ITEM 1A. RISK FACTORS.
An investment in our common stock involves
a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information
in this Form 10-K, including our consolidated financial statements and related notes. If any of the following risks actually occurs, our
business, financial condition, results of operations and future prospects could be materially and adversely affected. In that event, the
market price of our common stock could decline and you could lose part or all of your investment. All forward-looking statements made
by us or on our behalf are qualified by the risks described below.
Risks Related to Our Business
We may be unable to grow our business in future
periods, and if our revenue growth slows, or our revenues decline further, our business and financial conditions could be adversely affected.
Our growth rates may decline in the future. There
can be no assurance that we will be able to grow our business in future periods. In the near term, our growth depends in significant part
on our ability, among other things, to enter new markets and to continue to attract new clients, and to retain our current clientele.
Our growth also depends on our ability to develop and market other prepaid card products that can utilize the Paysign platform.
As the prepaid financial services industry continues
to develop, our competitors may be able to offer products and services that are, or that are perceived to be, substantially similar to
or better than ours. This may force us to compete on the basis of price and to expend significant marketing, product development and other
resources in order to remain competitive. Even if we are successful at increasing our operating revenues through our various initiatives
and strategies, we will experience an inevitable decline in growth rates as our operating revenues increase to higher levels and we may
also experience a decline in margins. If our operating revenue growth rates slow materially or decline, our business, operating results
and financial condition could be adversely affected.
We operate in a highly regulated environment,
and failure by us or business partners to comply with applicable laws and regulations could have an adverse effect on our business, financial
position and results of operations.
We operate in a highly regulated environment,
and failure by us or our business partners to comply with the laws and regulations to which we are subject could negatively impact our
business. We are subject to a wide range of federal and other state laws and regulations, which are described under "Business – Regulations"
above. In particular, our products and services are subject to an increasingly strict set of legal and regulatory requirements intended
to protect consumers and to help detect and prevent money laundering, terrorist financing and other illicit activities.
Many of these laws and regulations are evolving,
unclear and inconsistent across various jurisdictions, and ensuring compliance with them is difficult and costly. For example, with increasing
frequency, federal and state regulators are holding businesses like ours to higher standards of training, monitoring and compliance, including
monitoring for possible violations of laws by the businesses that participate in our reload network. Failure by us or those businesses
to comply with the laws and regulations to which we are subject could result in fines, penalties or limitations on our ability to conduct
our business, or federal or state actions, any of which could significantly harm our reputation with consumers and other network participants,
banks that issue our cards and regulators, and could materially and adversely affect our business, operating results and financial condition.
Changes in the laws, regulations, credit card
association rules or other industry standards affecting our business may impose costly compliance burdens and negatively impact our business.
There may be changes in the laws, regulations,
card association rules or other industry standards that affect our operating environment in substantial and unpredictable ways. Changes
to statutes, regulations or industry standards, including interpretation and implementation of statutes, regulations or standards, could
increase the cost of doing business or affect the competitive balance. For example, more stringent anti-money laundering regulations could
require the collection and verification of more information from our customers, which could have a material adverse effect on our operations.
Regulation of the payments industry has increased significantly in recent years. Additional regulatory changes may require us to incur
significant expenses to redevelop our products. Also, failure to comply with laws, rules and regulations or standards to which we are
subject, including with respect to privacy and data use and security, could result in fines, sanctions or other penalties, which could
have a material adverse effect on our financial position and results of operations, as well as damage our reputation.
A data security breach could expose us to liability
and protracted and costly litigation, and could adversely affect our reputation and operating results.
We, the banks that issue our cards and our third-party
service providers receive, transmit and store confidential customer and other information in connection with our products and services.
The encryption software and the other technologies we and our partners use to provide security for storage, processing and transmission
of confidential customer and other information may not be effective to protect against data security breaches. The risk of unauthorized
circumvention of our security measures has been heightened by advances in computer capabilities and the increasing sophistication of hackers.
The banks that issue our cards, our clients and our third-party service providers also may experience similar security breaches involving
the receipt, transmission and storage of our confidential customer and other information. Improper access to our or these third parties’
systems or databases could result in the theft, publication, deletion or modification of confidential customer and other information.
A data security breach of the systems on which
sensitive cardholder data and account information are stored could lead to fraudulent activity involving our products and services, reputational
damage and claims or regulatory actions against us. If we are sued in connection with any data security breach, we could be involved in
protracted and costly litigation. If unsuccessful in defending that litigation, we might be forced to pay damages and/or change our business
practices or pricing structure, any of which could have a material adverse effect on our operating revenues and profitability. We would
also likely have to pay (or indemnify the banks that issue our cards for) fines, penalties and/or other assessments imposed by card networks
as a result of any data security breach. Further, a significant data security breach could lead to additional regulation, which could
impose new and costly compliance obligations. In addition, a data security breach at one of the banks that issue our cards or our third-party
service providers could result in significant reputational harm to us and cause the use and acceptance of our cards to decline, either
of which could have a significant adverse impact on our operating results and future growth prospects.
We may have deficiencies or weaknesses in our
internal control over financial reporting which could, if not remediated, adversely affect our ability to report our financial condition
and results of operations in a timely and accurate manner, decrease investor confidence in our Company, and reduce the value of our common
stock.
Our management is responsible for establishing
and maintaining adequate internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act
and based upon the criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations
of the Treadway Commission. Management is also responsible for reporting on the effectiveness of internal control over financial reporting.
