Nayax - 20-F annual report 2025

PRESENTATION OF FINANCIAL AND OTHER INFORMATION

 

Unless otherwise indicated or the context otherwise requires, all references in this annual report to “Nayax” or the “Company,” “we,” “our,” “ours,” “us” or similar terms refer to Nayax Ltd., together with its consolidated subsidiaries. The term “NIS” refer to the lawful currency of the State of Israel, the terms “dollar,” “U.S. dollar,” “US$” and “$” refer to the lawful currency of the United States, the terms “euro,” “EUR” and “€” and refer to the lawful currency of the European Union, the terms “Australian dollar” and “AUD” refer to the lawful currency of Australia and the term “British pound” refers to the lawful currency of the United Kingdom. Unless derived from our financial statements or otherwise indicated, U.S. dollar translations of NIS amounts presented in this annual report are translated using the rate of NIS 3.19 to US$1.00, the exchange rate reported by the Bank of Israel on December 31, 2025.

 

 

We maintain our books and records in U.S. dollars and prepare our consolidated financial statements in accordance with International Financial Reporting Standards (“IFRS”) as issued by the International Accounting Standards Board (“IASB”). The financial information contained in this annual report includes our audited consolidated statements of financial position as of December 31, 2025 and 2024 and related audited consolidated statements of profit or loss, comprehensive income (loss), changes in equity and cash flows for each of the three years in the period ended December 31, 2025, which have been audited by Kesselman and Kesselman, a member of PricewaterhouseCoopers International Limited.

 

Our fiscal year ends December 31. References in this annual report to a fiscal year, such as “fiscal year 2025,” relates to our fiscal year ended on December 31 of that calendar year.

 

The financial information should be read in conjunction with “Item 5. Operating and Financial Review and Prospects” and our consolidated financial statements, including the related notes thereto, included elsewhere in this annual report.

 

 

This annual report includes statistical data, market data and other industry data and forecasts, which we obtained from market research, publicly available information and independent industry publications and reports that we believe to be reliable sources, although we have not verified the accuracy and completeness of such data.

 

Forecasts and other forward-looking information derived from such sources and included in this annual report are subject to the same qualifications and additional uncertainties regarding the other forward-looking statements in this annual report. See “Cautionary Statement Regarding Forward-Looking Statements.”

 

 

Throughout this annual report, we refer to various trademarks, service marks and trade names that we use in our business. The “Nayax” logo is the property of Nayax Ltd. Nayax® is our registered trademark in the United States. We have several other trademarks and service marks. Solely for convenience, some of the trademarks, service marks and trade names referred to in this annual report are listed without the “®” or “™” trademark designations. All rights to such trademarks are nevertheless reserved, and other trademarks and service marks appearing in this annual report are the property of their respective holders.

CAUTIONARY STATEMENT REGARDING FORWARD-LOOKING STATEMENTS

 

This annual report contains statements that constitute forward-looking statements. Many of the forward-looking statements contained in this annual report can be identified by the use of forward-looking words such as “anticipate,” “believe,” “could,” “estimate,” “expect,” “intend,” “plan,” “potential” and “should,” among others.

 

Forward-looking statements appear in a number of places in this annual report and include, but are not limited to, statements regarding our intent, belief or current expectations. Forward-looking statements are based on our management’s beliefs and assumptions and on information currently available to our management. Such statements are subject to risks and uncertainties, and actual results may differ materially from those expressed or implied in the forward-looking statements due to various factors, including, but not limited to, those identified under the section titled “Item 3. Key Information—D. Risk Factors” in this annual report. These risks and uncertainties include factors relating to:

 

 

 

 

 

 

 

 

 

 

 

 

 

The preceding list is not intended to be an exhaustive list of all of our forward-looking statements. The forward- looking statements are based on our beliefs, assumptions and expectations of future performance, taking into account the information currently available to us. These statements are only estimates based upon our current expectations and projections about future events. There are important factors that could cause our actual results, levels of activity, performance or achievements to differ materially from the results, levels of activity, performance or achievements expressed or implied by the forward-looking statements. In particular, you should consider the risks provided under “Item 3. Key Information—D. Risk Factors” in this annual report.

 

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that future results, levels of activity, performance and events and circumstances reflected in the forward-looking statements will be achieved or will occur. Each forward-looking statement speaks only as of the date of the particular statement. Except as required by law, we undertake no obligation to update publicly any forward-looking statements for any reason after the date of this annual report, to conform these statements to actual results or to changes in our expectations.

PART I

 

 

Not applicable.

 

ITEM 2.               OFFER STATISTICS AND EXPECTED TIMETABLE

 

Not applicable.

 

ITEM 3.               KEY INFORMATION

 

 

 

Not applicable.

 

 

Not applicable.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Current or future economic uncertainties or downturns could adversely affect our business, financial condition and results of operations. We are dependent on the growth of cashless transactions, and a reduction in customer or consumer demand for cashless payments would negatively affect our business. The market in which we operate is sensitive, to an extent, to changes in household income and the level of global economic activity. Any global economic slowdown or recession that leads to a decline in private consumption, and therefore a reduction in the demand for products sold by our customers using our integrated POS devices, payment processing services or software as a service, or SaaS, solutions, could negatively affect our revenues from existing customers. Such conditions could also make it difficult for us to obtain new customers or expand activities with existing customers.

 

For example, COVID-19 initially caused sharp declines in stock markets around the world in March 2020 and a global economic slowdown that extended into 2021 and beyond. The general slowdown in the world economy led to a drop in consumption, which for a time had a negative impact on our activities and results. Although consumer spending has recovered from pandemic levels, future economic downturns could again lead to declines in consumption that negatively impact us.

 

 

The competition we face varies across the different product markets in which we operate and geographic regions we serve. Activity in the market for payment processing and operations is characterized by limited competition on the global level. However, major players are active in both the markets that our solutions address and the regions we serve. We face significant competition in the certain areas in which we are active, such as the global market for POS devices. The existence of competitors in certain markets in which we operate, together with ever-increasing demands to provide technological solutions that make payment and business operation accessible across attended and automated self-service environments, require us to respond quickly and constantly update our services in order to maintain our ability to offer our customers complete, comprehensive solutions for business management.

 

Competitors may introduce new offerings embodying new technologies, or new industry standards and practices could emerge, that render obsolete our existing technology, including our integrated POS devices and SaaS offerings. Some of our competitors may offer more attractive prices, features or other services that we do not offer, and some customers may choose to provide these services themselves. Larger customers may seek lower prices from us when they renew or extend a contract or the customer’s business has significant volume changes. In addition, larger customers may reduce their use of our platform if they decide to move services in-house. Further, our small business customers may seek reduced fees due to pricing competition, their own financial condition or pressures from consumers. These factors result in lower revenue from a customer than we had anticipated based on our previous agreement with that customer. If we are not successful in achieving high renewal rates and favorable contract terms, our results of operations and financial condition may be materially and adversely affected. Accordingly, our future success will depend in part on our ability to respond to new product offerings by competitors, technological advances and emerging industry standards and practices in a cost-effective and timely manner in order to retain existing customers, renew customer contracts on favorable terms and attract new customers.

