to elect to exchange such Post-Merger Repay Units into shares of our Class A common stock on a one-for-one basis, subject to the terms of the Exchange Agreement. However, Hawk Parent may elect to settle such exchange in cash in lieu of delivering shares of our Class A common stock pursuant to the terms of the Exchange Agreement.

In addition, we have reserved a total of 7,326,72813,826,728 shares of Class A common stock for issuance under our Repay Holdings Corporation Omnibus Incentive Plan (as amended, the “Incentive Plan.”). Of these shares, 1,948,253 shares of Class A common stock remain available for future issuance under the Incentive Plan as of February 22, 2022. To the extent such shares have vested or vest in the future (and settle into shares, in the case of restricted stock units), they can be freely sold in the public market upon issuance, subject to volume limitations applicable to affiliates.

If these stockholders exercise their sale or exchange rights and sell shares or are perceived by the market as intending to sell shares, the market price of our shares of Class A common stock could drop significantly. These factors could also make it more difficult for us to raise additional funds through offerings of our shares of Class A common stock or other securities at a time and at a price that we deem appropriate.

We also have outstanding $440.0 million aggregate principal amount of our 2026 Notes which are convertible into shares of our Class A common stock in certain circumstances. Investors will incur further dilution upon the conversion of any of our 2026 Notes if we elect to deliver shares of Class A common stock upon such conversion. In the future, we may also issue additional securities in connection with investments, acquisitions or capital raising activities, which could constitute a material portion of our then-outstanding shares of our Class A common stock and may result in additional dilution to investors or adversely impact the price of our Class A common stock.

Our stock price may be volatile, which could negatively affect our business and operations.

Historically, our Class A common stock has experienced substantial price volatility. For example, the closing price per share of our Class A common stock on The Nasdaq Capital Market ranged from a low of $16.05$5.68 to a high of $26.93$10.29 during the period from January 4, 20213, 2023 to December 31, 2021.29, 2023. This volatility could be the result of changes in our volumes, revenue, earnings and margins or general market and economic factors. If our future operating results or margins are below the expectations of stock market analysts or our investors, our stock price will likely decline.

Speculation and opinions in the press or investment community about our strategic position, financial condition, results of operations or significant transactions can also cause changes in our stock price. In particular, speculation on our go-forward strategy, competition in some of the markets we address and the effect of COVID-19general economic and political conditions (such as recession concerns, interest rate changes and inflation) on our business, may have a dramatic effect on our stock price.

Volatility in the stock price of our common stock or other reasons may in the future cause us to become the target of securities litigation or shareholder activism. Securities litigation and shareholder activism, including potential proxy contests, could result in substantial costs and divert management’s and board of directors’ attention and resources from our business. Additionally, such securities litigation and shareholder activism could give rise to perceived uncertainties as to our future, adversely affect our relationships with service providers and make it more difficult to attract and retain qualified personnel. Also, we may be required to incur significant legal fees and other expenses related to any securities litigation andor activist shareholder matters.

Because we do not currently intend to pay dividends, holders of our Class A common stock will benefit from an investment in our Class A common stock only if it appreciates in value.

33

We have never declared or paid any dividends on our Class A common stock, and do not expect to pay cash dividends in the foreseeable future. As a result, the success of an investment in our common stock will depend entirely upon future appreciation in its value. There is no guarantee that our Class A common stock will maintain its value or appreciate in value.

Delaware law and our governing documents contain certain provisions, including anti-takeover provisions that limit the ability of stockholders to take certain actions and could delay or discourage takeover attempts that stockholders may consider favorable.