Deficiencies or weaknesses in our internal control
over financial reporting that are not promptly identified and remediated may adversely affect our ability to report our financial condition
and results of operations in a timely and accurate manner, decrease investor confidence in our Company and reduce the value of our common
stock. Although we believe we have taken appropriate actions to remediate previously reported control deficiencies that we have identified
and to strengthen our internal control over financial reporting, we cannot assure you that we will not discover other deficiencies or
weaknesses in the future.
Security and privacy breaches of our electronic
transactions may damage customer relations and inhibit our growth.
Any failures in our security and privacy measures
could have a material adverse effect on our business, financial condition and results of operations. Certain products we offer require
that we store personal information, including birth dates, addresses, bank account numbers, credit card information, social security numbers
and merchant account numbers. If we are unable to protect this information, or if consumers perceive that we are unable to protect this
information, our business and the growth of the electronic commerce market in general could be materially adversely affected. A security
or privacy breach may:
· cause our customers to lose confidence in our services;
· deter consumers from using our services;
· harm our reputation;
· expose us to liability;
· increase expenses related to remediation costs; and
Although management believes that we have utilized
proven systems designed for robust data security and integrity in electronic transactions, our use of these applications may be insufficient
to address changing technological or market conditions and the security and privacy concerns of existing and potential customers.
The industry in which we compete is highly
competitive, which could adversely affect our operating results and financial condition.
We believe that our existing competitors have
longer operating histories, are substantially larger than we are, may already have or could develop substantially greater financial and
other resources than we have, may offer, develop or introduce a wider range of programs and services than we offer or may use more effective
advertising and marketing strategies than we do to achieve broader brand recognition, customer awareness and retail penetration. We may
also face price competition that results in decreases in the purchase and use of our products and services. To stay competitive, we may
have to increase the incentives that we offer to our marketing partners and decrease the prices of our products and services, which could
adversely affect our operating results.
We rely on relationships with card issuing
banks to conduct our business, and our results of operations and financial position could be materially and adversely affected if we fail
to maintain these relationships or we maintain them under new terms that are less favorable to us.
Our relationships with various banks are currently,
and will be for the foreseeable future, a critical component of our ability to conduct our business and to maintain our revenue and expense
structure, because we are currently unable to issue our own cards. If we lose or do not maintain existing banking relationships, we could
incur significant switching and other costs and expenses and we and users of our products and services could be significantly affected,
creating contingent liabilities for us. As a result, the failure to maintain adequate banking relationships could have a material adverse
effect on our business, results of operations and financial condition. Our agreement with the bank that issues our cards provides for
cost and expense allocations between the parties. Changes in the costs and expenses that we have to bear under these relationships could
have a material impact on our operating expenses. In addition, we may be unable to maintain adequate banking relationships or renew our
agreements with the banks that currently issue our cards under terms at least as favorable to us as those existing before renewal.
We receive important services from third-party
vendors, and replacing them could entail unexpected integration costs.
Some services relating to our business, including
network connectivity and gateway services, are outsourced to third-party vendors. If any of our vendors were to terminate their contracts
with us or cease operations, we could replace the vendor with a competitor. However, in some cases, replacing a vendor would require one-time
integration costs to connect our systems to those of the new vendor, and could result in less advantageous contract terms for the same
service, which could adversely affect our profitability.
Changes in credit card association or other
network rules or standards set by Visa and MasterCard, or changes in card association and debit network fees or products or interchange
rates, could adversely affect our business, financial position and results of operations.
We and the banks that issue our cards are subject
to Visa, Interlink, Plus, MasterCard, Maestro, Cirrus, Discover and Pulse association rules that could subject us to a variety of fines
or penalties that may be levied by the card networks for acts or omissions by us or businesses that work with us. The termination of the
card association registrations held by us or any of the banks that issue our cards or any changes in card association or other debit network
rules or standards, including interpretations or implementations of existing rules or standards, that increase our cost of doing business
or limit our ability to provide our products and services, could have an adverse effect on our business, operating results and financial
condition. In addition, from time to time, card networks increase the organization and/or processing fees that they charge, which could
increase our operating expenses, reduce our profit margin and adversely affect our business, operating results and financial condition.
For example, a portion of our operating revenues
is derived from interchange fees (i.e., transaction fees paid by the merchant). The amount of interchange revenues that we earn is highly
dependent on the interchange rates that the card networks set and adjust from time to time. Interchange rates for certain products and
certain issuing banks declined significantly as a result of the enactment of the Dodd-Frank Bill. If interchange rates decline further,
whether due to actions by the card networks or future legislation or regulation, we would likely need to change our fee structure to compensate
for lost interchange revenues. To the extent we increase the pricing of our products and services, we might find it more difficult to
acquire consumers and to maintain or grow card usage and customer retention. We also might have to discontinue certain products or services.
As a result, our operating revenues, operating results, prospects for future growth and overall business could be materially and adversely
affected.
We may not be able to successfully manage our
intellectual property or may be subject to infringement claims.
In the rapidly developing legal framework, we
rely on a combination of contractual rights and copyright, trademark and trade secret laws to establish and protect our proprietary technology.
