EXFY · Read the filing

Item 1A. Risk Factors

Our business involves a high degree of risk. You should carefully consider the risks described below, as well as the other information contained or incorporated by reference in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, as well as our other filings with the SEC. The occurrence of any of the events or developments described below could materially and adversely affect our business, financial condition, results of operations and growth prospects. In such an event, the market price of our Class A common stock could decline, and you may lose all or part of your investment. Additional risks and uncertainties not presently known to us or that we currently believe are not material may also impair our business, financial condition, results of operations and growth prospects.

Risks Related to Our Business

Our quarterly and annual results of operations have fluctuated in the past and may fluctuate significantly in the future and may not meet our expectations or those of investors or securities analysts.

Our quarterly and annual results of operations, including the levels of our revenue, working capital and cash flows, have varied significantly in the past and may vary significantly in the future, such that period-to-period comparisons of our results of operations may not be meaningful. Our quarterly and annual financial results may fluctuate due to a variety of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

•the level of demand across our platform and for individual features within our platform;

•our ability to grow or maintain our gross logo retention rate and net seat retention rate (each as described under the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations—Key Factors Affecting Our Performance—Retaining Existing Customers"), expand usage within organizations, retain and increase sales to existing customers and attract new members and customers;

•our ability to convert individuals and organizations using our free features or trial subscriptions into paying customers;

•our ability to predictably generate revenue through marketing and sales efforts;

•the timing and success of new features, integrations, capabilities and enhancements by us to our platform, or by our competitors to their products, or any other changes in the competitive landscape of our market;

•our ability to grow and maintain our relationships and/or integrations with our network of third-party partners, including integration partners, channel partners and professional service partners;

•our ability to regulate members and member interactions on an increasingly collaborative platform;

•our ability to grow revenue share and customer referrals from our partner ecosystem;

•our ability to attract new customers and retain existing customers;

•the success of our customers’ businesses;

•our ability to achieve widespread acceptance and use of our platform and features, including the Expensify Card and any new features we may introduce;

•our ability to retain customers on annual subscriptions;

•our ability to maintain and improve employee efficiency, and our ability to manage third party, outsourced or open source workers to provide value-added services like receipt processing, customer support and engineering;

Table of Contents

•errors in our forecasting of the demand for our platform and features, which would lead to lower revenue, increased costs, or both;

•the amount and timing of operating expenses and capital expenditures, as well as entry into operating leases, that we may incur to maintain and expand our business and operations and to remain competitive;

•the timing of expenses and recognition of revenue;

•actual or perceived security breaches, technical difficulties, or interruptions to our platform and features;

•pricing pressure as a result of competition or otherwise;

•ineffective pricing strategies that could limit customer base expansion, revenue growth and subscription renewals;

•adverse litigation judgments, other dispute-related settlement payments, or other litigation-related costs;

•the number of new employees hired;

•the timing of the grant or vesting of equity awards to employees, directors, or consultants;

•declines in the values of foreign currencies relative to the U.S. dollar;

•changes in, and continuing uncertainty in relation to, the legislative or regulatory environment;

•legal and regulatory compliance costs in new and existing markets;

•costs and timing of expenses related to the potential acquisition of talent, technologies, businesses or intellectual property, and their integration, including potentially significant amortization costs and possible write-downs;

•health crises, such as the COVID-19 pandemic, or other conditions that impact travel and business spending; and

•general economic and market conditions in either domestic or international markets, including geopolitical uncertainty and instability and their effects on software spending.

Any one or more of the factors above may result in significant fluctuations in our quarterly and annual results of operations, which may negatively impact the trading price of our Class A common stock. You should not rely on our past results as an indicator of our future performance.

The variability and unpredictability of our quarterly and annual results of operations or other operating metrics could result in our failure to meet our expectations or those of investors or analysts with respect to revenue or other metrics for a particular period. If we fail to meet or exceed such expectations for these or any other reasons, the trading price of our Class A common stock could fall, and we would face litigation, including securities class action lawsuits, which could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business, results of operations, and financial condition.

We experienced rapid growth in periods prior to the COVID-19 pandemic, and those growth rates may not be indicative of our future growth, and we may not be able to maintain profitability.

Although we experienced rapid growth in periods prior to the COVID-19 pandemic, our business was impacted by the COVID-19 pandemic, with declines in revenue and paid members due to government-imposed lock-downs, a decrease in business travel and other expense-generating activity, and SMBs downsizing or going out of business, among other things. While the number of paid members and revenue improved compared to the low point of the pandemic, our growth rate has not yet returned and may never

Table of Contents

return to pre-pandemic levels. Even if our revenue and paid members increase in the near term, we expect that our growth rate will decline as a result of a variety of factors, including the maturation of our business. Further, as we operate in a new and rapidly changing category of preaccounting software, widespread acceptance and use of our platform and features, particularly our expense management feature, is critical to our future growth and success. We believe our growth depends on a number of factors, including, but not limited to, our ability to:

•attract new individuals and organizations to use our features, particularly our expense management feature;

•convert individuals and organizations using our free features or trial subscriptions into paying customers;

•grow or maintain our gross logo retention rate and net seat retention rate, and expand usage within organizations;

•price our subscription plans effectively and competitively;

•retain our existing individual and organizational customers;

•achieve widespread acceptance and use of our platform and features, including in markets outside of the United States;

•continue to successfully advance our bottom-up sales strategy as well as strategic relationships with our channel partners;

•continue to maintain and build a platform and brand that drives word-of-mouth exposure to new potential members;

•grow or maintain our brand through marketing, advertising campaigns, partnerships and other methods;

•gain member traction for and generate revenue from our new features and services;

•grow or maintain current levels of consideration from a vendor and/or fees generated through transaction-based features;

•expand the features and capabilities of our platform and features;

•provide excellent customer experience and customer support;

•maintain the security and reliability of our platform and features;

•maintain the trust of our customers;

•successfully compete against established companies and new market entrants, as well as existing software tools;

•successfully respond to other competitive challenges in the United States and globally;

•attract, hire and retain highly skilled personnel;

•the impact of any future pandemic, epidemic or other public health crisis and the corresponding pace and rate of recovery on our business;

•obtain, expand, maintain, enforce and protect our intellectual property portfolio;

•operate as a public company;

•grow our member and customer base in new countries and/or markets, and increase awareness of our brand on a global basis; and

Table of Contents

•obtain and maintain compliance and licenses material to our current and future businesses, and comply with existing and new applicable laws and regulations including in markets outside of the United States.

If we are unable to accomplish these tasks, our growth, including our revenue growth, would be harmed. Additionally, if future revenue growth does not offset any increases in our operating expenses, our business, results of operations, and financial condition will be harmed, and we may not be able to maintain profitability.

Our expense management feature drives the majority of our subscriptions, and any failure of this feature to satisfy customer demands or to achieve increased market acceptance could adversely affect our business, results of operations, financial condition and growth prospects.

A majority of our subscriptions are driven by bottom-up adoption related to our expense management feature. Although we have added, and expect to continue to add, new features to expand our offerings, and all of our features are accessible under a single subscription, at least in the near term, we expect our expense management feature to continue to drive the majority of our subscriptions. As a result, market acceptance of our expense management feature is critical to our success. Demand for our expense management feature, as well as our other features, is affected by a number of factors, many of which are beyond our control, such as the adoption of our features by new and existing customers; the timing of development and release of upgraded or new features on our platform; products and services introduced or upgraded by our competitors or partners; our ability to determine optimal pricing for our platform, including in international markets; pricing offered by our competitors; technological change; and growth or contraction in our addressable market. We increased our subscription prices in 2020, and although the increased prices have not substantially affected our business to date, we cannot guarantee any future price increases we choose to implement will not adversely affect our business. If we are unable to meet customer demand for our expense management feature; do not price our subscriptions optimally or make changes to our subscription or pricing models that are not accepted by the market; or fail to convert members of our free expense management feature or trial subscriptions to paying subscribers, our business, results of operations, financial condition and growth prospects will suffer.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards and changing customer needs or preferences, our platform may become less competitive.

The software industry is subject to rapid technological change, evolving industry standards and practices and changing customer needs and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes by continually modifying and enhancing our features to keep pace with changes in hardware systems and software applications, database technology and evolving technical standards and interfaces on a timely basis. If we are unable to develop and market new technology, features and functionality for our platform that keep pace with rapid technological and industry change and satisfy our customers, our revenue and operating results could be adversely affected. If new technologies emerge that deliver competitive products at lower prices, more efficiently, more conveniently, or more securely, it could adversely impact our ability to compete.

Our platform must also integrate with a variety of network, hardware, mobile and software platforms and technologies. We need to continuously modify and enhance our platform to adapt to changes and innovation in these technologies. This development effort may require significant engineering, marketing and sales resources, all of which would affect our business and operating results. Any failure of our platform to operate effectively with future technologies could reduce the demand for our platform. If we are unable to respond to these changes in a cost effective manner, our platform may become less marketable and less competitive or obsolete, and our operating results may be negatively affected.

Table of Contents

If we are unable to attract new customers on a cost-effective basis, convert individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, retain existing customers and expand usage within organizations, our revenue growth will be harmed.

To increase our revenue, we must increase our customer base through various methods, including but not limited to, retaining existing customers, adding new customers, converting individuals and organizations using our free basic expense management feature and trial subscriptions into paying customers, and expanding usage within organizations. Our business is subscription-based, with monthly and annual subscriptions, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire.

One of our primary marketing strategies is to offer a free basic version of our expense management feature to individuals within organizations. We rely on these individuals to expose others within their organizations to our platform and features and to convince those individuals to become new members, which could eventually lead to the engagement of the organization or individuals or departments within the organization as paying customers. To encourage viral adoption, we offer viral features that are free and accessible without a paid subscription, and we also offer time-limited trial subscriptions. We believe these free basic features and trial subscriptions promote brand awareness and organic adoption of our platform. While our viral model means that employees or contractors often introduce Expensify into SMBs, companies subscribe and pay for the majority of our paid members. To the extent that increasing numbers of these individuals and organizations who utilize the free aspects of our platform do not become, or lead others to become, paying customers, we will not realize the intended benefits of these marketing strategies, we will continue to pay the costs associated with hosting such free basic features and trial subscriptions, our ability to grow our business will be harmed, and our business, results of operations and financial condition will suffer.

While we experienced significant growth in the number of our customers prior to the COVID-19 pandemic, our growth rate has not yet returned and may never return to pre-pandemic levels. Numerous factors may impede our ability to attract new customers, convert individuals and organizations using our free basic features and trial subscriptions into paying customers, expand usage within organizations, increase use of our other features such as the Expensify Card and gain new subscriptions, including but not limited to, failure to retain and motivate our personnel; failure to establish, maintain or expand relationships with channel and integration partners; failure to compete effectively against alternative products or services; our ability to determine optimal pricing for our subscriptions, including in international markets; failure to successfully deploy new features and integrations; failure to provide a quality customer experience and customer support; or failure to ensure the effectiveness of our bottom-up sales approach and other marketing programs. Channel partnerships are also an important aspect of our growth strategy, and we will need to maintain our partnerships with existing channel partners and identify and attract new channel partners in order to maintain the effectiveness of this strategy. Moreover, we believe that many of our new customers originate from word-of-mouth and other non-paid referrals from existing customers, so we must ensure that our existing customers remain loyal to our platform in order to continue receiving those referrals.

