Nayax - 20-F annual report 2023

Unless otherwise indicated or the context otherwise requires, all references in this annual report to “Nayax” or the “Company,” “we,” “our,” “ours,” “us” or similar terms refer to Nayax Ltd., together with its consolidated subsidiaries. The term “NIS” refer to the lawful currency of the State of Israel, the terms “dollar,” “U.S. Dollar,” “US$” and “$” refer to the lawful currency of the United States, the terms “Euro,” “EUR” and “€” and refer to the lawful currency of the European Union, the terms “Australian Dollar” and “AUD” refer to the lawful currency of Australia and the term “British Pound” refers to the lawful currency of the United Kingdom. Unless derived from our financial statements or otherwise indicated, U.S. dollar translations of NIS amounts presented in this annual report are translated using the rate of NIS 3.6270 to US$1.00, the exchange rate reported by the Bank of Israel on December 31, 2023.

We maintain our books and records in U.S. dollars and prepare our consolidated financial statements in accordance with International Financial Reporting Standards (“IFRS”) as issued by the International Accounting Standards Board (“IASB”). The financial information contained in this annual report includes our audited consolidated statements of financial position as of December 31, 2023 and 2022 and related audited consolidated statements of profit or loss, comprehensive income (loss), changes in equity and cash flows for each of the three years in the period ended December 31, 2023, which have been audited by Kesselman and Kesselman, a member of PricewaterhouseCoopers International Limited.

Our fiscal year ends December 31. References in this annual report to a fiscal year, such as “fiscal year 2023,” relates to our fiscal year ended on December 31 of that calendar year.

The financial information should be read in conjunction with “Item 5. Operating and Financial Review and Prospects” and our consolidated financial statements, including the related notes thereto, included elsewhere in this annual report.

On September 1, 2022, our shareholders approved a 10-to-1 reverse share split (the “2022 Reverse Share Split”), which became effective on September 11, 2022. Other than where we otherwise indicate, all information in this annual report, including our consolidated financial statements, reflects the 2022 Reverse Share Split.

This annual report includes statistical data, market data and other industry data and forecasts, which we obtained from market research, publicly available information and independent industry publications and reports that we believe to be reliable sources, although we have not verified the accuracy and completeness of such data.

Forecasts and other forward-looking information derived from such sources and included in this annual report are subject to the same qualifications and additional uncertainties regarding the other forward-looking statements in this annual report. See “Cautionary Statement Regarding Forward-Looking Statements.”

Throughout this annual report, we refer to various trademarks, service marks and trade names that we use in our business. The “Nayax” logo is the property of Nayax Ltd. Nayax® is our registered trademark in the United States. We have several other trademarks and service marks. Solely for convenience, some of the trademarks, service marks and trade names referred to in this annual report are listed without the “®” or “™” trademark designations. All rights to such trademarks are nevertheless reserved, and other trademarks and service marks appearing in this annual report are the property of their respective holders.

Due to the evolving macroeconomic landscape in retail, we believe that the term automated self-service is more aligned with our core target market as opposed to the previously used term unattended. Automated self-service includes all unattended segments where a retailer is not operating the POS, including self-checkout in micro markets, ticketing and more. Starting in 2024, we intend to use the term automated self-service when defining our core target market.

This annual report contains statements that constitute forward-looking statements. Many of the forward-looking statements contained in this annual report can be identified by the use of forward-looking words such as “anticipate,” “believe,” “could,” “expect,” “should,” “plan,” “intend,” “estimate” and “potential,” among others.

Forward-looking statements appear in a number of places in this annual report and include, but are not limited to, statements regarding our intent, belief or current expectations. Forward-looking statements are based on our management’s beliefs and assumptions and on information currently available to our management. Such statements are subject to risks and uncertainties, and actual results may differ materially from those expressed or implied in the forward-looking statements due to of various factors, including, but not limited to, those identified under the section titled “Item 3. Key Information—D. Risk Factors” in this annual report. These risks and uncertainties include factors relating to:

The preceding list is not intended to be an exhaustive list of all of our forward-looking statements. The forward- looking statements are based on our beliefs, assumptions and expectations of future performance, taking into account the information currently available to us. These statements are only estimates based upon our current expectations and projections about future events. There are important factors that could cause our actual results, levels of activity, performance or achievements to differ materially from the results, levels of activity, performance or achievements expressed or implied by the forward-looking statements. In particular, you should consider the risks provided under “Item 3. Key Information—D. Risk Factors” in this annual report.

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that future results, levels of activity, performance and events and circumstances reflected in the forward-looking statements will be achieved or will occur. Each forward-looking statement speaks only as of the date of the particular statement. Except as required by law, we undertake no obligation to update publicly any forward-looking statements for any reason after the date of this annual report, to conform these statements to actual results or to changes in our expectations.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Current or future economic uncertainties or downturns could adversely affect our business, financial condition, and results of operations. We are dependent on the growth of cashless transactions, and a reduction in customer or consumer demand for cashless automated self-service methods of payments would negatively affect our business. The market in which we operate is sensitive, to an extent, to changes in household income and the level of global economic activity. Any global economic slowdown or recession that leads to a decline in private consumption, and therefore a reduction in the demand for products sold by our customers using our integrated POS devices, payment processing services and SaaS solutions, could negatively affect our revenues from existing customers. Such conditions could also make it difficult for us to obtain new customers or expand activities with existing customers.