Our certificate of incorporation, bylaws and Delaware General Corporation Law (“DGCL”) contain provisions that could have the effect of rendering more difficult, delaying, or preventing an acquisition deemed undesirable by our board of directors and therefore depress the trading price of our Class A common stock. These provisions could also make it difficult for stockholders to take certain actions, including electing directors who are not nominated by the current members of our board of directors or taking other corporate actions, including effecting changes in management. Among other things, our certificate of incorporation and bylaws include provisions regarding:

In addition, as a Delaware corporation, we are generally subject to provisions of Delaware law, including the DGCL. Although we have elected not to be governed by Section 203 of the DGCL, certain provisions of our certificate of

34

incorporation, in a manner substantially similar to Section 203 of the DGCL, prohibit certain of our stockholders (other than those stockholders who are party to a stockholders’ agreement with us) who hold 15% or more of our outstanding capital stock from engaging in certain business combination transactions with us for a specified period of time unless certain conditions are met.

Our certificate of incorporation designates a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.

Our certificate of incorporation provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware, or if such court does not have subject matter jurisdiction, any other court located in the State of Delaware with subject matter jurisdiction, will be the sole and exclusive forum for (i) any derivative action or proceeding brought on behalf of us, (ii) any action asserting a claim of breach of a fiduciary duty owed by any of our current or former directors, officers, other employees or stockholders to us or our stockholders, (iii) any action asserting a claim against us or our officers or directors arising pursuant to any provision of the DGCL or our certificate of incorporation or bylaws or as to which the DGCL confers jurisdiction on the Court of Chancery of the State of Delaware, or (iv) any action

asserting a claim against us or any of our directors or officers governed by the internal affairs doctrine of the law of the State of Delaware.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities will be deemed to have notice of and consented to this provision. These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us or our directors, officers, and other employees. If a court were to find these exclusive-forum provisions to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

ITEM 1B. UNRESOLVED STAFF COMMENTS.

None.

ITEM 1C. CYBERSECURITY.

We recognize the importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), has day-to-day responsibility for our cybersecurity programs. Due to the critical risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

Risk Management and Strategy

Risk Identification and Assessment

We have adopted processes and procedures, including those described below to identify cybersecurity risks and events. Our CISO maintains a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.

Risk Management

Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the “SIRP”) that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business.

We have implemented hiring, onboarding and termination procedures that are designed to ensure our employees and contractors assist us in meeting our cybersecurity compliance objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.

We have implemented a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. We utilize a combination of third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

Third Parties

We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. We also rely on these third party firms for educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors’ financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.

Risks from Cybersecurity Threats

While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See “Risk Factors” above.

Governance

Board of Directors Oversight

Our board of directors established a technology committee (the “Technology Committee”) to oversee the risks from cybersecurity threats. The Technology Committee is currently comprised of three independent directors and chaired by Maryann Goebel, who was awarded the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD). Our CTO works closely with the Technology Committee to develop the meeting agenda and to prepare the relevant materials for each committee meeting. The Technology Committee typically reviews an updated version of the cybersecurity risk assessment program (described above) at each meeting. The Technology Committee receives and reviews cybersecurity incidents that are reported in accordance with the SIRP and our other procedures. The Technology Committee typically meets on a quarterly basis. The Chairperson of the Technology Committee makes a regular report to our board of directors following each meeting of the Technology Committee. Our board of directors retains ultimate responsibility for the oversight of the major risks inherent in our business, including risks from cybersecurity threats.

Management’s Role

We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business. The Security and Privacy Steering Committee’s responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices. The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer). The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department. Our CTO also currently serves as a member of the Security and Privacy Steering Committee.

Our CISO is responsible for managing any cybersecurity incidents under the SIRP and coordinating with our senior management. The SIRP includes a process under which senior leaders from our information security, legal and accounting teams will assess the impact and significance of a cybersecurity incident to determine any necessary external notifications or filings. The SIRP also contains parameters regarding the requirements and timing for notifications of certain cybersecurity incidents to our board of directors.

Our CISO has served in various roles in information security, information technology and engineering operations for over 25 years. Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school. He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2). Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years. Our CTO’s prior experience includes serving as the Chief Information Officer and Chief Information Security Officer of a public company and as Chief Technology Officer of a separate public company.

ITEM 2. PROPERTIES.

The following table sets forth selected information concerning our principal facilities, as of December 31, 2021.2023.