Despite our efforts to protect our intellectual property, third parties may infringe or misappropriate our intellectual property or may
develop software or technology competitive to us. Our competitors may independently develop similar technology, duplicate our products
or services or design around our intellectual property rights. We may need to litigate to enforce or protect our intellectual property
rights, trade secrets and know-how, or to determine their scope, validity or enforceability. Such litigation can be expensive, may divert
resources, and may not be successful. The loss of intellectual property protection or the inability to secure or enforce intellectual
property protection could harm our business and ability to compete.
We may also be subject to costly litigation in
the event our products and technology infringe upon another party’s proprietary rights. Third parties may have, or may eventually
be issued, patents that would be infringed upon our products or technology and any of these third parties could make a claim of infringement
against us with respect to our products or technology. We may also be subject to claims by third parties for breach of copyright, trademark
or license usage rights. Any such claims and any resulting litigation could subject us to significant liability for damages. An adverse
determination in any litigation of this type could require us to design around a third party’s patent or to license alternative
technology from another party. In addition, litigation is time-consuming and expensive to defend and could result in the diversion of
time and attention of our management and employees. Any claim from third parties may result in limitations on our ability to use the intellectual
property subject to these claims. As of the date of this filing, we had not received any notice or claim of infringement from any party.
The market for electronic commerce services
is evolving and may not continue to develop or grow rapidly enough for us to maintain profitability.
If the number of electronic commerce transactions
does not continue to grow or if consumers or businesses do not continue as projected to adopt our products and services, it could have
a material adverse effect on our business, financial condition and results of operations. Management believes future growth in the electronic
commerce market will be driven by the cost, convenience, ease of use and quality of products and services offered to consumers and businesses.
In order to maintain our profitability, consumers and businesses must continue to adopt our products and services.
If we do not respond to rapid technological
change or changes in industry standards, our products and services could become obsolete and we could lose our customers.
If competitors introduce new products and services,
or if new industry standards and practices emerge, our existing product and service offerings, technology and systems may become obsolete.
Further, if we fail to adopt or develop new technologies or to adapt our products and services to emerging industry standards, we may
lose current and future customers, which could have a material adverse effect on our business, financial condition and results of operations.
The electronic commerce industry is changing rapidly. To remain competitive, we must continue to enhance and improve the functionality
and features of our products, services and technologies.
Our ability to adapt our existing products
and services to use artificial intelligence (“AI”) could adversely impact our business.
The legal and regulatory landscape surrounding
AI technologies is rapidly evolving and uncertain, including in the areas of consumer protection, intellectual property, cybersecurity
and privacy and data protection. In addition, there is uncertainty around the validity and enforceability of intellectual property rights
related to the use, development and deployment of AI-generated outputs. Compliance with new and emerging laws, regulations or industry
standards relating to AI in the U.S. and internationally, such as U.S. state regulations and the Artificial Intelligence Act in the EU,
may impose significant operational costs and may limit our ability to develop, deploy or use existing or future AI technologies. As a
result, our ability to adapt our existing products and services or develop future and new products and services using AI may be limited
or restricted, which could adversely impact our business.
Acquisitions and the integration of new businesses
create risks and may affect operating results. Failure to successfully complete, manage or integrate strategic transactions can adversely
affect our business, financial condition and results of operations.
We regularly review our businesses strategy and
evaluate potential acquisitions, joint ventures, divestitures and other strategic transactions. The success of these transactions is dependent
upon, among other things, our ability to realize the full extent of the expected returns, benefits, cost savings or synergies as a result
of a transaction within the anticipated time frame, or at all. Acquisitions often involve additional or increased risks including, for
example:
· retaining existing customers and attracting new customers;
· integrating the acquired systems and technologies into our Company;
· entering new markets with the services of the acquired businesses.
Changes in the Bank Secrecy Act and/or the
USA PATRIOT Act could impede our ability to circulate cards that can be easily loaded or issued.
Our current compliance program and screening process
for the distribution and/or sale of prepaid card products is designed to comply with the Bank Secrecy Act (“BSA”) and
the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (the “USA
PATRIOT Act”). These regulations require financial institutions to obtain and confirm information related to their respective cardholders.
If the BSA and/or the USA PATRIOT Act or subsequent legislation increases the level of scrutiny that we must apply to our cardholders
and customers, it may be costly or impractical for us to continue to profitably issue and load cards for our customers.
Internal processing errors could result in
our failing to appropriately reflect transactions in customer accounts.
In the event of a system failure that goes undetected
for a substantial period of time, transactions could be processed on blocked accounts, false authorizations could be confirmed, charges
could fail to be deducted from accounts or systematic fraud or abuse could go undetected. Errors or failures of this nature could adversely
impact our operations, credibility and financial standing.
Our business is dependent on the efficient
and uninterrupted operation of computer network systems and data centers.
Our ability to provide reliable service to our
clients and cardholders depends on the efficient and uninterrupted operation of our computer network systems and data centers as well
as those of our third-party service providers. Our business involves movement of large sums of money, processing of large numbers of transactions
and management of the data necessary to do both. Our success depends upon the efficient and error-free handling of the money. We rely
on the ability of our employees, systems and processes and those of the banks that issue our cards, and our third-party service providers
to process and facilitate these transactions in an efficient, uninterrupted and error-free manner.
