EXFY · Read the filing

Item 1A. Risk Factors

Our business involves a high degree of risk. You should carefully consider the risks described below, as well as the other information contained or incorporated by reference in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, as well as our other filings with the SEC. The occurrence of any of the events or developments described below could materially and adversely affect our business, financial condition, results of operations and growth prospects. In such an event, the market price of our Class A common stock could decline, and you may lose all or part of your investment. Additional risks and uncertainties not presently known to us or that we currently believe are not material may also impair our business, financial condition, results of operations and growth prospects.

Risks Related to Our Business

Our quarterly and annual results of operations have fluctuated in the past and may fluctuate significantly in the future and may not meet our expectations or those of investors or securities analysts.

Our quarterly and annual results of operations, including the levels of our revenue, deferred revenue, working capital and cash flows, have varied significantly in the past and may vary significantly in the future, such that period-to-period comparisons of our results of operations may not be meaningful. Our quarterly and annual financial results may fluctuate due to a variety of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

•the level of demand across our platform and for individual features within our platform;

•our ability to grow or maintain our gross logo retention rate and net seat retention rate (each as described under the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Key Factors Affecting Our Performance—Retaining Existing Customers"), expand usage within organizations, retain and increase sales to existing customers and attract new members and customers;

•our ability to convert individuals and organizations using our free features or trial subscriptions into paying customers;

•our ability to predictably generate revenue through marketing and sales efforts;

•the timing and success of new features, integrations, capabilities and enhancements by us to our platform, or by our competitors to their products, or any other changes in the competitive landscape of our market;

•our ability to grow and maintain our relationships and/or integrations with our network of third-party partners, including integration partners, channel partners and professional service partners;

•our ability to regulate members and member interactions on an increasingly collaborative platform;

•our ability to grow revenue share and customer referrals from our partner ecosystem;

•our ability to attract new customers and retain existing customers;

•the success of our customers’ businesses;

•our ability to achieve widespread acceptance and use of our platform and features, including the Expensify Card and any new features we may introduce;

•our ability to retain customers on annual subscriptions;

•our ability to maintain and improve employee efficiency, and our ability to manage third party, outsourced or open source workers to provide value-added services like receipt processing, customer support and engineering;

•errors in our forecasting of the demand for our platform and features, which would lead to lower revenue, increased costs, or both;

•the amount and timing of operating expenses and capital expenditures, as well as entry into operating leases, that we may incur to maintain and expand our business and operations and to remain competitive;

•the timing of expenses and recognition of revenue;

•actual or perceived security breaches, technical difficulties, or interruptions to our platform and features;

•pricing pressure as a result of competition or otherwise;

•ineffective pricing strategies that could limit customer base expansion, revenue growth and subscription renewals;

•adverse litigation judgments, other dispute-related settlement payments, or other litigation-related costs;

•the number of new employees hired;

•the timing of the grant or vesting of equity awards to employees, directors, or consultants;

•declines in the values of foreign currencies relative to the U.S. dollar;

•changes in, and continuing uncertainty in relation to, the legislative or regulatory environment;

•legal and regulatory compliance costs in new and existing markets;

•costs and timing of expenses related to the potential acquisition of talent, technologies, businesses or intellectual property, and their integration, including potentially significant amortization costs and possible write-downs;

•health epidemics, such as the COVID-19 pandemic, or other conditions that impact travel and business spending; and

•general economic and market conditions in either domestic or international markets, including geopolitical uncertainty and instability and their effects on software spending.

Any one or more of the factors above may result in significant fluctuations in our quarterly and annual results of operations, which may negatively impact the trading price of our Class A common stock. You should not rely on our past results as an indicator of our future performance.

The variability and unpredictability of our quarterly and annual results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenue or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our Class A common stock would fall, and we would face costly litigation, including securities class action lawsuits.

We experienced rapid growth in recent periods prior to the COVID-19 pandemic, and those growth rates may not be indicative of our future growth, and we may not be able to maintain profitability.

We experienced rapid growth in recent periods prior to the COVID-19 pandemic. Our business has been impacted by the COVID-19 pandemic, with declines in revenue and paid members due to government-

imposed lock-downs, a decrease in business travel and other expense-generating activity, and SMBs downsizing or going out of business, among other things. While we have seen an increase in paid members and improvements in revenue since the low point of the pandemic, our growth rate may not return to pre-pandemic levels. Even if our revenue and paid members continue to increase in the near term, we expect that our growth rate will decline as a result of a variety of factors, including the maturation of our business. Further, as we operate in a new and rapidly changing category of preaccounting software, widespread acceptance and use of our platform and features, particularly our expense management feature, is critical to our future growth and success. We believe our growth depends on a number of factors, including, but not limited to, our ability to:

•attract new individuals and organizations to use our features, particularly our expense management feature;

•convert individuals and organizations using our free features or trial subscriptions into paying customers;

•grow or maintain our gross logo retention rate and net seat retention rate, and expand usage within organizations;

•price our subscription plans effectively and competitively;

•retain our existing individual and organizational customers;

•achieve widespread acceptance and use of our platform and features, including in markets outside of the United States;

•continue to successfully advance our bottom-up sales strategy as well as strategic relationships with our channel partners;

•continue to maintain and build a platform and brand that drives word of mouth exposure to new potential members;

•grow or maintain our brand through marketing, advertising campaigns, partnerships and other methods;

•gain member traction for and generate revenue from our new features and services;

•grow or maintain current levels of consideration from a vendor and/or fees generated through transaction-based features;

•expand the features and capabilities of our platform and features;

•provide excellent customer experience and customer support;

•maintain the security and reliability of our platform and features;

•maintain the trust of our customers;

•successfully compete against established companies and new market entrants, as well as existing software tools;

•successfully respond to other competitive challenges in the United States and globally;

•attract, hire and retain highly skilled personnel;

•the impact of the COVID-19 pandemic and the pace and rate of recovery on our business;

•obtain, expand, maintain, enforce and protect our intellectual property portfolio;

•operate as a public company;

•grow our member and customer base in new countries and/or markets, and increase awareness of our brand on a global basis; and

•obtain and maintain compliance and licenses material to our current and future businesses, and comply with existing and new applicable laws and regulations including in markets outside of the United States.

If we are unable to accomplish these tasks, our growth, including our revenue growth, would be harmed. We also expect our operating expenses to increase in future periods, and if our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, results of operations, and financial condition will be harmed, and we may not be able to maintain profitability.

The COVID-19 pandemic has materially adversely affected, and may continue to materially adversely affect, our business and our ability to grow. Whether or not a result of the COVID-19 pandemic, a sustained general economic downturn, an uneven recovery, or continued instability could materially and adversely affect our business, results of operations, financial condition and growth prospects.

The COVID-19 pandemic and the measures attempting to contain and control its spread significantly curtailed the movement of people, goods and services worldwide. The effects of the COVID-19 pandemic, including stay at home, business closure and other restrictive orders, and the resulting changes in business and consumer expenditures and other behaviors, disrupted our business and impacted our employees, partners, third-party service providers and customers.

In particular, conditions caused by the COVID-19 pandemic such as economic instability, remote work and travel restrictions have negatively affected demand for our platform as employees incurred fewer work- and travel-related expenses and submitted fewer expense reimbursement requests to their employers, and as SMBs downsized or went out of business. As a result of the COVID-19 pandemic, we experienced a decline in paid members and subscription revenue, with our revenue declining from approximately $21.9 million in the quarter ended March 31, 2020 to approximately $18.8 million in the quarter ended June 30, 2020, as well as reduced customer spend as customers streamlined travel and other expenses, delayed expanding subscriptions and laid off or furloughed workers. After a steady increase in paid members over multiple years prior to the COVID-19 pandemic, the average number of paid members on our platform declined 15% from 742,000 in the quarter ended March 31, 2020 to 630,000 in the quarter ended June 30, 2020, but we have subsequently rebounded to 711,000 paid members in the quarter ended December 31, 2021. Our activity is still recovering from May 2020 as the United States and certain other parts of the world continue to rebound from the COVID-19 pandemic. The amount of expenses incurred by the paid members remaining on our platform has also declined. In 2020 and 2021, our annual gross logo retention was 86% and 83%, respectively. In 2020 and 2021, our net seat retention was 96% and 93%, respectively. The COVID-19 pandemic impacted both our annual gross logo retention and our net seat retention as many of our customers ceased (or paused) operations, and scaled back usage of our platform as their business travel and other expenses declined as a result of the factors stated above. In addition, we launched the Expensify Card shortly prior to the outbreak of the COVID-19 pandemic, and this product launch was negatively impacted by the effects of the pandemic due to decline in volume of expenses and potential customers' reluctance to adopt a new card in this unusual environment. If conditions caused by the COVID-19 pandemic continue, our business, results of operations, financial condition and growth prospects will be materially adversely affected. In addition, to the extent the ongoing COVID-19 pandemic continues to adversely affect our business and our ability to grow, it may also heighten many of the other risks and uncertainties described in this “Risk Factors” section.

The COVID-19 pandemic has caused an economic downturn in many markets and heightened uncertainty in the global economy. Our business depends on the economic health of our current and prospective customers and the overall state of the economy. Declining levels of economic activity may lead to declines in business spending, declines in the number of paid monthly members of our platform and fewer transactions for which our platform may be used, which may result in decreased revenue for

us. Further, our customers may change their company policies to limit expense reimbursement in response to a deterioration or continued uncertainty in the economy. Uncertainty or continued economic impacts from the pandemic may also cause prospective or existing customers to defer investment or expansion in their businesses. As of December 31, 2021, businesses with fewer than 1,000 employees accounted for approximately 95% of our customers by revenue, and we focus our product, marketing and sales efforts on these businesses, including SMBs. Many very small businesses (“VSBs”) and SMBs experienced substantial revenue and cash liquidity declines in the early months of the pandemic, and there were high observed rates of small business failures. Uncertain and adverse economic conditions also have led to increased requests for, and may lead to, increased refunds and chargebacks. We expect the COVID-19 pandemic and related impacts on the global economy to continue to affect our results of operations in future periods, and our member base may not return to pre-pandemic levels.

The degree to which the COVID-19 pandemic will continue to affect our business will depend on future developments that are highly uncertain and cannot currently be predicted. These developments include, but are not limited to, the duration, extent and severity of the pandemic; actions taken to contain the COVID-19 pandemic, including the development, approval, production, distribution and administration of vaccines, and the public’s perception of the safety of vaccines and their willingness to receive them; rising infection rates and the emergence of new variants; the ultimate societal impact of the pandemic and any lasting changes in business and consumer behavior, including with respect to remote work, business travel and business expense spending and reimbursement; the duration and nature of pandemic-related restrictions on economic activity and domestic and international trade; and the extent of the impact of these and other factors on our employees, partners, third-party service providers and customers. We cannot predict whether, when and to what extent pre-pandemic business SaaS spending, employee business expense spending and submission, and pre-pandemic ways of working will return, including whether demand for expense management products will return to pre-pandemic levels.