35

ITEM 3. LEGAL PROCEEDINGS.

We are currently not a party to any legal proceedings that would be expected to have a material adverse effect on our business or financial condition. From time to time, we may be subject to litigation incidental to our business, as well as other litigation of a non-material nature in the ordinary course of business.

ITEM 4. MINE SAFETY DISCLOSURE.

Not applicable.

PART II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED SHAREHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES.

Market Information

Our Class A common stock is traded on Nasdaq under the symbol “RPAY”. As of February 22, 2022,2024, the closing price for our Class A common stock was $17.22.$8.33.

Market price information regarding our Class V common stock and Post-Merger Repay Units is not provided because there is no public market for our Class V common stock or our Post-Merger Repay Units.

Holders

As of February 22, 2022,2024, there were 1214 holders of record of our Class A common stock, 2419 holders of record of our Class V common stock and 2419 holders of record of Post-Merger Repay Units (not including the Company). The number of record holders does not include beneficial owners of our securities whose shares are held in the names of various security brokers, dealers and registered clearing agencies.

Dividends

We have never declared or paid cash dividends on our Class A common stock. We currently do not intend to pay cash dividends in the foreseeable future.

Performance

The following graph compares the total shareholder return from July 17,December 31, 2018 the date on which our Class A common shares commenced trading on the Nasdaq, through December 31, 20212023 of (i) our Class A common stock, (ii) the Standard and Poor’s 500 Stock Index (“S&P 500 Index”) and (iii) the Standard and Poor’s 500 Information Technology Index (“S&P Information Technology Index”). The stock performance graph and table assume an initial investment of $100 on July 17,December 31, 2018 and that all dividends of the S&P 500 Index and S&P Information Technology Index, were reinvested.

The performance graph and table are not intended to be indicative of future performance. The performance graph and table shall not be deemed “soliciting material” or to be “filed” with the SEC for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liabilities under that Section, and shall not be deemed to be incorporated by reference into any of our filings under the Securities Act of 1933 or the Exchange Act.

36

Recent Sales of Unregistered Securities

None.

37

Purchases of Equity Securities by the Issuer and Affiliated Purchasers

In connection with the vesting of restricted stock awards, sharesThe following table summarizes purchases of Class A common stock are delivered tomade by the Company by employeesor any “affiliated purchaser” (as defined in Rule 10b-18(a)(3) of the Exchange Agent) in connection with tax withholdings, under the ESPP and pursuant to satisfy tax withholding obligations. The following table summarizes such purchases of Class A common stockour share repurchase program for the three months ended December 31, 2021:2023:

ITEM 6. [Reserved].

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS.

The following discussion and analysis of financial condition and results of operations should be read together with our audited consolidated financial statements and the related notes to those statements included under Item 8, hereof. For purposes of this section, "Repay", the “Company", "we", or "our" refer to (i) Hawk Parent Holdings, LLC and its subsidiaries ("Predecessor") for the period from January 1, 2019 through July 10, 2019 (each referred to herein as a "Predecessor Period") prior to the consummation of the Business Combination and (ii) Repay Holdings Corporation and its subsidiaries, (the "Successor ") for the period from July 11, 2019 through December 31, 2019 (the "Successor Period"), the year ended December 31, 2020, and the year ended December 31, 2021 after the consummation of the Business Combination, unless the context otherwise requires. Certain figures have been rounded for ease of presentation and may not sum due to rounding. The combined year ended December 31, 2019 represents the aggregated total of the Predecessor Period and Successor Period.

Cautionary Note Regarding Forward-Looking Statements

Statements under “Management’s Discussion and Analysis of Financial Condition and Results of Operations” regarding our financial position, business strategy and the plans and objectives of management for future operations, are forward-looking statements. Actual results could differ materially from those contemplated by the forward-looking statements as a result of certain factors, including those set forth under Part I, Item 1A “Risk Factors” in this Annual Report on Form 10-K.