In the event of a breakdown, a catastrophic event
(such as fire, natural disaster, power loss, telecommunications failure or physical break-in), a security breach or malicious attack,
an improper operation or any other event impacting our systems or processes, or those of our vendors, or an improper action by our employees,
agents or third-party vendors, we could suffer financial loss, loss of customers, regulatory sanctions and damage to our reputation. The
measures we have taken, including the implementation of disaster recovery plans and redundant computer systems, may not be successful,
and we may experience other problems unrelated to system failures. We may also experience software defects, development delays and installation
difficulties, any of which could harm our business and reputation and expose us to potential liability and increased operating expenses.
The soundness of other institutions and companies
could adversely affect us.
Our ability to engage in loading and purchasing
transactions could be adversely affected by the actions and failure of other institutions and companies, our card issuing banks and distributors
that carry our prepaid card products. As such, we have exposure to many different industries and counterparties. As a result, defaults
by, or even questions or rumors about, one or more of these institutions or companies could lead to losses or defaults by us or other
institutions. Losses related to these defaults or failures could materially and adversely affect our results of operations.
Additional equity or debt financing may be
dilutive to existing stockholders or impose terms that are unfavorable to us or our existing stockholders.
We may raise capital in order to provide working
capital for our expansion into other products and services using our payments platform. If we raise additional funds by issuing equity
securities, our stockholders will experience dilution. Debt financing, if available, may involve arrangements that include covenants limiting
or restricting our ability to take specific actions, such as incurring additional debt, making capital expenditures or declaring dividends.
Any debt financing or additional equity that we raise may contain terms, such as liquidation and other preferences that are not favorable
to us or our current stockholders. If we raise additional funds through collaboration and licensing arrangements with third parties, it
may be necessary to relinquish valuable rights to our technologies and products or grant unfavorable license terms.
Global and regional economic conditions could
harm our business.
Adverse global and regional economic conditions
such as turmoil affecting the banking system and financial markets, including, but not limited to, tightening in the credit markets, extreme
volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), high unemployment,
high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity,
government fiscal and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions,
the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative
financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including
a reduction in the volume and size of transactions on our payments platform. Additionally, an inability to access the capital markets
when needed due to volatility or illiquidity in the markets or increased regulatory liquidity and capital requirements may strain our
liquidity position. Such conditions may also expose us to fluctuations in foreign exchange rates or interest rates that could materially
and adversely affect our financial results.
We depend on key personnel and may be harmed
by the loss of their services or our inability to attract, develop, integrate, incentivize and retain qualified employees.
Because of our small size and the limited number
of qualified professionals in our industry, we rely heavily on the continued service and performance of our management team and our experienced
sales, marketing, program and technology personnel, all of whom we consider key employees. Our future success depends, to a significant
extent, on our ability to attract, source, hire, train, develop, incentivize and retain highly skilled directors, officers, management,
financial, legal, marketing, sales and technical personnel. Competition for qualified employees in the financial services and healthcare
industries is intense, and competitors have in the past and may in the future attempt to recruit our management and other key employees.
We may also experience difficulty integrating newly hired personnel, which could adversely affect our operations. The loss of the services
of one or more key employees, our failure to attract or retain additional highly qualified personnel, or our inability to effectively
integrate and motivate such individuals could impair our ability to manage and expand our business and provide services to our customers.
Risks Related to Ownership of Our Common
Stock
Our stock price is volatile, and you may not
be able to sell your shares at a price higher than what was paid.
The market for our common stock is highly volatile.
In 2025, our stock price fluctuated between $1.94 and $8.56. The trading price of our common stock could be subject to wide fluctuations
in response to, among other things, quarterly variations in operating and financial results, announcements of technological innovations
or new products by our competitors or us, changes in prices of our products and services or our competitors’ products and services,
changes in product mix or changes in our revenue and revenue growth rates.
If securities analysts do not publish research
or reports about our business or if they publish negative evaluations of our common stock, the trading price of our common stock could
decline.
We expect that the trading price for our common
stock will be affected by any research or reports that securities analysts publish about us or our business. If one or more of the analysts
who may elect to cover us or our business downgrade their evaluations of our common stock, the price of our common stock would likely
decline. If one or more of these analysts cease coverage of our company, we could lose visibility in the market for our common stock,
which in turn could cause our stock price to decline.
We do not intend to pay dividends for the foreseeable
future.
We have never declared or paid any cash dividends
on our capital stock. We intend to retain any earnings to finance the operation and expansion of our business, and we do not anticipate
paying any cash dividends in the foreseeable future. As a result, you will likely receive a return on your investment in our common stock
only if the market price of our common stock increases.
Concentration of ownership among our existing
directors, executive officers and principal stockholders may prevent new investors from influencing significant corporate decisions.
Our directors, executive officers and holders
of more than 5% of our total shares of common stock outstanding and their respective affiliates, in the aggregate, beneficially own approximately
31% of our outstanding common stock as of March 9, 2026. As a result, these stockholders will be able to exercise a controlling influence
over matters requiring stockholder approval, including the election of directors and approval of significant corporate transactions, and
will have significant influence over our management and policies for the foreseeable future. Some of these persons or entities may have
interests that are different from yours. For example, these stockholders may support proposals and actions with which you may disagree
or which are not in your interests. The concentration of ownership could delay or prevent a change in control of our company or otherwise
discourage a potential acquirer from attempting to obtain control of our company, which in turn could reduce the price of our common stock.
In addition, these stockholders, some of which have representatives sitting on our board of directors (the “Board”), could
use their voting control to maintain our existing management and directors in office, delay or prevent changes of control of our company,
or support or reject other management and Board proposals that are subject to stockholder approval, such as amendments to our employee
stock plans and approvals of significant financing transactions.