 

Furthermore, as the number of our customers with higher volume sales increases, so does the need for us to offer increased functionality, scalability and support, which requires us to devote additional resources to such efforts.

 

For further details regarding how we address competition in our fields of activity, see “Item 4. Information on the Company—B. Business Overview—Competition.”

 

 

We are exposed to risks of supply shortages, price increase, tariff increases, and delivery delays for key components used to manufacture our integrated POS devices, which can adversely impact our business, financial condition and results of operations. In addition, certain suppliers may have an increasing sentiment not to transact business with Israeli companies as a result of the recent war in Israel or due to a shift in international relations and politics. We rely on certain components, some of which are provided by a single or limited number of suppliers, to produce our products, including monitors, semiconductor chips and other electronics products. We also face competition for our key components from other companies in the computers, telecom and electronics sectors.

 

For example, a spike in demand for various electronic products during the COVID-19 pandemic, together with the slowdown in manufacturing, created a global shortage of certain components required for producing many electronic products, including certain of our products, which adversely affected our gross profit rates from the sale of POS devices starting in the third quarter of 2021 and continuing in 2022. Although the delivery delays and shortages have since abated, any similar shortages in the future in the components of our products could have an adverse impact on our business, financial condition or results of operations.

 

 

We started our company in 2005 and have experienced rapid growth in recent years. Our shares have a limited history trading on the Tel Aviv Stock Exchange (“TASE”), where they have been listed since May 2021, and on the Nasdaq Global Select Market (“Nasdaq”), where they have been listed since September 2022. Our historical results may not be indicative of, or comparable to, our future results and we may be unable to sustain or increase our rate of growth in the future. We have encountered and expect to continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly evolving industries, including those associated with forecasting demand for our products and platforms, our costs of revenue, such as those associated with device sales including hardware component costs, shipping and handling costs, manufacturing labor costs and other related costs, and other risks and uncertainties described herein. Such uncertainties may limit our ability to accurately predict our operating results. If we do not address these risks successfully, our results of operations could differ materially from our expectations, or our guidance, and as a result our business, results of operations and financial condition could suffer, and the price of our ordinary shares could decline.

 

 

Although we reported a net annual profit for the first time in 2025, we have incurred significant losses in each year since our inception, including losses of $5.6 million and $15.9 million in the years ended December 31, 2024 and 2023, respectively. Because the market for our platform and the features is rapidly evolving, it is difficult for us to predict our future results of operations or the limits of our market opportunity. We have experienced significant revenue growth in recent periods, but we are not certain whether we will obtain a high enough volume of revenue to sustain or increase our growth or maintain annual profitability in the future.

 

We also expect that our operating expenses will increase moderately over the next several years as we hire additional personnel, expand our customer base, operations and infrastructure, continue to enhance our brand, develop and expand our platform’s features, integrations, capabilities and enhancements, expand and improve our integrated POS devices and SaaS solutions and increase our spending on sales and marketing. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. Revenue may not grow as anticipated for a number of possible reasons, including as a result of slowing demand for our products or due to increased competition.

 

 

As illustrated by the increase in our number of customers from approximately 14,000 in 2019 to approximately 115,000 as of December 31, 2025, we have experienced significant growth in recent periods, which puts a strain on our business, operations and employees. We anticipate that our operations will continue to rapidly expand. Any failure by us to manage growth effectively could adversely affect our business.

 

We must also attract, train and retain a significant number of qualified sales and marketing personnel, customer support personnel, professional services personnel, software engineers, technical personnel and management personnel, without undermining our corporate culture of rapid innovation, teamwork and attention to customer success that has been central to our growth.

 

 

To increase our revenue and achieve and maintain profitability, we must increase our customer base through various methods, including but not limited to, selling and deploying more connected POS devices in both the attended and automated self-service markets, growing or maintaining our retention rates, and expanding usage of our end-to-end solutions by existing customers. While we have experienced significant growth in the number of our managed and connected devices, we may not continue achieving similar growth rates in the future.

 

Sales efforts targeted at larger enterprises typically involve greater costs, longer sales cycles, greater competition and less predictability in completing some of our sales. As a result of these factors, such sales opportunities may require us to devote greater sales, research and development, professional services and customer support resources to these customers, resulting in increased costs and lengthened sales cycles. If our efforts to sell to large enterprises are not successful or do not generate additional revenue, our business could suffer.

 

Moreover, our business is based on (i) fixed monthly subscription fees charged for accessing our SaaS solutions, (ii) payment processing fees charged as a percent of transaction value at the point of sale and (iii) one-time revenue from sales of our integrated POS devices. Customers who purchase and use our integrated POS devices are not always obligated to use our payment processing or SaaS solutions, and those who do may discontinue or reduce their use of these solutions. Businesses may or may not use our platform as a result of a number of factors, including their satisfaction or dissatisfaction with our integrated POS devices, SaaS solutions, application programming interfaces, or APIs, our fees or pricing structure, the pricing or capabilities of the products and services offered by our competitors, the effects of economic conditions, decreases in the number of transactions by consumers or reductions in our customers’ spending levels.

 

It is also difficult to predict attrition rates given our varied customer base of large enterprise and small and medium enterprises (“SMEs”), customers. Our attrition rates may increase or fluctuate as a result of a number of factors, including customer dissatisfaction with our services, consumer spending levels, mix of customer base, decreases in the consumer base of our customers, competition, pricing increases or changing or deteriorating general economic conditions. If we fail to expand our customer base or increase our customers’ use of our platform’s solutions, our revenue may decline or grow slower than anticipated, which could harm our business, results of operations and financial condition.

 

 

Our growth depends, in part, on continued revenue from our existing products, as well as the successful development and introduction of new solutions or technologies, which face uncertainty with respect to customer acceptance and reaction from competitors. Any delay in the development or launch of a new product could result in our competitors being the first to market, which could compromise our competitive position. Further, the development and introduction of new products may require us to make investments in specialized personnel and capital equipment, increase marketing efforts and reallocate resources away from other uses.

 

The attractiveness of our payment processing services also depends on our ability to integrate emerging payment technologies, alternative payment methods and credit card systems that our processing partners or we may not adequately support or for which they or we do not provide competitive processing rates. In the event such emerging payment methods become popular among consumers, any failure to timely integrate such payment methods into our software, anticipate consumer behavior changes, or contract with processing partners that support such emerging payment technologies could reduce the attractiveness of our payment processing services and of our platform, and adversely affect our operating results.

 

We also may need to modify our systems and strategy in light of new products that we develop. If we are unable to develop and introduce new products in a cost-effective manner or otherwise effectively manage our operations relating to new products, our financial condition, results of operations and cash flows could be adversely affected.