Our business is subscription-based, and customers are not obligated to and may not renew their subscriptions after their existing subscriptions expire. We cannot ensure that customers will renew subscriptions with the same or greater number of members or for the same level of subscription plan or that they will upgrade to use features such as bi-directional accounting sync and invoicing features or the Expensify Card. Customers may or may not renew their subscriptions as a result of a number of factors, including their satisfaction or dissatisfaction with our platform; changes we may implement in our pricing or structure; the pricing or capabilities of the products and services offered by our competitors; the effects of general economic conditions; or customers’ budgetary constraints. If customers do not renew their subscriptions, renew on less favorable terms, or fail to add members, or if we fail to convert individuals and organizations into paying members, or expand the adoption of our platform within their organizations, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations and financial condition. Our future success also depends in part on our ability to provide

Table of Contents

additional features to attract new members at existing customers, as well as increase transaction monetization from the Expensify Card. If our efforts to do so are not successful, our revenue may decline or grow less quickly than anticipated, which would harm our business, results of operations and financial condition.

We may fail to accurately predict the optimal pricing strategies necessary to attract new customers, retain existing customers and respond to changing market conditions.

We have in the past, and may in the future, need to change our pricing model from time to time. As the market for our platform matures, or as competitors introduce new solutions that compete with ours, we may be unable to attract new customers at the same prices or based on the same pricing models that we have used historically. While we do and will attempt to set prices based on our prior experiences and customer feedback, our assessments may not be accurate and we could be underpricing or overpricing our platform. In addition, if the offerings on our platform change, then we may need to revise our pricing strategies. Any such changes to our pricing strategies or our ability to efficiently price our offerings could adversely affect our business, operating results and financial condition. Pricing pressures and decisions could result in reduced sales, reduced margins, losses or the failure of our platform to achieve or maintain more widespread market acceptance, any of which could negatively impact our overall business, operating results and financial condition. Moreover, the organizations which we target may demand substantial price concessions. As a result, we may be required to price below our targets in the future, which could adversely affect our revenue, profitability, cash flows and financial condition.

We may not successfully develop or introduce new features, enhancements, integrations, capabilities and versions of our existing features that achieve market acceptance, and our business could be harmed and our revenue could suffer as a result.

Our ability to attract new customers and increase revenue from existing customers depends in large part upon the successful development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. If we are unable to expand our platform offerings in a manner that increases retention of existing customers and attracts new customers, our customers could migrate to competitors who may offer a broader or more attractive range of products and services. Unexpected delays in releasing new or enhanced features or versions of our features, or errors following their release, could result in loss of sales, delay in market acceptance of our features, or customer claims against us, any of which could harm our business. The success of any new feature, enhancement, integration, capability or version depends on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with existing technologies, proper marketing of the feature and market acceptance. We may not be able to develop new features successfully or to introduce and gain market acceptance of new features in a timely manner, or at all.

The successful development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features is costly and time-consuming, and our business could be harmed if we fail to deliver new features, enhancements, integrations, capabilities and versions of our existing features that meet customer needs on a timely and cost effective basis.

For example, we recently released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. This initial version has a subset of the features of our legacy app available as we continue development. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once completed. Although we see this direction as a natural next step in our long-term product vision, we have not developed an open-source financial group chat (or similar feature) before, and it may not meet customer needs, gain member traction or generate revenue sufficient to offset the costs of development, which could harm our business even if and when the feature complete version is released.

Table of Contents

We face significant competition, the market in which we operate is rapidly evolving, and if we do not compete effectively, our results of operations and financial condition could be harmed.

We face significant competitive challenges from do-it-yourself approaches as well as companies that provide traditional horizontal platform solutions with expense management features, corporate card providers and niche expense management solutions. Traditional do-it-yourself approaches (for example, using spreadsheets, email, messaging and legacy project management tools) are people-intensive and involve internal personnel manually performing expense management processes. Many businesses using do-it-yourself approaches believe that these manual processes are adequate and may be unaware that Expensify can replace several expensive, disconnected services with one fully connected preaccounting platform for a fraction of the cost, resulting in an inertia that can be difficult to overcome. It is difficult to predict adoption rates and demand for our platform, the future growth rate and size of the market for expense management and other preaccounting products, or the entry of competitive offerings. The expansion of the expense management and other preaccounting products market depends on a number of factors, including the cost, performance and perceived value associated with these solutions. If expense management and other preaccounting solutions do not achieve widespread adoption, or there is a reduction in demand for expense management and other preaccounting products caused by a lack of customer acceptance, technological challenges, weakening economic conditions, security or privacy concerns, competing technologies and products, decreases in corporate spending, or otherwise, it could result in decreased revenue, and our business, results of operations and financial condition would be adversely affected.

In addition, there are a number of competing companies that provide traditional horizontal platform solutions with expense management features, some of which have substantially greater revenue, personnel and other resources than we do. These firms have historically targeted primarily large enterprise customers, but many of them also market to SMBs in search of growth in revenue or market share. We also face competition from a growing number of other businesses offering expense management solutions and corporate cards. Our smaller competitors who currently focus their product offerings on SMBs may be better positioned than larger competitors to increase their market share with SMBs, whether by competing based on price, service, or otherwise. Increased competition may impact our ability to add new customers at the rates we have historically achieved. Additionally, competition may increase in the future from new market entrants. With the introduction of new technologies and the entry of new companies into the market, we expect competition to persist and intensify. This could harm our ability to increase our customer base, maintain subscription renewals and maintain our prices.

Additionally, it is possible that large enterprises with substantial resources that operate in adjacent accounting, finance or compliance verticals may decide to pursue expense management automation and become immediate, significant competitors. Merger and acquisition activity in the technology industry could increase the likelihood that we compete with other large technology companies. Many of our existing competitors have, and our potential competitors could have, substantial competitive advantages such as greater name recognition, longer operating histories, larger sales and marketing budgets and resources, greater customer support resources, lower labor and development costs, larger and more mature intellectual property portfolios and substantially greater financial, technical and other resources. Some of our larger competitors also have substantially broader product lines and market focus and will therefore not be as susceptible to downturns in a particular market. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. New startup companies that innovate, and large companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our platform, including the addition of bottom-up adoption features. Some of our larger competitors use broader product offerings to compete, including by selling at zero or negative margins, by bundling their product, or by closing access to their technology platforms. Potential customers may prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. Furthermore, potential customers may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our platform. These competitive pressures in our market, or our failure to compete effectively, may

Table of Contents

result in price reductions, fewer new customers, lower revenue and loss of market share. Any failure to successfully and effectively compete with current or future competitors could cause us to lose business and harm our revenue growth, business, results of operations and financial condition.

An economic downturn or economic uncertainty could negatively impact our customers and materially and adversely affect our business, financial condition and results of operations.

Our business depends on the economic health of our current and prospective customers and the overall state of the economy. Declining levels of economic activity may lead to declines or delays in business spending, declines in the number of paid monthly members of our platform and fewer transactions for which our platform may be used, which may result in decreased revenue for us. Uncertain and adverse economic conditions may cause customers to change their company policies to limit expense reimbursement and have led to increased requests for, and may lead to, increased refunds and chargebacks. Additionally, economic uncertainty and negative economic pressures may cause prospective or existing customers to defer investment or expansion in their business, and they may become more price-sensitive and perceive our platform as too costly. As of December 31, 2023, businesses with fewer than 1,000 employees accounted for approximately 95% of our customers by revenue, and we focus our product, marketing and sales efforts on these businesses, including SMBs. These customers may be more susceptible to general economic conditions than larger businesses, which may have greater liquidity and access to capital. Our competitors, many of whom are larger and more established than we are, may respond to market conditions by lowering their prices and attempting to lure away our customers. Many of our larger competitors currently focus their product offerings on larger customers who may be less susceptible to general economic conditions. As a result, our larger competitors may be better positioned than we are to increase their market share with businesses of all sizes. In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our platform offerings. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, our business, results of operations and financial condition could be materially and adversely affected.

Payments and other financial services-related laws and regulations and government oversight are material to our business. Our failure to comply with such laws and regulations could materially harm our business and can subject us to criminal and civil liability.

The local, state, and federal laws, rules, regulations, licensing and other authorization schemes, and industry standards that govern our business, including our payment services, include, or may in the future include, those relating to banking, invoicing, cross-border and domestic money transmission, foreign exchange, payments services (such as payment processing and settlement services), anti-money laundering, combating terrorist financing, escheatment, U.S. and international sanctions regimes, and compliance with the Payment Card Industry Data Security Standard ("PCI-DSS"), a set of requirements designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect cardholder data. These laws, rules, regulations, licensing and other authorization schemes, and industry standards are administered and enforced by multiple authorities and governing bodies in the United States, including but not limited to the U.S. Department of the Treasury, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, Office of Foreign Assets Control, self-regulatory organizations, and numerous state and local governmental and regulatory authorities. Any failure or perceived failure to comply with existing or new laws and regulations, or orders of any governmental authority, including changes to or expansion of their interpretations, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, and increased regulatory scrutiny of our business. In addition, we may be forced to restrict or change our operations or business practices, make product changes, or delay planned product launches or improvements. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.

Table of Contents

Expensify Payments LLC (“Expensify Payments”) is a licensed money transmitter (or its equivalent) in various U.S. states and territories and is in the process of obtaining money transmission licenses in a number of additional states and territories. As a licensed money transmitter, Expensify Payments, its ultimate beneficial owners, and its control persons are subject to a range of restrictions and ongoing compliance obligations under the money transmitter statutes (or their equivalent) administered by the banking departments (or their equivalent) of the various U.S. states and territories where it is licensed, including requirements with respect to the investment of customer funds, financial recordkeeping and reporting, reconciliation of customer funds, bonding, minimum capital, minimum net worth, disclosure, and inspection by regulatory authorities concerning various aspects of its business. In a number of cases, evaluation of our compliance efforts, as well as questions of whether and to what extent our activities in connection with the provision of certain products and services (both current and historical) are considered money transmission, are matters of regulatory interpretation and could change over time. In the past, regulators have identified violations or alleged violations of certain statutory and regulatory requirements, and we have been subject to fines and other penalties by state regulatory authorities due to their interpretation and application of their respective state money transmitter regime to our activities. In the future, as a result of the laws and regulations applicable to us and our business, we could be subject to investigations, inspections, examinations, and supervision, and resulting liability, including governmental fines, restrictions on our business, or other similar enforcement actions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses, regulatory approvals, or other similar authorizations. We cannot make any assurances that we will be able to obtain or maintain any such licenses, regulatory approvals, and other similar authorizations, and there could be substantial costs and potential product changes involved in obtaining and maintaining any such licenses, approvals, or other similar authorizations, which could have a material adverse effect on our business. In addition, there are substantial costs and potential product changes involved in maintaining and renewing any licenses, regulatory approvals, and other similar authorizations, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, net worth, corporate governance, or other requirements applicable to us, including those required in connection with maintaining such licenses, approvals, or authorizations. These factors could impose substantial additional costs on us, involve considerable delay to the development or provision of our products or services to our customers, require significant and costly operational changes, or prevent us from providing our products or services in any given market.