Our stock price could decline due to the large
number of outstanding shares of our common stock eligible for future sale.
We have 55,185,394 shares of common stock outstanding
as of March 9, 2026, assuming no exercise of outstanding options or unvested restricted stock awards. None of the shares of common stock
are subject to any lock-up agreements, and all are eligible for sale, subject to registration under the Securities Act and in some cases
to volume and other restrictions imposed by Rule 144. Sales of substantial amounts of our common stock in the public market, or even
the perception that these sales could occur, could cause the trading price of our common stock to decline. These sales could also make
it more difficult for us to sell equity or equity-related securities in the future at a time and price that we deem appropriate.
We incur significant costs as a result of operating
as a public company. We may not have sufficient personnel for our financial reporting responsibilities, which may result in the untimely
close of our books and records and delays in the preparation of financial statements and related disclosures.
As a registered public company, we have experienced
an increase in legal, accounting and other expenses. In addition, the Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”),
as well as new rules subsequently implemented by the SEC, has imposed various requirements on public companies, including requiring changes
in corporate governance practices. Our management and other personnel need to devote a substantial amount of time to these compliance
initiatives. Moreover, these rules and regulations have increased our legal and financial compliance costs and make some activities more
time-consuming and costly. In addition, three putative class action lawsuits were filed against us, which required our management
to devote significant time to defending. See “Item 3. Legal Proceedings” for additional information.
If we are not able to comply with the requirements
of the Sarbanes-Oxley Act, or if we or our independent registered public accounting firm identify additional deficiencies in our internal
control over financial reporting that are deemed to be material weaknesses, the market price of our stock could decline and we could be
subject to sanctions or investigations by the SEC and other regulatory authorities.
Our operating results may fluctuate in the
future, which could cause our stock price to decline.
Our quarterly and annual results of operations
may fluctuate in the future as a result of a variety of factors, many of which are outside of our control. If our results of operations
fall below the expectations of investors or any securities analysts who follow our common stock, the trading price of our common stock
could decline substantially. Fluctuations in our quarterly or annual results of operations may be due to a number of factors, including,
but not limited to:
· seasonality in the purchase or use of our products and services;
· reductions in the level of interchange rates that can be charged;
· fluctuations in customer retention rates;
· changes in the mix of products and services that we sell;
· changes in our or our competitors’ pricing policies or sales terms;
· the timing of commencement and termination of major advertising campaigns;
· the timing of costs of any major litigation to which we are a party;
· our ability to control costs, including third-party service provider costs;
ITEM 1B. UNRESOLVED STAFF
COMMENTS.
None.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
Cyber criminals are becoming more
sophisticated and effective every day, and they are increasingly targeting software companies, including companies like ours that
handle sensitive customer and stakeholder data. All companies utilizing technology are subject to threats of breaches of their
cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management
and make securing the data that customers and other stakeholders entrust to us a top priority. Our Board and our management are
actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As
described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and
managing material risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain
security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant
investments to maintain the security of our data and cybersecurity infrastructure. While no cybersecurity program can eliminate all
risk or guarantee complete effectiveness, our controls are designed in alignment with industry recognized frameworks such as the
NIST Cybersecurity Framework and incorporate key principles of ISO 27001.
While our Risk Factors describe in greater detail the material cybersecurity
risks we face, we believe that prior cybersecurity threats, including any previous cybersecurity incidents, have not materially impacted
our business to date. However, we cannot guarantee that future incidents will not occur or that, if they do, they will not have a material
adverse effect on our business, strategy, results of operations, or financial condition.
Risk Management and Strategy
We understand the critical importance of cybersecurity
in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we
adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our
overall risk management process. Our cybersecurity controls are guided by a formal data classification policy and are supported by a maturing
Zero Trust–inspired architecture, which includes least privilege access, continuous authentication and micro segmentation.
Our strategies are designed to ensure the resilience
and security of our systems, safeguarding against both internal and external vulnerabilities. We employ state-of-the-art technologies
and practices to secure our systems. This includes deploying advanced encryption, securing network infrastructure, and implementing robust
access controls and authentication mechanisms. Our information technology infrastructure is designed with security at its core, incorporating
full encryption of data in transit and at rest, endpoint detection and response, security information and event management
correlation, continuous vulnerability scanning and commercial threat intelligence feeds monitored by our 24/7/365 Security Operations
Center.
As part of our risk assessment framework, we have
a Vendor Risk Management Program to monitor cybersecurity risks posed by third-party vendors and service providers. This program
includes:
Partnerships and Collaboration
We believe in the strength of collaboration in
combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving
cyber risks. We also participate in threat sharing programs and use horizon scanning activities to evaluate emerging risks that may impact
fintech, payments infrastructure, and healthcare related data environments. By sharing knowledge and best practices, we enhance our defenses
and contribute to the broader effort of securing the digital ecosystem. We maintain controls and procedures that are designed to ensure
prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can
be made by management and the Board in a timely manner.
Risk Assessment
We continuously monitor our information technology
environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies,
potential vulnerabilities, and ongoing attacks. In addition to annual penetration and segmentation testing,we conduct periodic threat
hunting exercises to proactively identify malicious activity. Semi-annually, we leverage third-party independent consultants to perform
penetration and segmentation testing of our internal and externally facing environments. Results from these assessments inform remediation
roadmaps, prioritization of security investments, and updates to our enterprise risk register.