Overview

We provide integrated payment processing solutions to industry-oriented markets in which clients have specific transaction processing needs. We refer to these markets as “vertical markets” or “verticals.” Our proprietary, integrated payment technology platform reduces the complexity of the electronic payments process for businesses, while enhancing their consumers’ overall experience. We are a payments innovator, differentiated by our proprietary, integrated payment technology platform and our ability to reduce the complexity of the electronic payments for businesses. We intend to continue to strategically target verticals where we believe our ability to tailor payment solutions to our client needs, our deep knowledge of our vertical markets and the embedded nature of our integrated payment solutions will drive strong growth by attracting new clients and fostering long-term client relationships.

Since a significant portion of our revenue is derived from volume-based payment processing fees, card payment volume is a key operating metric that we use to evaluate our business. We processed approximately $20.5$25.7 billion of total card payment volume for the year ending December 31, 2021,2023, and our year-over-year card payment volume growth was approximately 35%0.1%. This increase was the result of newly signed clients and the growth of our existing clients, partially offset by a decrease in our media payments business due to the cyclical political media spending associated with the 2022 mid-term elections in the prior period.

We report our financial results based on two reportable segments.

Consumer Payments – Our Consumer Payments segment provides payment processing solutions (including debit and credit card processing, ACH processing and other electronic payment acceptance solutions, as well as our loan disbursement product) that enable our clients to collect payments and disburse funds to consumers and includes our RCS offering. RCS is our proprietary clearing and settlement platform through which we market customizable payment processing programs to other ISOs and payment facilitators. Our Consumer Payments segment also previously included our BCS business, which was sold on February 15, 2023. The ultimate impacts ofstrategic vertical markets served by our Consumer Payments segment primarily include personal loans, automotive loans, receivables management, credit unions, mortgage servicing, consumer healthcare and diversified retail.

Business Payments – Our Business Payments segment provides payment processing solutions (including accounts payable automation, debit and credit card processing, virtual credit card processing, ACH processing and other electronic payment acceptance solutions) that enable our clients to collect or send payments to other businesses. The strategic vertical markets served within our Business Payments segment primarily include retail automotive, education, field services, governments and municipalities, healthcare, HOA management and hospitality.

Macroeconomic Conditions

We have been monitoring the COVID-19 pandemiccurrent economic environment in the U.S. and related economicglobally – characterized by heightened inflation (including changes in wages), rising interest rates, supply chain issues, slower growth and recent banking system volatility. Such macroeconomic conditions on our results remain uncertain. The scope, duration and magnitude of the direct and indirect effects of the COVID-19 pandemicmay continue to evolve and in ways that are difficult to fully anticipate. Atanticipate and may also include increased levels of unemployment and/or a recession. Some or all of these market factors have and could continue to adversely affect our payment volumes from the consumer loan market, the receivables management industry and consumer and commercial spending. The effect of these events on our financial condition, results of operations and cash flows is uncertain

and cannot be predicted at this time, we cannot reasonably estimate the full impact of the pandemic on the Company, given the uncertainty over the duration and severity of the economic crisis. In addition,time. Finally, the impact of COVID-19all of these various events on our results in 20212023 may not be necessarily indicative of itstheir impact on our results in 2022.2024.

Business Combination

The Company was formed upon closing of the merger (the “Business Combination”) of Hawk Parent Holdings LLC (together with Repay Holdings, LLC and its other subsidiaries, “Hawk Parent”) with a subsidiary of Thunder Bridge Acquisition, Ltd., (“Thunder Bridge”), a special purpose acquisition company, on July 11, 2019. On the closing of the Business Combination, Thunder Bridge changed its name to “Repay Holdings Corporation.”

As a result of the Business Combination, Thunder Bridge was identified as the acquirer for accounting purposes, and Hawk Parent, which is the business conducted prior to the closing of the Business Combination, is the acquiree and accounting Predecessor. The acquisition was accounted for as a business combination using the acquisition method of accounting, and the Successor’s financial statements reflect a new basis of accounting that is based on the fair value of net assets acquired. As a result of the application of the acquisition method of accounting as of the effective time of the Business Combination, the financial statements for the Predecessor period and for the Successor period are presented on different bases. The historical financial information of Thunder Bridge prior to the Business Combination has not been reflected in the Predecessor period financial statements.