Governmental and regulatory bodies and authorities may also impose new or additional requirements on our business or issue or promulgate new laws, regulations, or rules applicable to persons engaged in money transmission that adversely affect our business, including those that:

•prohibit, restrict, and/or impose taxes or fees on money transmission transactions in, to or from certain countries or with certain governments, individuals, or entities;

•impose additional customer identification and customer due diligence requirements;

•impose additional reporting or recordkeeping requirements, or require enhanced transaction monitoring;

•limit the types of entities capable of providing money transmission services, or impose additional licensing or registration requirements;

•impose minimum capital or other financial requirements;

•limit or restrict the revenue that may be generated from money transmission, including revenue from interest earned on customer funds, transaction fees, and revenue derived from foreign exchange;

•require enhanced disclosures to our money transmission customers;

•require the principal amount of money transmission originated in a country to be invested in that country or held in trust until paid;

Table of Contents

•limit the number or principal amount of money transmission transactions that may be sent to or from a jurisdiction, whether by an individual or in the aggregate;

•restrict or limit our ability to process transactions using centralized databases, for example, by requiring that transactions be processed using a database maintained in a particular country or region; or

•impose other requirements in furtherance of their missions.

The success of our business largely depends on our senior management team, and we depend on professional services firms for a portion of our finance function. The loss of any key employees or our outsourced finance team could adversely affect our business.

Our success depends largely upon the continued services of our key executive officers and employees, including our founder and CEO, David Barrett. We also rely on our leadership team in the areas of research and development, marketing, sales, services and general and administrative functions, and on mission-critical individual contributors in research and development. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. The loss of one or more of our executive officers or key employees could have a serious adverse effect on our business.

In addition, we depend on certain professional services firms for a portion of our finance function. If we lose the services of these outsourced finance teams for any reason, our ability to complete key accounting processes and reviews and provide timely and accurate financial reporting could be seriously harmed, and we could experience material weaknesses in our disclosure controls and procedures and our internal control over financial reporting. In addition, we may be unable to retain a new outside professional services firm or expand the size and expertise of our internal accounting team sufficiently and quickly enough to implement the processes and reviews necessary to ensure that material misstatements do not occur, which could seriously harm our business. Any failure to provide timely and accurate financial reporting or to maintain effective disclosure controls and internal control over financial reporting could harm our business, results of operations and financial condition, and could cause investors to lose confidence in our financial reports and our financial reporting generally, which could cause a decline in the trading price of our Class A common stock.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance long-term stockholder value. Share repurchases could also increase the volatility of the trading price of our common stock and could diminish our cash reserves.

On May 10, 2022, the Executive Committee authorized a share repurchase program to repurchase up to $50 million of our outstanding Class A common stock. Although the Executive Committee has authorized this repurchase program, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares. The actual timing, manner, price and total amount of future repurchases will depend on a variety of factors, including business, economic and market conditions, corporate and regulatory requirements, prevailing stock prices, restrictions under the terms of loan agreements and other considerations. The share repurchase program may be modified, suspended, or terminated at any time, and we cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, this program could diminish our cash and cash equivalents and marketable securities.

Table of Contents

We rely on a single third-party vendor, issuing bank and card network for our Expensify Card, and if we lose any of these services, our business, results of operations, financial condition and growth prospects could be harmed.

The Expensify Card is an important element of our growth strategy, and we believe that, over time, the Expensify Card will be a prominent corporate card solution for SMBs in our core markets. For our Legacy Card Program, launched in 2020, we rely on a single third-party vendor, Marqeta, for the Expensify Card, who also manages the relationship with the card's issuing bank, Sutton Bank, and the card network, Visa. In the annual periods ended December 31, 2023, 2022 and 2021, consideration from this vendor representing monetized Expensify Card activities reduced our cost of revenue by $10.1 million, $6.2 million, and $2.9 million, respectively. Our agreement with Marqeta initially had a three year term that was renewed in June 2022 and now automatically renews annually thereafter unless either party provides 90 days’ notice prior to renewal.

Under our Updated Card Program, which had not yet launched to customers as of December 31, 2023 and thus has not yet resulted in any revenue, we rely on Marqeta as the payment processor, Bancorp as the card’s issuing bank, and Visa as the card network. Under the Updated Card Program, our agreement with Marqeta has an initial term of approximately four years, and will automatically renew annually thereafter. Our agreement with Bancorp has an initial five year term, and will automatically renew annually thereafter.

In addition to standard termination for cause provisions, either party can terminate without cause upon 180 days' notice, and under certain circumstances Marqeta may terminate with reduced or no notice, including if required to do so by the issuing bank or any regulator with jurisdiction over the issuing bank or Marqeta, or in the event of that we issue cards outside of approved use cases. In the event of termination or expiration of the agreement with Marqeta, we have the right to request Marqeta's assistance in transitioning to a new vendor, and during the transition period the agreement will continue on the same terms. If such transition is not successful, or if we otherwise lose our Expensify Card vendor, issuing bank or card network for any reason, we could experience service interruptions as well as delays and additional expenses, and we may be unable to replace these services on competitive terms, or at all, which could harm our business, results of operations, financial condition and growth prospects.

If we or our third party providers fail to protect our IT Systems against security incidents, or otherwise to protect our Confidential Information, there may be damage to our reputation and brand, material financial penalties, and legal liability, which could substantially harm our business, financial condition, and results of operations.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems, but also rely on third parties for a range of IT Systems and related products and services. We and certain of our third-party providers collect, maintain, and process data our customers provide us, some of which is confidential information about them or their financial transactions. We also process personal information about our employees, vendors, and business partners, and those who purchase products or services from our customers – as well as proprietary information belonging to the business such as trade secrets (collectively, “Confidential Information”).

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of our IT Systems and Confidential Information, through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT systems, products, or services. Attacks upon information technology systems are increasing, and expected to continue increasing, in their frequency, levels of persistence, sophistication and intensity – including through the use of artificial intelligence – and are being conducted by diverse threat actors including sophisticated and organized groups and individuals with a wide range of motives and expertise. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to

Table of Contents

anticipate these techniques or implement adequate preventative measures. We may also be subject to vulnerabilities or experience security incidents that may remain undetected for an extended period as attacks may circumvent security controls, evade detection, and remove forensic evidence. As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information, or business.

There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Because we make extensive use of third party suppliers and service providers, successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. Additionally, many of our employees and service providers work remotely, in part due to a significant increase in remote work stemming from the COVID-19 pandemic that has been maintained. As a result, we may be more vulnerable to cybersecurity-related events such as phishing attacks and other security challenges. Many companies that provide cloud based services have reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic and related increase in remote work.

We and certain of our third-party providers regularly experience cyberattacks and other incidents, and we expect such attacks and incidents to continue in varying degrees. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Any adverse impact to the availability, integrity, or confidentiality of our IT Systems or Confidential Information can result in intentional or accidental unauthorized access to our IT Systems or our customers’ or partners’ sites, networks, systems and accounts; unauthorized access to, and misappropriation or disclosure of Confidential Information; viruses, worms, spyware, ransomware, or other malware being served from our platform, mobile application, networks, or systems, including as a result of supply chain attacks; deletion or modification of content or the display of unauthorized content on our platform; interruption, disruption, or malfunction of operations; costs relating to remediation, deployment of additional personnel and protection technologies, and response to governmental investigations and media inquiries and coverage; engagement of third-party experts and consultants; or risk of loss, litigation, regulatory action and other potential liabilities. If any of these adverse impacts should occur, we cannot guarantee data loss can be prevented. Additionally, if any adverse impacts occur, our reputation and brand could be damaged, our business may suffer, and we could be required to expend significant capital and other resources to alleviate problems caused by such breaches. Actual or anticipated cyber security attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security incidents among other things, could harm our reputation and our ability to retain existing customers and attract new customers.

Any actual or perceived compromise of our IT Systems or Confidential Information, or those of our customers, partners, or third-party service providers, could also violate applicable privacy, data protection, data security, network and information systems security and other laws, and cause significant legal and financial exposure, adverse publicity, and a loss of confidence in our security measures, which could have a material adverse effect on our business, results of operations, and financial condition. In addition, any insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks, or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance. We may need to devote significant resources in the future to address problems caused by cyber attacks, including notifying affected individuals and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

Moreover, we are subject to the Payment Card Industry Data Security Standard (“PCI-DSS”), issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. If we or our service providers are unable to comply with the security standards

Table of Contents

established by banks and the payment card industry, we may be subject to fines, restrictions and expulsion from card acceptance programs, which could materially and adversely affect our business.

Our business depends on a strong brand, and if we are not able to maintain and enhance our brand, our ability to expand our base of customers may be impaired, and our business and results of operations will be harmed.

We believe that the brand identity that we have developed has significantly contributed to the success of our business. We also believe that maintaining and enhancing the “Expensify” brand is critical to expanding our customer base and establishing and maintaining relationships with partners. Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts, our ability to ensure that our platform remains high-quality, reliable, useful and competitively priced, the quality and perceived value of our platform, our ability to successfully differentiate our platform and features from those of our competitors and the ability of our customers to achieve successful results by using our platform and features. Maintaining and enhancing our brand may require us to make substantial investments not just in our core expense management service but also in newer features, such as our financial chat services, and to make substantial investments in foreign markets, and these investments may not be successful. We also plan to enhance our brand and drive interest in our overall platform by introducing certain consumer-focused features, which may not be successful. Substantial advertising expenditures may be required to maintain and enhance our brand, which may not prove successful. Advertising and other brand promotion activities may not generate customer awareness or increase revenue, and even if they do, any increase in revenue may not offset the expenses we incur in building our brand. For example, in 2023 we opened the Expensify Lounge in San Francisco, CA as a brand awareness campaign that ultimately did not yield the expected results and was shut down in late 2023. As another example, in 2023 we hosted our third ExpensiCon, an invite-only, all-expenses paid industry conference set in an exotic location that includes a full itinerary of events and excursions. The goal of this ExpensiCon was to increase our market consensus among our Approved! Accounting partners and increase adoption of our platform. We have spent significant resources on this initiative, and there can be no assurance that we will be successful in achieving those goals or that the nature of the event will not expose us to additional risks. Additionally, there could be a negative reaction to certain advertising campaigns and values-based activity and communications. If we fail to promote and maintain the “Expensify” brand, or if we incur excessive expenses in this effort, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts or to achieve the widespread brand awareness that is critical for broad customer adoption of our platform and features. We anticipate that, as our market becomes increasingly competitive, maintaining and enhancing our brand may become more difficult and expensive.

We expect to continue to make substantial investments and expenditures related to the growth of our business.

To improve the scalability, security, efficiency and failover aspects of our features, and to support our ongoing efforts to expand and enhance our platform and our business, we are continually updating our software and content and investing in the development, introduction and customer acceptance of new features, enhancements, integrations, capabilities and versions of our existing features. Additionally, we will need to continue to make substantial investments and expenditures to, among other things:

•hire new and retain existing employees;

•maintain, expand, update and improve our infrastructure;

•expand our sales and marketing activities, including to obtain channel partners and to expand our SMB and consumer advertising;

•expand our operations across multiple geographies;

•operate as a public company; and

Table of Contents

•pay for increasing costs associated with our general and administrative organization.