Technical Safeguards
Cybersecurity is an ever-evolving field, and we
are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures,
and technologies to address new challenges and adapt to the changing threat landscape. Technical safeguards also include multi factor
authentication (MFA) across all privileged and non-privileged accounts, automated provisioning and de provisioning, periodic access reviews,
and comprehensive logging and monitoring to support audit and regulatory obligations.
Incident Response and Recovery Planning
Cybersecurity is a foundational element of our
operations. Our multi-layered approach—encompassing system security, vigilant monitoring, comprehensive training, and collaborative
engagement—demonstrates our dedication to protecting our company, our clients, and the financial ecosystem. Our incident response
program includes ransomware specific playbooks, cross functional tabletop exercises involving senior leadership, and tight integration
with our business continuity (BCP) and disaster recovery (DR) plans. We have established comprehensive incident response and recovery
plans and continue to regularly test and evaluate the effectiveness of those plans.
Education and Awareness
Recognizing that human error can often be a weak
link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. We also conduct
periodic phishing simulations, evaluate key performance indicators such as employee susceptibility rates, and track cybersecurity awareness
metrics as part of our overall risk management dashboard.
Cybersecurity Threats
We are not aware of any risks from cybersecurity
threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially
affect our business strategy, results of operations, or financial condition.
Governance
Board Oversight
Our Board, in coordination with the Audit Committee,
oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation,
and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.Our Audit Committee
directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting
from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal
and industry cybersecurity incidents. The Board receives quarterly cybersecurity briefings, including key risk indicators, remediation
metrics, third party risk insights, and updates to our threat landscape assessment.
Management’s Role
Our Chief Technology Officer, Information Security Officer, and General
Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our management’s
Information Technology Steering Committee (the “Security Committee”), which is a governing body that drives alignment on security
decisions across the Company.Such individuals have experience in various roles for public companies involving managing information security,
managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements.The Security
Committee meets at least quarterly to review security performance metrics, identify security risks, and assess the status of approved
security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service
requirements, and risk mitigation strategies.The Security Committee is responsible for a cybersecurity risk report which is presented
to the Board at each quarterly meeting, ensuring continuous oversight of cybersecurity risks and mitigation efforts at the highest
levels of governance. Management evaluates the cybersecurity program using defined key risk indicators, including patch timeliness
metrics, vulnerability severity reduction intervals, access review completion rates, phishing resilience metrics and third party assurance
results.
ITEM 2. PROPERTIES.
We have an operating lease for office space at
2615 St. Rose Parkway, Henderson, Nevada 89052. The lease will expire in 2030 and allows for two optional extensions of 5 years each.
Lease payments are approximately $60,000 per month.
We have an operating lease for office space at
168 N. Gibson Road, Henderson, Nevada 89014. The lease will expire in 2033 and allows for two optional extensions of 5 years each.
Lease payments are approximately $60,000 per month.
We believe that our properties are adequate and
suitable for us to conduct business in the future.
ITEM 3. LEGAL PROCEEDINGS.
From time to time, we may become involved in various lawsuits and legal
proceedings which arise in the ordinary course of business. However, litigation is subject to inherent uncertainties, and an adverse result
in these or other matters may arise from time to time that may harm our business.
The Company was named as a defendant in three securities class action
complaints filed in the United States District Court for the District of Nevada: Yilan Shi v. Paysign, Inc. et al., filed on March 19,
2020 (“Shi”), Lorna Chase v. Paysign, Inc. et al., filed on March 25, 2020 (“Chase”), and Smith & Duvall v.
Paysign, Inc. et al., filed on April 2, 2020 (collectively, the “Complaints” or “Securities Class Action”). Smith
& Duvall v. Paysign, Inc. et al. was voluntarily dismissed on May 21, 2020. On May 18, 2020, the Shi plaintiffs and another entity
called the Paysign Investor Group each filed a motion to consolidate the remaining Shi and Chase actions and to be appointed lead plaintiff.
The Complaints are putative class actions filed on behalf of a class of persons who acquired the Company’s common stock from March
19, 2019 through March 31, 2020, inclusive. The Complaints generally allege that the Company, Mark R. Newcomer, and Mark Attinger violated
Section 10(b) of the Exchange Act, and that Messrs. Newcomer and Attinger violated Section 20(a) of the Exchange Act, by making materially
false or misleading statements, or failing to disclose material facts, regarding the Company’s internal control over financial reporting
and its financial statements. The Complaints seek class action certification, compensatory damages, and attorney’s fees and costs.
On December 2, 2020, the Court consolidated Shi and Chase as In re Paysign, Inc. Securities Litigation and appointed the Paysign Investor
Group as lead plaintiff. On January 12, 2021, Plaintiffs filed an Amended Complaint in the consolidated action. Defendants filed a Motion
to Dismiss the Amended Complaint on March 15, 2021. On February 9, 2023, the Court granted in part and denied in part Defendants’
Motion to Dismiss. On May 22, 2023, Defendants filed an Answer to the Amended Complaint. On December 15, 2023, the parties agreed in principle
to a proposed settlement of the Securities Class Action and Plaintiffs filed a Consented Motion for Preliminary Approval of Settlement.