 

 

In deploying and using our products, our customers depend on our support team to resolve complex technical and operational issues. We also rely in part on third parties to provide some customer support services, including manpower, software development and training, and our ability to provide effective customer support is partially dependent on our ability to engage qualified and capable third-party service providers. As we continue to grow our business and improve our platform, we will face challenges related to providing high-quality customer support services at scale. We may be unable to respond quickly enough to accommodate short-term increases in demand for customer support or to modify the nature, scope and delivery of our customer support to compete with changes in customer support services provided by our competitors. Increased demand for customer support could increase costs and, without a corresponding increase in revenue, adversely affect our operating results. Our revenue streams are highly dependent on our business reputation and on positive recommendations from our existing customers. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality customer support, could adversely affect our reputation and brand, our ability to benefit from referrals by existing customers, our ability to sell our platform to existing and prospective customers and our business, financial condition and results of operations.

 

 

We rely on a limited number of manufacturers to complete the assembly of the majority of our finished POS devices. Any disruption in one or more of these relationships may cause us to fail to meet the demands of our customers, damage our customer relationships and adversely affect our results of operations. We obtain all of the finished products from these contract manufacturers on a purchase order basis, and none of them have an obligation to provide us with any specified minimum quantities of finished products. In the event our relationship with one or more such contract manufacturer is disrupted or one or more is unable to deliver sufficient quantities of finished products, we may be unable to locate, qualify and engage with an alternate contract manufacturer or manufacturers in a timely, cost-efficient manner. Further, any failure or deterioration of quality control at such contract manufacturer could result in defects in our projects or products, which in turn may subject us to contractual, product liability and other claims. Any such claims, regardless of whether they are ultimately successful, could cause us to incur costs, harm our business reputation and result in disruption to our operations.

 

We are also subject to other risks inherent in the manufacturing of our products and their supply chain, including industrial accidents, natural disasters (including as a result of climate change), environmental events, strikes and other labor disputes, capacity constraints and disruptions in material supplies. We are also subject to risks associated with global shortages, disruptions in supply chain or information technology, loss or impairment of key manufacturing sites or suppliers, product quality control and safety issues, increase in commodity prices and energy costs, licensing requirements and other regulatory issues and other external factors over which we have no control. If such an event were to occur, it could have an adverse effect on our business, financial condition and results of operations.

 

 

Our payment processing services are dependent on a payment transfer system that operates through a chain of different entities, including but not limited to clearing entities, banks and credit card companies. We rely on payment processors, regulated financial institutions and other partners and third-party vendors to enable us to provide services to our customers. Due to our agreements with our partners and service providers, we are contractually required to comply with certain legal and regulatory requirements, credit card network rules and other obligations which otherwise would not necessarily be applicable to us. If we fail to meet our obligations under our agreements with payment processors or other service providers, one of the entities fails to fulfill its obligations to us or engages in prohibited activity, or if we or our service providers decide to terminate our agreement, we would need to find one or more new vendors to provide materially similar services. If we are unable to find vendors under terms consistent with, or better than, those currently in place, or if we are unable to sign new agreements or maintain our current relationships under terms consistent with those currently in place, our revenue and business may be harmed. This may directly result in a violation of our obligations to our customers or otherwise adversely affect our activities, reputation and results.

 

 

Our activities are grounded in our data transfer capability. The operation of communications enabling our activity is dependent on the reliability and capacity of services supplied to us by communications vendors. Termination of business relationships with vendors from the communications field, such as vendors of infrastructure and internet servers, could force us to invest additional resources in order to adapt our products to a new vendor and could have a negative impact on our business, financial condition or results of operations.

 

 

In pursuing our business strategy, we routinely conduct discussions and evaluate opportunities for possible acquisitions, strategic investments, entries into new businesses, joint ventures, divestitures and other transactions. We have in the past acquired or invested in, and we currently are active in M&A pipeline activity and execution to acquire or invest in, businesses, technologies or other assets that we believe could complement or expand our business.

 

For example, in October 2023, we announced the acquisition of Retail Pro International (“Retail Pro”), a U.S. based retail software company, for a purchase price that represents an implied enterprise value of $36.5 million, in April 2024, we completed the acquisition of both Roseman Engineering Ltd. and Roseman Holdings Ltd. (together, “Roseman Engineering”), which manage smart systems in the fields of refuelling, charging stations and management systems for forecourts and vehicle fleets, and of VMtecnologia LTDA (“VMT”), a leading technology provider for the automated self-service industry in Brazil, marking a significant step in our expansion into the Latin American market, and in December 2025, we announced the acquisition of Lynkwell, a leading energy ecosystem platform focused on supporting developers and operators of renewable generation, battery storage, utilities, and microgrids with next-generation technologies, for an implied effective purchase price of $25.9 million, with an additional earnout based on certain profitability metrics within the first 12 months post-closing.

 

The identification, evaluation and negotiation of potential transactions, as well as the integration of acquired companies and businesses, have in the past, and may continue in the future, to divert the attention of management and require various expenses, whether or not such transactions are ultimately completed. There can be no assurance that we will be successful in identifying, negotiating and consummating favorable transaction opportunities. In addition to transaction and opportunity costs, such transactions involve significant challenges and risks, whether or not such transactions are completed, any of which could harm our business and negatively impact our results of operations, including risks that:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

We may also choose to divest certain businesses or product lines. If we decide to sell assets or a business, we may have difficulty obtaining terms acceptable to us in a timely manner, or at all. Additionally, we may experience difficulty separating out portions of, or entire, businesses, incur potential loss of revenue or experience negative impact on margins, or we may not achieve the desired strategic and financial benefits. Such potential transactions may also delay achievement of our strategic objectives, cause us to incur additional expenses, potentially disrupt customer or employee relationships and expose us to unanticipated or ongoing obligations and liabilities, including as a result of our indemnification obligations. Further, during the pendency of a divestiture, we may be subject to risks related to a decline in the business, loss of employees, customers or suppliers and the risk that the transaction may not close, any of which could have a material adverse effect on the business to be divested and us. If a divestiture is not completed for any reason, we may not be able to find another buyer on the same terms, and we may have incurred significant costs without the corresponding benefit.

 

Joint ventures and minority investments inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational, regulatory and/or compliance risks associated with the joint venture or minority investment. In addition, we may be dependent on joint venture partners, controlling shareholders, management or other persons or entities who control them and who may have business interests, strategies or goals that are inconsistent with ours. Business decisions or other actions or omissions of the joint venture partners, controlling shareholders, management or other persons or entities who control them may adversely affect the value of our investment, result in litigation or regulatory action against us and may otherwise damage our reputation and brand.

 

 

Our future success and our ability to manage future growth depend, in large part, upon the efforts, experience and expertise of our senior management team. Our senior management team is comprised of highly regarded figures within our industry who have extensive experience with, and an exceptional understanding of, our business, customers and products. It could be difficult or impossible for us to find appropriate replacements for our senior management, as competition for personnel is intense. For example, Mr. Yair Nechmad, CEO, co-founder and a controlling shareholder in the Company, and Mr. David Ben-Avi, CTO, co-founder and a controlling shareholder, are key figures in the Company. Although we are not dependent on these key figures, we could be harmed if they were to leave the Company.