For example, COVID-19 caused sharp declines in stock markets around the world and a global economic slowdown. The general slowdown in the world economy led to a drop in consumption, which had a negative impact on our activities and results. Although consumer spending has in general recovered from pandemic levels, future economic downturns could again lead to declines in consumption that negatively impact us.

The competition we face varies across the different product markets in which we operate and geographic regions we serve. Activity in the market for payment processing and operations is characterized by limited competition on the global level. However, major players are active in both the markets that our solutions address and the regions we serve. We face significant competition in the certain areas in which we are active, such as the global market for POS devices. The existence of competitors in certain markets in which we operate, together with ever-increasing demands to provide technological solutions that make payment and business operation accessible across attended and automated self-service environments, require us to respond quickly and constantly update our services in order to maintain our ability to offer our customers complete, comprehensive solutions for business management.

Competitors may introduce new offerings embodying new technologies, or new industry standards and practices could emerge, that render our existing technology, including our integrated POS devices and SaaS offerings, obsolete. Some of our competitors may offer more attractive prices, features or other services that we do not offer, and some customers may choose to provide the services themselves. Larger customers may seek lower prices from us when they renew or extend a contract or the customer’s business has significant volume changes. In addition, larger customers may reduce their use of our platform if they decide to move services in-house. Further, our small business customers may seek reduced fees due to pricing competition, their own financial condition, or pressures from consumers. On some occasions, these factors result in lower revenue from a customer than we had anticipated based on our previous agreement with that customer. If we are not successful in achieving high renewal rates and favorable contract terms, our results of operations and financial condition may be materially and adversely affected. Accordingly, our future success will depend in part on our ability to respond to new product offerings by competitors, technological advances, and emerging industry standards and practices in a cost-effective and timely manner in order to retain existing customers, renew customer contracts on favorable terms and attract new customers.

Furthermore, as the number of our customers with higher volume sales increases, so does the need for us to offer increased functionality, scalability and support, which requires us to devote additional resources to such efforts.

For further details regarding how we address competition in our fields of activity, see “Item 4. Information on the Company—B. Business Overview—Competition.”

We are exposed to risks of supply shortages, price increase, tariff increases and delivery delays for key components used to manufacture our integrated POS devices, which can adversely impact our business, financial condition, and results of operations. We rely on certain components, some of which are provided by a single or limited number of suppliers, to produce our products, including monitors, semiconductor chips and other electronics products. We also face competition for our key components from other companies in the computers, telecom and electronics sectors.

For example, the COVID-19 pandemic resulted in closures of many businesses, slowdowns in manufacturing, delivery delays and partial shutdowns of national and international transportation. Amidst the global economic uncertainty and staggering economic damage caused by the pandemic, global demand for various electronic products increased significantly. This spike in demand, together with the slowdowns in manufacturing, has created a global shortage of certain components required for producing many electronic products, including certain of our products. This global shortage in the availability of such components adversely affected our gross profit rates from the sale of POS devices starting in the third quarter of 2021 and continuing in 2022 due to an increase in the price of most of the components used in our products. Since then, the delivery delays and shortages have abated, but any similar shortages in the future in the components of our products could have an adverse impact on our business, financial condition or results of operations.

We started our company in 2005 and have experienced rapid growth in recent years. Our shares have a limited history trading on the Tel Aviv Stock Exchange (“TASE”), where they have been listed since May 2021, and on the Nasdaq Global Select Market (“Nasdaq”), where they have been listed since September 2022. Our historical results may not be indicative of, or comparable to, our future results and we may be unable to sustain or increase our rate of growth in the future. We have encountered and expect to continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly evolving industries, including those associated with forecasting demand for our products and platforms, our costs of revenue, such as those associated with device sales including hardware component costs, shipping and handling costs, manufacturing labor costs and other related costs, and the other risks and uncertainties described herein. Such uncertainties may limit our ability to accurately predict our operating results. If we do not address these risks successfully, our results of operations could differ materially from our expectations, or our guidance, and as a result our business, results of operations and financial condition could suffer, and the price of our ordinary shares could decline.

We have incurred significant net losses in each year since our inception, including losses of $15.9 million, $37.5 million and $24.8 million in the years ended December 31, 2023, 2022 and 2021, respectively. Because the market for our platform and the features, integrations, capabilities and enhancements we offer are rapidly evolving, it is difficult for us to predict our future results of operations or the limits of our market opportunity. We have experienced significant revenue growth in recent periods, but we are not certain whether we will obtain a high enough volume of revenue to sustain or increase our growth or achieve or maintain profitability in the future.

We also expect that our operating expenses will increase moderately over the next several years as we hire additional personnel, expand our customer base, operations and infrastructure, continue to enhance our brand, develop and expand our platform’s features, integrations, capabilities and enhancements, expand and improve our integrated POS devices and SaaS solutions and increase our spending on sales and marketing. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. Revenue may not grow as anticipated for a number of possible reasons, including slowing demand for our products or increasing competition.

As illustrated by the increase in our number of customers from approximately 14,000 in 2019 to approximately 72,000 as of December 31, 2023, we have experienced significant growth in recent periods, which puts a strain on our business, operations and employees. We anticipate that our operations will continue to rapidly expand. Any failure by us to manage growth effectively could adversely affect our business.

We must also attract, train, and retain a significant number of qualified sales and marketing personnel, customer support personnel, professional services personnel, software engineers, technical personnel and management personnel, without undermining our corporate culture of rapid innovation, teamwork, and attention to customer success that has been central to our growth.