39

Key Factors Affecting Our Business

Key factors that we believe impact our business, results of operations and financial condition include, but are not limited to, the following:

Recent Acquisitions

On June 15, 2021, we completed the acquisition of BillingTree for approximately $505.8 million, consisting of approximately $277.5 million in cash from our balance sheet and approximately 10 million shares of newly issued Class A common stock, representing approximately 10% of the voting power of our outstanding shares of common stock at that time. See Note 5 to the audited consolidated financial statements included elsewhere in this Annual Report on Form 10-K.

On June 22, 2021, we completed the acquisition of Kontrol LLC (“Kontrol”) for up to $10.5 million, of which approximately $7.4 million was paid at closing. The acquisition was financed with cash on hand. See Note 5 to the audited consolidated financial statements included elsewhere in this Annual Report on Form 10-K.

On December 29, 2021, we completed the acquisition of Payix for up to $115.0 million, which includes $95.6 million paid at closing and up to $20.0 million in performance-based earnouts. The acquisition was financed with cash on hand and available revolver capacity.

Key Components of Our Revenues and Expenses

Revenues

Revenue. As our clients process increased volumes of payments, our revenues increase as a result of the fees we charge for processing these payments. Most of our revenues are derived from volume-based payment processing fees (“discount fees”) and other related fixed per transaction fees. Discount fees represent a percentage of the dollar amount of each credit or debit transaction processed and include fees relating to processing and services that we provide. The transaction price for such processing services areis determined, based on the judgment of our management, considering factors such as margin objectives, pricing practices and controls, client segment pricing strategies, the product life cycle and the observable price of the service charged to similarly situated clients. We believe ourOur chargeback rate was less than 1% of our card payment volume, during the years ended December 31, 2021, 20202023, 2022 and 2019.2021.

Expenses

Other costsCosts of services. Other costsCosts of services primarily include commissions to our software integration partners and other third-party processing costs, such as front and back-end processing costs and sponsor bank fees.

Selling, general and administrative. Selling, general and administrative expenses include salaries, share-based compensation and other employment costs, professional service fees, rent and utilities and other operating costs.

Depreciation and amortization. Depreciation expense consists of depreciation on our investments in property, equipment and computer hardware. Depreciation expense is recognized on a straight-line basis over the estimated useful life of the asset. Amortization expense for software development costs and purchased software is recognized on the straight-line method over a three-year estimated useful life, between eight to ten years estimated useful life for client relationships and channel relationships, and between two to five years estimated useful life for non-compete agreements.

Interest expense. Prior to the closing of the Business Combination, interest expense consisted of interest in respect of our indebtedness under our Predecessor Credit Agreement (as defined below), which was terminated in connection with the

40

closing of the Business Combination.(expense) income, net. In periods after the closing of the Business Combination, interestInterest expense consists of interest paid in respect of our indebtedness under the Successor Credit Agreement (as defined below), which was entered into in connection with the Business Combination, and the Amended Credit Agreement, which replaced the Successor Credit Agreement in February 2021.

Change in fair valueAgreement. Interest income consists of warrant liabilities. This amount represents the change in fair value of the warrant liabilities. The warrant liabilities are carried at fair value; so, any change to the valuation of this liability is recognized through this line in other expense. The change in fair value results from the change of underlying publicly listed trading price ofinterest received on our Class A common stock at each measurement date.cash and cash equivalents.

Change in fair value of tax receivable liability. This amount represents the change in fair value of the tax receivable agreement liability. The TRA liability is carried at fair value; so, any change to the valuation of this liability is recognized through this line in other expense. The change in fair value can result from the redemption or exchange of Post-Merger Repay Units for Class A common stock of Repay Holdings Corporation, or through accretion of the discounted fair value of the expected future cash payments.payments, or changes to the discount rate, or Early Termination Rate, used to determine the fair value of the liability.