 

As of the date of this annual report, we have not developed a succession plan for our senior management. If we fail to timely develop and successfully execute a succession plan capable of maintaining continuity in our senior management and business, or if we lose senior management members and we fail to attract and retain qualified successors, our business, financial condition, results of operations and cash flows could be harmed.

 

 

Our businesses function at the intersection of rapidly changing technological, economic and regulatory environments that require a wide range of expertise and intellectual capital. For us to successfully compete and grow, we must recruit, retain and develop personnel who can provide the necessary expertise across a broad spectrum of disciplines. In addition, we must develop, maintain and, as necessary, implement appropriate succession plans to ensure we have the necessary human resources capable of maintaining continuity in our business.

 

The market for qualified personnel is competitive, and we may not succeed in recruiting additional personnel or may fail to effectively replace current personnel who depart with qualified or effective successors. Our effort to retain and develop personnel may also result in significant additional expenses, which could adversely affect our profitability. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. The trading price of our ordinary shares is likely to remain volatile, could be subject to fluctuations in response to various factors and may not appreciate. If the perceived value of our equity awards declines for these or other reasons, it may adversely affect our ability to attract and retain highly qualified employees.

 

We are also substantially dependent on our direct sales force and marketing team to obtain new customers and increase sales to existing customers. There is significant competition for sales and marketing personnel with the skills and technical knowledge that we require. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining a sufficient number of direct sales and marketing personnel to support our growth. If we are unable to hire, train and retain a sufficient number of qualified and successful sales personnel, our business, financial condition and results of operations could be harmed.

 

 

We believe that maintaining and enhancing our brand identity and reputation is critical to our relationships with existing, and ability to attract new, customers, partners and employees. Accordingly, we have invested, and expect to continue to invest, a great amount of resources in branding and other marketing initiatives, which may not be successful or cost effective. If we do not successfully maintain and enhance our brand and reputation in a cost-effective manner, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands or reputations, and we could lose customers or partners, all of which would harm our business, financial condition and results of operations.

 

In addition, any negative publicity about our company or our management, including about the quality, stability and reliability of our products or services, changes to our products and services, our data privacy and cybersecurity practices, litigation, regulatory enforcement and other actions involving us, as well as the perception of us and our products by our customers and their consumers, even if inaccurate, could cause a loss of confidence in us and adversely affect our brand.

 

 

A material portion of our expenses are denominated in NIS, USD and Euro. At the same time, we are active in more than 120 different countries, including emerging markets, and therefore receive payments and generate revenue in a large number of currencies, primarily from Euro, U.S. dollar, Australian dollar and British pound. We also face exposure to currency volatility in certain emerging markets, where fluctuations may be more pronounced. Our financial statements are presented in U.S. dollar, our functional and reporting currency, and therefore we are subject to the effects of exchange-rate fluctuations between the U.S. dollar and other currencies, which may impact on our results of operations. Fluctuations in foreign currency exchange rates may reduce our results and could materially adversely affect our business, operating results, and financial condition. In 2025, foreign currency transaction gains and losses have had an impact on our financial statements, which was partially mitigated by hedging transactions. For additional information, see “Item 5. Operating and Financial Review and Prospects - Operating Results - Components of our Consolidated Income Statement - Finance Income (Expense), Net.”

 

 

Since we operate on a global basis, our operations could be disrupted by political or geopolitical conditions, trade disputes, international boycotts and sanctions, political and social instability, acts of war, terrorist activity or other similar events.

 

In recent years, diplomatic and trade relationships between the U.S. government and China have become increasingly frayed and the threat of a takeover of Taiwan by China has increased. Tensions between the U.S. and China have led to a series of tariffs being imposed by the U.S. on imports from mainland China, as well as other business restrictions. Following his re-election, President Donald Trump has imposed and may continue to impose additional tariffs on U.S. imports from a variety of countries, including China, Mexico and Canada. Tariffs could increase the cost of our products and the components that go into making them. These increased costs could adversely impact the gross margin that we earn on our products. Tariffs could also make our products more expensive for customers, which could make our products less competitive and reduce consumer demand. Changing our operations in accordance with new or changed trade restrictions can be expensive, time-consuming and disruptive to our operations.

 

At the same time, the ongoing war between Russia and Ukraine and the instability in the Middle East between Israel and a variety of terrorist organizations and the Islamic Republic of Iran each threaten to expand into wider regional conflicts, which could have severe negative impact on the global economy. For more details regarding conflicts in the Middle East, see “ - Risks Related to our Operations and Incorporation in Israel - After being subject to ceasefire arrangements following an extended period of war, Israel has launched together with the United States a joint operation against Iran. The security situation remains unstable and hostilities could escalate or resume at any time, and the duration, scope and effects of the war, the strike against Iran and related instability are uncertain.”

 

The tensions between the U.S. and China, the Russia-Ukraine war and conflicts in the Middle East remain uncertain, and while it is difficult to predict the impact of any of the foregoing, any escalation or additional uncertainty in these situations could increase our costs, disrupt our supply chain, reduce our sales and earnings, impair our ability to raise additional capital when needed on acceptable terms, if at all, or otherwise adversely affect our business, financial condition and results of operations.

 

 

Many factors affect our reputation and the value of our brand, including the perception held by our customers, business partners, investors, other key stakeholders and the communities in which we operate, such as our social responsibility, corporate governance and other company practices. As with other companies, we have faced, and will likely continue to face, scrutiny related to our environmental, social and governance (“ESG”) activities, and our reputation, operations, access to and cost of capital, and the value of our brand can be adversely affected if we fail to act responsibly in a number of areas, such as diversity and inclusion, workplace conduct, sustainable environmental practices, human rights, philanthropy and support for local communities.

 

Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions at shareholder meetings. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us, which could negatively impact our share price as well as our access to and cost of capital. Any harm to our reputation could impact employee engagement and retention and the willingness of customers and partners to do business with us, which could have an adverse effect on our business, results of operations and cash flows. We believe that our reputation is critical to our role as a global leader in commerce enablement and cashless payments and as a publicly traded company. While our management and directors are focused on the integrity of our business and behavior of our board of directors, senior management, employees, other personnel and third-party suppliers and partners, we cannot assure that these efforts will be successful in producing the desired responsible outcomes in all cases nor that they will be sufficient in meeting investor demands in this area.

 

In addition, government authorities in various countries have adopted or proposed ESG regulation, and we expect there will likely be increasing levels of regulation globally, disclosure-related and otherwise, with respect to ESG matters. For example, the European Commission has established a number of sustainability-related due diligence, reporting and compliance regimes, which we are subject to, including the Corporate Sustainability Reporting Directive. This directive will require disclosure of detailed information on our social and environmental risks, impacts and sustainability performance when it comes into effect for us in the coming years. We may in the future also be subject to climate-related disclosure laws adopted by the State of California, which are currently subject to legal challenge. Such laws require companies with revenues in excess of certain thresholds that are doing business in California to publicly disclose greenhouse gas emissions data and provide climate-related financial risk reports.