To increase our revenue and achieve and maintain profitability, we must increase our customer base through various methods, including but not limited to, selling and deploying more connected POS devices in both the attended and automated self-service markets, growing or maintaining our retention rates, and expanding usage of our end- to-end solutions by existing customers. While we have experienced significant growth in the number of our managed and connected devices, we may not continue achieving similar growth rates in the future.

Sales efforts targeted at larger enterprises typically involve greater costs, longer sales cycles, greater competition and less predictability in completing some of our sales. As a result of these factors, these sales opportunities may require us to devote greater sales, research and development, and customer support resources to these customers, resulting in increased costs and lengthened sales cycles. If our efforts to sell to large enterprises are not successful or do not generate additional revenue, our business could suffer.

Moreover, our business is based on (i) fixed monthly subscription fees charged for accessing our SaaS solutions, (ii) payment processing fees charged as a percent of transaction value at the point of sale and (iii) one-time payment for sales of our integrated POS devices. Customers who purchase and use our integrated POS devices are not obligated to use our payment processing or SaaS solutions, and those who do may discontinue or reduce their use of these solutions. Businesses may or may not use our platform as result of a number of factors, including their satisfaction or dissatisfaction with our integrated POS devices, SaaS solutions, APIs, our fees or pricing structure, the pricing or capabilities of the products and services offered by our competitors, the effects of economic conditions, decreases in the number of transactions by consumers, or reductions in our customers’ spending levels.

It is also difficult to predict attrition rates given our varied customer base of large enterprise and SME customers. Our attrition rates may increase or fluctuate as a result of a number of factors, including customer dissatisfaction with our services, consumer spending levels, mix of customer base, decreases in the consumer base of our customers, competition, pricing increases, or changing or deteriorating general economic conditions. If we fail to expand our customer base or increase our customers’ use of our platform’s solutions, our revenue may decline or grow slower than anticipated, which could harm our business, results of operations and financial condition.

Our growth depends, in part, on continued revenue from our existing products, as well as the successful development and introduction of new solutions or technologies, which face uncertainty with respect to customer acceptance and reaction from competitors. Any delay in the development or launch of a new product could result in our competitors being the first to market, which could compromise our competitive position. Further, the development and introduction of new products may require us to make investments in specialized personnel and capital equipment, increase marketing efforts and reallocate resources away from other uses.

The attractiveness of our payment processing services also depends on our ability to integrate emerging payment technologies, alternative payment methods and credit card systems that our processing partners or we may not adequately support or for which they or we do not provide competitive processing rates. In the event such methods become popular among consumers, any failure to timely integrate emerging payment methods into our software, anticipate consumer behavior changes, or contract with processing partners that support such emerging payment technologies could reduce the attractiveness of our payment processing services and of our platform, and adversely affect our operating results.

We also may need to modify our systems and strategy in light of new products that we develop. If we are unable to develop and introduce new products in a cost-effective manner or otherwise effectively manage our operations relating to new products, our financial condition, results of operations and cash flows could be adversely affected.

In deploying and using our products, our customers depend on our support team to resolve complex technical and operational issues. We also rely on third parties to provide some support services, and our ability to provide effective support is partially dependent on our ability to engage qualified and capable third-party service providers. As we continue to grow our business and improve our platform, we will face challenges related to providing high-quality support services at scale. We may be unable to respond quickly enough to accommodate short-term increases in demand for customer support or to modify the nature, scope and delivery of our customer support to compete with changes in customer support services provided by our competitors. Increased demand for customer support could increase costs and, without a corresponding increase in revenue, adversely affect our operating results. Our revenue streams are highly dependent on our business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality customer support, could adversely affect our reputation and brand, our ability to benefit from referrals by existing customers, our ability to sell our platform to existing and prospective customers, and our business, financial condition and results of operations.

We rely on two manufacturers to complete the assembly of the majority of our finished POS devices. Any disruption in one or both of these relationships may cause us to fail to meet the demands of our customers, damage our customer relationships and adversely affect our results of operations. We obtain all of the finished products from these two contract manufacturers on a purchase order basis, and both of them have no obligation to provide us with any specified minimum quantities of finished products. In the event our relationship with either, or each contract manufacturer is disrupted or either, or each is unable to deliver sufficient quantities of finished products, we may be unable to locate, qualify and engage with an alternate contract manufacturer in a timely, cost-efficient manner. Further, any failure or deterioration of quality control at either contract manufacturer could result in defects in our projects or products, which in turn may subject us to contractual, product liability and other claims. Any such claims, regardless of whether they are ultimately successful, could cause us to incur costs, harm our business reputation and result in disruption to our operations.

Our payment processing services are dependent on a payment transfer system that operates through a chain of different entities, including but not limited to clearing entities, banks and credit card companies. We rely on payment processors, regulated financial institutions and other partners and third-party vendors to enable us to provide services to our customers. Due to our agreements with our partners and service providers, we are contractually required to comply with certain legal and regulatory requirements, the card network rules and other obligations which otherwise would not necessarily be applicable to us. If we fail to meet our obligations under our agreements with payment processors or other service providers, one of the entities fails to fulfill its obligations to us or engages in prohibited activity, or if we or our service providers decide to terminate our agreement, we would need to find one or more new vendors to provide materially similar services. If we are unable to find vendors under terms consistent with, or better than, those currently in place, or if we are unable to sign new agreements or maintain our current relationships under terms consistent with those currently in place, our revenue and business may be harmed. This may directly result in a violation of our obligations to our customers or otherwise adversely affect our activities, reputation and results.