We may also review or revise our software architecture as we grow, which may require significant resources and investments. For example, we recently released the first version of an open-source financial group chat optimized for financial conversations, designed to be used both in and outside of work, and maintained by a community of open source developers. We expect our open-source offering to be a complete rewrite of the Expensify front end, built on a new React Native platform that uses the same codebase across iOS, Android, web and desktop once it is completed. There can be no assurance that this direction will achieve customer acceptance or that we will realize the anticipated return on our investment even if and when the feature complete version is released.

If we experience increasing demand for our features, we may not be able to augment our infrastructure quickly enough to accommodate this demand, which may limit our growth or cause disruptions, outages and other performance problems that could lead to financial liabilities or affect our brand and reputation. If our subscription sales decrease, certain of our fixed costs, such as for capital equipment, may make it difficult for us to adjust our expenses downward quickly.

Our business is substantially dependent upon the continued development of the market for, and acceptance of, cloud based software features.

We have derived, and expect to continue to derive, substantially all of our revenue from the sale of subscriptions for our cloud based platform. The market for cloud based software is not as mature as the market for on premises software applications. We do not know whether the trend of adoption of cloud based software that we have experienced in the past will continue in the future, and the adoption rate of cloud based software may be slower at companies in industries with heightened data security interests or sensitivity to communication network slowdowns or outages. Additionally, international acceptance of cloud-based software varies by country, and is limited in certain countries where we may seek to expand. Our success will depend to a substantial extent on the widespread adoption of cloud based software products in general, and of cloud based preaccounting products in particular. Many businesses have invested substantial personnel and financial resources to integrate on premises software products into their businesses and have been reluctant or unwilling to migrate to cloud based software products. Furthermore, some businesses may be reluctant or unwilling to use cloud based products because they have concerns regarding the risks associated with the security of their data and the reliability of the technology and service delivery model associated with solutions like ours. Additionally, integration opportunities for our cloud-based platform may be limited without widespread adoption of other cloud-based software products, which may prevent a member from maximizing their experience with our platform. In addition, if we or other cloud based providers experience security incidents, loss of customer data, disruptions in delivery, or other problems, the market for cloud based software solutions as a whole, including for our solutions, may be negatively impacted. If the adoption of cloud based software solutions does not continue at the rate we anticipate, the market for these solutions may stop developing or may develop more slowly than we expect, either of which would harm our business.

If we fail to offer a high-quality customer experience, our business and reputation will suffer.

While we have designed our platform and features to be easy to adopt and use, once individuals and organizations begin using Expensify, they rely on our support services to resolve any related issues. High-quality member and customer education and customer experience have been key to the adoption of our platform and features and for the conversion of individuals and organizations using our free features and trial subscriptions into paying customers. The importance of high-quality customer experience will increase as we expand our business and pursue new customers. For instance, if we do not help organizations on our platform quickly resolve issues and provide effective ongoing member experience at the individual and organizational levels, our ability to convert organizations on our trial subscription into paying customers will suffer, and our reputation with existing or potential customers will be harmed. Further, the success of our bottom-up business model is highly dependent on our business reputation and on word-of-mouth positive recommendations from existing individuals and organizations using our platform and features. Any failure to maintain high-quality customer experience, or a market perception

Table of Contents

that we do not maintain high-quality customer experience, could harm our reputation, our ability to sell our platform to existing and prospective customers and our business, results of operations and financial condition.

In addition, as we continue to grow our operations and reach a larger and increasingly global customer and member base, we need to be able to provide efficient customer support that meets the needs of organizations using our platform and features globally at scale. The number of organizations using our platform and features has grown significantly, which puts additional pressure on our support organization. Our platform is designed to leverage our proprietary AI-powered customer support engine, Concierge. Our Concierge service is powered by AI and trained by customer support agents. As we continue to grow and add features, we will need to hire additional support personnel to be able to continue to provide efficient customer support globally at scale, and if we are unable to provide such support, our business, results of operations and financial condition would be harmed.

We must continue to attract and retain highly qualified personnel, including an on-demand workforce in certain jurisdictions and for certain aspects of our business, to continue to execute on our business strategy and growth plans.

In order to continue to execute on our business strategy and growth plans, including the development of new features, and to maintain and upgrade our existing features, we will need to attract a sufficient number of highly qualified personnel, especially software engineers. Competition for software engineers and other key personnel in our industry is intense, especially for engineers with high levels of experience in designing and developing software for Internet-related services. As we become a more mature company, we may find our recruiting efforts more challenging.

In addition, one of our business strategies is to supplement our small core team of generalists with a large number of specialist contractors, managed by third-party vendors, from around the world. For example, we rely on certain third-party vendors to provide a specialized on-demand workforce to provide 24/7 real-time chat support and free phone onboarding for every Expensify member. We also intend to use this strategy to pair our core group of engineering generalists with a global network of open source engineering specialists, such as for the development and maintenance of our open-source financial group chat. If we are unable attract a sufficient number of specialized on-demand workers, or if changes to applicable foreign, state and local laws governing the definition or classification of independent contractors make it difficult or impossible for us to hire a sufficient number of specialized on-demand workers in a cost-effective manner, our costs could increase and our business, results of operations and financial condition could be harmed.

Job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. The incentives to attract, retain and motivate employees provided by our equity awards or other compensation arrangements may not be as effective as in the past. If the perceived value of our stock declines, it may adversely affect our ability to recruit and retain highly skilled employees.

Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or our company have breached their legal obligations, resulting in a diversion of our time and resources.

Our recruiting efforts may also be limited by laws and regulations, such as restrictive immigration laws, and restrictions on travel or availability of visas. If we do not succeed in attracting excellent personnel or retaining or motivating existing personnel, we may be unable to innovate quickly enough to support our business model or grow effectively.

Table of Contents

Our culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the high employee engagement fostered by our culture, which could harm our business.

We believe that a critical component of our success has been our culture, which is deeply embedded in everything we do. Our culture is centered on a belief that a life well lived is one that enables you to achieve the following three goals: Live Rich, Have Fun and Save the World. We have invested substantial time and resources in building our team with an emphasis on collaboration and innovation, ensuring customer success and a commitment to diversity and inclusion. We invest in our culture to create fun, diverse and memorable experiences for our employees, including employee travel to company-wide meetings in the U.S. and abroad. As we continue to grow and develop the infrastructure associated with being a public company, we will need to maintain our culture among a larger number of employees dispersed in various geographic regions. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel.

If we fail to effectively manage our growth, our business and results of operations could be harmed.

We experienced rapid growth and increased demand for our platform prior to the COVID-19 pandemic. Our revenue grew from $53.9 million in 2018 to $80.5 million in 2019 to $88.1 million in 2020 to $142.8 million in 2021, but our headcount remained relatively consistent, with 131 employees as of December 31, 2018, 127 employees as of December 31, 2019, 133 employees as of December 31, 2020, and 144 employees as of December 31, 2021. From 2021 to 2022, our revenue grew to $169.5 million, but our headcount remained relatively consistent, with 144 employees as of December 31, 2021 and 138 employees as of December 31, 2022. In 2023, our revenue declined to $150.7 million, with 133 employees as of December 31, 2023. The growth and expansion of our business and platform may place a significant strain on our management and our administrative, operational and financial reporting resources. Our ability to accurately plan for and model future growth is limited and subject to a number of uncertainties, due in part to our global operations, customer preferences and mix of products and features. We have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in rapidly changing industries. If our assumptions regarding these risks and uncertainties, which we use to plan our business strategies and operations, are incorrect or change due to industry or market developments, or if we do not address these risks successfully, our operating results could differ materially from our expectations and our business could suffer. For example, we are required to manage multiple relationships with various strategic, integration and channel partners, customers and other third parties. In the event of further growth of our operations or in the number of our third-party relationships, our computer systems, procedures, or internal controls may not be adequate to support our operations, and our management may not be able to manage such growth effectively. To effectively manage our growth, we must continue to implement and improve our operational, financial and management information and reporting systems and manage our employee base. In addition, as we seek to continue to expand internationally, we will likely encounter unexpected challenges and expenses due to unfamiliarity with local regulations, requirements, practices and markets.

Our payments services and our Expensify Card are targets for illegal or improper uses, and our risk management efforts may not be effective, which could expose us to losses and liability and otherwise harm our business.

We offer payments services and the Expensify Card to our customers, and we are responsible for vetting and monitoring these customers and determining whether the transactions we process for them are legitimate. When our features and services are used to process illegitimate transactions, and we settle those funds to sellers and are unable to recover them, we suffer losses and liability. These types of illegitimate transactions can also expose us to governmental and regulatory sanctions. The highly automated nature of, and liquidity offered by, our payments services make us a target for illegal or improper uses, including fraudulent or illegal sales of goods or services, money laundering and terrorist financing. Identity thieves and those committing fraud using stolen or fabricated credit card or bank account numbers, or other deceptive or malicious practices, can potentially steal significant amounts of money from our business. In configuring our payments services, we face an inherent trade-off between

Table of Contents

security and customer convenience. Our risk management policies, procedures, techniques and processes may not be sufficient to identify all of the risks to which we are exposed, to enable us to mitigate the risks we have identified, or to identify additional risks to which we may become subject in the future. In addition, when we introduce new services, focus on new business types, or begin to operate in markets where we have a limited history of fraud loss, we may be less equipped to forecast and reserve accurately for those losses. Furthermore, if our risk management policies and processes contain errors or are otherwise ineffective, we may suffer large financial losses, we may be subject to civil and criminal liability, and our business may be materially and adversely affected.

We are currently, and will continue to be, exposed to risks associated with chargebacks and refunds in connection with payment card fraud or relating to the goods or services provided by our sellers. In the event that a billing dispute between a cardholder and a seller is not resolved in favor of the seller, including in situations where the seller engaged in fraud, the transaction is typically “charged back” to the seller and the purchase price is credited or otherwise refunded to the cardholder. If we are unable to collect chargeback or refunds from the seller’s account, or if the seller refuses to or is unable to reimburse us for a chargeback or refunds due to closure, bankruptcy, or other reasons, we may bear the loss for the amounts paid to the cardholder. We do not collect and maintain reserves from our sellers to cover these potential losses. The risk of chargebacks is typically greater with those of our sellers that promise future delivery of goods and services, which we allow on our service. If we are unable to maintain our losses from chargebacks at acceptable levels, the payment card networks could fine us, increase our transaction fees, or terminate our ability to process payment cards. Any increase in our transaction fees could damage our business, and if we were unable to accept payment cards, our business would be materially and adversely affected.

If we experience excessive fraudulent activity, we could incur substantial costs and lose the right to accept credit cards for payment, which could cause our customer base to decline significantly.