 

Our current and future ESG efforts may be costly and may not have the desired effect. We currently engage multiple firms specializing in ESG matters to support our ESG efforts.  Expectations around companies’ management of ESG matters continue to evolve rapidly, in many instances due to factors that are out of our control. Any actions we currently take may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulatory engagement on our ESG initiatives. In addition, stakeholder expectations are not uniform, and opponents of various ESG-related matters have increasingly resulted in a range of activism and legal and regulatory developments. For example, there is an increasing number of state-level anti-ESG initiatives in the U.S. that may conflict with other regulatory requirements or our various stakeholders’ expectations. Moreover, President Trump has issued an executive order directing federal agencies to take appropriate action to discourage private sector diversity, equity and inclusion initiatives.

 

These and other changes in stakeholder expectations and regulations globally, whether pro- or anti-ESG, many of which are not possible to predict, and navigating conflicting requirements, will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor and litigation risks.

 

 

 

Risks associated with operating in such markets include unexpected changes in regulatory environments, uncertainty in enforcing contracts and intellectual property rights, challenges in obtaining legal redress, difficulties in collecting accounts receivables, foreign exchange controls, as well as bribery and corruption risks, which can all lead to reputational damage and impair our ability to win and retain contracts. Should one or more of these risks materialize, there could be a material adverse effect on our business, results of operations and financial condition.

 

Our hardware-as-a-service offerings require substantial capital expenditures on our part and entail additional risks to our business, financial condition and results of operations.

 

We have begun to offer a hardware-as-a-service subscription pricing model for our POS devices in certain countries and plan to expand such pricing model to our offerings in other countries in the future. Hardware-as-a-service offerings require significant additional up-front capital expenditure on our part compared to the sale of our POS devices. As we expand such offerings, we may not have sufficient capital available on our balance sheet and may be required to finance such capital expenditures. Hardware-as-a-service based revenue also exposes us to credit risk, as subscribers to this service may default on their payment obligations to us. Expenses related to our hardware-as-a-service offerings are recovered by us over a longer period in comparison to the sale of our POS devices, and we also bear the risk of malfunctioning hardware.

 

If our implementation of hardware-as-a-service subscription pricing model is not successful, our results of operation and revenue could be adversely affected. In addition, customers who subscribe to our hardware-as-a-service offerings may terminate such subscriptions under certain circumstances in accordance with our agreements with them, subject, in some instances, to early termination fees. Accordingly, if demand for and satisfaction with hardware-as-a-service is not maintained, the overall stickiness of our offerings as compared to the sale of our POS devices could be negatively impacted.

 

We offer, and may in the future expand the offering of, certain embedded financial services through our platform, which exposes us to a variety of risks.

 

 

Our Yellow Account offering is dependent on our relationship with a third-party sponsor bank, which holds merchant funds and provides the underlying infrastructure for this product. We do not hold merchant funds directly in connection with Yellow Account. If our sponsor bank were to terminate, fail to renew, or materially modify the terms of our arrangement, we may be unable to continue offering Yellow Account or may experience a significant disruption in service to our merchants. Transitioning to an alternative sponsor bank or infrastructure could be time-consuming, costly and operationally complex, and there can be no assurance that we would be able to secure a replacement arrangement on comparable or acceptable terms, or at all. In addition, our sponsor bank is itself subject to regulatory requirements and oversight. Any regulatory action against, or operational failure by, our sponsor bank, including with respect to the safeguarding and reconciliation of merchant funds, could disrupt our ability to offer Yellow Account, result in the loss or unavailability of merchant funds, or expose us to merchant claims, regulatory scrutiny or reputational harm, even if such issues are not caused by us. Moreover, negative events or adverse publicity involving our sponsor bank, including regulatory enforcement actions, financial difficulties or data security incidents, could adversely affect merchant confidence in Yellow Account and in our platform more broadly, regardless of our own performance or conduct.

 

The offering of embedded financial services subjects us to regulatory requirements that may vary significantly across jurisdictions. Our Yellow Account offering and any future embedded financial products are or may be subject to laws and regulations relating to anti-money laundering, counter-terrorist financing, sanctions compliance, know-your-customer obligations, safeguarding of client funds, disclosure requirements, and other applicable regulatory frameworks. If we offer credit-related products directly in the future, such activities may require us to obtain and maintain licenses or regulatory approvals in the applicable jurisdictions, and to comply with additional regulatory regimes, including those relating to fair lending, interest rate restrictions, and capital or liquidity thresholds. As we may offer these products across multiple jurisdictions, we face the additional complexity of navigating differing and potentially conflicting regulatory frameworks. Failure to comply with applicable laws and regulations, or changes in their interpretation or enforcement, could result in fines, penalties, restrictions on our activities, reputational harm, or the suspension or termination of our financial services offerings.

 

Our hardware purchase financing and rental activities expose us to credit risk on our balance sheet. Merchants that finance or rent hardware through us may be unable or unwilling to meet their payment obligations, particularly during periods of macroeconomic uncertainty, rising interest rates, or industry-specific downturns affecting the sectors we serve. If merchant defaults exceed our expectations, or if we fail to accurately price the credit risk associated with these arrangements, our results of operations and financial condition could be materially adversely affected. If we offer additional credit-related products in the future, either directly or through third-party financial partners, we would be exposed to further credit risk, as well as liquidity risk, interest rate risk, and earnings volatility. Such activities may require us to commit significant capital, maintain regulatory capital, or secure third-party funding arrangements, which could constrain our liquidity. If we are unable to access sufficient funding on acceptable terms, or if market conditions limit the availability of capital, we may be forced to curtail such activities or bear higher funding costs, which could adversely affect our margins and growth prospects.

 

The integration of financial services into our platform increases the complexity of our operations and internal controls. We are enhancing, and expect to continue enhancing, our risk management, compliance, cybersecurity, and fraud detection capabilities in connection with these offerings. If our systems, or those of our third-party partners, fail to effectively manage these risks, including risks arising from data breaches or cyberattacks targeting sensitive financial information, we could incur financial losses, regulatory scrutiny and reputational damage.

 

 

Moreover, our expansion into embedded financial services may not achieve the anticipated benefits of higher platform adoption or improved monetization of our merchants. Merchants may be reluctant to adopt our financial products, may prefer competing offerings from traditional financial institutions or fintech providers, or may perceive conflicts of interest in consolidating payments, operations management, and financial services with a single provider. If adoption rates are lower than expected, we may not realize a return on the investments made to develop and launch these offerings.

 

Any of the foregoing risks, individually or in the aggregate, could have a material adverse effect on our business, financial condition, results of operations and prospects.

 

We are exposed to credit risk from trade receivables and from financing or credit arrangements we extend to certain customers and partners.

 

We are exposed to credit risk in the ordinary course of our business, including from trade receivables arising from the sale of our products and services. In addition, from time to time, we may lend money or otherwise extend financing or credit arrangements to certain customers and partners in connection with our offerings. As of December 31, 2025, an aggregate of approximately $7.3 million was outstanding under such loans.