In response to the COVID-19 pandemic, we have taken a number of actions that have impacted and continue to impact our business and which could negatively impact our culture, our marketing initiatives, our expansion efforts and our ability to retain and recruit employees across the organization. For example, we reduced our 2020 marketing spend in response to the COVID-19 pandemic, although we have since began increasing the spend to promote the adoption of new products and features. Travel is an important part of our business and our culture, and prior to the COVID-19 pandemic, we hosted global conferences and an annual “Offshore” trip for our employees. We have a distributed workforce, and many of our employees were accustomed to traveling frequently prior to the pandemic to establish and maintain relationships with each other and with our customers, members, business partners, vendors and others. Prior to the pandemic, we began to transition our offices to co-working spaces, which we call lounges, with the goal of creating flexible workspaces that can be shared by Expensify employees and certain Expensify members. This initiative has been disrupted by the pandemic, and it is unclear when, and if, members will have access to these co-working spaces and whether they will be successful in the post-pandemic business climate. See “—We are transitioning our offices to co-working spaces, which we call lounges, and may expand to additional lounges. This process is expensive, may not achieve our intended goals, and could expose us to additional risks.” While we expect to return to offering our employees, and possibly others, the option to work from our lounges, we expect there to be an increase in sustained remote work as a result of the COVID-19 pandemic. If we must continue to limit or suspend travel, use of our lounges, and in-person business on a long-term basis, our culture, marketing initiatives, expansion efforts and ability to recruit and retain employees could be negatively affected.

To the extent there is a sustained general economic downturn, whether or not related to the COVID-19 pandemic, our customers may become more price-sensitive, our platform may be perceived by customers and potential customers as too costly, and our revenue may be disproportionately affected by delays or reductions in general business spending. Our VSB and SMB customers may be more susceptible to general economic conditions than larger businesses, which may have greater liquidity

and access to capital. Competitors, many of whom are larger and more established than we are, may respond to market conditions by lowering their prices and attempting to lure away our customers. Many of our larger competitors currently focus their product offerings on larger customers who may be less susceptible to general economic conditions, whether or not related to the COVID-19 pandemic. As a result, our larger competitors may be better positioned than we are to increase their market share with businesses of all sizes. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our platform offerings. We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, our business, results of operations and financial condition could be materially and adversely affected.

Our expense management feature drives the majority of our subscriptions, and any failure of this feature to satisfy customer demands or to achieve increased market acceptance could adversely affect our business, results of operations, financial condition and growth prospects.

A majority of our subscriptions are driven by bottom-up adoption related to our expense management feature. Although we have added, and expect to continue to add, new features to expand our offerings, and all of our features are accessible under a single subscription, at least in the near term, we expect our expense management feature to continue to drive the majority of our subscriptions. As a result, market acceptance of our expense management feature is critical to our success. Demand for our expense management feature, as well as our other features, is affected by a number of factors, many of which are beyond our control, such as the adoption of our features by new and existing customers; the timing of development and release of upgraded or new features on our platform; products and services introduced or upgraded by our competitors or partners; our ability to determine optimal pricing for our platform, including in international markets; pricing offered by our competitors; technological change; and growth or contraction in our addressable market. We recently increased our subscription prices, and we do not know if these price increases will adversely affect our business. If we are unable to meet customer demand for our expense management feature; do not price our subscriptions optimally or make changes to our subscription or pricing models that are not accepted by the market; or fail to convert members of our free expense management feature or trial subscriptions to paying subscribers, our business, results of operations, financial condition and growth prospects will suffer.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards and changing customer needs or preferences, our platform may become less competitive.

The software industry is subject to rapid technological change, evolving industry standards and practices and changing customer needs and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes by continually modifying and enhancing our features to keep pace with changes in hardware systems and software applications, database technology and evolving technical standards and interfaces on a timely basis. If we are unable to develop and market new technology, features and functionality for our platform that keep pace with rapid technological and industry change and satisfy our customers, our revenue and operating results could be adversely affected. If new technologies emerge that deliver competitive products at lower prices, more efficiently, more conveniently, or more securely, it could adversely impact our ability to compete.

Our platform must also integrate with a variety of network, hardware, mobile and software platforms and technologies. We need to continuously modify and enhance our platform to adapt to changes and innovation in these technologies. This development effort may require significant engineering, marketing and sales resources, all of which would affect our business and operating results. Any failure of our platform to operate effectively with future technologies could reduce the demand for our platform. If we are unable to respond to these changes in a cost effective manner, our platform may

become less marketable and less competitive or obsolete, and our operating results may be negatively affected.

If we are unable to attract new customers on a cost-effective basis, convert individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, retain existing customers and expand usage within organizations, our revenue growth will be harmed.

To increase our revenue, we must increase our customer base through various methods, including but not limited to, retaining existing customers, adding new customers, converting individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, and expanding usage within organizations. Our business is subscription-based, with monthly and annual subscriptions, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

One of our primary marketing strategies is to offer a free basic version of our expense management feature to individuals within organizations. We rely on these individuals to expose others within their organizations to our platform and features and to convince those individuals to become new members, which could eventually lead to the engagement of the organization or individuals or departments within the organization as paying customers. To encourage viral adoption, we offer viral features that are free and accessible without a paid subscription, and we also offer time-limited trial subscriptions. We believe these free basic features and trial subscriptions promote brand awareness and organic adoption of our platform. While our viral model means that employees or contractors often introduce Expensify into SMBs, companies subscribe and pay for the majority of our paid members. To the extent that increasing numbers of these individuals and organizations who utilize the free aspects of our platform do not become, or lead others to become, paying customers, we will not realize the intended benefits of these marketing strategies, we will continue to pay the costs associated with hosting such free basic features and trial subscriptions, our ability to grow our business will be harmed, and our business, results of operations and financial condition will suffer.

While we experienced significant growth in the number of our customers prior to the COVID-19 pandemic, we do not know whether we will continue to achieve similar customer growth rates in the future. The COVID-19 pandemic significantly impacted the number of our paid members, and our member base has not recovered and may never recover. Numerous factors may impede our ability to attract new customers, convert individuals and organizations using our free basic features and trial subscriptions into paying customers, expand usage within organizations, increase use of our other features such as the Expensify Card and gain new subscriptions, including but not limited to, the continuing impacts of the COVID-19 pandemic; failure to retain and motivate our personnel; failure to establish, maintain or expand relationships with channel and integration partners; failure to compete effectively against alternative products or services; our ability to determine optimal pricing for our subscriptions, including in international markets; failure to successfully deploy new features and integrations; failure to provide a quality customer experience and customer support; or failure to ensure the effectiveness of our “bottom-up” sales approach and other marketing programs. Channel partnerships are also an important aspect of our growth strategy, and we will need to maintain our partnerships with existing channel partners and identify and attract new channel partners in order to maintain the effectiveness of this strategy. Moreover, we believe that many of our new customers originate from word-of-mouth and other non-paid referrals from existing customers, so we must ensure that our existing customers remain loyal to our platform in order to continue receiving those referrals.

Our business is subscription-based, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire. We cannot ensure that customers will renew subscriptions with the same or greater number of members or for the same level of subscription plan or that they will upgrade to use features such as bi-directional accounting sync and invoicing features or the Expensify Card. Customers may or may not renew their subscriptions as a result of a number of factors, including their satisfaction or dissatisfaction with our platform; changes we may implement in

our pricing or structure, such as the pricing change implemented in May 2020; the pricing or capabilities of the products and services offered by our competitors; the effects of general economic conditions; or customers’ budgetary constraints. If customers do not renew their subscriptions, renew on less favorable terms, or fail to add members, or if we fail to convert individuals and organizations into paying members, or expand the adoption of our platform within their organizations, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations and financial condition. Our future success also depends in part on our ability to provide additional features to attract new members at existing customers, as well as increase transaction monetization from the Expensify Card. If our efforts to do so are not successful, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations and financial condition.

We may fail to accurately predict the optimal pricing strategies necessary to attract new customers, retain existing customers and respond to changing market conditions.

We have in the past, and may in the future, need to change our pricing model from time to time. As the market for our platform matures, or as competitors introduce new solutions that compete with ours, we may be unable to attract new customers at the same prices or based on the same pricing models that we have used historically. While we do and will attempt to set prices based on our prior experiences and customer feedback, our assessments may not be accurate and we could be underpricing or overpricing our platform. In addition, if the offerings on our platform change, then we may need to revise our pricing strategies. Any such changes to our pricing strategies or our ability to efficiently price our offerings could adversely affect our business, operating results and financial condition. Pricing pressures and decisions could result in reduced sales, reduced margins, losses or the failure of our platform to achieve or maintain more widespread market acceptance, any of which could negatively impact our overall business, operating results and financial condition. Moreover, the organizations which we target may demand substantial price concessions. As a result, we may be required to price below our targets in the future, which could adversely affect our revenue, profitability, cash flows and financial condition.

We may not successfully develop or introduce new features, enhancements, integrations, capabilities and versions of our existing features that achieve market acceptance, and our business could be harmed and our revenue could suffer as a result.

Our ability to attract new customers and increase revenue from existing customers depends in large part upon the successful development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. If we are unable to expand our platform offerings in a manner that increases retention of existing customers and attracts new customers, our customers could migrate to competitors who may offer a broader or more attractive range of products and services. Unexpected delays in releasing new or enhanced features or versions of our features, or errors following their release, could result in loss of sales, delay in market acceptance of our features, or customer claims against us, any of which could harm our business. The success of any new feature, enhancement, integration, capability or version depends on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with existing technologies, proper marketing of the feature and market acceptance. For example, growth from Expensify Card, which we introduced in 2020, has taken longer than anticipated due to the impact of the COVID-19 pandemic, and there can be no assurance that it will reach the level of customer adoption that it was designed to achieve. We may not be able to develop new features successfully or to introduce and gain market acceptance of new features in a timely manner, or at all.

The successful development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features is costly and time-consuming, and our business could be harmed if we fail to deliver new features, enhancements, integrations, capabilities and versions of our existing features that meet customer needs on a timely and cost effective basis.

For example, we are developing an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop. Although we see this direction as a natural next step in our long-term product vision, we have not developed an open-source financial group chat (or similar feature) before, and it may not meet customer needs, gain member traction or generate revenue sufficient to offset the costs of development, which could harm our business.

We face significant competition, the market in which we operate is rapidly evolving, and if we do not compete effectively, our results of operations and financial condition could be harmed.

We face significant competitive challenges from do-it-yourself approaches as well as companies that provide traditional horizontal platform solutions with expense management features, corporate card providers and niche expense management solutions. Traditional do-it-yourself approaches (for example, using spreadsheets, email, messaging and legacy project management tools) are people-intensive and involve internal personnel manually performing expense management processes. Many businesses using do-it-yourself approaches believe that these manual processes are adequate and may be unaware that Expensify can replace several expensive, disconnected services with one fully connected preaccounting platform for a fraction of the cost, resulting in an inertia that can be difficult to overcome. It is difficult to predict adoption rates and demand for our platform, the future growth rate and size of the market for expense management and other preaccounting products, or the entry of competitive offerings. The expansion of the expense management and other preaccounting products market depends on a number of factors, including the cost, performance and perceived value associated with these solutions. If expense management and other preaccounting solutions do not achieve widespread adoption, or there is a reduction in demand for expense management and other preaccounting products caused by a lack of customer acceptance, technological challenges, weakening economic conditions, security or privacy concerns, competing technologies and products, decreases in corporate spending, or otherwise, it could result in decreased revenue, and our business, results of operations and financial condition would be adversely affected.