A large portion of our paying customers authorize us to bill their credit card accounts through our third-party payment processing partners for our paid subscription plans. If customers pay for their subscription plans with stolen credit cards, we could incur substantial third-party vendor costs for which we may not be reimbursed. Further, our customers provide us with credit card billing information online, and we do not review the physical credit cards used in these transactions, which increases our risk of exposure to fraudulent activity. We also incur chargebacks from the credit card companies for claims that the customer did not authorize the credit card transaction for subscription plans, something that we have experienced in the past. If the number of claims of unauthorized credit card transactions becomes excessive, we could be assessed substantial fines for excess chargebacks, and we could lose the right to accept credit cards for payment. In addition, credit card issuers may change merchant standards, including data protection and documentation standards, required to utilize their services from time to time. Our third-party payment processing partners must also maintain compliance with current and future merchant standards to accept credit cards as payment for our paid subscription plans. Substantial losses due to fraud or our inability to accept credit card payments would cause our customer base to significantly decrease and would harm our business.

Sales to customers outside the United States and our international operations expose us to risks inherent in international sales and operations.

Our revenue generated from customers outside the United States was $13.3 million (9% of our revenue), $14.7 million (9% of our revenue), and $15.2 million (11% of our revenue) for the annual periods ended December 31, 2023, 2022 and 2021, respectively. Our core geographies are the United States, the United Kingdom, Canada and Australia. We intend to pursue expansion of our international operations. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that are different from those in the United States. In addition, we

Table of Contents

face risks in doing business internationally that could adversely affect our business and results of operations, including:

•the need to localize and adapt our platform and features for specific countries, including translation into foreign languages, tax and regulatory updates and associated expenses;

•data privacy laws that impose different and potentially conflicting obligations with respect to how personal data is processed or require that customer data be stored in a designated territory;

•more fragmented partner market which proves to be harder for our platform to integrate with;

•difficulties in staffing and managing foreign operations;

•regulatory and other delays and difficulties in setting up foreign operations;

•different pricing environments, longer accounts receivable payment cycles and collections issues;

•new and different sources of competition;

•weaker protection for intellectual property and other legal rights than in the United States and practical difficulties in enforcing intellectual property and other rights outside of the United States;

•laws and business practices favoring local competitors;

•compliance challenges related to the complexity of multiple, conflicting and changing governmental laws and regulations;

•exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act, U.S. bribery laws, the UK Bribery Act and similar laws and regulations in other jurisdictions;

•increased financial accounting and reporting burdens and complexities;

•declines in the values of foreign currencies relative to the U.S. dollar;

•restrictions on the transfer of funds;

•potentially adverse tax consequences;

•the cost of and potential outcomes of any claims or litigation;

•future accounting pronouncements and changes in accounting policies;

•changes in tax laws or tax regulations;

•health or similar issues, such as a pandemic or epidemic; and

•regional and local economic and political conditions.

As we continue to expand our business globally, our success will depend, in large part, on our ability to anticipate and effectively manage these risks. These factors and others could harm our ability to increase international revenue and, consequently, would materially impact our business and results of operations. The expansion of our existing international operations and entry into additional international markets will require significant management attention and financial resources. Our failure to successfully manage our international operations and the associated risks effectively could limit the future growth of our business.

We may be adversely affected by global economic and political instability.

As we seek to expand our business globally, our overall performance will depend in part on worldwide economic and geopolitical conditions. Economies domestically and internationally have been affected from time to time by falling demand for a variety of goods and services, restricted credit, poor liquidity,

Table of Contents

reduced corporate profitability, employment pressures in services sectors, volatility in credit, equity and foreign exchange markets, bankruptcies and health crises, including COVID-19, as well as war, terrorist activity, political unrest, civil strife and other geopolitical uncertainty, and the resulting impact on business continuity and travel, supply chain disruptions, inflation, security issues, and overall uncertainty with respect to the economy, including with respect to tariff and trade issues.

For example, the invasion of Ukraine by Russian military forces in February 2022 and Hamas's attack on Israel in October 2023 has resulted in sustained conflict and disruption in those regions and the surrounding areas. The length, impact and outcome of these conflicts are highly unpredictable; however, they could lead to significant market and other disruptions, some of which have already been experienced, including significant volatility in commodity prices and supply of energy resources, instability in financial markets, supply chain interruptions, political and social instability and changes in consumer or purchaser preferences, as well as an increase in cyberattacks and espionage. Additionally, sanctions or other measures implemented by other countries, as well as potential responses from other countries, could adversely affect the global economy and financial markets, which could in turn have a material adverse effect on our business, financial condition and results of operations. In addition, political instability or adverse political developments and new or continued economic deterioration in any of the countries in which we operate could harm our business, results of operations and financial condition.

We face exposure to foreign currency exchange rate fluctuations.

While we have historically transacted in U.S. dollars with the majority of our customers and vendors, we have transacted in some foreign currencies with such parties and for our payroll in those foreign jurisdictions where we have operations, and expect to continue to transact in more foreign currencies in the future. Accordingly, declines in the value of foreign currencies relative to the U.S. dollar can adversely affect our revenue and results of operations due to remeasurement that is reflected in our earnings. Also, fluctuations in the values of foreign currencies relative to the U.S. dollar could make it more difficult to detect underlying trends in our business and results of operations.

We are subject to anti-corruption, anti-bribery, anti-money laundering and similar laws. Non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

We must comply with anti-corruption laws and regulations imposed by governments around the world with jurisdiction over our operations, which may include the U.S. Foreign Corrupt Practices Act of 1977 (“FCPA”) and the U.K. Bribery Act 2010 (“Bribery Act”), as well as the laws of the countries where we do business. These laws and regulations apply to companies, individual directors, officers, employees and agents, and may restrict our operations, trade practices, investment decisions and partnering activities. Where they apply, the FCPA and the Bribery Act prohibit us and our officers, directors, employees and business partners acting on our behalf, including joint venture partners and agents, from corruptly offering, promising, authorizing or providing anything of value to public officials for the purposes of influencing official decisions or obtaining or retaining business or otherwise obtaining favorable treatment. The Bribery Act also prohibits non-governmental “commercial” bribery and accepting bribes. As part of our business, we may deal with governments and state-owned business enterprises, the employees and representatives of which may be considered public officials for purposes of the FCPA and the Bribery Act. We also are subject to the jurisdiction of various governments and regulatory agencies around the world, which may bring our personnel and agents into contact with public officials responsible for issuing or renewing permits, licenses or approvals or for enforcing other governmental regulations. In addition, some of the international locations in which we operate lack a developed legal system and have elevated levels of corruption.

Our wholly owned subsidiary, Expensify Payments LLC, is registered as a “Money Services Business” with the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”), and subject to regulatory oversight and enforcement by FinCEN under the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001 (“BSA”). Among other things, the BSA requires money services businesses to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity and maintain transaction records. The BSA prohibits, among other things, our

Table of Contents

involvement in transferring the proceeds of criminal activities. Regulators in the United States and globally may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions. In addition, we are contemplating offering certain products in the future that may require us to obtain licenses to operate as a money transmitter (or its equivalent) in various states and territories where such licenses are required. We have already obtained such licenses in certain states and have pending license applications in others. If we are unable to obtain a license to operate as a money transmitter, our ability to grow certain of our services may be limited. As a licensed money transmitter, we would be subject to obligations and restrictions with respect to the handling and investment of customer funds, record keeping and reporting requirements, bonding requirements and inspection by state regulatory agencies.

There are substantial costs and potential changes to our offerings involved in obtaining, maintaining and renewing these licenses and registrations. We could be subject to significant fines or other enforcement actions if we are found to violate disclosure, reporting, anti-money laundering, economic and trade sanctions, corporate governance and internal controls, banking secrecy, or other laws and requirements. These factors could involve considerable delay to the development or provision of our offerings or services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, or prevent us from providing our offerings or services in a given geography.

Our business also must be conducted in compliance with applicable economic and trade sanctions and export control laws and regulations, such as those administered and enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council and other relevant sanctions authorities, which impose restrictions or prohibitions on the sale or supply of certain products or services to embargoed or sanctioned countries, governments, persons, and entities. Although we take precautions to prevent our platform from being provided in violation of such laws, our platform may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take. Our global operations expose us to the risk of violating, or being accused of violating, anti-corruption, anti-money laundering, export control and economic and trade sanctions laws and regulations. Our failure to comply with these laws and regulations may expose us to reputational harm as well as significant penalties, including criminal fines, imprisonment, civil fines, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. Despite our compliance efforts and activities we cannot assure compliance by our employees or representatives for which we may be held responsible, and any such violation could materially adversely affect our reputation, business, financial condition and results of operations.

We receive, process, store and use business and personal data, which subjects us to governmental regulation and other legal obligations related to data privacy, protection and security, and our actual or perceived failure to comply with such obligations could harm our business and expose us to liability.

We receive, process, store and use business and personal data relating to our employees, members and customers around the world, including the United States and the European Economic Area (“EEA”). As a result, our business is therefore subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, sharing and protection of personal data. For instance, laws in all fifty U.S. states and outside the United States (and sometimes contractual and/or other obligations) and certain international laws and regulations require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. We seek to comply with applicable laws, regulations, policies, legal obligations and industry standards and have developed privacy policies, data processing addenda and internal privacy procedures to reflect our practices designed to achieve such compliance. However, such laws, regulations, regulatory codes and guidelines regulations are complex, may be inconsistent across jurisdictions or conflict with other rules and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements,

Table of Contents

ambiguous, uncertain, and potentially inconsistent and therefore, there can be no assurance that our policies and process will be fully implemented, complied with, or effective. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business. Further, any significant change in applicable laws, regulations, or industry practices regarding the use or disclosure of our members’ or customers’ data, or regarding the manner in which the express or implied consent of members or customers for the use and disclosure of such data is obtained, could require us to modify our platform, possibly in a material manner, and may limit our ability to develop new services and features that make use of the data that our members and customers voluntarily share.

A failure on our part to safeguard consumer data adequately or to destroy data securely or otherwise comply with legal obligations may subject us, depending on the personal data in question, to costs associated with notice and remediation, as well as potential regulatory investigations or enforcement actions, and possibly to civil liability, under federal, state, or foreign laws or regulation, industry standards, our internal privacy policies and procedures, or our contracts governing our processing of personal data claims by third parties, and damage to our reputation, any of which could have an adverse effect on our operations, financial performance and business. We could also incur significant costs investigating and defending such claims and, if we are found liable, significant damages.

For example, in the United States, the data protection landscape is also rapidly growing and evolving on both the state and federal level. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For example, a number of state-level general data privacy laws have or will soon go into effect that introduce new data privacy rights for consumers and new operational requirements for companies. For instance, the California Consumer Privacy Act (“CCPA”), provides data privacy rights for California residents and operational requirements for covered businesses. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents certain privacy rights relating to their personal data. The CCPA also considers certain financial information to be “sensitive personal information” imposing additional requirements on businesses, such as public disclosures about how such data is being used and disclosed by the business. The CCPA also provides for civil penalties for violations, as well as a private right of action for certain data breaches that increases the potential exposure in relation to data breaches. We cannot fully predict the impact of these laws, or subsequent guidance, regulations or rules on our business or operations, including those that are still in draft form, but they may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal data, our financial condition, and the results of our operations or prospects. Further, if we become subject to other state-level privacy laws, guidelines or regulations, we may be required again to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

Furthermore, at the federal level, we are also subject to laws, regulations and standards covering marketing, advertising, cookies, tracking technologies, e-marketing, and other activities conducted by telephone, email, mobile devices and the internet, such as the Federal Wiretap Act, the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, and similar state consumer protection and communication privacy laws. Additionally, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal data secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. There are a number of legislative proposals in the United States, at

Table of Contents

both the federal and state level, and in the E.U. and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations and standards may have on our business.