 

These arrangements expose us to the risk that customers or partners may be unable or unwilling to repay amounts owed to us in a timely manner or at all, whether due to liquidity constraints, financial distress, bankruptcy or other factors. If such customers or partners were to delay payment or default on their obligations, or if our allowances for expected credit losses prove inadequate, we may be required to record additional provisions or write-offs, which could adversely affect our results of operations and financial condition.

 

Providing financing or extending credit may also increase our exposure to customer concentration risk and require additional operational and administrative resources.

 

 

 

As a company that processes payments, information security failures and leaking of financial data of our customers or their consumers, as well as passage of information between different territories in violation of privacy protection laws, could harm our results and reputation. Sensitive credit provider information, personal information, personally identifiable information and other financial data are transferred through our products and services, either through execution of transactions, or through remote management services or other services we offer, including those that are consumer-facing.

 

The processing of the information we acquire in connection with our customers’ use of our services is subject to numerous privacy, data protection, cybersecurity and other laws, rules, regulations and standards in a number of jurisdictions. Furthermore, we operate under strict information security standards and regulations and use advanced security technologies in our efforts to comply with such laws, rules, regulations and standards, prevent data loss and protect the confidential, proprietary and sensitive information to which we have access. In order to mitigate against failures, cybersecurity incidents, attacks and other disruptions of our information technology systems, we strive to improve the security of our own servers, as well as the security environment we provide to customers and third parties using our products. For example, we possess three on-premise environments (data centers) for storing information, as well as dedicated cloud IT premises, mostly for customers in the Asia-Pacific region. In addition, we have offline backup for information, as well as internal and external support teams which are active seven days a week for identification of cyber-attacks, infiltration and exposure to other threat actors. Despite these measures, our efforts to protect such sensitive information and the Company’s information technology systems are not always effective, which could disrupt our operations and adversely affect our business.

 

The nature of our business and our reliance on digital technologies make us an attractive and frequent target for, and vulnerable to, technological failures and exposure to cyber-attacks, fraud, computer viruses, social engineering (including phishing and ransomware attacks), malware, password praying, credential stuffing, general hacking, physical or electronic break-ins or similar disruptions. Breaches of our security systems, which may arise as a result of employee theft, exfiltration, misuse or malfeasance, our actions, omissions or errors, third-party actions, omissions or errors, unintentional events or deliberate attacks by cyber criminals, have in the past and may in the future result in the loss or vulnerability of, or unauthorized access to, our or our customers’ data, including personal data, our intellectual property or other confidential, proprietary or sensitive business information. The techniques used to obtain unauthorized, improper or illegal access to our systems, our data, customer data or end-user data, disable or degrade service or sabotage systems are constantly evolving and have become increasingly complex and sophisticated, may be difficult to detect quickly and may not be recognized or detected until after they have been launched against a target. We and our service providers also face threats from sophisticated nation-state and nation-state-supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our and their systems, internal networks and the information that we and they store and process.

 

Companies newly acquired by us may have different information security standards and practices from us, making us potentially vulnerable to cybersecurity threats following such acquisitions during system integration. We expect that a growing number of unauthorized parties will continue to attempt to gain access to our systems or facilities through various means, including hacking into our systems or facilities or those of our customers, or attempting to fraudulently induce (for example, through spear phishing attacks or social engineering) our employees, customers, partners, vendors or other users of our systems into disclosing usernames, tax identifications, passwords, payment card information or other personal or sensitive information, which may in turn be used to access our information technology systems. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. Security breaches, incidents or other unauthorized access to our platform could potentially impact our ability to engage with clearing entities, banks and credit companies, since under the terms of our agreements with these entities, non-compliance with security requirements could lead to termination of the commercial engagement. To the extent that any system failure or similar event results in harm or losses to customers using our platforms or their data, customers could also seek monetary recourse or contractual remedies from us for their losses and such claims. Beyond the risks posed to our reputation and financial position by loss of user financial data, personal data or other sensitive information, we could be exposed to regulatory inquiries, time-consuming and expensive litigation, sanctions and fines.

 

Furthermore, regulators and many foreign, federal, state and local laws and regulations require notice of certain data security breaches that involve personal information. Additionally, the SEC has adopted rules that require us to publicly disclose information about material cybersecurity incidents, including their impact or reasonably likely impact. Disclosure may be required before the incident has been resolved or fully investigated. These mandatory disclosures regarding a security breach are costly to implement and often lead to widespread negative publicity, which may cause customers to lose confidence in the effectiveness of our data security measures. Any security breach suffered by, or the occurrence of a cyber-threat to, us or our service providers, any attack against our service availability, any unauthorized, accidental or unlawful access or loss of data, or the perception that any such event has occurred, has the potential to result in a disruption to our service, litigation, an obligation to notify regulators and affected individuals, the triggering of indemnification and other contractual obligations, regulatory investigations or inquiries, substantial government fines and penalties, material reputational damage and loss of customers and ecosystem partners and a material adverse effect on our business operations and financial conditions. In addition, we may incur significant costs and operational consequences in connection with investigating, mitigating and remediating security incidents, including complying with any notification or other obligations resulting from such incidents, as well as implementing prophylactic measures to prevent future actual or perceived security incidents. Our insurance policies carry retention and coverage limits, which may not be adequate to reimburse us for losses caused by security breaches or other cybersecurity incidents, and we may not be able to collect fully, if at all, under these insurance policies. The successful assertion of one or more large legal claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our business. Furthermore, we cannot be certain that insurance coverage related to security breaches will continue to be available on acceptable terms or at all, or that our insurer will not deny coverage as to any future claim. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

 

Although we have continued to invest in our due diligence, onboarding and monitoring capabilities over critical external parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties.

 

To the extent we use or are dependent on any particular third-party data, technology or software, we may also be harmed if such data, technology or software becomes non-compliant with existing regulations or industry standards, becomes subject to third-party claims of intellectual property infringement, misappropriation or other violation, or malfunctions or functions in a way we did not anticipate. Any loss of the right to use any of this data, technology or software could result in delays in the provisioning of our products and services until equivalent or replacement data, technology or software is either developed by us, or, if available, obtained from a third party and integrated into our systems, and there is no guarantee that we would be successful in developing, obtaining or integrating equivalent or similar data, technology or software, which could result in the loss or limiting of our products, services or features available in our products or services. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

 

For more information about our cybersecurity practices, please see “Item 16K. Cybersecurity.”

 

 

We are subject to various laws, rules, directives and regulations, as well as contractual obligations, relating to the collection, storing, sharing, use, disclosure, retention, disposition, security, protection, transfer and other processing (“Processing”) of personal information and other data, including personally identifiable information of our customers, their consumers and our employees. The regulatory framework for privacy and data protection worldwide is rapidly evolving and, as a result, implementation standards and enforcement practices are likely to continue to evolve for the foreseeable future. Legislators and regulators are increasingly adopting or revising privacy and data protection laws, rules, directives, and regulations that could have a significant impact on our current and planned privacy and data protection-related practices, our Processing of consumer or employee information, and our current or planned business activities.