Our activities are grounded in our data transfer capability. The operation of communications enabling our activity is dependent on the reliability and capacity of services supplied to us by communications vendors. Termination of business relationships with vendors from the communications field, such as vendors of infrastructure and internet servers, could force us to invest additional resources in order to adapt our products to a new vendor and could have a negative impact on our business, financial condition or results of operations.

In pursuing our business strategy, we routinely conduct discussions and evaluate opportunities for possible acquisitions, strategic investments, entries into new businesses, joint ventures, divestitures and other transactions. Consistent with our acquisition strategy, we have in the past acquired or invested in, and we currently are active in M&A pipeline and execution to acquire or invest, in, businesses, technologies or other assets that we believe could complement or expand our business.

For example, on January 20, 2022, we announced the acquisition of On Track Innovation Ltd. (“OTI”), a provider of smart payment solutions for automated self-service machines, for an aggregate consideration of approximately $10 million, and on October 30, 2023, we announced the acquisition of Retail Pro International (“Retail Pro”), a U.S. based retail software company, for a purchase price that represents an implied enterprise value of $36.5 million.

The identification, evaluation and negotiation of potential transactions have in the past, and may continue in the future, to divert the attention of management and require various expenses, whether or not such transactions are ultimately completed. There can be no assurance that we will be successful in identifying, negotiating and consummating favorable transaction opportunities. In addition to transaction and opportunity costs, such transactions involve significant challenges and risks, whether or not such transactions are completed, any of which could harm our business and negatively impact our results of operations, including risks that:

We may also choose to divest certain businesses or product lines. If we decide to sell assets or a business, we may have difficulty obtaining terms acceptable to us in a timely manner, or at all. Additionally, we may experience difficulty separating out portions of, or entire, businesses, incur potential loss of revenue or experience negative impact on margins, or we may not achieve the desired strategic and financial benefits. Such potential transactions may also delay achievement of our strategic objectives, cause us to incur additional expenses, potentially disrupt customer or employee relationships and expose us to unanticipated or ongoing obligations and liabilities, including as a result of our indemnification obligations. Further, during the pendency of a divestiture, we may be subject to risks related to a decline in the business, loss of employees, customers or suppliers and the risk that the transaction may not close, any of which could have a material adverse effect on the business to be divested and us. If a divestiture is not completed for any reason, we may not be able to find another buyer on the same terms, and we may have incurred significant costs without the corresponding benefit.

Joint ventures and minority investments inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational, regulatory and/or compliance risks associated with the joint venture or minority investment. In addition, we may be dependent on joint venture partners, controlling shareholders, management or other persons or entities who control them and who may have business interests, strategies or goals that are inconsistent with ours. Business decisions or other actions or omissions of the joint venture partners, controlling shareholders, management or other persons or entities who control them may adversely affect the value of our investment, result in litigation or regulatory action against us, and may otherwise damage our reputation and brand.

Our future success and our ability to manage future growth depend, in large part, upon the efforts and expertise of our senior management team. Our senior management team is comprised of highly regarded and experienced figures within our industry who have extensive experience with, and an exceptional understanding of, our business, customers and products. It could be difficult for us to find appropriate replacements for our senior management, as competition for personnel is intense. For example, Mr. Yair Nechmad, CEO, co-founder and a controlling shareholder in the Company, and well as Mr. David Ben-Avi, CTO, co-founder and a controlling shareholder, are key figures in the Company. Although we are not dependent on these key figures, we could be harmed if they were to leave the Company.

Our businesses function at the intersection of rapidly changing technological, economic and regulatory environments that require a wide range of expertise and intellectual capital. For us to successfully compete and grow, we must recruit, retain and develop personnel who can provide the necessary expertise across a broad spectrum of disciplines. In addition, we must develop, maintain and, as necessary, implement appropriate succession plans to ensure we have the necessary human resources capable of maintaining continuity in our business.

The market for qualified personnel is competitive, and we may not succeed in recruiting additional personnel or may fail to effectively replace current personnel who depart with qualified or effective successors. Our effort to retain and develop personnel may also result in significant additional expenses, which could adversely affect our profitability. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Following the September 2022 listing of our ordinary shares on Nasdaq, the trading price of our ordinary shares is likely to remain volatile, could be subject to fluctuations in response to various factors and may not appreciate. If the perceived value of our equity awards declines for these or other reasons, it may adversely affect our ability to attract and retain highly qualified employees.

We are also substantially dependent on our direct sales force and marketing team to obtain new customers and increase sales to existing customers. There is significant competition for sales and marketing personnel with the skills and technical knowledge that we require. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining a sufficient number of direct sales and marketing personnel to support our growth. If we are unable to hire, train and retain a sufficient number of qualified and successful sales personnel, our business, financial condition and results of operations could be harmed.

We believe that maintaining and enhancing our brand identity and reputation is critical to our relationships with existing, and ability to attract new, customers, partners and employees. Accordingly, we have invested, and expect to continue to invest, a great amount of resources in branding and other marketing initiatives, which may not be successful or cost effective. If we do not successfully maintain and enhance our brand and reputation in a cost-effective manner, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands or reputations, and we could lose customers or partners, all of which would harm our business, financial condition and results of operations.