In addition, the EU General Data Protection Regulation ("GDPR") imposes stringent data protection requirements for processing the personal data of individuals within the European Economic Area ("EEA"). The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosure requirements, limitations on retention of personal data, mandatory data breach notification requirements and additional obligations. Non-compliance with the GDPR can trigger fines of up to the greater of €20 million or 4% of our global revenue. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the E.U. and the United States remains uncertain. For example, in 2016, the E.U. and United States agreed to a transfer framework for data transferred from the E.U. to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union ("CJEU"). The CJEU also raised questions about whether the European Commission’s Standard Contractual Clauses, one of the primary mechanisms used by companies to transfer personal data out of the EEA, complies with the GDPR. While the CJEU upheld the validity of the Standard Contractual Clauses, the CJEU ruled that the underlying data transfers must be assessed on a case-by-case basis by the data controller to determine whether the personal data will be adequately protected. At present, there are few if any viable alternatives to the Standard Contractual Clauses and, therefore, there is uncertainty regarding how to ensure that transfers of personal data from Europe to the United States comply with the GDPR. As such, any transfers by us of personal data from Europe may not comply with European data protection laws and may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions. Loss of our ability to transfer personal data from Europe may also require us to increase our data processing capabilities in those jurisdictions at significant expense.

Further, following the United Kingdom’s withdrawal from the E.U. and the end of the related transition period, as of January 1, 2021, companies may be subject to both GDPR and the United Kingdom GDPR, or UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, imposing fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the E.U. in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure. Currently there is a four to six-month grace period agreed in the E.U. and United Kingdom Trade and Cooperation Agreement, ending June 30, 2021 at the latest, while the parties discuss an adequacy decision. The European Commission published a draft adequacy decision on February 19, 2021. If adopted, the decision will enable data transfers from E.U. member states to the United Kingdom for a four-year period, subject to subsequent extensions. While we have instituted a GDPR compliance strategy and program that we continue to evaluate and improve as our platform changes and expands, we still do not know how E.U. regulators will interpret or enforce many aspects of the GDPR, and some regulators may do so in an inconsistent manner, making such a prediction even more difficult.

In addition to the E.U., a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR. Others, such as those in Russia, India and China, could potentially impose more stringent obligations, including data localization requirements. If we are unable to develop and offer features that meet legal requirements or help our members and customers meet their obligations under

Table of Contents

the laws or regulations relating to privacy, data protection, or information security, or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience reduced demand for our platform, harm to our reputation and become subject to investigations, claims and other remedies, which would expose us to significant fines, penalties and other damages, all of which would harm our business. Further, given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.

In addition to laws relating to data privacy and security, we are subject to self-regulatory standards and industry certifications that may legally or contractually apply to us. These include the Payment Card Industry Data Security Standards ("PCI-DSS") with which we are currently compliant. In the event that we fail to comply with the PCI-DSS, we could be in breach of our obligations under customer and other contracts, fines and other penalties could result, and we may suffer reputational harm and damage to our operations, financial performance, reputation and business. Further, our clients may expect us to comply with more stringent privacy and data security requirements than those imposed by laws, regulations, or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data on or by our offerings.

If we fail to manage our technical operations infrastructure, or experience service outages, interruptions, or delays in the deployment of our platform, our results of operations may be harmed.

Because our operations involve delivering a suite of preaccounting features to our customers through a cloud-based software platform, our continued growth depends in part on the ability of our platform and related computer equipment, infrastructure and systems to continue to support our features. In the past, we have experienced temporary platform disruptions, outages in our features and degraded levels of performance due to human and software errors, file corruption and capacity constraints associated with the number of customers accessing our platform simultaneously. While our past experiences have not materially impacted us, in the future we may face more disruptions, outages, or performance problems. Factors that may cause such disruptions or problems include:

•human error;

•security breaches;

•telecommunications failures or outages from third-party providers;

•computer viruses, malware, vulnerability exploits, or cyber-attacks;

•software errors, failures, vulnerabilities or bugs in our features;

•acts of terrorism, sabotage or other intentional acts of vandalism;

•unforeseen interruption or damages;

•pandemics and epidemics;

•tornados, fires, earthquakes, floods and other natural disasters; and

•power loss.

In addition, continued growth in our customer base could place additional demands on our platform and features and could cause or exacerbate slowdowns or interrupt the availability of our platform. As we expand our platform capabilities to other features, like the Expensify Card, those new features may come with different technological demands, like real time transactions. If we are unable to plan or develop our platform accordingly, it could have a negative impact on our business. If there is a substantial increase in the volume of usage across our platform, we will be required to further expand and upgrade our technology and infrastructure. There can be no assurance that we will be able to accurately project the

Table of Contents

rate or timing of increases, if any, in the use of our platform or expand and upgrade our systems and infrastructure to accommodate such increases on a timely basis. In such cases, if our members are not able to access our platform and features or encounter slowdowns when doing so, we may lose customers or partners, which would adversely impact our reputation and revenue. Further, any changes in the service levels at our data centers or any errors, defects, disruptions or other performance problems with our network infrastructure may result in lengthy interruptions in the availability of our platform and features. In such cases, we may lose our customers’ trust and confidence in our platform, and customer and employee data from recent transactions may be permanently lost and we could be exposed to significant claims by clients, particularly if the access interruption is associated with problems in the timely delivery of funds due to employees. In order to remain competitive, we must continue to enhance and improve the responsiveness, functionality and features of our platform and products. Our disaster recovery plan may not be sufficient to address all aspects or any unanticipated consequence or incidents, and our insurance may not be sufficient to compensate us for the losses that could occur.

We lease the cloud computing infrastructure that we use to host our platform, mobile application and many of the internal tools we use to operate our business. Any significant disruption of, limitation of our access to, or other interference with our use of the cloud services would negatively impact our operations and could seriously harm our business. Our business relies on the availability of our platform for our members and customers, and we may lose members or customers if they are not able to access our platform or encounter difficulties in doing so.

In addition, we rely on third-party hosting services, hardware and infrastructure purchased or leased from third parties and software licensed from third parties to operate critical business functions. Our business would be disrupted if any of this third-party hardware, software and infrastructure becomes unavailable on commercially reasonable terms, or at all. Furthermore, delays or complications with respect to the transition of critical business functions from one third-party product to another, or any errors or defects in third-party hardware, software, or infrastructure could result in errors or a failure of our platform, which could harm our business and results of operations.

Moreover, our platform and features depend on our customers’ high speed broadband or wireless access to the Internet. Increasing numbers of customers and bandwidth requirements may degrade the performance of our features due to capacity constraints and other Internet infrastructure limitations, and additional network capacity to maintain adequate data transmission speeds may be unavailable or unacceptably expensive. If adequate capacity is not available to us, our features may be unable to achieve or maintain sufficient data transmission, reliability, or performance. In addition, if Internet service providers and other third parties providing Internet services, including incumbent phone companies, cable companies and wireless companies, have outages or suffer deterioration in their quality of service, our customers may not have access to or may experience a decrease in the quality of our platform and features. These providers may take measures that block, degrade, discriminate, disrupt, or increase the cost of customer access to our features. Any of these disruptions to data transmission could lead customers to switch to our competitors or avoid using our features, which could negatively impact our revenue or harm our opportunities for growth.

We rely upon data centers and other systems and technologies provided by third parties to operate our business, and interruptions or performance problems with these centers, systems and technologies may adversely affect our business and operating results.

We rely on data centers and other technologies and services provided by third parties in order to operate our business. If any of these services becomes unavailable or otherwise is unable to serve our requirements, there could be a delay in activating a mirrored data center or our disaster recovery system.

Our business depends on our ability to protect the growing amount of information stored in our data centers and related systems, offices and hosting facilities, against damage from earthquake, floods, fires, other extreme weather conditions, power loss, telecommunications failures, hardware failures, unauthorized intrusion, overload conditions and other events. If our data centers or related systems fail to operate properly or become disabled even for a brief period of time, we could suffer financial loss, a

Table of Contents

disruption of our business, liability to customers, or damage to our reputation. Our response to any type of disaster may not be successful in preventing the loss of customer data, service interruptions and disruptions to our operations, or damage to our important facilities.

Our data center providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all, and it is possible that we will not be able to switch our operations to another provider in a timely and cost effective manner should the need arise. If we are unable to renew our agreements with these providers on commercially reasonable terms, or if in the future we add additional data center facility providers, we may face additional costs or expenses or downtime, which could harm our business.

Any unavailability of, or failure to meet our requirements by, third party data centers, technologies, or services, could impede our ability to provide services to our customers, harm our reputation, subject us to potential liabilities, result in contract terminations and adversely affect our customer relationships. Any of these circumstances could adversely affect our business and operating results.

If we are unable to ensure that our platform interoperates with a variety of software applications that are developed by others, including our integration partners, we may become less competitive and our business, results of operations and financial condition may be harmed.

Our platform must integrate with a variety of hardware and software platforms, and we need to continuously modify and enhance our platform to adapt to changes in hardware, software and browser technologies. In particular, we have developed our platform to be able to easily integrate with third-party applications, including the applications of software providers that compete with us as well as our partners, through the interaction of APIs and/or platforms. In general, we rely on the providers of such software systems to allow us access to their APIs to enable these integrations. We are typically subject to standard terms and conditions of such providers, which govern the distribution, operation and fees of such software systems, and which are subject to change by such providers from time to time. Our business will be harmed if any provider of such software systems:

•discontinues or limits our access to its software or APIs;

•modifies its terms of service or other policies, including fees charged to, or other restrictions on us, or other application developers;

•changes how information is accessed by us or our customers;

•establishes more favorable relationships with one or more of our competitors; or

•develops or otherwise favors its own competitive offerings over our platform.

Third-party services and products are constantly evolving, and we may not be able to modify our platform to assure its compatibility with that of other third parties. In addition, some of our competitors may be able to disrupt the operations or compatibility of our platform with their products or services, or exert strong business influence on our ability to, and terms on which we operate our platform. Should any of our competitors modify their products or standards in a manner that degrades the functionality of our platform or gives preferential treatment to competitive products or services, whether to enhance their competitive position or for any other reason, the interoperability of our platform with these products could decrease and our business, results of operations and financial condition would be harmed. If we are not permitted or able to integrate with these and other third-party applications in the future, our business, results of operations and financial condition would be harmed.

Further, our platform includes a mobile application to enable individuals and organizations to access our platform through their mobile devices. If our mobile application does not perform well, our business will suffer. In addition, our platform interoperates with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties. We therefore depend on the interoperability of our platform with such third-party services, mobile devices

Table of Contents

and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control. The loss of interoperability, whether due to actions of third parties or otherwise, and any changes in technologies that degrade the functionality of our platform or give preferential treatment to competitive services could adversely affect adoption and usage of our platform. Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in ensuring that Expensify operates effectively with a range of operating systems, networks, devices, browsers, protocols and standards. If we are unable to effectively anticipate and manage these risks, or if it is difficult for customers to access and use our platform, our business, results of operations and financial condition may be harmed.