In addition, there are a number of competing companies that provide traditional horizontal platform solutions with expense management features, some of which have substantially greater revenue, personnel and other resources than we do, such as Intuit, Oracle Corporation (NetSuite), SAP AG (Concur) and Workday. These firms have historically targeted primarily large enterprise customers, but many of them also market to SMBs in search of growth in revenue or market share. We also face competition from a growing number of other businesses offering expense management solutions and corporate cards, including Bill.com (Divvy), Bento, Brex, Emburse (Certify, Abacus and Nexonia), Expensya, Fyle, Happay, Pleo, Ramp, Spendesk, TravelBank, TripActions, Webexpenses and Zoho Expense. Our smaller competitors who currently focus their product offerings on SMBs may be better positioned than larger competitors to increase their market share with SMBs, whether by competing based on price, service, or otherwise. Increased competition may impact our ability to add new customers at the rates we have historically achieved. Additionally, competition may increase in the future from new market entrants. With the introduction of new technologies and the entry of new companies into the market, we expect competition to persist and intensify. This could harm our ability to increase our customer base, maintain subscription renewals and maintain our prices.

Additionally, it is possible that large enterprises with substantial resources that operate in adjacent accounting, finance or compliance verticals may decide to pursue expense management automation and become immediate, significant competitors. Merger and acquisition activity in the technology industry could increase the likelihood that we compete with other large technology companies. Many of our existing competitors have, and our potential competitors could have, substantial competitive advantages such as greater name recognition, longer operating histories, larger sales and marketing budgets and resources, greater customer support resources, lower labor and development costs, larger and more mature intellectual property portfolios and substantially greater financial, technical and other

resources. Some of our larger competitors also have substantially broader product lines and market focus and will therefore not be as susceptible to downturns in a particular market. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. New startup companies that innovate, and large companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our platform, including the addition of “bottom up” adoption features. Some of our larger competitors use broader product offerings to compete, including by selling at zero or negative margins, by bundling their product, or by closing access to their technology platforms. Potential customers may prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. Furthermore, potential customers may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our platform. These competitive pressures in our market, or our failure to compete effectively, may result in price reductions, fewer new customers, lower revenue and loss of market share. Any failure to successfully and effectively compete with current or future competitors could cause us to lose business and harm our revenue growth, business, results of operations and financial condition.

Payments and other financial services-related laws and regulations and government oversight are material to our business. Our failure to comply with such laws and regulations could materially harm our business and can subject us to criminal and civil liability.

The local, state, and federal laws, rules, regulations, licensing and other authorization schemes, and industry standards that govern our business, including our payment services, include, or may in the future include, those relating to banking, invoicing, cross-border and domestic money transmission, foreign exchange, payments services (such as payment processing and settlement services), anti-money laundering, combating terrorist financing, escheatment, U.S. and international sanctions regimes, and compliance with the Payment Card Industry Data Security Standard (PCI-DSS), a set of requirements designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect cardholder data. These laws, rules, regulations, licensing and other authorization schemes, and industry standards are administered and enforced by multiple authorities and governing bodies in the United States, including but not limited to the U.S. Department of the Treasury, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, Office of Foreign Assets Control, self-regulatory organizations, and numerous state and local governmental and regulatory authorities. Any failure or perceived failure to comply with existing or new laws and regulations, or orders of any governmental authority, including changes to or expansion of their interpretations, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, and increased regulatory scrutiny of our business. In addition, we may be forced to restrict or change our operations or business practices, make product changes, or delay planned product launches or improvements. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.

Expensify Payments LLC (“Expensify Payments”) is a licensed money transmitter (or its equivalent) in various U.S. states and territories and is in the process of obtaining money transmission licenses in a number of states and territories. As a licensed money transmitter, Expensify Payments, its ultimate beneficial owners, and its control persons are subject to a range of restrictions and ongoing compliance obligations under the money transmitter statutes (or their equivalent) administered by the banking departments (or their equivalent) of the various U.S. states and territories where it is licensed, including requirements with respect to the investment of customer funds, financial recordkeeping and reporting, reconciliation of customer funds, bonding, minimum capital, minimum net worth, disclosure, and inspection by regulatory authorities concerning various aspects of its business. In a number of cases, evaluation of our compliance efforts, as well as questions of whether and to what extent our activities in connection with the provision of certain products and services (both current and historical) are considered money transmission, are matters of regulatory interpretation and could change over time. In the past, regulators have identified violations or alleged violations of certain statutory and

regulatory requirements, and we have been subject to fines and other penalties by state regulatory authorities due to their interpretation and application of their respective state money transmitter regime to our activities. In the future, as a result of the laws and regulations applicable to us and our business, we could be subject to investigations, inspections, examinations, and supervision, and resulting liability, including governmental fines, restrictions on our business, or other similar enforcement actions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses, regulatory approvals, or other similar authorizations. We cannot make any assurances that we will be able to obtain or maintain any such licenses, regulatory approvals, and other similar authorizations, and there could be substantial costs and potential product changes involved in obtaining and maintaining any such licenses, approvals, or other similar authorizations, which could have a material adverse effect on our business. In addition, there are substantial costs and potential product changes involved in maintaining and renewing any licenses, regulatory approvals, and other similar authorizations, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, net worth, corporate governance, or other requirements applicable to us, including those required in connection with maintaining such licenses, approvals, or authorizations. These factors could impose substantial additional costs on us, involve considerable delay to the development or provision of our products or services to our customers, require significant and costly operational changes, or prevent us from providing our products or services in any given market.

Governmental and regulatory bodies and authorities may also impose new or additional requirements on our business or issue or promulgate new laws, regulations, or rules applicable to persons engaged in money transmission that adversely affect our business, including those that:

•prohibit, restrict, and/or impose taxes or fees on money transmission transactions in, to or from certain countries or with certain governments, individuals, or entities;

•impose additional customer identification and customer due diligence requirements;

•impose additional reporting or recordkeeping requirements, or require enhanced transaction monitoring;

•limit the types of entities capable of providing money transmission services, or impose additional licensing or registration requirements;

•impose minimum capital or other financial requirements;

•limit or restrict the revenue that may be generated from money transmission, including revenue from interest earned on customer funds, transaction fees, and revenue derived from foreign exchange;

•require enhanced disclosures to our money transmission customers;

•require the principal amount of money transmission originated in a country to be invested in that country or held in trust until paid;

•limit the number or principal amount of money transmission transactions that may be sent to or from a jurisdiction, whether by an individual or in the aggregate;

•restrict or limit our ability to process transactions using centralized databases, for example, by requiring that transactions be processed using a database maintained in a particular country or region; or

•impose other requirements in furtherance of their missions.

We depend on our senior management team, as well as a single professional services firm for a significant portion of our finance function, and the loss of any key employees or our outsourced finance team could adversely affect our business.

Our success depends largely upon the continued services of our key executive officers and employees, including our founder and CEO, David Barrett. We also rely on our leadership team in the areas of research and development, marketing, sales, services and general and administrative functions, and on mission-critical individual contributors in research and development. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. The loss of one or more of our executive officers or key employees could have a serious adverse effect on our business.

In addition, we depend on a single professional services firm for a significant portion of our finance function. If we lose the services of this outsourced finance team for any reason, our ability to complete key accounting processes and reviews and provide timely and accurate financial reporting could be seriously harmed, and we could experience material weaknesses in our disclosure controls and procedures and our internal control over financial reporting. In addition, we may be unable to retain a new outside professional services firm or expand the size and expertise of our internal accounting team sufficiently and quickly enough to implement the processes and reviews necessary to ensure that material misstatements do not occur, which could seriously harm our business. Any failure to provide timely and accurate financial reporting or to maintain effective disclosure controls and internal control over financial reporting could harm our business, results of operations and financial condition, and could cause investors to lose confidence in our financial reports and our financial reporting generally, which could cause a decline in the trading price of our Class A common stock.

We rely on a single third-party vendor, issuing bank and card network for our Expensify Card, and if we lose any of these services, our business, results of operations, financial condition and growth prospects could be harmed.

The Expensify Card is an important element of our growth strategy, and we believe that, over time, the Expensify Card will be a prominent corporate card solution for SMBs in our core markets. We rely on a single third-party vendor, Marqeta, Inc. ("Marqeta"), for the Expensify Card, who also manages the relationship with the card's issuing bank, Sutton Bank, and the card network, Visa. In the annual periods ended December 31, 2021 and December 31, 2020, consideration from this vendor representing monetized Expensify Card activities reduced our cost of revenue by $2.9 million and $1.0 million, respectively. Our agreement with Marqeta has a three year term, expiring in June 2022 and automatically renews annually thereafter unless either party provides 90 days' notice prior to renewal. In addition to standard termination for cause provisions, either party can terminate without cause upon 180 days' notice, and under certain circumstances Marqeta may terminate with reduced or no notice, including if required to do so by the issuing bank or any regulator with jurisdiction over the issuing bank or Marqeta, or in the event of that we issue cards outside of approved use cases. In the event of termination or expiration of the agreement with Marqeta, we have the right to request Marqeta's assistance in transitioning to a new vendor, and during the transition period the agreement will continue on the same terms. If such transition is not successful, or if we otherwise lose our Expensify Card vendor, issuing bank or card network for any reason, we could experience service interruptions as well as delays and additional expenses, and we may be unable to replace these services on competitive terms, or at all, which could harm our business, results of operations, financial condition and growth prospects.

Our failure to protect our sites, networks and systems against security breaches, or otherwise to protect our confidential information or the confidential information of our members, customers, or other third parties, would damage our reputation and brand, and substantially harm our business and results of operations.

Breaches of our security measures or those of our customers, partners or third-party service providers, or other cyber security incidents, could result in intentional or accidental unauthorized access to our or our customers’ or partners’ sites, networks, systems and accounts; unauthorized access to, and misappropriation or disclosure of, individuals’ personal information or other confidential or proprietary information of ourselves, our customers or partners, or other third parties; viruses, worms, spyware, ransomware, or other malware being served from our platform, mobile application, networks, or systems, including as a result of supply chain attacks; deletion or modification of content or the display of unauthorized content on our platform; interruption, disruption, or malfunction of operations; costs relating to breach remediation, deployment of additional personnel and protection technologies, and response to governmental investigations and media inquiries and coverage; engagement of third-party experts and consultants; or risk of loss, litigation, regulatory action and other potential liabilities. If any of these intentional or accidental breaches of security should occur, we cannot guarantee that recovery protocols and backup systems will be sufficient to prevent data loss. Additionally, if any of these breaches occur, our reputation and brand could be damaged, our business may suffer, we could be required to expend significant capital and other resources to alleviate problems caused by such breaches. Actual or anticipated security breaches or attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Additionally, some of our employees and our service providers have historically worked remotely, and the number doing so increased significantly as a result of the COVID-19 pandemic. As a result, we may be more vulnerable to cybersecurity-related events such as phishing attacks and other security challenges. Many companies that provide cloud based services have reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also be subject to vulnerabilities or experience security breaches or incidents that may remain undetected for an extended period. These events threaten the performance, reliability, security and availability of our platform. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security breaches to our systems could, among other things, harm our reputation and our ability to retain existing customers and attract new customers.