In addition, any negative publicity about our company or our management, including about the quality, stability and reliability of our products or services, changes to our products and services, our data privacy and cybersecurity practices, litigation, regulatory enforcement and other actions involving us, as well as the perception of us and our products by our customers and their consumers, even if inaccurate, could cause a loss of confidence in us and adversely affect our brand.

A material portion of our expenses are incurred in Israel and denominated in NIS. However, we are active in more than 120 different countries and therefore receive payments and derive revenue in a large number of currencies (primarily the Euro, U.S. dollar, Australian Dollar and British Pound). Our financial statements are presented in U.S. dollar, our functional and reporting currency, and therefore we are exposed to fluctuations in the different exchange rates in relation to the U.S. dollar, which could impact on our results of operations. Our results may be reduced by fluctuations in foreign currency exchange rates that could materially adversely affect our business, results of operation and financial condition.

As a company that processes payments, information security failures and leaking of financial data of our customers or their consumers, as well as passage of information between different territories in violation of privacy protection laws, could harm our results and reputation. Sensitive credit provider information, personal information, personally identifiable information and other financial data are transferred through our products and services, either within execution of transactions or within remote management services we offer. The processing of the information we acquire in connection with our customers’ use of our services is subject to numerous privacy, data protection, cybersecurity and other laws, rules, regulations and standards in a number of jurisdictions.

Furthermore, we operate under strict information security standards and regulations and use advanced security technologies in our efforts to comply with such laws, rules, regulations and standards, prevent data loss and protect the confidential, proprietary and sensitive information to which we have access. In order to mitigate against failures, cybersecurity incidents, attacks and other disruptions of our information technology systems, we strive to improve the security of our own servers, as well as the security environment we provide to customers and third parties using our products. For example, we possess three on premises environments for saving information, as well as dedicated cloud IT premises. In addition, we have offline backup for information, as well as a support team which is active seven days a week and external teams for identification of cyber-attacks, infiltration and exposure to other threat actors. Despite these measures, our efforts to protect such sensitive information may not be effective, which could disrupt our operations and adversely affect our business.

The nature of our business and our reliance on digital technologies may make us an attractive target for, and potentially vulnerable to, technological failures and exposure to cyber-attacks, fraud, computer malware, computer viruses, social engineering (including phishing and ransomware attacks), malware, password praying, credential stuffing, general hacking, physical or electronic break-ins or similar disruptions. Any breaches of our security systems, including as a result of employee theft, exfiltration, misuse or malfeasance, our actions, omissions, or errors, third-party actions, omissions, or errors, unintentional events or deliberate attacks by cyber criminals, may result in the loss of, or unauthorized access to, our or our customers’ data, including personal data, our intellectual property or other confidential, proprietary or sensitive business information. The techniques used to obtain unauthorized, improper or illegal access to our systems, our data, customer data or end-user data, disable or degrade service or sabotage systems are constantly evolving and have become increasingly complex and sophisticated, may be difficult to detect quickly and may not be recognized or detected until after they have been launched against a target. We and our service providers also face threats from sophisticated nation-state and nation-state-supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our and their systems, internal networks and the information that we and they store and process. We expect that unauthorized parties will continue to attempt to gain access to our systems or facilities through various means, including hacking into our systems or facilities or those of our customers, or attempting to fraudulently induce (for example, through spear phishing attacks or social engineering) our employees, customers, partners, vendors or other users of our systems into disclosing usernames, tax identifications, passwords, payment card information or other personal or sensitive information, which may in turn be used to access our information technology systems. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident Any accidental or willful security breaches, security incidents or other unauthorized access to our platform or servicing systems could cause personal, confidential, proprietary or sensitive information to be stolen and used for criminal or other unauthorized purposes. Such an event could potentially impact our ability to engage with clearing entities, banks and credit companies, since under the terms of our agreements with these entities, non-compliance with security requirements could lead to termination of the commercial engagement. To the extent that any system failure or similar event results in harm or losses to customers using our platforms, customers could also seek monetary recourse or contractual remedies from us for their losses and such claims, even if unsuccessful. Beyond the risks posed to our reputation and financial position by loss of user financial data, personal data or other sensitive information, we could be exposed to regulatory inquiries, time-consuming and expensive litigation, sanctions and fines.

Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical external parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties.

To the extent we use or are dependent on any particular third-party data, technology or software, we may also be harmed if such data, technology or software becomes non-compliant with existing regulations or industry standards, becomes subject to third-party claims of intellectual property infringement, misappropriation or other violation, or malfunctions or functions in a way we did not anticipate. Any loss of the right to use any of this data, technology or software could result in delays in the provisioning of our products and services until equivalent or replacement data, technology or software is either developed by us, or, if available, is identified, obtained and integrated, and there is no guarantee that we would be successful in developing, identifying, obtaining or integrating equivalent or similar data, technology or software, which could result in the loss or limiting of our products, services or features available in our products or services. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

For more information about our cybersecurity practices, please see “Item 16K. Cybersecurity,”

We are subject to various laws, rules, directives and regulations, as well as contractual obligations, relating to the collection, storing, sharing, use, disclosure, retention, disposition, security, protection, transfer and other processing (“Processing”) of personal information and other data, including personally identifiable information of our customers, their consumers and our employees. The regulatory framework for privacy and data protection worldwide is rapidly evolving and, as a result, implementation standards and enforcement practices are likely to continue to evolve for the foreseeable future. Legislators and regulators are increasingly adopting or revising privacy and data protection laws, rules, directives, and regulations that could have a significant impact on our current and planned privacy and data protection-related practices, our Processing of consumer or employee information, and our current or planned business activities.