We rely on third parties maintaining open marketplaces to distribute our mobile application. If such third parties interfere with the distribution of our platform, our business would be adversely affected.

We rely on third parties maintaining open marketplaces, including the Apple App Store and Google Play, which make our mobile application available for download. We cannot assure you that the marketplaces through which we distribute our mobile application will maintain their current structures or that such marketplaces or any new marketplaces will not charge us additional fees to list our application for download. We are also dependent on these third-party marketplaces to enable us and our members to timely update our mobile application, and to incorporate new features, integrations and capabilities.

In addition, Apple Inc. and Google, among others, for competitive or other reasons, could stop allowing or supporting access to our mobile application through their products, could allow access for us only at an unsustainable cost, or could make changes to the terms of access in order to make our mobile application less desirable or harder to access.

We rely on traditional web search engines and prominence in mobile application marketplaces to drive interest in our platform. If our website fails to rank prominently in organic search results, or our mobile application is not featured prominently in marketplaces, the discoverability of our platform could decline and our business would be adversely affected.

Our success depends in part on our discoverability – our ability to attract new members through unpaid Internet search results on traditional web search engines such as Google and through the prominence of our mobile application in open marketplaces. The number of members we are able to attract through these platforms is due in large part to how our website ranks in organic search results and how our mobile application ranks against similar applications. These rankings can be affected by a number of factors, many of which are not in our direct control, and they may change frequently. For example, a search engine may change its ranking algorithms, methodologies, or design layouts. As a result, links to our website may not be prominent enough to drive traffic to our website, and we may not know how or otherwise be in a position to influence the results. Any reduction in our discoverability could reduce our revenue or require us to increase our sales and marketing expenditures.

Changes in laws and regulations related to the Internet or changes in the internet infrastructure itself may diminish the demand for our applications, and could have a negative impact on our business.

The future success of our business depends upon the continued use of the Internet as a primary medium for commerce, communication and business. Federal, state and foreign government bodies or agencies have in the past adopted, and may in the future adopt, laws or regulations affecting the use of the Internet as a commercial medium. Changes in these laws or regulations could require us to modify our applications in order to comply with these changes. In addition, government agencies or private organizations may impose taxes, fees or other charges for accessing the Internet or commerce conducted via the Internet. These laws or charges could limit the growth of Internet-related commerce or communications generally, or result in reductions in the demand for Internet-based applications such as ours.

In addition, the use of the Internet as a means of conducting business could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of

Table of Contents

Internet activity, security, reliability, cost, ease of use, accessibility and quality of service. The performance of the Internet has been adversely affected by “viruses,” “worms” and similar malicious programs and the Internet has experienced a variety of outages and other delays as a result of damage to portions of its infrastructure. If the use of the Internet is adversely affected by these issues, demand for our applications could suffer.

Third parties may claim that our platform infringes their intellectual property rights and this may create liability for us or otherwise adversely affect our business, operating results and financial condition.

There is considerable patent and other intellectual property litigation in our industry. Our competitors, as well as a number of other entities, including non-practicing entities and individuals, may own or claim to own intellectual property relating to our industry. There may be third-party intellectual property rights, including issued or pending patents, that cover significant aspects of our technologies or business methods. As we face increasing competition and our public profile increases, the possibility of intellectual property rights claims against us may also increase. From time to time, our competitors or other third parties have claimed, and may in the future claim, that we are infringing upon, misappropriating, or violating their intellectual property rights, even if we are unaware of the intellectual property rights that such parties may claim cover our platform or some or all of the other technologies we use in our business.

Our success depends, in part, on our ability to develop and commercialize our solutions and services without infringing, misappropriating or otherwise violating the intellectual property rights of third parties. In a patent infringement claim against us, we may assert, as a defense, that we do not infringe the relevant patent claims, that the patent is invalid or both. The strength of our defenses will depend on the patents asserted, the interpretation of these patents, and our ability to invalidate the asserted patents. However, we could be unsuccessful in advancing non-infringement or invalidity arguments in our defense. In the United States, issued patents enjoy a presumption of validity, and the party challenging the validity of a patent claim must present clear and convincing evidence of invalidity, which is a high burden of proof. Conversely, the patent owner need only prove infringement by a preponderance of the evidence, which is a lower burden of proof. We may also be unaware of the intellectual property rights of others that may cover some or all of our technology. Because patent applications can take years to issue and are often afforded confidentiality for some period of time, there may currently be pending applications, unknown to us, that later result in issued patents that could cover one or more of our products and there is also a risk that we could adopt a technology without knowledge of a pending patent application, which technology would infringe a third-party patent once that patent is issued. Any litigation may also involve non-practicing entities or other adverse patent owners that have no relevant solution revenue, and therefore, our patent portfolio may provide little or no deterrence as we would not be able to assert our patents against such entities or individuals.

We may also face exposure to third party intellectual property infringement, misappropriation, or violation actions if we engage software engineers or other personnel who were previously engaged by competitors or other third parties and those personnel inadvertently or deliberately incorporate proprietary technology of third parties into our features. Any intellectual property claims, with or without merit, could be very time-consuming and expensive to settle or litigate, could cause us to incur significant expenses, pay substantial amounts in damages, ongoing royalty or license fees, or other payments, or could prevent us from offering all or aspects of our platform or using certain technologies, require us to re-engineer all or a portion of our platform or require that we comply with other unfavorable terms. The costs of litigation are considerable, and such litigation may divert management and key personnel’s attention and resources, which might seriously harm our business, results of operations and financial condition. We may be required to settle such litigation on terms that are unfavorable to us. For example, a settlement may require us to obtain a license to continue practices found to be in violation of a third party’s rights, which may not be available on reasonable terms and may significantly increase our operating expenses. A license to continue such practices may not be available to us at all. As a result, we may also be required to develop alternative non-infringing technology or practices or discontinue the practices. The development of alternative non-infringing technology or practices would require significant effort and expense. Similarly, if any litigation to which we may be a party fails to settle and we go to trial, we may be

Table of Contents

subject to an unfavorable judgment that may not be reversible upon appeal. For example, the terms of a judgment may require us to cease some or all of our operations or require the payment of substantial amounts to the other party. Any of these events would cause our business and results of operations to be materially and adversely affected as a result.

We are also frequently required to indemnify our reseller partners and customers in the event of any third-party infringement claims against our customers and third parties who offer our platform, and such indemnification obligations may be excluded from contractual limitation of liability provisions that limit our exposure. These claims may require us to initiate or defend protracted and costly litigation on behalf of our customers and reseller partners, regardless of the merits of these claims. If any of these claims succeed, we may be forced to pay damages on behalf of our customers and reseller partners, may be required to modify our allegedly infringing platform to make it non-infringing, or may be required to obtain licenses for the products used. If we cannot obtain all necessary licenses on commercially reasonable terms, our customers may be forced to stop using our platform, and our reseller partners may be forced to stop selling our platform.

If we are unable to protect our intellectual property rights, the value of our brand and other intangible assets may be diminished, and our business may be adversely affected.

Our success is dependent, in part, upon protecting our intellectual property rights and proprietary information. We rely and expect to continue to rely on a combination of trademark, copyright, patent and trade secret protection laws to protect our intellectual property rights and proprietary information. Our trademarks and service marks include EXPENSIFY, SMARTSCAN and various marketing slogans. Additionally, we maintain a policy requiring our employees, consultants, independent contractors and third parties who are engaged to develop any material intellectual property for us to enter into confidentiality and invention assignment agreements to control access to and use of our proprietary information and to ensure that any intellectual property developed by such employees, contractors, consultants and other third parties are assigned to us. However, we cannot guarantee that the confidentiality and proprietary agreements or other employee, consultant, or independent contractor agreements we enter into adequately protect our intellectual property rights and other proprietary information. In addition, we cannot guarantee that these agreements will not be breached, that we will have adequate remedies for any breach, or that the applicable counter-parties to such agreements will not assert rights to our intellectual property rights or other proprietary information arising out of these relationships. If we lose valuable personnel, our ability to develop, market and support potential features or enhancements could also be hampered, which could severely harm our business. Furthermore, the steps we have taken and may take in the future may not prevent misappropriation of our proprietary features or technologies, particularly with respect to officers and employees who are no longer employed by us.

Moreover, third parties may knowingly or unknowingly infringe or circumvent our intellectual property rights, and we may not be able to prevent infringement without incurring substantial expense. Litigation brought to protect and enforce our intellectual property rights may be costly, time-consuming and distracting to management and key personnel, and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. If the protection of our intellectual property rights is inadequate to prevent use or misappropriation by third parties, the value of our brand and other intangible assets may be diminished and competitors may be able to more effectively mimic our platform and methods of operations. Any of these events would have a material adverse effect on our business, results of operations and financial condition.

Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our platform without compensating us and negatively affect our business.

Our future success and competitive position depends in part upon our ability to obtain or maintain certain intellectual property used in our platform. We rely primarily on patent, trademark, copyright and trade

Table of Contents

secrets laws and confidentiality procedures and contractual provisions to protect our technology. While we have been issued patents for certain aspects of our intellectual property in the United States and have additional patent applications pending in the United States, we have not applied for patent protection in foreign jurisdictions, and may be unable to obtain patent protection for the technology covered in our patent applications. In addition, we cannot ensure that any of the patent applications will issue or that the claims allowed on any issued patents will be sufficiently broad to protect our technology or platform and provide us with competitive advantages. Moreover, failure to comply with applicable procedural, documentary, fee payment and other similar requirements with the United States Patent and Trademark Office could result in abandonment or lapse of the affected patent, trademark or application. Furthermore, any issued patents may be challenged, invalidated, or circumvented by third parties.

Many patent applications in the United States may not be public for at least 18 months after they are filed, and since publication of discoveries in the scientific or patent literature tends to lag behind actual discoveries by several months, we cannot be certain that we will be the first creator of inventions covered by any patent application we make or that we will be the first to file patent applications on such inventions. In addition, recent changes to the patent laws in the United States may bring into question the validity of certain software patents and may make it more difficult and costly to prosecute patent applications. Such changes may lead to uncertainties or increased costs and risks surrounding the prosecution, validity, ownership, enforcement and defense of our issued patents and patent applications and other intellectual property, the outcome of third-party claims of infringement, misappropriation, or other violation of intellectual property brought against us and the actual or enhanced damages (including treble damages) that may be awarded in connection with any such current or future claims, and could have a material adverse effect on our business.

We also rely on unpatented proprietary technology. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our technology or obtain and use information that we regard as proprietary. It is possible that others will independently develop the same or similar technology or otherwise obtain access to our unpatented technology. To protect our trade secrets and other proprietary information, we require employees, consultants and independent contractors to enter into confidentiality agreements. However, such agreements may not be enforceable in full or in part in all jurisdictions and any breach could have a negative effect on our business and our remedy for such breach may be limited. The contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. As such, we cannot guarantee that the steps taken by us will prevent misappropriation of our technology. We cannot assure you that these agreements will provide meaningful protection for our trade secrets, know-how, or other proprietary information in the event of any unauthorized use, misappropriation, or disclosure of such trade secrets, know-how, or other proprietary information. If we are unable to maintain the proprietary nature of our technologies, our business would be materially adversely affected.