Our customers provide us with information that our systems store, some of which is confidential information about them or their financial transactions. In addition, we store personal information about our employees and, to a lesser extent, those who purchase products or services from our customers. Even though we have security systems and information technology infrastructure designed to protect against unauthorized access to such information, our efforts to address these threats may not always be successful. Any actual or perceived compromise or breach of our security measures, or those of our customers, partners or third-party service providers, could violate applicable privacy, data protection, data security, network and information systems security and other laws, and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, which could have a material adverse effect on our business, results of operations and financial condition. In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks, or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance. Our disaster recovery plan may not be sufficient to address all aspects or any unanticipated consequence or incident. We continue to devote significant resources to protect against security breaches, and we may need to devote significant resources in the future to address problems

caused by breaches, including notifying affected subscribers and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to expand our base of customers may be impaired, and our business and results of operations will be harmed.

We believe that the brand identity that we have developed has significantly contributed to the success of our business. We also believe that maintaining and enhancing the “Expensify” brand is critical to expanding our customer base and establishing and maintaining relationships with partners. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts, our ability to ensure that our platform remains high-quality, reliable, useful and competitively priced, the quality and perceived value of our platform, our ability to successfully differentiate our platform and features from those of our competitors and the ability of our customers to achieve successful results by using our platform and features. Maintaining and enhancing our brand may require us to make substantial investments not just in our core expense management service but also in newer features, such as our travel concierge services, and to make substantial investments in foreign markets, and these investments may not be successful. We also plan to enhance our brand and drive interest in our overall platform by introducing certain consumer-focused features, which may not be successful. Substantial advertising expenditures may be required to maintain and enhance our brand, which may not prove successful. Advertising and other brand promotion activities may not generate customer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand. Additionally, there could be a negative reaction to certain advertising campaigns and values-based activity and communications. If we fail to promote and maintain the “Expensify” brand, or if we incur excessive expenses in this effort, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts or to achieve the widespread brand awareness that is critical for broad customer adoption of our platform and features. We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become more difficult and expensive.

We expect to continue to make substantial investments and expenditures related to the growth of our business.

To improve the scalability, security, efficiency and failover aspects of our features, and to support our ongoing efforts to expand and enhance our platform and our business, we are continually updating our software and content and investing in the development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. Additionally, we will need to continue to make substantial investments and expenditures to, among other things:

•hire new and retain existing employees;

•maintain, expand, update and improve our infrastructure;

•expand our sales and marketing activities, including to obtain channel partners and to expand our SMB and consumer advertising;

•expand our operations across multiple geographies;

•operate as a public company; and

•pay for increasing costs associated with our general and administrative organization.

We may also review or revise our software architecture as we grow, which may require significant resources and investments. For example, we are developing an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase

across iOS, Android, web and desktop. There can be no assurance that this direction will achieve customer acceptance or that we will realize the anticipated return on our investment.

If we experience increasing demand for our features, we may not be able to augment our infrastructure quickly enough to accommodate this demand, which may limit our growth or cause disruptions, outages and other performance problems that could lead to financial liabilities or affect our brand and reputation. If our subscription sales decrease, certain of our fixed costs, such as for capital equipment, may make it difficult for us to adjust our expenses downward quickly.

Our business is substantially dependent upon the continued development of the market for, and acceptance of, cloud based software features.

We have derived, and expect to continue to derive, substantially all of our revenue from the sale of subscriptions for our cloud based platform. The market for cloud based software is not as mature as the market for on premises software applications. We do not know whether the trend of adoption of cloud based software that we have experienced in the past will continue in the future, and the adoption rate of cloud based software may be slower at companies in industries with heightened data security interests or sensitivity to communication network slowdowns or outages. Additionally, international acceptance of cloud-based software varies by country, and is limited in certain countries where we may seek to expand. Our success will depend to a substantial extent on the widespread adoption of cloud based software products in general, and of cloud based preaccounting products in particular. Many businesses have invested substantial personnel and financial resources to integrate on premises software products into their businesses and have been reluctant or unwilling to migrate to cloud based software products. Furthermore, some businesses may be reluctant or unwilling to use cloud based products because they have concerns regarding the risks associated with the security of their data and the reliability of the technology and service delivery model associated with solutions like ours. Additionally, integration opportunities for our cloud-based platform may be limited without widespread adoption of other cloud-based software products, which may prevent a member from maximizing their experience with our platform. In addition, if we or other cloud based providers experience security incidents, loss of customer data, disruptions in delivery, or other problems, the market for cloud based software solutions as a whole, including for our solutions, may be negatively impacted. If the adoption of cloud based software solutions does not continue at the rate we anticipate, the market for these solutions may stop developing or may develop more slowly than we expect, either of which would harm our business.

If we fail to offer a high-quality customer experience, our business and reputation will suffer.

While we have designed our platform and features to be easy to adopt and use, once individuals and organizations begin using Expensify, they rely on our support services to resolve any related issues. High-quality member and customer education and customer experience have been key to the adoption of our platform and features and for the conversion of individuals and organizations using our free features and trial subscriptions into paying customers. The importance of high-quality customer experience will increase as we expand our business and pursue new customers. For instance, if we do not help organizations on our platform quickly resolve issues and provide effective ongoing member experience at the individual and organizational levels, our ability to convert organizations on our trial subscription into paying customers will suffer, and our reputation with existing or potential customers will be harmed. Further, the success of our “bottom up” business model is highly dependent on our business reputation and on word-of-mouth positive recommendations from existing individuals and organizations using our platform and features. Any failure to maintain high-quality customer experience, or a market perception that we do not maintain high-quality customer experience, could harm our reputation, our ability to sell our platform to existing and prospective customers and our business, results of operations and financial condition.

In addition, as we continue to grow our operations and reach a larger and increasingly global customer and member base, we need to be able to provide efficient customer support that meets the needs of organizations using our platform and features globally at scale. The number of organizations using our

platform and features has grown significantly, which puts additional pressure on our support organization. Our platform is designed to leverage our proprietary AI-powered customer support engine, Concierge. Our Concierge service is powered by AI and trained by customer support agents. As we continue to grow and add features, we will need to hire additional support personnel to be able to continue to provide efficient customer support globally at scale, and if we are unable to provide such support, our business, results of operations and financial condition would be harmed.

We must continue to attract and retain highly qualified personnel, including an on-demand workforce in certain jurisdictions and for certain aspects of our business, to continue to execute on our business strategy and growth plans.

In order to continue to execute on our business strategy and growth plans, including the development of new features, and to maintain and upgrade our existing features, we will need to attract a sufficient number of highly qualified personnel, especially software engineers. Competition for software engineers and other key personnel in our industry is intense, especially for engineers with high levels of experience in designing and developing software for Internet-related services. As we become a more mature company, we may find our recruiting efforts more challenging.

In addition, one of our business strategies is to supplement our small core team of generalists with a large number of specialist contractors, managed by third-party vendors, from around the world. For example, we rely on certain third-party vendors to provide a specialized on-demand workforce to provide 24/7 real-time chat support and free phone onboarding for every Expensify.com member. We also intend to use this strategy to pair our core group of engineering generalists with a global network of open source engineering specialists, such as for the development and maintenance of our open-source financial group chat. If we are unable attract a sufficient number of specialized on-demand workers, or if changes to applicable foreign, state and local laws governing the definition or classification of independent contractors make it difficult or impossible for us to hire a sufficient number of specialized on-demand workers in a cost-effective manner, our costs could increase and our business, results of operations and financial condition could be harmed.

Job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. The incentives to attract, retain and motivate employees provided by our equity awards or other compensation arrangements may not be as effective as in the past. If the perceived value of our stock declines, it may adversely affect our ability to recruit and retain highly skilled employees.

Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or our company have breached their legal obligations, resulting in a diversion of our time and resources.

Our recruiting efforts may also be limited by laws and regulations, such as restrictive immigration laws, and restrictions on travel or availability of visas (including during the ongoing COVID-19 pandemic). If we do not succeed in attracting excellent personnel or retaining or motivating existing personnel, we may be unable to innovate quickly enough to support our business model or grow effectively.

Our culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the high employee engagement fostered by our culture, which could harm our business.

We believe that a critical component of our success has been our culture, which is deeply embedded in everything we do. Our culture is centered on a belief that a life well lived is one that enables you to achieve the following three goals: Live Rich, Have Fun and Save the World. We have invested substantial time and resources in building our team with an emphasis on collaboration and innovation, ensuring customer success and a commitment to diversity and inclusion. We invest in our culture to create fun, diverse and memorable experiences for our employees, including employee travel to

company-wide meetings in the U.S. and abroad. As we continue to grow and develop the infrastructure associated with being a public company, we will need to maintain our culture among a larger number of employees dispersed in various geographic regions. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel.

If we fail to effectively manage our growth, our business and results of operations could be harmed.

We experienced rapid growth and increased demand for our platform prior to the COVID-19 pandemic. Our revenue grew from $53.9 million in 2018 to $80.5 million in 2019 to $88.1 million in 2020, but our headcount remained consistent, with 131 employees as of December 31, 2018, 127 employees as of December 31, 2019 and 133 employees as of December 31, 2020. Comparing 2020 to 2021, our revenue has grown from $88.1 million to $142.8 million, respectively, but our headcount remained relatively consistent, with 133 employees as of December 31, 2020 and 144 employees as of December 31, 2021. The growth and expansion of our business and platform may place a significant strain on our management and our administrative, operational and financial reporting resources. Our ability to accurately plan for and model future growth is limited and subject to a number of uncertainties, due in part to our global operations, customer preferences and mix of products and features. We have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If our assumptions regarding these risks and uncertainties, which we use to plan our business strategies and operations, are incorrect or change due to industry or market developments, or if we do not address these risks successfully, our operating results could differ materially from our expectations and our business could suffer. For example, we are required to manage multiple relationships with various strategic, integration and channel partners, customers and other third parties. In the event of further growth of our operations or in the number of our third-party relationships, our computer systems, procedures, or internal controls may not be adequate to support our operations, and our management may not be able to manage such growth effectively. To effectively manage our growth, we must continue to implement and improve our operational, financial and management information and reporting systems and manage our employee base. In addition, as we seek to continue to expand internationally, we will likely encounter unexpected challenges and expenses due to unfamiliarity with local regulations, requirements, practices and markets.

Our payments services and our Expensify Card are targets for illegal or improper uses, and our risk management efforts may not be effective, which could expose us to losses and liability and otherwise harm our business.

We offer payments services and the Expensify Card to our customers, and we are responsible for vetting and monitoring these customers and determining whether the transactions we process for them are legitimate. When our features and services are used to process illegitimate transactions, and we settle those funds to sellers and are unable to recover them, we suffer losses and liability. These types of illegitimate transactions can also expose us to governmental and regulatory sanctions. The highly automated nature of, and liquidity offered by, our payments services make us a target for illegal or improper uses, including fraudulent or illegal sales of goods or services, money laundering and terrorist financing. Identity thieves and those committing fraud using stolen or fabricated credit card or bank account numbers, or other deceptive or malicious practices, can potentially steal significant amounts of money from our business. In configuring our payments services, we face an inherent trade-off between security and customer convenience. Our risk management policies, procedures, techniques and processes may not be sufficient to identify all of the risks to which we are exposed, to enable us to mitigate the risks we have identified, or to identify additional risks to which we may become subject in the future. In addition, when we introduce new services, focus on new business types, or begin to operate in markets where we have a limited history of fraud loss, we may be less equipped to forecast and reserve accurately for those losses. Furthermore, if our risk management policies and processes contain errors or are otherwise ineffective, we may suffer large financial losses, we may be subject to civil and criminal liability, and our business may be materially and adversely affected.