In the United States, the Federal Trade Commission (“FTC”) and many state attorneys general interpret federal and state consumer protection laws to impose standards for the online Processing of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. In addition, if we fail to take appropriate steps to keep consumers’ personal data secure, such failure may also constitute unfair acts or practices under the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

Moreover, various federal and state legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding data privacy and security. For example, the State of California enacted the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), which created new privacy rights for users residing in the state. The CCPA broadly defines personal information and gives California residents expanded privacy rights and protections, such as affording them the right to access and request deletion of their information and the right to opt out of certain sharing and sales of personal information and provides a new cause of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. The law also prohibits covered businesses from discriminating against California residents (for example, charging more for services) for exercising any of their CCPA rights. It also creates a new California data protection agency specifically tasked to enforce the law, which could result in increased regulatory scrutiny of businesses operating in California in the areas of data protection and security.

The enactment of the CCPA and other state privacy, data protection and cybersecurity laws, rules and regulations has prompted a wave of similar legislative developments in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. At least four such state laws (in Virginia, Colorado, Connecticut and Utah) went into effect in 2023. In 2021, the Governor of Virginia signed into law the Virginia Consumer Data Protection Act (the “VCDPA”). The VCDPA creates consumer rights, similar to the CCPA, but also imposes security and assessment requirements for businesses. In addition, later in 2021, Colorado enacted the Colorado Privacy Act (the “CPA”), becoming the third comprehensive consumer privacy law to be passed in the United States (after the CCPA and VCDPA). The CPA closely resembles the VCDPA and is intended to be enforced by the respective states’ attorneys general and district attorneys, although the two differ in many ways. As these laws, rules and regulations become enforceable, we must comply with each if our operations fall within the scope of such newly enacted comprehensive mandates. The enactment of such laws, rules and regulations could have potentially conflicting requirements that would make compliance challenging.

In addition, some laws require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal information or other unauthorized or inadvertent access to or disclosure of such information. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. We also may be contractually required to notify consumers or other counterparties of a security breach. Regardless of our contractual protections, any actual or perceived security breach or breach of our contractual obligations could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

We are also subject to other privacy and data protection laws and standards, including but not limited to the Children’s Online Privacy Protection Act, the Gramm-Leach-Bliley Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, the Personal Information Protection and Electronic Documents Act, the Telephone Consumer Protection Act, the Payment Card Industry Data Security Standard, the Canadian Anti-Spam Law, Section 30a of the Israeli Telecommunications (Telecommunications and Broadcasts) Law, 5742-1982, the Israeli Protection of Privacy Law, 5741-1981 and the United Kingdom General Data Protection Regulation. These laws and any other applicable state, federal, and international privacy laws, may increase our compliance costs and potential liability.

Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. The European Union’s (“EU”) General Data Protection Regulation (“GDPR”), which regulates the gathering, Processing, protection, storage and transfer of personal data, applies directly to the activities of our subsidiaries that are established in the European Union and indirectly to us and our non-EU subsidiaries to the extent that such entities process personal data collected from EU data subjects through the offering of goods and services or monitoring of data subjects in the EU. The GDPR, which became effective in May 2018, created new individual privacy rights and imposed worldwide obligations on companies Processing personal data of EU users, which has created a greater compliance burden for us and other companies with European users, and subjects violators to substantial monetary penalties. Fines for noncompliance with the GDPR are significant and can be up to the greater of €20 million or 4% of annual global turnover. The GDPR requires data controllers to implement stringent operational requirements, including, for example, transparent and expanded disclosure to data subjects about how their personal data is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for demonstrating that they have obtained valid consent for certain data Processing activities, and also to impose significant requirements on data Processing actions on their behalf. The GDPR also provides that EU member states may introduce further conditions, including limitations, and make their own laws and regulations further limiting the Processing of ‘special categories of personal data,’ including personal data related to health, biometric data used for unique identification purposes and genetic information, which could limit our ability to collect, use and share EU data, and could cause our compliance costs to increase, ultimately having an adverse impact on our business, and harm our business and financial condition. Following the United Kingdom’s exit from the European Union, known as Brexit, the United Kingdom implemented the U.K. General Data Protection Regulation (“UK GDPR”), which currently imposes substantially the same obligations as the GDPR. With respect to transfers of personal data from the European Economic Area (“EEA”), on June 28, 2021, the European Commission issued an adequacy decision in respect of the United Kingdom’s data protection framework, enabling data transfers from EU member states to the United Kingdom to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs it could lead to additional costs and increase our overall risk exposure.

The GDPR also imposes strict rules on the transfer of personal data to countries outside the EEA, including the United States. On July 16, 2020, the Court of Justice of the European Union (“CJEU”) struck down a frequently used permitted personal data transfer mechanism between the EU and the United States, leading to uncertainty about the legal basis for other transfers of personal data from the EU to the United States. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the EEA and the United Kingdom to the United States, and we may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the EEA and the United Kingdom to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA and the United Kingdom to the United States. We and our customers may face a risk of enforcement actions by data protection authorities in the EEA and the United Kingdom relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel, damage our reputation and adversely affect our business, financial condition and results of operations. Any of these developments may have an adverse effect on our business.