We rely on our trademarks, trade names and brand names to distinguish our features from the products of our competitors, and have registered or applied to register many of these trademarks in the United States and certain countries outside the United States. However, occasionally third parties may have already registered identical or similar marks for products or features that also address the software market. As we rely in part on brand names and trademark protection to enforce our intellectual property rights, efforts by third parties to limit use of our brand names or trademarks and barriers to the registration of brand names and trademarks in various countries may restrict our ability to promote and maintain a cohesive brand throughout our key markets. Occasionally trademark offices have taken the view that certain of our trademarks, including SMARTSCAN, are merely descriptive or not inherently protectable. There can also be no assurance that pending or future U.S. or foreign trademark applications will be approved in a timely manner or at all, or that such registrations will effectively protect our brand names and trademarks. Third parties may also oppose our trademark applications, or otherwise challenge our use of the trademarks. For example, our applications to register KARMA POINTS as a trademark in the European Union and United Kingdom have been opposed by a third party. In the event that our trademarks are successfully

Table of Contents

challenged or we do not adequately protect our trademarks, we could be forced to rebrand our platform, which would result in loss of brand recognition and would require us to devote resources to advertising and marketing new brands.

Policing unauthorized use of our technology and trademarks is difficult. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States. For example, many foreign countries limit the enforceability of patents against certain third parties, including government agencies or government contractors. In these countries, any patents that we may obtain may provide limited or no benefit. Effective trade secret protection may also not be available in every country in which our features are available or where we have employees or independent contractors. The loss of trade secret protection could make it easier for third parties to compete with our features by copying functionality. In addition, any changes in, or unexpected interpretations of, the trade secret and employment laws in any country in which we operate may compromise our ability to enforce our trade secret and intellectual property rights. From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the proprietary rights of others or to defend against claims of infringement or invalidity. Such litigation could result in substantial costs and diversion of resources and could negatively affect our business, operating results and financial condition. If we are unable to protect our proprietary rights (including aspects of our software and platform protected other than by patent rights), we will find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create our platform and other innovative features that have enabled us to be successful to date. Moreover, we may need to expend additional resources to defend our intellectual property rights in foreign countries, and our inability to do so could impair our business or adversely affect our international expansion.

Our use of “open source” and third-party software could impose unanticipated conditions or restrictions on our ability to commercialize our features and could subject us to possible litigation.

A portion of the technologies we use in our platform, database infrastructure (Bedrock), Expensify.com, new.expensify.com and mobile application incorporate “open source” software, and we may incorporate open source software in our platform and mobile application in the future. From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and their compliance with the terms of the applicable open source license. We may be subject to suits by parties claiming ownership of what we believe to be open source software, or claiming non-compliance with the applicable open source licensing terms. If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public, including authorizing further modification and redistribution, or otherwise be limited in the licensing of our services, each of which could provide an advantage to our competitors or other entrants to the market, allow them to create similar products with lower development effort and time, and ultimately result in a loss of sales for us. While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable proprietary source code, we may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract. Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose source code that incorporates or is a modification of such licensed software. Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such license types. If an author or other third party that distributes open source software that we use or license were to allege that we had not complied with the conditions of the applicable open source license, we may also have to expend substantial time and resources to re-engineer some or all of our software, incur significant legal expenses defending against such allegations, be subject to significant damages, or be enjoined from the sale of our platform that contained the open source software.

Table of Contents

In addition, the use of third-party open source software typically exposes us to greater risks than the use of third-party commercial software because open-source licensors generally do not provide warranties or controls on the functionality or origin of the software. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to determine how to compromise our platform. Any of the foregoing could be harmful to our business, results of operations, or financial condition.

We license technology from third parties, and our inability to maintain those licenses could harm our business.

We rely on software licensed from third parties to offer our platform. In addition, we may need to obtain future licenses from third parties to use intellectual property rights associated with the development of our platform, which might not be available on acceptable terms, or at all. Any loss of the right to use any third-party software required for the development and maintenance of our platform or mobile application could result in loss of functionality or availability of our platform or mobile application until equivalent technology is either developed by us, or, if available, is identified, obtained and integrated. Any errors or defects in third-party software could result in errors or a failure of our platform or mobile application. Licensing technologies from third parties also exposes us to increased risk of being the subject of intellectual property infringement due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against infringement risks. We cannot be certain that our licensors do not or will not infringe on the intellectual property rights of third parties or that our licensors have or will have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our platform. Some of our agreements with our licensors may be terminated by them for convenience, or otherwise provide for a limited term. If we are unable to continue to license technology because of intellectual property infringement claims brought by third parties against our licensors or against us, or if we are unable to continue our license agreements or enter into new licenses on commercially reasonable terms, our ability to develop and sell features and services containing or dependent on that technology would be limited, and our business could be harmed. Additionally, if we are unable to license technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and may require us to use alternative technology of lower quality or performance standards. This could limit or delay our ability to offer new or competitive features and increase our costs. Any of the foregoing would disrupt the distribution and sale of subscriptions to our platform and harm our business, results of operations and financial condition.

Any litigation against us could be costly and time-consuming to defend.

We have in the past and may in the future become subject to legal proceedings and claims that arise in the ordinary course of business. We could be subject to claims, lawsuits (including class actions and individual lawsuits), government investigations and other proceedings involving consumer protection, labor and employment, immigration, import and export practices, product labeling, competition, accessibility, securities, tax, marketing and communications practices, commercial disputes, defamation, civil rights infringement, negligence, intellectual property rights infringement, invasion of privacy, product liability, regulatory compliance, or other legal claims, including claims relating to information that is published or made available via our platform. For example, in November 2020, the Federal Election Commission ("FEC") notified us of a number of complaints filed against us in connection with David Barrett's email on October 23, 2020 urging customers to protect democracy. We responded to the complaints in November and December 2020, requesting dismissal of all complaints. On May 31, 2022 we received notice from the FEC clearing us of any wrongdoings in relation to these complaints. However, we cannot assure you that the matter will not result in further complaints, regulatory inquiries or future proceedings. See Part I, Item 3 "Legal Proceedings" for additional information regarding our legal proceedings.

The number and significance of our legal disputes and inquiries have increased as we have grown larger, as our business has expanded in scope and geographic reach, and as our features and services have

Table of Contents

increased in complexity, and we expect the potential for future legal proceedings, claims and disputes will continue to increase. Becoming a public company has raised our public profile, which may result in increased litigation.

Regardless of the outcome, legal proceedings might result in substantial costs and may divert management and key personnel’s attention and resources, which might seriously harm our business, results of operations and financial condition. Plaintiffs may seek, and we may become subject to, preliminary or provisional rulings in the course of litigation, including preliminary injunctions requiring us to cease some or all of our operations. We may decide to settle legal disputes on terms that are unfavorable to us; for example, we may be required to cease some or all of our operations or pay substantial amounts to the other party, which could materially and adversely affect our business. Furthermore, if any litigation to which we are a party is resolved adversely, we may be subject to an unfavorable judgment that we may not choose to appeal or that may not be reversed upon appeal. We may have to seek a license to continue practices found to be in violation of a third party’s rights. If we are required, or choose to enter into, royalty or licensing arrangements, such arrangements may not be available on reasonable terms or at all and may significantly increase our operating costs and expenses. As a result, we may also be required to develop or procure alternative non-infringing technology or discontinue use of technology, and doing so could require significant effort and expense or may not be feasible. In addition, insurance might not cover these claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs and could have a material adverse effect on our business, results of operations and financial condition.

Our employees, commercial partners and vendors may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements.

We are exposed to the risk that our employees, commercial partners and vendors may engage in fraudulent or illegal activity. Misconduct by these parties could include intentional, reckless and/or negligent conduct or disclosure of unauthorized activities to us that violate: (i) the rules of the applicable regulatory bodies; (ii) data privacy laws or other similar non-United States laws; or (iii) laws that require the true, complete and accurate reporting of financial information or data. It is not always possible to identify and deter misconduct by our employees and other third parties, and the precautions we take to detect and prevent these activities may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. In addition, we are subject to the risk that a person or government could allege such fraud or other misconduct, even if none occurred. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could result in the imposition of significant fines or other sanctions, including the imposition of civil, criminal and administrative penalties, additional integrity reporting and oversight obligations. Whether or not we are successful in defending against any such actions or investigations, we could incur substantial costs, including legal fees, and divert the attention of management in defending ourselves against any of these claims or investigations, which could have a material adverse effect on our business, financial condition and results of operations.

We may need additional capital, and we cannot be sure that additional financing will be available.

In the future, we may raise additional capital through additional debt or equity financings to support our business growth, to respond to business opportunities, challenges, or unforeseen circumstances, or for other reasons. On an ongoing basis, we are evaluating sources of financing and may raise additional capital in the future. Our ability to obtain additional capital will depend on our development efforts, business plans, investor demand, operating performance, the condition of the capital markets, and other factors. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. If we raise additional funds through the issuance of equity or equity-linked securities, those securities may have rights, preferences, or privileges senior to the rights of existing stockholders,

Table of Contents

and existing stockholders may experience dilution. Debt financing, if available, may involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which could reduce our operational flexibility or make it more difficult for us to obtain additional capital and to pursue business opportunities. In addition, subject to limited exceptions, our loan and security agreement with Canadian Imperial Bank of Commerce ("CIBC”) restricts us from incurring indebtedness without the prior written consent of the lender. Further, if we are unable to obtain additional capital when required, or are unable to obtain additional capital on satisfactory terms, our ability to continue to support our business growth or to respond to business opportunities, challenges, or unforeseen circumstances would be adversely affected.

Our operating activities may be restricted as a result of covenants related to the indebtedness under our existing loan and security agreement and/or future indebtedness, and we may be required to repay the outstanding indebtedness in an event of default, which would have an adverse effect on our business.

Our loan and security agreement with CIBC, as amended and restated on February 21, 2024, consists of a $25.0 million revolving line of credit, which matures in September 2025. The loan and security agreement subjects us, and any future indebtedness would likely subject us, to various customary covenants, including requirements as to financial reporting, insurance and certain liquidity and leverage thresholds and restrictions on our ability to maintain cash deposits outside of CIBC above certain thresholds, dispose of our business or property, to change our line of business, to liquidate or dissolve, to enter into any change in control transaction, to merge or consolidate with any other entity or to acquire all or substantially all the capital stock or property of another entity, to incur additional indebtedness, to incur liens on our property, to pay any dividends or other distributions on capital stock other than dividends payable solely in capital stock, to redeem capital stock, to engage in transactions with affiliates, to encumber our intellectual property and certain other restrictions on our activities. Our business may be adversely affected by these restrictions on our ability to operate our business.

Expensify, Inc. EXFY US Equity

EXFY · 10-K · period ended 2023-12-31

Item 1A. Risk Factors

Expensify, Inc. EXFY US Equity☆

EXFY · 10-K · period ended 2023-12-31

Item 1A. Risk Factors

Expensify, Inc. EXFY US Equity