On January 4, 2024, the Court preliminarily approved a settlement in the amount of $3,750,000, the entirety of which came from the Company’s
directors-and-officers insurance policy, for the referenced class of purchasers, and scheduled a final approval hearing for April 17,
2024. On April 17, 2024, the Court conducted the final approval hearing and approved the settlement and, on April 18, 2024, issued an
order and final judgment thereon.
The Company was also named as a nominal defendant in four stockholder
derivative actions currently pending in the United States District Court for the District of Nevada. The first-filed derivative action
is entitled Andrzej Toczek, derivatively on behalf of Paysign, Inc. v. Mark R. Newcomer, et al. and was filed on September 17, 2020. This
action alleged violations of Section 14(a) of the Exchange Act, breach of fiduciary duty, unjust enrichment, and waste, largely in connection
with the failure to correct information technology controls over financial reporting alleged in the Securities Class Action, thereby causing
the Company to face exposure in the Securities Class Action. The complaint also alleged insider trading violations against certain individual
defendants. The second-filed derivative action is entitled John K. Gray, derivatively on behalf of Paysign, Inc. v. Mark Attinger, et
al. and was filed on May 9, 2022. This action involved the same alleged conduct raised in the Toczek action and asserted claims for breach
of fiduciary duty in connection with financial reporting, breach of fiduciary duty in connection with alleged insider trading against
certain individual defendants, and unjust enrichment. On June 3, 2022, the Court approved a stipulation staying the action until the Court
in the consolidated Securities Class Action issued a ruling on the Motion to Dismiss. On May 10, 2023, the Toczek and Gray actions were
consolidated.
The Company was also named as a nominal defendant in a third stockholder
derivative action initially filed in state court in Clark County, Nevada, on October 2, 2023, entitled Simone Blanchette, derivatively
on behalf of Paysign, Inc. v. Mark Newcomer, et al, which the defendants subsequently removed to federal district court in Nevada pursuant
to a Notice of Removal filed on October 10, 2023. That complaint made substantially the same allegations as made in the consolidated Toczek
and Gray actions, and also contained a claim that the individual defendants violated Section 10(b) and Rule 10b-5 promulgated thereunder.
On December 7, 2023, the parties requested that the action be stayed for sixty days due to the settlement negotiations in the consolidated
Toczek and Gray actions, and the Court granted the sixty-day stay on December 11, 2023. Subsequently, the Court extended that deadline
to March 29, 2024 and then to May 29, 2024 based upon the parties’ stipulations. On July 26, 2024, the parties in Blanchette submitted
a Joint Status Report which suggested a proposed briefing schedule on a motion to dismiss, but that schedule was not ruled upon by the
Court.
The Company was also named as a nominal defendant in a fourth stockholder
derivative action in the United States District Court for the District of Nevada, filed on December 27, 2023, entitled Mo Jeewa, derivatively
on behalf of Paysign, Inc. v. Mark R. Newcomer, et al. That complaint made substantially the same allegations as made in the consolidated
Toczek and Gray actions and the Blanchette action discussed above, and alleged breach of fiduciary duty and unjust enrichment. On January
23, 2025, the parties in Jeewa filed a stipulation to relate the case to the Toczek, Gray, and Blanchette actions.
On October 4, 2024, the parties to the four stockholder derivative
actions agreed in principle to a proposed settlement of all pending claims asserted in the Toczek, Gray, Blanchette, and Jeewa actions.
On December 6, 2024, Plaintiffs in the Toczek and Gray actions filed a Motion for Preliminary Approval of Derivative Settlement. On May
6, 2025, the Court granted the parties’ request to relate the actions and assigned all four cases to the judge presiding over the
Jeewa action. On August 28, 2025, the Court issued a minute order granting the Motion for Preliminary Approval of Derivative Settlement
and, on October 7, 2025, it entered a Scheduling Order and Preliminary Approval Order, effective nunc pro tunc as of September 4, 2025.
On October 17, 2025, Plaintiffs filed a Motion for Final Approval of Derivative Settlement, which was granted by the Court on December
14, 2025 with the final order and judgment entered on December 16, 2025.
ITEM 4. MINE SAFETY DISCLOSURES.
Not applicable.
PART II
ITEM 5. MARKET FOR REGISTRANT’S
COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES.
Our common stock trades on the Nasdaq Capital
Market under the symbol “PAYS”. The following table summarizes the low and high closing prices for our common stock for each
of the calendar quarters of 2025 and 2024.
High Low High Low
There were approximately 12,941 shareholders of
record of the common stock as of December 31, 2025.
The shares were issued pursuant to an exemption
from registration provided by Section 4(2) of the Securities Act of 1933.
Dividend Policy
We have not declared any cash dividends on our
common stock during our fiscal years ended on December 31, 2025 or 2024. Our Board has made no determination to date to declare cash
dividends during the foreseeable future, and is not likely to do so. There are no restrictions on our ability to pay dividends.
Purchases of Equity Securities by the Issuer
and Affiliated Purchasers
Share repurchases of our common stock for the three months ended December
31, 2025 were as follows:
(1) On March 21, 2023, our Board authorized a
stock repurchase program to repurchase up to $5 million of our common stock, subject to certain conditions, in the open market, in privately
negotiated transactions, or by other means in compliance with Rule 10b-18 under the Exchange Act. The program is expected to be completed
within 36 months from the commencement date. As of December 31, 2025 the Company had repurchased 631,258 shares of common stock for $1,998,715
at a weighted average price of $3.17 per share under this repurchase program.