We are currently, and will continue to be, exposed to risks associated with chargebacks and refunds in connection with payment card fraud or relating to the goods or services provided by our sellers. In the event that a billing dispute between a cardholder and a seller is not resolved in favor of the seller, including in situations where the seller engaged in fraud, the transaction is typically “charged back” to the seller and the purchase price is credited or otherwise refunded to the cardholder. If we are unable to collect chargeback or refunds from the seller’s account, or if the seller refuses to or is unable to reimburse us for a chargeback or refunds due to closure, bankruptcy, or other reasons, we may bear the loss for the amounts paid to the cardholder. We do not collect and maintain reserves from our sellers to cover these potential losses. The risk of chargebacks is typically greater with those of our sellers that promise future delivery of goods and services, which we allow on our service. If we are unable to maintain our losses from chargebacks at acceptable levels, the payment card networks could fine us, increase our transaction fees, or terminate our ability to process payment cards. Any increase in our transaction fees could damage our business, and if we were unable to accept payment cards, our business would be materially and adversely affected.

If we experience excessive fraudulent activity, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly.

A large portion of our paying customers authorize us to bill their credit card accounts through our third-party payment processing partners for our paid subscription plans. If customers pay for their subscription plans with stolen credit cards, we could incur substantial third-party vendor costs for which we may not be reimbursed. Further, our customers provide us with credit card billing information online, and we do not review the physical credit cards used in these transactions, which increases our risk of exposure to fraudulent activity. We also incur chargebacks from the credit card companies for claims that the customer did not authorize the credit card transaction for subscription plans, something that we have experienced in the past. If the number of claims of unauthorized credit card transactions becomes excessive, we could be assessed substantial fines for excess chargebacks, and we could lose the right to accept credit cards for payment. In addition, credit card issuers may change merchant standards, including data protection and documentation standards, required to utilize their services from time to time. Our third-party payment processing partners must also maintain compliance with current and future merchant standards to accept credit cards as payment for our paid subscription plans. Substantial losses due to fraud or our inability to accept credit card payments would cause our customer base to significantly decrease and would harm our business.

We are transitioning our offices to co-working spaces, which we call lounges, and may expand to additional lounges. This process is expensive, may not achieve our intended goals, and could expose us to additional risks.

Prior to the COVID-19 pandemic, we began to transition our offices to co-working spaces, which we call lounges, with the goal of enhancing our culture and our brand by creating flexible workspaces that can be shared by Expensify employees and certain Expensify members. We have spent significant resources on this initiative, which has been disrupted by the pandemic. While we expect to open these lounges to certain members in the near term, there is no assurance that they will be successful in the post-pandemic business climate. In addition, we may be exposed to additional risks by allowing non-employees to use our lounges, including increased risk of litigation, theft, data privacy and cybersecurity breaches, and because we have very limited experience managing co-working spaces, we may not adequately balance managing these risks with our goals for these spaces. Furthermore, these lounges are subject to different rules and regulations than our normal operations, and which differ from location to location, and a failure to properly comply with such rules and regulations, due to our limited experience managing co-working spaces or otherwise, could result in regulatory action or fines. If we are unable to achieve our desired results, or if we are required to limit or suspend use of our lounges for an extended period of time for any reason, this initiative may be unsuccessful, which could damage our business, our culture and our brand.

Sales to customers outside the United States and our international operations expose us to risks inherent in international sales and operations.

Our revenue generated from customers outside the United States was $15.2 million (11% of our revenue), and $9.0 million (10% of our revenue), for the annual periods ended December 31, 2021 and 2020, respectively. Our core geographies are the United States, the United Kingdom, Canada and Australia. We intend to pursue expansion of our international operations. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that are different from those in the United States. In addition, we face risks in doing business internationally that could adversely affect our business and results of operations, including:

•the need to localize and adapt our platform and features for specific countries, including translation into foreign languages, tax and regulatory updates and associated expenses;

•data privacy laws that impose different and potentially conflicting obligations with respect to how personal data is processed or require that customer data be stored in a designated territory;

•more fragmented partner market which proves to be harder for our platform to integrate with;

•difficulties in staffing and managing foreign operations;

•regulatory and other delays and difficulties in setting up foreign operations;

•different pricing environments, longer accounts receivable payment cycles and collections issues;

•new and different sources of competition;

•weaker protection for intellectual property and other legal rights than in the United States and practical difficulties in enforcing intellectual property and other rights outside of the United States;

•laws and business practices favoring local competitors;

•compliance challenges related to the complexity of multiple, conflicting and changing governmental laws and regulations;

•exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act (FCPA), U.S. bribery laws, the UK Bribery Act and similar laws and regulations in other jurisdictions;

•increased financial accounting and reporting burdens and complexities;

•declines in the values of foreign currencies relative to the U.S. dollar;

•restrictions on the transfer of funds;

•potentially adverse tax consequences;

•the cost of and potential outcomes of any claims or litigation;

•future accounting pronouncements and changes in accounting policies;

•changes in tax laws or tax regulations;

•health or similar issues, such as a pandemic or epidemic; and

•regional and local economic and political conditions.

As we continue to expand our business globally, our success will depend, in large part, on our ability to anticipate and effectively manage these risks. These factors and others could harm our ability to increase international revenue and, consequently, would materially impact our business and results of

operations. The expansion of our existing international operations and entry into additional international markets will require significant management attention and financial resources. Our failure to successfully manage our international operations and the associated risks effectively could limit the future growth of our business.

We may be adversely affected by global economic and political instability.

As we seek to expand our business globally, our overall performance will depend in part on worldwide economic and geopolitical conditions. Economies domestically and internationally have been affected from time to time by falling demand for a variety of goods and services, restricted credit, poor liquidity, reduced corporate profitability, employment pressures in services sectors, volatility in credit, equity and foreign exchange markets, bankruptcies and outbreaks of COVID-19, as well as war, terrorist activity, political unrest, civil strife and other geopolitical uncertainty, and the resulting impact on business continuity and travel, supply chain disruptions, inflation, security issues, and overall uncertainty with respect to the economy, including with respect to tariff and trade issues.

For example, on February 24, 2022, Russian military forces invaded Ukraine, and sustained conflict and disruption in the region is likely. Although the length, impact and outcome of the ongoing military conflict in Ukraine is highly unpredictable, this conflict could lead to significant market and other disruptions, including significant volatility in commodity prices and supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability, changes in consumer or purchaser preferences as well as an increase in cyberattacks and espionage.

Russia’s recognition of two separatist republics in the Donetsk and Luhansk regions of Ukraine and subsequent military action against Ukraine have led to an unprecedented expansion of sanction programs imposed by the United States, the European Union, the United Kingdom, Canada, Switzerland, Japan and other countries against Russia, Belarus, the Crimea Region of Ukraine, the so-called Donetsk People’s Republic and the so-called Luhansk People’s Republic. The situation is rapidly evolving as a result of the conflict in Ukraine, and the United States, the European Union, the United Kingdom and other countries may implement additional sanctions, export controls or other measures against Russia, Belarus and other countries, regions, officials, individuals or industries in the respective territories. Such sanctions and other measures, as well as the existing and potential responses from Russia or other countries to such sanctions, tensions and military actions, could adversely affect the global economy and financial markets, which could in turn have a material adverse effect on our business, financial condition and results of operations.

We are actively monitoring the situation in Ukraine and assessing its impact on our business, but to date have not experienced any material impact. We have no way to predict the progress or outcome of the conflict in Ukraine or its impacts in Ukraine, Russia or Belarus as the conflict, and any resulting government reactions, are rapidly developing and beyond our control. The extent and duration of the military action, sanctions and resulting market disruptions could be significant and could potentially have a substantial impact on the global economy and our business for an unknown period of time. As the adverse effects of this conflict continue to develop and potentially spread, both in Europe and through the rest of the world, our customers, and customer behavior, may be negatively impacted, which could negatively affect subscription renewal rates and overall demand across our platform. Further or prolonged impacts on the global economy could also cause businesses to curtail business expenses, which could hinder our ability to attract new customers or result in fewer expense reimbursements among our existing customers and, thus, less frequent use of our platform. It is not possible to predict the ultimate broader consequences of this conflict. and any of the abovementioned factors could have a material adverse effect on our business, financial condition and results of operations, particularly to the extent the conflict escalates to involve additional countries, further economic sanctions and wider military conflict. Any such disruptions could also magnify the impact of other risks described in this Annual Report on Form 10-K.

In addition, political instability or adverse political developments and new or continued economic deterioration, including as a result to the withdrawal by many global central banks of stimulus

measures deployed during the peak of the COVID-19 pandemic, in any of the countries in which we operate could harm our business, results of operations and financial condition.

We face exposure to foreign currency exchange rate fluctuations.

While we have historically transacted in U.S. dollars with the majority of our customers and vendors, we have transacted in some foreign currencies with such parties and for our payroll in those foreign jurisdictions where we have operations, and expect to continue to transact in more foreign currencies in the future. Accordingly, declines in the value of foreign currencies relative to the U.S. dollar can adversely affect our revenue and results of operations due to remeasurement that is reflected in our earnings. Also, fluctuations in the values of foreign currencies relative to the U.S. dollar could make it more difficult to detect underlying trends in our business and results of operations.

We are subject to anti-corruption, anti-bribery, anti-money laundering and similar laws. Non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

We must comply with anti-corruption laws and regulations imposed by governments around the world with jurisdiction over our operations, which may include the U.S. Foreign Corrupt Practices Act of 1977 (the “FCPA”) and the U.K. Bribery Act 2010 (the “Bribery Act”), as well as the laws of the countries where we do business. These laws and regulations apply to companies, individual directors, officers, employees and agents, and may restrict our operations, trade practices, investment decisions and partnering activities. Where they apply, the FCPA and the Bribery Act prohibit us and our officers, directors, employees and business partners acting on our behalf, including joint venture partners and agents, from corruptly offering, promising, authorizing or providing anything of value to public officials for the purposes of influencing official decisions or obtaining or retaining business or otherwise obtaining favorable treatment. The Bribery Act also prohibits non-governmental “commercial” bribery and accepting bribes. As part of our business, we may deal with governments and state-owned business enterprises, the employees and representatives of which may be considered public officials for purposes of the FCPA and the Bribery Act. We also are subject to the jurisdiction of various governments and regulatory agencies around the world, which may bring our personnel and agents into contact with public officials responsible for issuing or renewing permits, licenses or approvals or for enforcing other governmental regulations. In addition, some of the international locations in which we operate lack a developed legal system and have elevated levels of corruption.

Our wholly owned subsidiary, Expensify Payments LLC, is registered as a “Money Services Business” with the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”), and subject to regulatory oversight and enforcement by FinCEN under the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001 (the “BSA”). Among other things, the BSA requires money services businesses to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity and maintain transaction records. The BSA prohibits, among other things, our involvement in transferring the proceeds of criminal activities. Regulators in the United States and globally may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions. In addition, we are contemplating offering certain products in the future that may require us to obtain licenses to operate as a money transmitter (or its equivalent) in various states and territories where such licenses are required. We have already obtained such licenses in certain states and have pending license applications in others. If we are unable to obtain a license to operate as a money transmitter, our ability to grow certain of our services may be limited. As a licensed money transmitter, we would be subject to obligations and restrictions with respect to the handling and investment of customer funds, record keeping and reporting requirements, bonding requirements and inspection by state regulatory agencies.