 

In the United States, the Federal Trade Commission (“FTC”) and many state attorneys general interpret federal and state consumer protection laws to impose standards for the online Processing of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. In addition, if we fail to take appropriate steps to keep consumers’ personal data secure, such failure may also constitute unfair acts or practices under the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

 

Moreover, various federal and state legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding data privacy and security. For example, the State of California enacted the California Consumer Privacy Act, as amended by the California Privacy Rights Act, as amended (collectively, the “CCPA”), which created new privacy rights for users residing in the state. The CCPA broadly defines personal information and gives California residents expanded privacy rights and protections, such as affording them the right to access and request deletion of their information and the right to opt out of certain sharing and sales of personal information and provides a new cause of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation and class actions. The law also prohibits covered businesses from discriminating against California residents (for example, charging more for services) for exercising any of their CCPA rights. It also creates a new California data protection agency specifically tasked to enforce the law, which could result in increased regulatory scrutiny of businesses operating in California in the areas of data protection and security.

 

The enactment of the CCPA and other state privacy, data protection and cybersecurity laws, rules and regulations has prompted a wave of similar legislative developments in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. There are also ongoing discussions in the U.S. Congress of a new federal privacy and cybersecurity law to which we may become subject if it is enacted.

 

In addition, some laws require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal information or other unauthorized or inadvertent access to or disclosure of such information. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach or due to regulatory requirements. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. We also may be contractually required to notify our customers, consumers or other counterparties of a security breach. Regardless of our contractual protections, any actual or perceived security breach or breach of our contractual obligations could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

 

We are also subject to other privacy and data protection laws, rules, regulations and standards, including but not limited to the Children’s Online Privacy Protection Act, the Gramm-Leach-Bliley Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, the Personal Information Protection and Electronic Documents Act, the Telephone Consumer Protection Act, the Payment Card Industry Data Security Standard, the Canadian Anti-Spam Law, and Section 30a of the Israeli Telecommunications (Telecommunications and Broadcasts) Law. These laws and any other applicable state, federal, and international privacy laws, may increase our compliance costs and potential liability.

 

Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. The European Union’s (“EU”) General Data Protection Regulation (“GDPR”), which regulates the gathering, Processing, protection, storage and transfer of personal data, applies directly to the activities of our subsidiaries that are established in the European Union and indirectly to us and our non-EU subsidiaries to the extent that such entities process personal data collected from EU data subjects through the offering of goods and services or monitoring of data subjects in the EU. The GDPR, which became effective in May 2018, created new individual privacy rights and imposed worldwide obligations on companies Processing personal data of EU users, which has created a greater compliance burden for us and other companies with European users, and subjects violators to substantial monetary penalties. Fines for noncompliance with the GDPR are significant and can be up to the greater of €20 million or 4% of annual global turnover. The GDPR requires data controllers to implement stringent operational requirements, including, for example, transparent and expanded disclosure to data subjects about how their personal data is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for demonstrating that they have obtained valid consent for certain data Processing activities, and also to impose significant requirements and responsibilities on data Processing actions carried out by data processors on their behalf. The GDPR also provides that EU member states may introduce further conditions, including limitations, and make their own laws and regulations further limiting the Processing of ‘special categories of personal data,’ including personal data related to health, biometric data used for unique identification purposes and genetic information, which could limit our ability to collect, use and share EU data, and could cause our compliance costs to increase, ultimately having an adverse impact on our business, and harm our business and financial condition.

 

Following the United Kingdom (“U.K.”)’s exit from the European Union, known as Brexit, the U.K. implemented the U.K. General Data Protection Regulation (“U.K. GDPR”), which imposed substantially the same obligations as the GDPR. However, the U.K. GDPR will not automatically incorporate changes made to the GDPR going forward (which would need to be specifically incorporated by the U.K. government), which creates a risk of divergent parallel regimes and related uncertainty. We also cannot predict how the U.K. GDPR and other U.K. privacy and cybersecurity laws, rules, or regulations may develop, including as compared to the GDPR, nor can we predict the effects of divergent laws and related guidance. For example, the U.K.’s Data Use and Access Act of 2025, which makes several modifications to the U.K. GDPR, reived Royal Assent in June 2025, and implementation began in August 2025. Such modifications cause the U.K.’s data privacy law to deviate from the GDPR and that of the EU, and permit further deviations in the form of regulatory guidance or secondary legislation. Fines for noncompliance with the U.K. GDPR are significant and can be up to the greater of GBP 17.5 million or 4% of annual global turnover.

 

With respect to transfers of personal data from the European Economic Area (“EEA”), on June 28, 2021, the European Commission issued an adequacy decision in respect of the U.K.’s data protection framework, enabling data transfers from EU member states to the U.K. to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. The decision was renewed on December19, 2025 and it is intended to last until December 27, 2031, however, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs it could lead to additional costs and increase our overall risk exposure. in addition, recent legal developments in Europe have created complexity and uncertainty regarding data transfers from the EEA to countries outside of the EEA in respect of which the European Commission or other relevant regulatory body has not issued an adequacy decision. Furthermore, the U.K. similarly restricts transfers of personal data to countries outside of the U.K. to countries such as the United States that the U.K. government does not consider to provide an adequate level of personal data protection. While we currently rely on the standard contractual clauses promulgated and recently substantially revised by the European Commission and the U.K.’s International Data Transfer Agreement (or the U.K.’s approved international data transfer addendum to the European Union’s standard contractual clauses) for such transfers, on July 10, 2023, the European Commission adopted an adequacy decision concluding that the United States ensures an adequate level of protection for personal data transferred from the European Union to United States companies participating in the EU-U.S. Data Privacy Framework (followed on October 12, 2023 with the adoption of an adequacy decision in the U.K. for the U.K.-U.S. Data Bridge). However, the EU-U.S. Data Privacy Framework (and the U.K.-U.S. Data Bridge) may be in flux as such new adequacy decision has been challenged, and is likely to face additional challenges, including at the Court of Justice of the European Union.

 

An additional example of data privacy laws and regulations we may be subject to is the Israeli Protection of Privacy Law, 5741-1981 (“PPL”), as amended, including Amendment 13 that came into force and the regulations promulgated thereunder, including the Israeli Protection of Privacy (Data Protection) Regulations, 5777-2017. The PPL and the regulations promulgated thereunder, as well as guidelines of the Israeli Privacy Protection Authority (the “PPA”), impose obligations with respect to the manner personal data is processed, maintained, transferred, disclosed, accessed and secured. Failure to comply with the PPL, its regulations and guidelines issued by the PPA may expose us to administrative fines, civil claims (including class actions) and in certain cases criminal liability. The PPA may initiate administrative inspection proceedings, from time to time, without suspicion of any particular breach of the PPL, as it has done in the past with respect to dozens of Israeli companies in various business sectors. In addition, to the extent that any administrative supervision procedure is initiated by the PPA and reveals certain irregularities with respect to our compliance with the PPL, in addition to our exposure to administrative fines, civil claims (including class actions) and in certain cases criminal liability, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs. Pending legislation in Israel may result in a change to the current enforcement measures and sanctions.