ITEM 6. [RESERVED]
ITEM
7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION and RESULTS OF OPERATIONS.
The following discussion and analysis of our
financial condition and results of operations should be read in conjunction with the audited consolidated financial statements and related
notes included elsewhere in this Form 10-K. This discussion contains forward-looking statements that involve risks and uncertainties.
Our actual results could differ materially from those discussed below. Factors that could cause or contribute to such differences include,
but are not limited to, those identified below and those discussed in “Risk Factors” included elsewhere in this Form 10-K.
Disclosure Regarding Forward-Looking Statements
This Annual Report on Form 10-K includes
forward looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities
Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”)
(“Forward-Looking Statements”). All statements other than statements of historical fact included in this report are
Forward-Looking Statements. These Forward-Looking Statements are based on our current expectations, assumptions, estimates and
projections about our business and our industry. Words such as “believe,” “anticipate,”
“expect,” “intend,” “plan,” “propose,” “may,” and other similar
expressions identify Forward-Looking Statements. Specific forward-looking statements made herein include: our belief that we cannot
predict how future regulations might affect us; our belief that complying with future regulation could be expensive or require us to
change the way we operate our business; our belief that our in-house customer service center provides the highest customer service
experience for our clients as training is performed on-site by Paysign staff; we may utilize independent contractors who make direct
sales and are paid on a commission basis only; our belief that nearly every state would require us to obtain a money transmitter
license to operate a money transfer business; our anticipation that we will not pay any cash dividends in the foreseeable future;
our intention to retain any earnings to finance the operation and expansion of our business; our intention to continue to make
significant investments to maintain the security of our data and cybersecurity infrastructure; our expectation that the trading
price for our common stock will be affected by any research or reports that securities analysts publish about us or our business;
our belief that our editing processes are consistent with applicable reimbursement rules and industry practice; our belief that all
independent contractor and employment agreement relationships are satisfactory; our belief that we have taken appropriate actions to
remediate previously reported control deficiencies that we have identified and to strengthen our internal control over financial
reporting; our belief that we have utilized proven systems designed for robust data security and integrity in electronic
transactions; we may introduce products in the future that would be subject to money transfer and payment instrument licensing
regulations; our belief that a data security breach at one of the banks that issue our cards or our third-party service providers
could result in significant reputational harm to us and cause the use and acceptance of our cards to decline, either of which could
have a significant adverse impact on our operating results and future growth prospects; our belief that our existing competitors
have longer operating histories, are substantially larger than we are, may already have or could develop substantially greater
financial and other resources than we have, may offer, develop or introduce a wider range of programs and services than we offer or
may use more effective advertising and marketing strategies than we do to achieve broader brand recognition, customer awareness and
retail penetration; our expectation that we may also face price competition that results in decreases in the purchase and use of our
products and services; our expectation that we may have to increase the incentives that we offer to our marketing partners and
decrease the prices of our products and services, which could adversely affect our operating results; we may receive a stockholder
proposal relating to a variety of ESG issues to public companies in the future; we may be subject to, or contractually required to
comply with, state and federal laws that govern various aspects of the submission of healthcare claims for reimbursement and the
receipt of payments for healthcare items or services; we may use and disclose individually identifiable health information to
perform our services and for other limited purposes, such as creating de-identified information; we may not be able to detect
unauthorized use of our intellectual property or proprietary information, or to take enforcement action; we may retain additional
employees and consultants during the next twelve months, including additional patient affordability, information technology, product
and project management, fraud, and customer care personnel to support our growing businesses; we may be unable to grow our business
in future periods, and if our revenue growth slows, or our revenues decline further, our business and financial conditions could be
adversely affected; our anticipation that we will experience an inevitable decline in growth rates as our operating revenues
increase to higher levels and we may also experience a decline in margins; our anticipation that if our operating revenue growth
rates slow materially or decline, our business, operating results and financial condition could be adversely affected; we may have
deficiencies or weaknesses in our internal control over financial reporting which could, if not remediated, adversely affect our
ability to report our financial condition and results of operations in a timely and accurate manner, decrease investor confidence in
our Company, and reduce the value of our common stock; we may face price competition that results in decreases in the purchase and
use of our products and services; our belief that to stay competitive , we may have to increase the incentives that we offer to our
marketing partners and decrease the prices of our products and services, which could adversely affect our operating results; we may
be unable to maintain adequate banking relationships or renew our agreements with the banks that currently issue our cards under
terms at least as favorable to us as those existing before renewal; we may not be able to successfully manage our intellectual
property or may be subject to infringement claims; we may need to litigate to enforce or protect our intellectual property rights,
trade secrets and know-how or to determine their scope, validity or enforceability, which is expensive, may divert resources, and
may not be successful; we may be subject to costly litigation in the event our products and technology infringe upon another
party’s proprietary rights; we may be subject to claims by third parties for breach of copyright, trademark or license usage
rights; we may lose current and future customers, which could have a material adverse effect on our business, financial condition
and results of operations; our belief that the measures we have taken to provide reliable service to our clients and cardholders,
including the implementation of disaster recovery plans and redundant computer systems, may not be successful, and we may experience
other problems unrelated to system failures; we may also experience software defects, development delays and installation
difficulties, any of which could harm our business and reputation and expose us to potential liability and increased operating
expenses; we may raise capital in order to provide working capital for our expansion into other products and services using our