There are substantial costs and potential changes to our offerings involved in obtaining, maintaining and renewing these licenses and registrations. We could be subject to significant fines or other enforcement actions if we are found to violate disclosure, reporting, anti-money laundering, economic and trade sanctions, corporate governance and internal controls, banking secrecy, or other laws and

requirements. These factors could involve considerable delay to the development or provision of our offerings or services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, or prevent us from providing our offerings or services in a given geography.

Our business also must be conducted in compliance with applicable economic and trade sanctions and export control laws and regulations, such as those administered and enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council and other relevant sanctions authorities, which impose restrictions or prohibitions on the sale or supply of certain products or services to embargoed or sanctioned countries, governments, persons, and entities. Although we take precautions to prevent our platform from being provided in violation of such laws, our platform may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. Our global operations expose us to the risk of violating, or being accused of violating, anti-corruption, anti-money laundering, export control and economic and trade sanctions laws and regulations. Our failure to comply with these laws and regulations may expose us to reputational harm as well as significant penalties, including criminal fines, imprisonment, civil fines, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. Despite our compliance efforts and activities we cannot assure compliance by our employees or representatives for which we may be held responsible, and any such violation could materially adversely affect our reputation, business, financial condition and results of operations.

We receive, process, store and use business and personal information, which subjects us to governmental regulation and other legal obligations related to data protection and security, and our actual or perceived failure to comply with such obligations could harm our business and expose us to liability.

We receive, process, store and use business and personal information belonging to our members and customers. There are numerous federal, state, local and foreign laws, regulations and standards regarding data protection and the storing, sharing, use, processing, disclosure and protection of business and personal information, and we may be subject to these laws in certain circumstances. Most states have also adopted data security breach laws that require notice be given to affected consumers in the event of a security breach. In the event of a security breach, our compliance with these laws may subject us to costs associated with notice and remediation, as well as potential investigations from federal regulatory agencies and state attorneys general. These laws continue to evolve in scope and are subject to differing interpretations, and may contain inconsistencies or pose conflicts with other legal requirements. We seek to comply with applicable laws, regulations, policies, legal obligations and industry standards and have developed privacy policies, data processing addenda and internal privacy procedures to reflect our practices designed to achieve such compliance. However, it is possible that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. A failure on our part to safeguard consumer data adequately or to destroy data securely or otherwise comply with legal obligations may subject us, depending on the personal information in question, to costs associated with notice and remediation, as well as potential regulatory investigations or enforcement actions, and possibly to civil liability, under federal, state, or foreign laws or regulation, industry standards, our internal privacy policies and procedures, or our contracts governing our processing of personal information claims by third parties, and damage to our reputation, any of which could have an adverse effect on our operations, financial performance and business. We could also incur significant costs investigating and defending such claims and, if we are found liable, significant damages.

Data protection regulation is an area of increased focus and changing requirements. Any significant change in applicable laws, regulations, or industry practices regarding the use or disclosure of our members’ or customers’ data, or regarding the manner in which the express or implied consent of members or customers for the use and disclosure of such data is obtained, could require us to modify

our platform, possibly in a material manner, and may limit our ability to develop new services and features that make use of the data that our members and customers voluntarily share.

For example, the EU General Data Protection Regulation (the "GDPR") imposes stringent data protection requirements for processing the personal data of individuals within the European Economic Area (the "EEA"). The GDPR enhances data protection obligations for processors and controllers of personal information, including, for example, expanded disclosure requirements, limitations on retention of personal information, mandatory data breach notification requirements and additional obligations. Non-compliance with the GDPR can trigger fines of up to the greater of €20 million or 4% of our global revenue. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the E.U. and the United States remains uncertain. For example, in 2016, the E.U. and United States agreed to a transfer framework for data transferred from the E.U. to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union ("CJEU"). The CJEU also raised questions about whether the European Commission’s Standard Contractual Clauses, one of the primary mechanisms used by companies to transfer personal information out of the EEA, complies with the GDPR. While the CJEU upheld the validity of the Standard Contractual Clauses, the CJEU ruled that the underlying data transfers must be assessed on a case-by-case basis by the data controller to determine whether the personal information will be adequately protected. At present, there are few if any viable alternatives to the Standard Contractual Clauses and, therefore, there is uncertainty regarding how to ensure that transfers of personal information from Europe to the United States comply with the GDPR. As such, any transfers by us of personal information from Europe may not comply with European data protection laws and may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions. Loss of our ability to transfer personal information from Europe may also require us to increase our data processing capabilities in those jurisdictions at significant expense.

Further, following the United Kingdom’s withdrawal from the E.U. and the end of the related transition period, as of January 1, 2021, companies may be subject to both GDPR and the United Kingdom GDPR, or UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, imposing fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the E.U. in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure. Currently there is a four to six-month grace period agreed in the E.U. and United Kingdom Trade and Cooperation Agreement, ending June 30, 2021 at the latest, while the parties discuss an adequacy decision. The European Commission published a draft adequacy decision on February 19, 2021. If adopted, the decision will enable data transfers from E.U. member states to the United Kingdom for a four-year period, subject to subsequent extensions. While we have instituted a GDPR compliance strategy and program that we continue to evaluate and improve as our platform changes and expands, we still do not know how E.U. regulators will interpret or enforce many aspects of the GDPR, and some regulators may do so in an inconsistent manner, making such a prediction even more difficult.

In addition to the E.U., a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR. Others, such as those in Russia, India and China, could potentially impose more stringent obligations, including data localization requirements. If we are unable to develop and offer features that meet legal requirements or help our members and customers meet their obligations under the laws or regulations relating to privacy, data protection, or information

security, or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience reduced demand for our platform, harm to our reputation and become subject to investigations, claims and other remedies, which would expose us to significant fines, penalties and other damages, all of which would harm our business. Further, given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.

The data protection landscape is also rapidly growing and evolving in the United States. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For example, the California Consumer Privacy Act of 2018 (the "CCPA") came into effect on January 1, 2020. The CCPA requires companies that process information on California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to opt out of certain data sharing with third parties and exercise certain individual rights regarding their personal information, provides a new cause of action for data breaches, and provides for penalties for noncompliance of up to $7,500 per violation. While we are positioned as a “service provider” under the CCPA with respect to most of our data activities, have conducted a CCPA compliance review process, and do not currently share data with third parties in a way that would be currently considered a “sale” under the CCPA, some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which means that despite our efforts, an expansive reading of the CCPA could increase our potential liability and adversely affect our business. Additionally, the California Privacy Rights Act (the "CPRA") was recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the CPRA provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Similar laws have been proposed, and likely will be proposed, in other states and at the federal level, and if passed, such laws may have potentially conflicting requirements that would make compliance challenging. For example, on March 2, 2021, the Virginia Consumer Data Protection Act ("CDPA") was signed into law. The CDPA becomes effective January 1, 2023 and contains provisions that require businesses subject to the legislation to conduct data protection assessments in certain circumstances and that require opt-in consent from Virginia consumers to process certain sensitive personal information.

Furthermore, the Federal Trade Commission (the "FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. There are a number of legislative proposals in the United States, at both the federal and state level, and in the E.U. and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations and standards may have on our business.

In addition to laws relating to data privacy and security, we are subject to self-regulatory standards and industry certifications that may legally or contractually apply to us. These include the Payment Card Industry Data Security Standards ("PCI-DSS") with which we are currently compliant. In the event that we fail to comply with the PCI-DSS, we could be in breach of our obligations under customer and other

contracts, fines and other penalties could result, and we may suffer reputational harm and damage to our operations, financial performance, reputation and business. Further, our clients may expect us to comply with more stringent privacy and data security requirements than those imposed by laws, regulations, or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data on or by our offerings.

Changes in laws and regulations related to the Internet or changes in the internet infrastructure itself may diminish the demand for our applications, and could have a negative impact on our business.

The future success of our business depends upon the continued use of the Internet as a primary medium for commerce, communication and business. Federal, state and foreign government bodies or agencies have in the past adopted, and may in the future adopt, laws or regulations affecting the use of the Internet as a commercial medium. Changes in these laws or regulations could require us to modify our applications in order to comply with these changes. In addition, government agencies or private organizations may impose taxes, fees or other charges for accessing the Internet or commerce conducted via the Internet. These laws or charges could limit the growth of Internet-related commerce or communications generally, or result in reductions in the demand for Internet-based applications such as ours.

In addition, the use of the Internet as a means of conducting business could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of Internet activity, security, reliability, cost, ease of use, accessibility and quality of service. The performance of the Internet has been adversely affected by “viruses,” “worms” and similar malicious programs and the Internet has experienced a variety of outages and other delays as a result of damage to portions of its infrastructure. If the use of the Internet is adversely affected by these issues, demand for our applications could suffer.

If we fail to manage our technical operations infrastructure, or experience service outages, interruptions, or delays in the deployment of our platform, our results of operations may be harmed.

Because our operations involve delivering a suite of preaccounting features to our customers through a cloud-based software platform, our continued growth depends in part on the ability of our platform and related computer equipment, infrastructure and systems to continue to support our features. In the past, we have experienced temporary platform disruptions, outages in our features and degraded levels of performance due to human and software errors, file corruption and capacity constraints associated with the number of customers accessing our platform simultaneously. While our past experiences have not materially impacted us, in the future we may face more disruptions, outages, or performance problems. Factors that may cause such disruptions or problems include:

•human error;

•security breaches;

•telecommunications failures or outages from third-party providers;

•computer viruses, malware, vulnerability exploits, or cyber-attacks;

•software errors, failures, vulnerabilities or bugs in our features;

•acts of terrorism, sabotage or other intentional acts of vandalism;

•unforeseen interruption or damages;

•pandemics and epidemics;

•tornados, fires, earthquakes, floods and other natural disasters; and

•power loss.

In addition, continued growth in our customer base could place additional demands on our platform and features and could cause or exacerbate slowdowns or interrupt the availability of our platform. As we expand our platform capabilities to other features, like the Expensify Card, those new features may come with different technological demands, like real time transactions. If we are unable to plan or develop our platform accordingly, it could have a negative impact on our business. If there is a substantial increase in the volume of usage across our platform, we will be required to further expand and upgrade our technology and infrastructure. There can be no assurance that we will be able to accurately project the rate or timing of increases, if any, in the use of our platform or expand and upgrade our systems and infrastructure to accommodate such increases on a timely basis. In such cases, if our members are not able to access our platform and features or encounter slowdowns when doing so, we may lose customers or partners, which would adversely impact our reputation and revenue. Further, any changes in the service levels at our data centers or any errors, defects, disruptions or other performance problems with our network infrastructure may result in lengthy interruptions in the availability of our platform and features. In such cases, we may lose our customers’ trust and confidence in our platform, and customer and employee data from recent transactions may be permanently lost and we could be exposed to significant claims by clients, particularly if the access interruption is associated with problems in the timely delivery of funds due to employees. In order to remain competitive, we must continue to enhance and improve the responsiveness, functionality and features of our platform and products. Our disaster recovery plan may not be sufficient to address all aspects or any unanticipated consequence or incidents, and our insurance may not be sufficient to compensate us for the losses that could occur.

We lease the cloud computing infrastructure that we use to host our platform, mobile application and many of the internal tools we use to operate our business. Any significant disruption of, limitation of our access to, or other interference with our use of the cloud services would negatively impact our operations and could seriously harm our business. Our business relies on the availability of our platform for our members and customers, and we may lose members or customers if they are not able to access our platform or encounter difficulties in doing so.