 

We publicly post policies and documentation regarding our practices concerning the Processing of data. This publication of our privacy policy and other documentation that provide promises and assurances about privacy and security is required by applicable law and can subject us to proceedings and actions brought by data protection authorities, government entities, or others (including, potentially, in class action proceedings brought by individuals) if our policies are alleged to be deceptive, unfair, or misrepresentative of our actual practices.

 

Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so.

 

Any breach of privacy or data protection laws or regulations could result in significant fines, regulatory investigations, reputational damage, orders to cease Processing data or to change our practices, enforcement notices or assessment notices for a compulsory audit. We could also face civil privacy and data protection claims, including representative or class action litigation, potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. Non-compliance could result in proceedings against us by governmental entities, consumers, data subjects, or others. We may also experience difficulty retaining or obtaining new consumers in these jurisdictions due to the legal requirements, compliance costs, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these consumers pursuant to the terms set forth in our engagements with them.

 

Compliance with current or future privacy and data protection laws (including those regarding security breach notification) affecting consumer and/or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve us sharing information with third parties or storing personal or sensitive information), which could materially and adversely affect our profitability and could reduce income from certain business initiatives. We have incurred, and may continue to incur, significant expenses to comply with evolving privacy and security standards and protocols imposed by law, regulation, industry standards, shifting consumer expectations, or contractual obligations. In particular, with laws and regulations such as the GDPR in the EU, the U.K. GDPR in the U.K., the PPL in Israel and the CCPA and other laws, rules, regulations and standards in the U.S. imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices, and we may incur significant costs and expenses in an effort to do so. There is a risk that the interpretations and measures conducted by us in our efforts to comply with the applicable privacy and data protection legislation may prove to be insufficient or incorrect. Any failure, real or perceived, by us to comply with our privacy, data protection, or information security policies, changing consumer expectations, or with any evolving regulatory requirements, industry standards, or contractual obligations could cause our customers to reduce their use of our products and services, disrupt our supply chain or third-party vendor or developer partnerships, and materially and adversely affect our business. Privacy and data security concerns, whether valid or not, may inhibit market adoption of our products and services, particularly in certain industries and jurisdictions. If we are not able to quickly adjust to changing laws, regulations, and standards related to the internet, our business may be harmed.

 

Entering new markets with different legal regimes exposes us to a range of regulatory and privacy risks.  Non‑compliance with the privacy laws of such jurisdictions may lead to fines, investigations and unenforceable contracts. In regions with evolving or fragmented privacy frameworks, there is additional uncertainty as to our ability to adapt to local requirements which may differ materially from other privacy laws which are the basis of our current practices.

 

 

The core of our activity is providing technological services. As a result, and in light of the continuous, rapid development of the area of activity, as well as expansion of the services required by our customers, we are exposed to operational risks, including risks to the stable, ongoing operation of our technological systems, data security and the durability of our servers and data transfer infrastructure. These risks include technical malfunctions, overloads of system servers and cyber-attacks that could lead to the failure or shutdown of our computer systems and servers. If a technical failure or an attack on our computer infrastructure occurs and we are unable to restore our systems to proper functioning within a reasonable timeframe, our reputation and business results may suffer. Additionally, real or perceived software errors, failures, bugs, defects or outages of our systems could materially and adversely affect our business, results of operations, financial condition and future prospects.

 

Our systems rely on software that is highly technical and complex, and we depend on the ability of such software to store, retrieve, manage and otherwise process immense amounts of data. As a result, undetected errors, failures, bugs or defects may be present in such software or occur in such software in the future, especially when updates or new products or services are released, and particularly to the extent such failures are not detected or remedied quickly. Our products and services are designed to process complex transactions and deliver reports and other information related to those transactions, all at high volumes and processing speeds. Since customers use our services for important aspects of their businesses, any errors, defects, disruptions in services or other performance problems with our services could hurt our reputation and damage our customers’ businesses. For example, if we approve a transaction incorrectly and the acquiring or issuing bank does not transfer the funds for any reason, we are liable to our customers for the amount of the transaction. Software and system errors, or human error, could delay or inhibit settlement of payments, result in over settlement, cause reporting errors or prevent us from collecting transaction fees, which could have a material adverse effect on our business, financial condition and results of operations.

 

In addition, in order to compete as a significant player in the market for payment processing and operations solutions for businesses, we must demonstrate technological flexibility and advanced technical capability. We operate in an industry experiencing rapid technological change and frequent product introductions, including developments in payment card tokenization, mobile payments, social commerce (i.e., e-commerce through social networks), authentication, virtual currencies, distributed ledger or blockchain technologies, near field communication and other proximity or contactless payment methods, machine learning and AI.

 

We may not be able to make technological improvements as quickly as demanded by our customers, or as provided by our competitors, which could harm our ability to meet market demands and maintain the innovativeness and uniqueness of the services and products we offer. Developing and adapting to new technologies, together with expansion of our services and an increase in our customer base, require us to continuously maintain and expand our existing technological capabilities, including those for data transfer between the points of operation and relevant servers.

 

Operational failures, including regarding data transfer, could harm our reputation, business results and our ability to retain customers and recruit new customers. Furthermore, as our business continues to grow, we will need to invest additional resources to improve our operational infrastructure in order to maintain its performance level under a heavy operational load. Any failure to do so effectively could harm our business.

 

 

We are dependent on the ability of our products and services to integrate with a variety of operating systems, software, hardware and networks, as well as web browsers that we do not control. Any changes in these systems or networks that degrade the functionality of our products and services, impose additional costs or requirements on us or give preferential treatment to competitive services, including their own services, could materially and adversely affect usage of our products and services. In the event that it is difficult for our customers to access and use our products and services, our business may be materially and adversely affected. We also rely on bank platforms, acquirers, payment processors, last-mile payment service providers and others, including card issuers and alternative payment methods, to process some of our transactions. If there are any issues with, or service interruptions in, these bank platforms, users may be unable to have their transactions completed, which would seriously harm our business.

 

In addition, our solutions, including hardware and software, interoperate with mobile networks offered by telecom operators and mobile devices developed by third parties. Changes in these networks or in the design of these mobile devices may limit the interoperability of our solutions with such networks and devices and require modifications to our solutions. If we are unable to ensure that our hardware continues to interoperate effectively with such networks and devices, or if doing so is costly, our business may be materially and adversely affected.

 

 

Our ability to obtain, maintain, protect, defend and enforce our existing intellectual property and technological know-how is a matter of great importance. Continuing to lead in the provision of our services to customers is partially dependent on our ability to protect the intellectual property upon which our products are based, as well as trade secrets. We seek to protect our intellectual property, whether registered or unregistered, and other proprietary rights by relying on applicable laws, rules and regulations, as well as contractual restrictions both with our employees in the development of new services and technologies and when offering or procuring products and services, including through confidentiality agreements with our employees and third parties with whom we conduct business.