Results of Operations

Year Ended December 31, 20212023 Compared to Year Ended December 31, 20202022

Revenue

Total revenue was $219.3 million for the year ended December 31, 2021 and $155.0$296.6 million for the year ended December 31, 2020,2023 and $279.2 million for the year ended December 31, 2022, an increase of $64.3$17.4 million or 41.4%6.2%. This increase was the result of newly signed clients and the growth of our existing clients, as well aspartially offset by a decrease in our media payments business due to the acquisitions of BillingTree and Kontrol.cyclical political media spending associated with the 2022 mid-term elections in the prior period. For the year ended December 31, 2021,2022, incremental revenues of approximately $42.7$8.6 million are attributable to BillingTree, Kontrol and Payix.BCS.

41

Costs of Services

Costs of services were $55.5$69.7 million for the year ended December 31, 20212023 and $41.4$64.8 million for the year ended December 31, 2020,2022, an increase of $14.1$4.9 million or 33.9%7.5%. This increase was the result of newly signed clients and the growth of our existing clients, partially offset by a decrease in our media payments business due to the cyclical political media spending associated with the 2022 mid-term elections in the prior period. For the year ended December 31, 2020,2022, incremental costs of services of approximately $8.4$0.2 million are attributable to BillingTree, Kontrol and Payix.BCS.

Selling, General and Administrative

Selling, general and administrative expenses were $120.1$148.7 million for the year ended December 31, 20212023 and $87.3$149.1 million for the year ended December 31, 2020, an increase2022, a decrease of $32.8$0.4 million or 37.5%. This increase was0.3%, primarily due to increaseda $4.9 million decrease in legal expenses related to settlement payments to certain clients and partners in the prior year period and a $0.7 million decrease in transaction expenses, offset by a $1.9 million increase in equity compensation expenses with general business growthexpense related to restricted shares and increased expenses relating tostock options granted and a $1.9 million increase in software and technological services.services expenses related to the integration of acquired businesses.

Depreciation and Amortization

Depreciation and amortization expenses were $89.7$103.9 million for the year ended December 31, 20212023 and $60.8$107.8 million for year ended December 31, 2020, an increase2022, a decrease of $28.9$3.9 million or 47.5%3.6%. This decrease was driven by a significant component of capitalized software related to the Business Combination being fully amortized in the prior year, partially offset by additional amortization related to newly capitalized software.

Loss on business disposition

We incurred a loss on business disposition of $10.0 million for the year ended December 31, 2023 related to the sale of BCS.

Impairment Loss

We incurred an impairment loss of $75.8 million for the year ended December 31, 2023, due to a $75.7 million goodwill impairment loss related to the Business Payments segment and a $0.1 million trade name write-off related to Media Payments. The increasefair value of the Business Payments reporting unit was primarily impacted by a change in the discount rate. We incurred an impairment loss of $8.1 million for the year ended December 31, 2022, due to depreciationtrade names write-offs related to BillingTree, Kontrol and amortization of fixed assetsPayix. These trade names were strategically phased out, and intangibles fromservice offerings are marketed under the acquisitions of BillingTreeREPAY name. See Note 8. Intangible Assets and Kontrol.Note 9. Goodwill for more information.

Change in Fair Value of Contingent Consideration

Change in the fair value of contingent consideration was $5.8 million$0 for the year ended December 31, 2021, which consisted of fair value adjustments related2023, due to theall contingent consideration for the acquisitions of Ventanex, CPS, BillingTree and Kontrol.considerations being settled in March 2023.

Impairment LossInterest (Expense) Income, net

We incurred an impairment loss of $2.2Interest (expense) income, net was ($1.0) million for the year ended December 31, 2021, due to trade names write-offs related to TriSource, APS, Ventanex, cPayPlus2023, and CPS.

included ($3.8) million of interest expense and $2.8 million of interest income. Interest Expense