In addition, we rely on third-party hosting services, hardware and infrastructure purchased or leased from third parties and software licensed from third parties to operate critical business functions. Our business would be disrupted if any of this third-party hardware, software and infrastructure becomes unavailable on commercially reasonable terms, or at all. Furthermore, delays or complications with respect to the transition of critical business functions from one third-party product to another, or any errors or defects in third-party hardware, software, or infrastructure could result in errors or a failure of our platform, which could harm our business and results of operations.

Moreover, our platform and features depend on our customers’ high speed broadband or wireless access to the Internet. Increasing numbers of customers and bandwidth requirements may degrade the performance of our features due to capacity constraints and other Internet infrastructure limitations, and additional network capacity to maintain adequate data transmission speeds may be unavailable or unacceptably expensive. If adequate capacity is not available to us, our features may be unable to achieve or maintain sufficient data transmission, reliability, or performance. In addition, if Internet service providers and other third parties providing Internet services, including incumbent phone companies, cable companies and wireless companies, have outages or suffer deterioration in their quality of service, our customers may not have access to or may experience a decrease in the quality of our platform and features. These providers may take measures that block, degrade, discriminate, disrupt, or increase the cost of customer access to our features. Any of these disruptions to data transmission could lead customers to switch to our competitors or avoid using our features, which could negatively impact our revenue or harm our opportunities for growth.

We rely upon data centers and other systems and technologies provided by third parties to operate our business, and interruptions or performance problems with these centers, systems and technologies may adversely affect our business and operating results.

We rely on data centers and other technologies and services provided by third parties in order to operate our business. If any of these services becomes unavailable or otherwise is unable to serve our requirements, there could be a delay in activating a mirrored data center or our disaster recovery system.

Our business depends on our ability to protect the growing amount of information stored in our data centers and related systems, offices and hosting facilities, against damage from earthquake, floods, fires, other extreme weather conditions, power loss, telecommunications failures, hardware failures, unauthorized intrusion, overload conditions and other events. If our data centers or related systems fail to operate properly or become disabled even for a brief period of time, we could suffer financial loss, a disruption of our business, liability to customers, or damage to our reputation. Our response to any type of disaster may not be successful in preventing the loss of customer data, service interruptions and disruptions to our operations, or damage to our important facilities.

Our data center providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all, and it is possible that we will not be able to switch our operations to another provider in a timely and cost effective manner should the need arise. If we are unable to renew our agreements with these providers on commercially reasonable terms, or if in the future we add additional data center facility providers, we may face additional costs or expenses or downtime, which could harm our business.

Any unavailability of, or failure to meet our requirements by, third party data centers, technologies, or services, could impede our ability to provide services to our customers, harm our reputation, subject us to potential liabilities, result in contract terminations and adversely affect our customer relationships. Any of these circumstances could adversely affect our business and operating results.

If we are unable to ensure that our platform interoperates with a variety of software applications that are developed by others, including our integration partners, we may become less competitive and our business, results of operations and financial condition may be harmed.

Our platform must integrate with a variety of hardware and software platforms, and we need to continuously modify and enhance our platform to adapt to changes in hardware, software and browser technologies. In particular, we have developed our platform to be able to easily integrate with third-party applications, including the applications of software providers that compete with us as well as our partners, through the interaction of APIs and/or platforms. In general, we rely on the providers of such software systems to allow us access to their APIs to enable these integrations. We are typically subject to standard terms and conditions of such providers, which govern the distribution, operation and fees of such software systems, and which are subject to change by such providers from time to time. Our business will be harmed if any provider of such software systems:

•discontinues or limits our access to its software or APIs;

•modifies its terms of service or other policies, including fees charged to, or other restrictions on us, or other application developers;

•changes how information is accessed by us or our customers;

•establishes more favorable relationships with one or more of our competitors; or

•develops or otherwise favors its own competitive offerings over our platform.

Third-party services and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with that of other third parties. In addition, some of our competitors may be able to disrupt the operations or compatibility of our platform with their products or services, or

exert strong business influence on our ability to, and terms on which we operate our platform. Should any of our competitors modify their products or standards in a manner that degrades the functionality of our platform or gives preferential treatment to competitive products or services, whether to enhance their competitive position or for any other reason, the interoperability of our platform with these products could decrease and our business, results of operations and financial condition would be harmed. If we are not permitted or able to integrate with these and other third-party applications in the future, our business, results of operations and financial condition would be harmed.

Further, our platform includes a mobile application to enable individuals and organizations to access our platform through their mobile devices. If our mobile application does not perform well, our business will suffer. In addition, our platform interoperates with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties. We therefore depend on the interoperability of our platform with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control. The loss of interoperability, whether due to actions of third parties or otherwise, and any changes in technologies that degrade the functionality of our platform or give preferential treatment to competitive services could adversely affect adoption and usage of our platform. Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in ensuring that Expensify operates effectively with a range of operating systems, networks, devices, browsers, protocols and standards. If we are unable to effectively anticipate and manage these risks, or if it is difficult for customers to access and use our platform, our business, results of operations and financial condition may be harmed.

We rely on third parties maintaining open marketplaces to distribute our mobile application. If such third parties interfere with the distribution of our platform, our business would be adversely affected.

We rely on third parties maintaining open marketplaces, including the Apple App Store and Google Play, which make our mobile application available for download. We cannot assure you that the marketplaces through which we distribute our mobile application will maintain their current structures or that such marketplaces or any new marketplaces will not charge us additional fees to list our application for download. We are also dependent on these third-party marketplaces to enable us and our members to timely update our mobile application, and to incorporate new features, integrations and capabilities.

In addition, Apple Inc. and Google, among others, for competitive or other reasons, could stop allowing or supporting access to our mobile application through their products, could allow access for us only at an unsustainable cost, or could make changes to the terms of access in order to make our mobile application less desirable or harder to access.

We rely on traditional web search engines and prominence in mobile application marketplaces to drive interest in our platform. If our website fails to rank prominently in organic search results, or our mobile application is not featured prominently in marketplaces, the discoverability of our platform could decline and our business would be adversely affected.

Our success depends in part on our discoverability – our ability to attract new members through unpaid Internet search results on traditional web search engines such as Google and through the prominence of our mobile application in open marketplaces. The number of members we are able to attract through these platforms is due in large part to how our website ranks in organic search results and how our mobile application ranks against similar applications. These rankings can be affected by a number of factors, many of which are not in our direct control, and they may change frequently. For example, a search engine may change its ranking algorithms, methodologies, or design layouts. As a result, links to our website may not be prominent enough to drive traffic to our website, and we may not know how or otherwise be in a position to influence the results. Any reduction in our discoverability could reduce our revenue or require us to increase our sales and marketing expenditures.

Third parties may claim that our platform infringes their intellectual property rights and this may create liability for us or otherwise adversely affect our business, operating results and financial condition.

There is considerable patent and other intellectual property litigation in our industry. Our competitors, as well as a number of other entities, including non-practicing entities and individuals, may own or claim to own intellectual property relating to our industry. There may be third-party intellectual property rights, including issued or pending patents, that cover significant aspects of our technologies or business methods. As we face increasing competition and our public profile increases, the possibility of intellectual property rights claims against us may also increase. From time to time, our competitors or other third parties have claimed, and may in the future claim, that we are infringing upon, misappropriating, or violating their intellectual property rights, even if we are unaware of the intellectual property rights that such parties may claim cover our platform or some or all of the other technologies we use in our business.

Our success depends, in part, on our ability to develop and commercialize our solutions and services without infringing, misappropriating or otherwise violating the intellectual property rights of third parties. In a patent infringement claim against us, we may assert, as a defense, that we do not infringe the relevant patent claims, that the patent is invalid or both. The strength of our defenses will depend on the patents asserted, the interpretation of these patents, and our ability to invalidate the asserted patents. However, we could be unsuccessful in advancing non-infringement or invalidity arguments in our defense. In the United States, issued patents enjoy a presumption of validity, and the party challenging the validity of a patent claim must present clear and convincing evidence of invalidity, which is a high burden of proof. Conversely, the patent owner need only prove infringement by a preponderance of the evidence, which is a lower burden of proof. We may also be unaware of the intellectual property rights of others that may cover some or all of our technology. Because patent applications can take years to issue and are often afforded confidentiality for some period of time, there may currently be pending applications, unknown to us, that later result in issued patents that could cover one or more of our products and there is also a risk that we could adopt a technology without knowledge of a pending patent application, which technology would infringe a third-party patent once that patent is issued. Any litigation may also involve non-practicing entities or other adverse patent owners that have no relevant solution revenue, and therefore, our patent portfolio may provide little or no deterrence as we would not be able to assert our patents against such entities or individuals.

We may also face exposure to third party intellectual property infringement, misappropriation, or violation actions if we engage software engineers or other personnel who were previously engaged by competitors or other third parties and those personnel inadvertently or deliberately incorporate proprietary technology of third parties into our features. Any intellectual property claims, with or without merit, could be very time-consuming and expensive to settle or litigate, could cause us to incur significant expenses, pay substantial amounts in damages, ongoing royalty or license fees, or other payments, or could prevent us from offering all or aspects of our platform or using certain technologies, require us to re-engineer all or a portion of our platform or require that we comply with other unfavorable terms. The costs of litigation are considerable, and such litigation may divert management and key personnel’s attention and resources, which might seriously harm our business, results of operations and financial condition. We may be required to settle such litigation on terms that are unfavorable to us. For example, a settlement may require us to obtain a license to continue practices found to be in violation of a third party’s rights, which may not be available on reasonable terms and may significantly increase our operating expenses. A license to continue such practices may not be available to us at all. As a result, we may also be required to develop alternative non-infringing technology or practices or discontinue the practices. The development of alternative non-infringing technology or practices would require significant effort and expense. Similarly, if any litigation to which we may be a party fails to settle and we go to trial, we may be subject to an unfavorable judgment that may not be reversible upon appeal. For example, the terms of a judgment may require us to cease some or all of our operations or require the payment of substantial amounts to the other party. Any of these

events would cause our business and results of operations to be materially and adversely affected as a result.

We are also frequently required to indemnify our reseller partners and customers in the event of any third-party infringement claims against our customers and third parties who offer our platform, and such indemnification obligations may be excluded from contractual limitation of liability provisions that limit our exposure. These claims may require us to initiate or defend protracted and costly litigation on behalf of our customers and reseller partners, regardless of the merits of these claims. If any of these claims succeed, we may be forced to pay damages on behalf of our customers and reseller partners, may be required to modify our allegedly infringing platform to make it non-infringing, or may be required to obtain licenses for the products used. If we cannot obtain all necessary licenses on commercially reasonable terms, our customers may be forced to stop using our platform, and our reseller partners may be forced to stop selling our platform.

If we are unable to protect our intellectual property rights, the value of our brand and other intangible assets may be diminished, and our business may be adversely affected.