An additional example of data privacy laws and regulations we may be subject to is the Israeli Protection of Privacy Law, 5741-1981 (“PPL”) and the regulations promulgated thereunder, including the Israeli Protection of Privacy (Data Protection) Regulations, 5777-2017. The PPL and the regulations promulgated thereunder, as well as guidelines of the Israeli Privacy Protection Authority (the “PPA”), impose obligations with respect to the manner personal data is processed, maintained, transferred, disclosed, accessed and secured. Failure to comply with the PPL, its regulations and guidelines issued by the PPA may expose us to administrative fines, civil claims (including class actions) and in certain cases criminal liability. The PPA may initiate administrative inspection proceedings, from time to time, without suspicion of any particular breach of the PPL, as it has done in the past with respect to dozens of Israeli companies in various business sectors. In addition, to the extent that any administrative supervision procedure is initiated by the PPA and reveals certain irregularities with respect to our compliance with the PPL, in addition to our exposure to administrative fines, civil claims (including class actions) and in certain cases criminal liability, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs. Pending legislation in Israel may result in a change to the current enforcement measures and sanctions.

We publicly post policies and documentation regarding our practices concerning the Processing of data. This publication of our privacy policy and other documentation that provide promises and assurances about privacy and security is required by applicable law and can subject us to proceedings and actions brought by data protection authorities, government entities, or others (including, potentially, in class action proceedings brought by individuals) if our policies are alleged to be deceptive, unfair, or misrepresentative of our actual practices.

Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so.

Any breach of data or privacy protection laws or regulations could result in significant fines, regulatory investigations, reputational damage, orders to cease Processing data or to change our practices, enforcement notices or assessment notices for a compulsory audit. We could also face civil privacy and data protection claims, including representative or class action litigation, potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. Non-compliance could result in proceedings against us by governmental entities, consumers, data subjects, or others. We may also experience difficulty retaining or obtaining new consumers in these jurisdictions due to the legal requirements, compliance costs, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these consumers pursuant to the terms set forth in our engagements with them.

Compliance with current or future privacy and data protection laws (including those regarding security breach notification) affecting consumer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve us sharing information with third parties or storing personal or sensitive information), which could materially and adversely affect our profitability and could reduce income from certain business initiatives. We have incurred, and may continue to incur, significant expenses to comply with evolving privacy and security standards and protocols imposed by law, regulation, industry standards, shifting consumer expectations, or contractual obligations. In particular, with laws and regulations such as the GDPR in the EU, the UK GDPR in the United Kingdom, the PPL in Israel and the CCPA, CPRA, VCDPA, and COCPA in the U.S. imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices, and we may incur significant costs and expenses in an effort to do so. There is a risk that the interpretations and measures conducted by us in our efforts to comply with the applicable data protection legislation may prove to be insufficient or incorrect. Any failure, real or perceived, by us to comply with our privacy, data protection, or information security policies, changing consumer expectations, or with any evolving regulatory requirements, industry standards, or contractual obligations could cause our customers to reduce their use of our products and services, disrupt our supply chain or third-party vendor or developer partnerships, and materially and adversely affect our business. Privacy and data security concerns, whether valid or not, may inhibit market adoption of our products and services, particularly in certain industries and jurisdictions. If we are not able to quickly adjust to changing laws, regulations, and standards related to the internet, our business may be harmed.

The core of our activity is providing technological services. As a result, and in light of the continuous, rapid development of the area of activity, as well as expansion of the services required by our customers, we are exposed to operational risks, including risks to the stable, ongoing operation of our technological systems, data security and the durability of our servers and data transfer infrastructure. These risks include technical malfunctions, overloads of system servers and cyber-attacks that could lead to the failure or shutdown of our computer systems and servers. If a technical failure or an attack on our computer infrastructure occurs and we are unable to restore our systems to proper functioning within a reasonable timeframe, our reputation and business results may suffer. Additionally, real or perceived software errors, failures, bugs, defects or outages of our systems could materially and adversely affect our business, results of operations, financial condition and future prospects.

Our systems rely on software that is highly technical and complex, and we depend on the ability of such software to store, retrieve, manage and otherwise process immense amounts of data. As a result, undetected errors, failures, bugs or defects may be present in such software or occur in such software in the future, especially when updates or new products or services are released, and particularly to the extent such failures are not detected or remedied quickly. Our products and services are designed to process complex transactions and deliver reports and other information related to those transactions, all at high volumes and processing speeds. Since customers use our services for important aspects of their businesses, any errors, defects, disruptions in services or other performance problems with our services could hurt our reputation and damage our customers’ businesses. For example, if we approve a transaction incorrectly and the acquiring or issuing bank does not transfer the funds for any reason, we are liable to our customers for the amount of the transaction. Software and system errors, or human error, could delay or inhibit settlement of payments, result in over settlement, cause reporting errors or prevent us from collecting transaction fees, which could have a material adverse effect on our business, financial condition and results of operations.

In addition, in order to compete as a significant player in the market for payment processing and operations solutions for businesses, we must demonstrate technological flexibility and advanced technical capability. We operate in an industry experiencing rapid technological change and frequent product introductions, including developments in payment card tokenization, mobile payments, social commerce (i.e., e-commerce through social networks), authentication, virtual currencies, distributed ledger or blockchain technologies, near field communication and other proximity or contactless payment methods, machine learning and artificial intelligence.