Our success is dependent, in part, upon protecting our intellectual property rights and proprietary information. We rely and expect to continue to rely on a combination of trademark, copyright, patent and trade secret protection laws to protect our intellectual property rights and proprietary information. Our trademarks and service marks include EXPENSIFY, SMARTSCAN and various marketing slogans. Additionally, we maintain a policy requiring our employees, consultants, independent contractors and third parties who are engaged to develop any material intellectual property for us to enter into confidentiality and invention assignment agreements to control access to and use of our proprietary information and to ensure that any intellectual property developed by such employees, contractors, consultants and other third parties are assigned to us. However, we cannot guarantee that the confidentiality and proprietary agreements or other employee, consultant, or independent contractor agreements we enter into adequately protect our intellectual property rights and other proprietary information. In addition, we cannot guarantee that these agreements will not be breached, that we will have adequate remedies for any breach, or that the applicable counter-parties to such agreements will not assert rights to our intellectual property rights or other proprietary information arising out of these relationships. If we lose valuable personnel, our ability to develop, market and support potential features or enhancements could also be hampered, which could severely harm our business. Furthermore, the steps we have taken and may take in the future may not prevent misappropriation of our proprietary features or technologies, particularly with respect to officers and employees who are no longer employed by us.

Moreover, third parties may knowingly or unknowingly infringe or circumvent our intellectual property rights, and we may not be able to prevent infringement without incurring substantial expense. Litigation brought to protect and enforce our intellectual property rights may be costly, time-consuming and distracting to management and key personnel, and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. If the protection of our intellectual property rights is inadequate to prevent use or misappropriation by third parties, the value of our brand and other intangible assets may be diminished and competitors may be able to more effectively mimic our platform and methods of operations. Any of these events would have a material adverse effect on our business, results of operations and financial condition.

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our platform without compensating us and negatively affect our business.

Our future success and competitive position depends in part upon our ability to obtain or maintain certain intellectual property used in our platform. We rely primarily on patent, trademark, copyright and trade secrets laws and confidentiality procedures and contractual provisions to protect our technology. While we have been issued patents for certain aspects of our intellectual property in the United States

and have additional patent applications pending in the United States, we have not applied for patent protection in foreign jurisdictions, and may be unable to obtain patent protection for the technology covered in our patent applications. In addition, we cannot ensure that any of the patent applications will issue or that the claims allowed on any issued patents will be sufficiently broad to protect our technology or platform and provide us with competitive advantages. Moreover, failure to comply with applicable procedural, documentary, fee payment and other similar requirements with the United States Patent and Trademark Office could result in abandonment or lapse of the affected patent, trademark or application. Furthermore, any issued patents may be challenged, invalidated, or circumvented by third parties.

Many patent applications in the United States may not be public for at least 18 months after they are filed, and since publication of discoveries in the scientific or patent literature tends to lag behind actual discoveries by several months, we cannot be certain that we will be the first creator of inventions covered by any patent application we make or that we will be the first to file patent applications on such inventions. In addition, recent changes to the patent laws in the United States may bring into question the validity of certain software patents and may make it more difficult and costly to prosecute patent applications. Such changes may lead to uncertainties or increased costs and risks surrounding the prosecution, validity, ownership, enforcement and defense of our issued patents and patent applications and other intellectual property, the outcome of third-party claims of infringement, misappropriation, or other violation of intellectual property brought against us and the actual or enhanced damages (including treble damages) that may be awarded in connection with any such current or future claims, and could have a material adverse effect on our business.

We also rely on unpatented proprietary technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our technology or obtain and use information that we regard as proprietary. It is possible that others will independently develop the same or similar technology or otherwise obtain access to our unpatented technology. To protect our trade secrets and other proprietary information, we require employees, consultants and independent contractors to enter into confidentiality agreements. However, such agreements may not be enforceable in full or in part in all jurisdictions and any breach could have a negative effect on our business and our remedy for such breach may be limited. The contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. As such, we cannot guarantee that the steps taken by us will prevent misappropriation of our technology. We cannot assure you that these agreements will provide meaningful protection for our trade secrets, know-how, or other proprietary information in the event of any unauthorized use, misappropriation, or disclosure of such trade secrets, know-how, or other proprietary information. If we are unable to maintain the proprietary nature of our technologies, our business would be materially adversely affected.

We rely on our trademarks, trade names and brand names to distinguish our features from the products of our competitors, and have registered or applied to register many of these trademarks in the United States and certain countries outside the United States. However, occasionally third parties may have already registered identical or similar marks for products or features that also address the software market. As we rely in part on brand names and trademark protection to enforce our intellectual property rights, efforts by third parties to limit use of our brand names or trademarks and barriers to the registration of brand names and trademarks in various countries may restrict our ability to promote and maintain a cohesive brand throughout our key markets. Occasionally trademark offices have taken the view that certain of our trademarks, including SMARTSCAN, are merely descriptive or not inherently protectable. There can also be no assurance that pending or future U.S. or foreign trademark applications will be approved in a timely manner or at all, or that such registrations will effectively protect our brand names and trademarks. Third parties may also oppose our trademark applications, or otherwise challenge our use of the trademarks. For example, our applications to register KARMA POINTS as a trademark in the European Union and United Kingdom have been opposed by a third party. In the event that our trademarks are successfully challenged or we do not adequately protect our

trademarks, we could be forced to rebrand our platform, which would result in loss of brand recognition and would require us to devote resources to advertising and marketing new brands.

Policing unauthorized use of our technology and trademarks is difficult. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States. For example, many foreign countries limit the enforceability of patents against certain third parties, including government agencies or government contractors. In these countries, any patents that we may obtain may provide limited or no benefit. Effective trade secret protection may also not be available in every country in which our features are available or where we have employees or independent contractors. The loss of trade secret protection could make it easier for third parties to compete with our features by copying functionality. In addition, any changes in, or unexpected interpretations of, the trade secret and employment laws in any country in which we operate may compromise our ability to enforce our trade secret and intellectual property rights. From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the proprietary rights of others or to defend against claims of infringement or invalidity. Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition. If we are unable to protect our proprietary rights (including aspects of our software and platform protected other than by patent rights), we will find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create our platform and other innovative features that have enabled us to be successful to date. Moreover, we may need to expend additional resources to defend our intellectual property rights in foreign countries, and our inability to do so could impair our business or adversely affect our international expansion.

Our use of “open source” and third-party software could impose unanticipated conditions or restrictions on our ability to commercialize our features and could subject us to possible litigation.

A portion of the technologies we use in our platform, database infrastructure (Bedrock), Expensify.com, Expensify.cash and mobile application incorporate “open source” software, and we may incorporate open source software in our platform and mobile application in the future. From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and their compliance with the terms of the applicable open source license. We may be subject to suits by parties claiming ownership of what we believe to be open source software, or claiming non-compliance with the applicable open source licensing terms. If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public, including authorizing further modification and redistribution, or otherwise be limited in the licensing of our services, each of which could provide an advantage to our competitors or other entrants to the market, allow them to create similar products with lower development effort and time, and ultimately result in a loss of sales for us. While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable proprietary source code, we may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract. Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose source code that incorporates or is a modification of such licensed software. Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such license types. If an author or other third party that distributes open source software that we use or license were to allege that we had not complied with the conditions of the applicable open source license, we may also have to expend substantial time and resources to re-engineer some or all of our software, incur significant legal expenses defending against such

allegations, be subject to significant damages, or be enjoined from the sale of our platform that contained the open source software.

In addition, the use of third-party open source software typically exposes us to greater risks than the use of third-party commercial software because open-source licensors generally do not provide warranties or controls on the functionality or origin of the software. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform. Any of the foregoing could be harmful to our business, results of operations, or financial condition.

We license technology from third parties, and our inability to maintain those licenses could harm our business.

We rely on software licensed from third parties to offer our platform. In addition, we may need to obtain future licenses from third parties to use intellectual property rights associated with the development of our platform, which might not be available on acceptable terms, or at all. Any loss of the right to use any third-party software required for the development and maintenance of our platform or mobile application could result in loss of functionality or availability of our platform or mobile application until equivalent technology is either developed by us, or, if available, is identified, obtained and integrated. Any errors or defects in third-party software could result in errors or a failure of our platform or mobile application. Licensing technologies from third parties also exposes us to increased risk of being the subject of intellectual property infringement due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against infringement risks. We cannot be certain that our licensors do not or will not infringe on the intellectual property rights of third parties or that our licensors have or will have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our platform. Some of our agreements with our licensors may be terminated by them for convenience, or otherwise provide for a limited term. If we are unable to continue to license technology because of intellectual property infringement claims brought by third parties against our licensors or against us, or if we are unable to continue our license agreements or enter into new licenses on commercially reasonable terms, our ability to develop and sell features and services containing or dependent on that technology would be limited, and our business could be harmed. Additionally, if we are unable to license technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and may require us to use alternative technology of lower quality or performance standards. This could limit or delay our ability to offer new or competitive features and increase our costs. Any of the foregoing would disrupt the distribution and sale of subscriptions to our platform and harm our business, results of operations and financial condition.

Any future litigation against us could be costly and time-consuming to defend.

We have in the past and may in the future become subject to legal proceedings and claims that arise in the ordinary course of business. We could be subject to claims, lawsuits (including class actions and individual lawsuits), government investigations and other proceedings involving consumer protection, labor and employment, immigration, import and export practices, product labeling, competition, accessibility, securities, tax, marketing and communications practices, commercial disputes, defamation, civil rights infringement, negligence, intellectual property rights infringement, invasion of privacy, product liability, regulatory compliance, or other legal claims relating to information that is published or made available via our platform. For example, in November 2020, the Federal Election Commission ("FEC") notified us of a number of complaints filed against us in connection with David Barrett's email on October 23, 2020 urging customers to protect democracy. We responded to the complaints in November and December 2020, requesting dismissal of all complaints, and have not received a decision from the FEC on the matter. We cannot assure you that this matter will not result in further complaints, regulatory inquiries or future proceedings.

The number and significance of our legal disputes and inquiries have increased as we have grown larger, as our business has expanded in scope and geographic reach, and as our features and services

have increased in complexity, and we expect the potential for future legal proceedings, claims and disputes will continue to increase. Becoming a public company will raise our public profile, which may result in increased litigation.

Regardless of the outcome, legal proceedings might result in substantial costs and may divert management and key personnel’s attention and resources, which might seriously harm our business, results of operations and financial condition. Plaintiffs may seek, and we may become subject to, preliminary or provisional rulings in the course of litigation, including preliminary injunctions requiring us to cease some or all of our operations. We may decide to settle legal disputes on terms that are unfavorable to us; for example, we may be required to cease some or all of our operations or pay substantial amounts to the other party, which could materially and adversely affect our business. Furthermore, if any litigation to which we are a party is resolved adversely, we may be subject to an unfavorable judgment that we may not choose to appeal or that may not be reversed upon appeal. We may have to seek a license to continue practices found to be in violation of a third party’s rights. If we are required, or choose to enter into, royalty or licensing arrangements, such arrangements may not be available on reasonable terms or at all and may significantly increase our operating costs and expenses. As a result, we may also be required to develop or procure alternative non-infringing technology or discontinue use of technology, and doing so could require significant effort and expense or may not be feasible. In addition, insurance might not cover these claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs and could have a material adverse effect on our business, results of operations and financial condition.

Our employees, commercial partners and vendors may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements.

Expensify, Inc. EXFY US Equity

EXFY · 10-K · period ended 2021-12-31

Item 1A. Risk Factors

Expensify, Inc. EXFY US Equity☆

EXFY · 10-K · period ended 2021-12-31

Item 1A. Risk Factors

Expensify, Inc. EXFY US Equity