We may not be able to make technological improvements as quickly as demanded by our customers, or as provided by our competitors, which could harm our ability to meet market demands and maintain the innovativeness and uniqueness of the services and products we offer. Developing and adapting to new technologies, together with expansion of our services and an increase in our customer base, requires us to continuously maintain and expand our existing technological capabilities, including those for data transfer between the points of operation and relevant servers.

Operational failures, including regarding data transfer, could harm our reputation, business results and our ability to retain customers and recruit new customers. Furthermore, as our business continues to grow, we will need to invest additional resources to improve our operational infrastructure in order to maintain its performance level under a heavy operational load. Any failure to do so effectively could harm our business.

We are dependent on the ability of our products and services to integrate with a variety of operating systems, software, hardware and networks, as well as web browsers that we do not control. Any changes in these systems or networks that degrade the functionality of our products and services, impose additional costs or requirements on us or give preferential treatment to competitive services, including their own services, could materially and adversely affect usage of our products and services. In the event that it is difficult for our customers to access and use our products and services, our business may be materially and adversely affected. We also rely on bank platforms, acquirers, payment processors, last-mile payment service providers and others, including card issuers and alternative payment methods, to process some of our transactions. If there are any issues with, or service interruptions in, these bank platforms, users may be unable to have their transactions completed, which would seriously harm our business.

In addition, our solutions, including hardware and software, interoperate with mobile networks offered by telecom operators and mobile devices developed by third parties. Changes in these networks or in the design of these mobile devices may limit the interoperability of our solutions with such networks and devices and require modifications to our solutions. If we are unable to ensure that our hardware continues to interoperate effectively with such networks and devices, or if doing so is costly, our business may be materially and adversely affected.

Our ability to obtain, maintain, protect, defend and enforce our existing intellectual property and technological know-how is a matter of great importance. Continuing to lead in the provision of our services to customers is partially dependent on our ability to protect the intellectual property upon which our products are based, as well as trade secrets. We seek to protect our intellectual property, whether registered or unregistered, and proprietary rights by relying on applicable laws, rules and regulations, as well as contractual restrictions both with our employees in the development of new services and technologies and when offering or procuring products and services, including through confidentiality agreements with our employees and third parties with whom we conduct business.

Nonetheless, the steps we take to obtain, maintain, protect, defend and enforce our intellectual property and other proprietary rights may be inadequate and, despite our efforts to protect these rights, unauthorized third parties, including our competitors, may duplicate, mimic, reverse engineer, access, obtain or use the proprietary aspects of our technology, processes, products or services without our permission. Our competitors and other third parties may also design around or independently develop similar technology or otherwise duplicate or mimic our services or products such that we would not be able to successfully assert our intellectual property or other proprietary rights against them. We cannot assure that any future patent, trademark or service mark registrations will be issued for our pending or future applications or that any of our current or future patents, copyrights, trademarks, or service marks (whether registered or unregistered) will be valid, enforceable, sufficiently broad in scope, provide adequate protection of our intellectual property or other proprietary rights, or provide us with any competitive advantage. A failure to suitably protect our technology could lead to increased competition from our competitors and even a loss of customers. Furthermore, competitors may reverse engineer our technology and develop similar products and services. We also might not be able to detect unauthorized use of, or take appropriate and timely steps to enforce, our intellectual property rights and technology. Additionally, our contractual arrangements may be breached and our contractual arrangements and other steps we have taken to protect our intellectual property may not prevent third parties from infringing or misappropriating our intellectual property or deter independent development of equivalent or superior intellectual property rights by others. We cannot guarantee that we have entered into agreements containing obligations of confidentiality with each party that has or may have had access to proprietary information, know-how or trade secrets owned or held by us. Protecting and/or enforcing our intellectual property rights and other proprietary rights may be expensive, time-consuming and may require litigation for which outcomes are inherently uncertain, such that we may not be successful. Also, we may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. Defending a claim that a party illegally disclosed or misappropriated a trade secret is difficult, expensive and time-consuming, and the outcome is unpredictable. In addition, some courts within and outside of the United States are less willing or unwilling to protect trade secrets. If any of our trade secrets were to be lawfully obtained or independently developed by a competitor or other third party, we would have no right to prevent them from using that technology or information to compete with us. If any of our trade secrets were to be disclosed to or independently developed by a competitor or other third party, our competitive position would be materially and adversely harmed.

In addition, third parties may assert that we infringed, misappropriated or otherwise violated a patent, copyright, trademark or other intellectual property right belonging to them and we may become subject to intellectual property disputes. Any infringement claim, even one without merit, could result in the expenditure of significant financial and managerial resources to defend against the claim. Moreover, a successful claim of intellectual property infringement, misappropriation, dilution or other violation against us or a settlement is time-consuming and could also require us to pay substantial amounts (including treble damages and attorneys’ fees if we are found to have willfully infringed intellectual property rights) or obtain a license to continue to use the technology that is the subject of the claim, or otherwise restrict or prohibit our use of the technology. We may also not be able to obtain a license to use satisfactory alternative technology that would allow us to continue selling our products and services. Even if we were able to obtain a license, it could be non-exclusive, thereby giving our competitors and other third parties access to the same technologies licensed to us. We cannot predict the outcome of lawsuits and cannot ensure that the results of any such actions will not have an adverse effect on our business, financial condition or results of operations. Any intellectual property litigation to which we might become a party, or for which we are required to provide indemnification, regardless of the merit of the claim or our defenses, may require us to do one or more of the following: