Risk Factors Dashboard
Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.
View risk factors by ticker
Search filings by term
Risk Factors - WEX
-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing
ITEM 1A. RISK FACTORS
We view our Global Information Security Program and the processes followed thereunder as just one part of our overall enterprise risk management strategy. As part of our annual enterprise risk management review, we identify and categorize risk areas across our business, including technology risks and those related to cybersecurity. We determine the magnitude of such risks in the context of our overall business and how the technology risks, including cybersecurity specifically, may have an impact on other risks the Company faces and vice versa to help us inform our overall risk management strategy going forward. We determine the magnitude 50Table of ContentsPART Iof such risks in the context of our overall business and how the technology risks, including cybersecurity specifically, may have an impact on other risks the Company faces and vice versa to help us inform our overall risk management strategy going forward. This allows us to continuously assess cybersecurity risks in alignment with our strategic objectives and operational needs.The Technology Committee , pursuant to its charter, is responsible for the oversight of the Company’s management of risks regarding technology, data security, cybersecurity, disaster recovery, and business continuity. In addition, the Technology Committee reviews the Company’s use and development of artificial intelligence to help ensure alignment with the Company’s AI Governance Framework and applicable legal and ethical obligations. To perform its oversight functions, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company’s CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. To perform this function, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company’s CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. The Technology Committee then, in turn, regularly reports out to the full board of directors and the Audit Committee as necessary during succeeding meetings to keep them informed. In addition, members of senior management, including the Chief Technology Officer (“CTO”), the CISO, and the Chief Legal Officer (“CLO”) correspond directly with, or present to, the full board of directors, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. In addition, members of senior management, including the Chief Technology Officer (“CTO”), the CISO, and the Chief Legal Officer (“CLO”) correspond directly with, or present to, the full Board, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. We believe the members of our senior management responsible for assessing and managing material risks from cybersecurity threats and interfacing with the board of directors and board of director committees on such matters collectively possess the appropriate expertise and experience from both a technical and governance perspective to ensure that they are able to carry out these responsibilities effectively. In particular, our CISO has spent over 30 years in various information security roles, including serving as the CISO of WEX since March 2014. Additionally, he holds professional degrees in the areas of Computer and Information Systems Security and multiple ISACA and ISC2 certifications (CISM, CISA, CRISC, CISA and CISSP). Our CTO has spent over 25 years in various engineering and technology roles, including serving as Chief Technology Officer for two other companies prior to joining WEX. In his past roles he was responsible for implementing product and technology initiatives and gained extensive experience in payments technology, technology infrastructure, technical engineering, AI, and machine learning. Additionally, he holds a professional degree in Computer Science. Our CLO has been with WEX since 2021, serving as Chief of Staff to the CEO and as Vice President, Corporate Legal Services prior to that, before becoming the Corporate Secretary and head of the Legal department in 2024. In these roles, she has gained extensive experience coordinating with the Board on addressing numerous emerging risk areas and ensuring our governance processes are equipped to manage and mitigate such risks. As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, there is no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations or financial condition in the future. See Part I – Item 1A – Risk Factors – “We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability, damage to our reputation, and other financial impacts. Our efforts to implement
The risks and uncertainties described below are not the only risks and uncertainties that we face. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also impair our business operations. If any of those risks actually occurs, our business, financial condition, results of operations and cash flows could suffer. The risks and uncertainties discussed below also include forward-looking statements and our actual results may differ materially from those discussed in these forward-looking statements.
Risk Factor Summary
Investment in our securities involves risk. Below is a summary of what we believe to be the principal risks facing our business. You should carefully review and consider this summary along with the risks described more fully in this Item 1A, “Risk Factors” of Part I of this Annual Report and other information included in this Annual Report. The risks and uncertainties described below are not the only risks and uncertainties we face. Additional risks and uncertainties not presently known to us or that we presently deem less significant may also impair our business operations.
If any of the following risks occurs, our business, financial condition, and results of operations and future growth prospects could be materially and adversely affected, and the actual outcomes of matters as to which forward-looking statements are made in this report could be materially different from those anticipated in such forward-looking statements.
Our Business and Industry
•A reduction in the demand for or supply of gasoline and/or diesel fuel, and/or volatility or decline in fuel prices, could have a material adverse effect on our business, financial condition, and operating results.
•A decline in general economic conditions that negatively impacts the demand for fuel, travel related services or health care services could significantly affect our business, operating results, and financial condition.
•If any of the WEX owned issuers and other third party licensed institutions that we use to process transactions through the Mastercard or Visa networks, cease to be licensed, or are unable or unwilling to provide services to us, we would need to find other appropriate institutions to provide such services.
•If we stop receiving incentives from Mastercard or Visa or are unable to meet our transaction volume commitments with them our profitability could be adversely impacted.
22
| PART I | |||||
•Unpredictable or catastrophic events may adversely affect our ability to conduct business.
•We have experienced and may in the future experience credit and fraud losses and other adverse effects.
•Changes in or limits on interchange fees could decrease our revenue.
•Bank failures or other similar events could adversely affect our and our customers’ liquidity and financial performance.
•Our failure to adapt to technological and industry changes and effectively implement new technology and products could materially affect our competitive position and our business.
•We may not realize or sustain the expected benefits from our investments in certain capabilities and initiatives.
•We operate in a highly competitive business environment.
•Our ability to attract, motivate, and retain qualified employees is critical to our success.
•We may not realize the expected benefits of transactions, including acquisitions or divestitures.
•We are subject to risks associated with our strategic minority equity investments.
•We are exposed to risks associated with our operations outside of the U.S.
•Fluctuations in foreign currency exchange rates have affected and could continue to affect our financial results.
•As a non-bank custodian of HSA assets, WEX Inc.’s failure to adequately place and safeguard our custodial assets, or the failure of any of our depository partners, could have a material adverse effect on our business.
•We have incurred, and may incur in the future, impairment charges on goodwill or other long-lived assets.
•The Company is, and may in the future become, involved in various claims, investigations, and legal proceedings.
•If we fail to adequately protect our IP, our competitive position could be impaired.
•Our business could be negatively impacted by stockholder activism.
WEX Bank
•The loss or suspension of WEX Bank’s ILC, changes in applicable regulatory requirements, or an increase in the number or type of institutions eligible for an ILC or to be authorized to conduct activities typically reserved for ILCs and other bank entities could be disruptive to our operations, increase costs, and increase competition.
•WEX Bank is subject to extensive supervision and regulation that could restrict our activities and impose financial requirements or limitations on the conduct of our business and limit our ability to generate income.
•Conditions in the economy or other markets may have a negative impact on WEX Bank’s ability to attract deposits.
•WEX Bank’s cost of capital has increased and may continue to increase.
•WEX Bank is subject to funding risks associated with its reliance on brokered deposits and advances from the FHLB.WEX Bank is subject to funding risks associated with its reliance on brokered deposits.
•If WEX Bank fails to meet certain criteria, WEX Inc. may become subject to the Bank Holding Company Act.
•WEX Bank’s results may be affected by market fluctuations and significant changes in the value of financial instruments.
Our Indebtedness
•We currently have a substantial amount of indebtedness, including indebtedness tied to variable interest rates, and may incur additional indebtedness, which could increase our leverage, affect our flexibility in managing our business and could materially and adversely affect our ability to meet our obligations.
•We may want or need to refinance a significant amount of indebtedness or otherwise require additional financings, but we cannot guarantee that we will be able to refinance or obtain additional financing on favorable terms or at all.
Regulation
•Existing and new laws and regulations and enforcement activities, could negatively impact our business, limit our expansion opportunities and significantly impact our results of operations and financial condition.
•Laws or regulations developed in one jurisdiction or for one product could result in new laws or regulations in other jurisdictions or for other products.
•Changes in our tax rates, the adoption of new legislation or exposure to additional tax liabilities could affect our results.
•As a non-bank custodian WEX Inc. is subject to regulation and noncompliance could render it unable to maintain its status.
23
| PART I | |||||
•Evolution and expansion of our business may subject us to additional regulatory requirements and other risks, for which failure to comply or adapt could harm our operating results.
•Our increased presence in foreign jurisdictions increases the possibility of foreign law violations.
•Legislation and regulation of, and private actions related to sustainability issues could adversely affect our business.
Our Dependence on Technology
•We regularly experience cyberattacks and expect they will continue in the future and we may not be able to adequately protect our information systems.
•We are subject to privacy and data protection regulations, and compliance with these regulations could impose significant burdens. Failure to comply could have a negative impact on our business.
•If the technologies we use are unavailable, or do not operate to expectations, or we fail to successfully implement technology, our business and results of operations could be adversely impacted.
•Our business is dependent on electronic communications networks managed by third parties.
•We use AI in our business, and challenges with properly managing its use could result in harm.
Ownership of Our Common Stock
•The failure to maintain effective systems of internal control over financial reporting and disclosure controls and procedures could result in the inability to accurately report our financial results.
•We may not realize the anticipated long-term stockholder value of our share repurchase programs, and there can be no assurance that we will repurchase shares or that we will repurchase shares at favorable prices, which may negatively affect our stock price.
•Provisions in our charter documents, Delaware law and applicable banking law may delay or prevent our acquisition by a third party, and could adversely impact the market price of our common stock.
24
| PART I | |||||
Risks Relating to Our Business and Industry
A significant portion of our revenue is generated by the purchase and sale of gasoline and diesel fuel by or through our customers and from our fuel retailer partners, and, as a result, a reduction in the demand for or supply of gasoline and/or diesel fuel and/or volatility or decline in such fuel prices could have a material adverse effect on our business, financial condition, and operating results.
Our Mobility segment is our largest segment by total revenue and our customers and fuel retailer partners in this segment primarily purchase or sell gasoline or diesel fuel. Accordingly, a substantial amount of our Company’s total revenue is generated as a result of the purchase and/or sale of fuel, making our revenues in this segment subject to the demand for and supply of fuel and historically volatile fuel prices. Accordingly, a substantial amount of our Company’s total revenue is generated through the purchase and/or sale of fuel, making our revenues in this segment subject to the demand for and supply of fuel and historically volatile fuel prices.
We currently do not utilize fuel hedging derivatives, and therefore, these revenues are currently exposed to the full impact of fuel price declines and volatility. Therefore, extended declines in the price of fuel, as well as declines in the amount of fuel purchased by our customers or sold by our fuel retailer partners would have a material adverse effect on our total revenues and therefore our business, financial condition, and operating results.
Fuel prices and fuel price volatility are influenced by many factors, all of which are beyond our control.Fuel price volatility is influenced by many factors, all of which are beyond our control. These factors include, but are not limited to:
•domestic and foreign supply and demand for oil and gas, and market expectations regarding such supply and demand;
•the demand for commercial, trucking and freight hauling services;
•investor speculation in commodities;
•actions by major oil exporting nations, including members of the Organization of Petroleum Exporting Countries, and the ability of the same to maintain oil price and production controls;
•level of domestic and foreign oil production;
•advances in oil production technologies;
•excess, or alternatively, lack of adequate, infrastructure;
•the speed of adoption or a material change in the use of alternative fuel and hybrid vehicles;
•geo-political conditions, including revolution, insurgency, environmental activism, terrorism, war or international conflicts, such as, the ongoing conflicts and instability in Venezuela, Europe and the Middle East;
•oil refinery capacity and utilization rates;
•weather, including climate change and natural disasters;
•the value of the U.S. dollar (or other relevant currencies) versus other major currencies;
•unexpected public health events;
•general local, regional, or worldwide economic conditions, including heightened international trade tensions;
•taxes and tariffs; and
•governmental regulations and legislation, including those pertaining to greenhouse gases (“GHG”) and fuel efficiency standards.
Some of these factors can vary by region and may change quickly, adding to market volatility, while others may have longer-term effects. The long-term effects of these and other factors on prices for fuel could be substantial and we cannot predict the precise impact of any of these factors on fuel prices. The long-term effects of these and other factors on prices for fuel could be substantial. For example, although we cannot predict the duration or severity of impact, the imposition and threatened imposition of tariffs and the ongoing conflicts and instability in Venezuela, Europe and the Middle East, and resulting sanctions and military actions, have significantly impacted and will likely continue to impact volatility in worldwide fuel prices. For example, although we cannot predict the duration or severity of impact, the ongoing conflicts in Europe and the Middle East, and the resulting sanctions and military actions have significantly impacted and will likely continue to impact volatility in worldwide fuel prices, and we cannot predict the ultimate impact of these conflicts on fuel prices.
Our revenue is also dependent, in part, on the late fees that our customers pay on past due balances and finance charges on revolving portfolio balances. As a result, a decrease in the price of fuel or volume of fuel purchased may lead to a decline in the amount of late fees we earn from customers who fail to pay us timely. As a result, a decrease in the price of fuel may lead to a decline in the amount of late fees we earn from customers who fail to pay us timely. Alternatively, an increase in the price of fuel could lead to higher amounts of receivables or payables we fund, thereby increasing the risk of, and our exposure to, a failure to pay by our counterparty, as well as an increase in the amount of fraudulent activity. See Part I – Item 1A – Risk Factors – "We have experienced and may in the future experience credit and fraud losses and other adverse effects if we fail to adequately assess and monitor credit risks posed by our counterparties or if there continues to be fraudulent use of our payment cards or systems.We have experienced and may in the future experience substantial credit and fraud losses and other adverse effects if we fail to adequately assess and monitor credit risks posed by our counterparties or if there continues to be fraudulent use of our payment cards or systems. "
25
| PART I | |||||
In addition to its impact on the price of fuel, the market demand for and supply of fuel and other vehicle products and services may affect the number of transactions or the volume of fuel sold. Fewer gallons sold equates to a lower total purchase price of fuel on which our negotiated percentage revenue is determined. Fewer gallons sold equates to a lower total 27Table of ContentsPART Ipurchase price of fuel on which our negotiated percentage revenue is determined. Our revenues, particularly in the over-the-road business, are also dependent, in part, on a flat fee derived from each fuel purchase transaction. Accordingly, in a soft fuel demand environment — which could be caused by a number of factors beyond our control, including higher prices, general local, regional or worldwide economic conditions, public health crises, decreased demand for trucking and freight hauling services, such as the current freight demand recession in the United States, and governmental regulations and legislation, including those pertaining to GHG emissions and fuel efficiency standards — fewer transactions occur, resulting in less revenue to us. Accordingly, in a soft fuel demand environment, which could be caused by a number of factors beyond our control, including higher prices, general local, regional, or worldwide economic conditions, public health crises, decreased demand for trucking and freight hauling services and governmental regulations and legislation, including those pertaining to GHG and fuel efficiency standards, fewer transactions occur, resulting in less revenue to us. Credit and other standards set by us can also limit demand for the purchase of fuel using our products. In addition, further adoption of alternative fuel and hybrid vehicles by our customers or others, an increase in the speed at which such adoption occurs, or any material increase in the use of alternative fuel vehicles in heavier duty vehicle fleets, such as over-the-road truck fleets, would lead to less gasoline or diesel fuels being sold and could affect our financial performance. The continued adoption of alternative fuel and hybrid vehicles by our customers or others, an increase in the speed at which such adoption occurs, or any material increase in the use of alternative fuel vehicles in heavier duty vehicle fleets, such as over-the-road truck fleets, would lead to less gasoline or diesel fuels being sold and affect our financial performance. This trend could have a material adverse effect on our financial performance if the products we develop and introduce to the market are unable to replace any decrease in revenue caused by any resulting decrease in the sale of gasoline or diesel fuels. This trend could have a material adverse effect on our financial performance if we are unable to develop products and introduce them to the market to replace any decrease in revenue caused by any resulting decrease in the sale of gasoline or diesel fuels. For further information on the affects of the ongoing freight recession and its effect on our business, see Part I - Item 1A - Risk Factors - “A decline in general economic conditions that negatively impacts the demand for fuel, travel related services or health care services, and other business related products and services that we provide, adversely affects our business, operating results, and financial condition.” For a further discussion on any trend toward alternative fuel and hybrid vehicles and how legislation and regulation of GHG emissions could affect our business, see Part I – Item 1A – Risk Factors – "Our failure to adapt to technological and industry changes and effectively implement new technology and products could materially affect our competitive position and our business." and Item 1A – Risk Factors – "Legislation and regulation of, and private business actions related to sustainability issues, including as to climate-related disclosure and the reduction of GHG emissions could adversely affect our business.Legislation and regulation of, and private business actions related to the reduction of GHG emissions could adversely affect our business. "
On the supply side, disruptions to supply caused by factors such as geopolitical issues, including heightened international trade tensions, war and international conflicts (such as the ongoing conflicts and resulting instability in Venezuela, Europe and the Middle East), weather, environmental considerations, infrastructure, labor shortages, or economic conditions could also affect the amount of fuel purchased by our customers. To the extent that our customers require, or have access to, less fuel, the resulting decline in purchase volume or transactions could reduce our revenues, or any growth in our revenues, and have a material adverse effect on our business, financial condition, and operating results.
Finally, revenue from our European fleet business is primarily derived from transactions in which our revenue is tied to the difference between the negotiated price of the fuel from the supplier and the price charged to the fleet customer. The merchant’s cost of fuel and the amount we charge to our fleet customer for fuel are dependent on several factors including, among others, the factors described herein affecting fuel prices. We experience fuel price related revenue contraction when the merchant’s cost of fuel increases at a faster rate than the fuel price we charge to our Mobility customers, or the fuel price we charge to our Mobility customers decreases at a faster rate than the merchant’s cost of fuel. If the foregoing scenarios exist or persist we would generate less revenue, which could have a material adverse effect on our business, financial condition, and operating results.
A decline in general economic conditions that negatively impacts the demand for fuel, travel related services or health care services, and other business related products and services that we provide, adversely affects our business, operating results, and financial condition.A decline in general economic conditions, including any potential recession, and in particular, a decline in demand for fuel, travel related services or health care services, and other business related products and services that we provide, adversely affects our business, operating results, and financial condition.
Our business, operating results and financial condition are materially affected by general conditions in the economy, both in the U.S. and internationally. We generate a substantial part of our revenue based on the volume of purchases and other transactions we process and our business generally depends heavily upon the overall level of spending. Demand for our services has in the past been, and may in the future be, at least partially correlated with general economic conditions and the amount of business activity in the regional economies in which we operate, particularly in the U.S., Europe, and the United Kingdom. Unfavorable changes in economic conditions, which are typically beyond our control, include declining consumer confidence, increasing unemployment, a restructured or reduced workforce and business patterns, a change in government contracting practices and reduced government spending, inflation, recession, changes in the political climate, trade restrictions or tariffs, including recent changes in global trade policy, heightened international trade tensions and tariff related actions, war and international conflicts, including the ongoing conflicts and resulting instability in Venezuela, Europe and the Middle East or other changes. These factors may lead to a reduction or plateau in spending by those whose spending directly or indirectly contributes to our revenues, resulting in reduced or stagnant demand for, or use of, our products and services, including fuel related services, travel related services, health care services, CDH accounts, accounts payables services, and other business related products and services by our customers or partners and our customers’ or partners’ customers. More specifically, the current freight demand recession in the United States has had an adverse impact on fuel demand from our over-the-road fleet customers, affecting our volume of gallons sold and our financial performance and operating results. The continuation or worsening of this rolling recession will likely serve to
26
| PART I | |||||
prolong or increase the above impact on fuel demand. In addition, if the U.S. or global economy enters a recession, we may experience a decline in demand for our services and/or may have to decrease our pricing, all of which could have a material adverse impact on our financial results. The severity and length of time that any downturn in economic and financial market conditions may persist, as well as the timing, strength and sustainability of any recovery from such downturn, are typically unknown and are beyond our control. As a result, a sustained decline in general economic conditions in the U.S. or internationally could have a material adverse effect on our business, financial condition, and operating results.
If any of the WEX owned issuers and other third party licensed institutions that we use to process transactions through the Mastercard and Visa networks cease to be licensed or if the third party licensed institutions are unable or unwilling to provide services to us, we would need to find other appropriate institutions to provide such services. In addition, if we fail to comply with the applicable requirements of Mastercard or Visa, they could seek to fine us, suspend us or terminate our license with them.
A significant source of our revenue comes from processing transactions through the Mastercard and Visa networks. Licensing with Mastercard and Visa is achieved through multiple WEX owned issuers and third party financial institutions. If any of our WEX owned issuers ceased to be licensed, or in the case of a third party financial institution stop providing, or are otherwise unable to provide, services for any reason, or, provide services on materially less favorable terms, we would need to find other providers of those services. If these licensed entities should stop providing, or are otherwise unable to provide, services for any reason, or, in the case of a third party, provide services on materially less favorable terms, we would need to find other providers of those services. Any delay or inability in finding a sufficient replacement could limit or eliminate our ability to provide payment services, resulting in a loss of customers and revenue, which could adversely affect our business, financial condition and operating results.
Further, Mastercard and Visa routinely update and modify their license requirements. Changes in certain requirements, including enhanced security, data or reporting standards may make it significantly more expensive for us to maintain compliance with the conditions of a license or may impact our ability to offer services to our clients. Additionally, new mandates could require us to modify our technology or business practices, which could impact our ability to offer certain products. Any such failure to comply with updated requirements or mandates could result in fines, the suspension of our licenses, or the termination of our ability to process transactions on their networks, all which could adversely affect our business, financial condition and operating results.
Additionally, regulatory changes or non-compliance of an issuer with regulatory requirements, could impair or require us to stop providing Mastercard or Visa payment services in the applicable jurisdictions. Further, regulatory changes or non-compliance of an issuer with regulatory requirements, could impair or require us to stop providing Mastercard or Visa payment services in the applicable jurisdictions. If we are unable to find a replacement provider, we may no longer be able to provide such payment processing services to our customers, which would materially affect our operations and have a material adverse effect on our business, financial condition, and operating results.
If we stop receiving incentives from Mastercard or Visa or are unable to meet our transaction volume commitments with them our profitability could be adversely impacted.
Under certain agreements we receive cash and other incentives in some of our business areas from scheme networks, including Mastercard and Visa. If we stop receiving such incentives as a result of these agreements being terminated or not being renewed on favorable terms or if the scheme networks provide these incentives directly to our customers or partners our financial results could be adversely affected. Additionally, if we become more reliant on incentives from a single scheme network, our brand or competitive positioning could be materially harmed.
We also often agree to commitments to deliver specific transaction volumes to certain scheme networks. If the scheme networks launch their own proprietary products or partner with our competitors to offer similar services, potentially diverting volume away from our platforms, or we otherwise fail to meet these volume thresholds, we may face additional costs or lose eligibility for volume-based incentives, which could materially affect our operations and financial results.
Unpredictable or catastrophic events in the locations in which we or our customers operate, or elsewhere may adversely affect our ability to conduct business and could impact our financial condition and operating results.
Unpredictable events, including events such as public health crises, political unrest, war or international conflicts, including the ongoing conflicts and resulting instability in Venezuela, Europe and the Middle East, terrorist attacks, power or technological failures, natural disasters or catastrophes (such as wildfires or hurricanes) and severe weather, including conditions arising from climate change, which have been increasing in frequency and severity, could interrupt our operations by causing disruptions in global markets, economic conditions, fuel supply or demand, travel and tourism, and the use of health care services.Unpredictable events, including events such as pandemics and public health crises like the COVID-19 pandemic, political unrest, war, including the ongoing wars in Europe and the Middle East, terrorist attacks, power or technological failures, natural disasters or catastrophes (such as wildfires or hurricanes) and severe weather, including conditions arising from climate change, could interrupt our operations by causing disruptions in global markets, economic conditions, fuel supply or demand, travel and tourism, and the use of health care services. Such events have triggered, and could also trigger in the future, large-scale technology failures, delays, or security lapses as well as increased volatility or significant disruption of global financial markets. Such events, if continuing or significant, could affect our revenues, including by reducing the demand for our products and
27
| PART I | |||||
services, by limiting our ability to provide our services, or by resulting in security or other issues to our technology systems and the information contained therein. As a result, such events could negatively impact our business, financial condition, and operating results, potentially materially.
We have experienced and may in the future experience credit and fraud losses and other adverse effects if we fail to adequately assess and monitor credit risks posed by our counterparties or if there continues to be fraudulent use of our payment cards or systems.We have experienced and may in the future experience substantial credit and fraud losses and other adverse effects if we fail to adequately assess and monitor credit risks posed by our counterparties or if there continues to be fraudulent use of our payment cards or systems.
We are subject to credit risks posed by our counterparties, many of which are small-to mid-sized businesses. Because we often fund a counterparty’s entire receivable or payable, as the case may be, while our revenue is generated from only a small percentage of that amount, our risk of loss is amplified by a counterparty’s failure to pay. Although we use various models and techniques to screen potential counterparties and establish appropriate credit limits, these models and techniques cannot eliminate all potential credit risks and may not prevent us from, among other things, approving applications that are fraudulently completed and submitted. Although we use various models and techniques to screen potential counterparties and establish appropriate credit limits, these models and 29Table of ContentsPART Itechniques cannot eliminate all potential credit risks and may not prevent us from approving applications that are fraudulently completed and submitted. Moreover, businesses that are good credit risks at the time of application may deteriorate over time and we may fail to detect such changes. In addition, in order to grow our business we may institute changes to our policies on the types and profiles of businesses to which we extend credit, which could also have an adverse impact on our credit losses. Additionally, inflationary market conditions and any rise in interest rates, could impact the notional amount of receivables or payables we fund as well as our counterparty’s ability to pay. Additionally, inflationary market conditions and rising interest rates have increased, and may continue to increase, the notional amount of receivables or payables we fund as well as our counterparty’s ability to pay.
With respect to certain transactions with our counterparties, we bear, contractually or otherwise, the risk of substantial losses due to fraudulent use of our payment cards or payment systems. We also face risk of losses as a result of fraudulent acts of employees, merchants, or contractors. Our insurance coverage may be insufficient or limited and may not protect against those losses. Additionally, criminals use sophisticated illegal activities to target us, including “skimming”, counterfeit cards and accounts, and identity theft. A single, significant incident or a series of incidents of fraud or theft could lead to, among other things, increased overall levels of fraud; direct financial losses as a result of fraudulent activity; reputational harm; decreased desirability of our services; greater regulation; increased compliance costs; the imposition of regulatory sanctions; or significant monetary fines. Accordingly, if material fraud, as described above or otherwise, occurs or continues to occur, the result could be a material adverse effect on our business, financial condition, and operating results.
In prior years we incurred material credit and fraud losses, particularly in our Mobility segment and there can be no guarantee that the strategies we have implemented to reduce the impact of credit loss and fraud will continue to be successful to reduce the effect of credit loss and fraud on our business. Moreover, if our strategies do not continue to work as intended, the Company may limit revenue and earnings growth. Accordingly, if we fail to adequately manage our credit risks, if economic conditions affect the businesses of our counterparties or of their customers, or if we experience material fraud losses our provision for credit losses on the statement of operations could increase, which could have a material adverse effect on our business, financial condition, and operating results.
Changes in or limits on interchange fees could decrease our revenue.
A substantial portion of our revenue is generated by network processing fees charged to merchants, known as interchange fees, associated with transactions processed using our payment systems, including those using Mastercard or Visa branded cards or using the Mastercard or Visa system. Interchange fee amounts associated with these payment methods are affected by a number of factors, including regulatory limits in certain of the markets in which we operate and fee or program changes imposed or allowed by our third-party partners, including Mastercard and Visa. In addition, the credit card industry and specifically interchange fees are continually the subject of intense legal, regulatory, and legislative scrutiny and competitive pressures in the markets in which we operate, any of which could result in interchange fees being limited, lowered, or eliminated altogether in any given jurisdiction in the future. In addition, interchange fees are continually the subject of intense legal, regulatory, and legislative scrutiny and competitive pressures in the markets in which we operate, any of which could result in interchange fees being limited, lowered, or eliminated altogether in any given jurisdiction in the future. Specifically, in the U.S. there has been recent proposed legislation aimed at the credit card industry that could result in downward pressure on interchange rates. Any such legislative or other future changes may further restrict or otherwise impact the way we do business or limit our ability to charge certain fees to customers. Moreover, temporary or permanent decreases in, limitations on or elimination of the interchange fees associated with our card or virtual payment transactions, could have a material adverse effect on our business, financial condition, and operating results.
On July 1, 2022, WEX Bank became subject to the caps on debit card interchange fees set forth in the Durbin Amendment to the Dodd-Frank Act. Although, at present, the applicability of the Durbin Amendment to any prepaid or debit card products we have is minimal, the Durbin Amendment’s interchange fee caps may limit the growth prospects, viability or profitability of any such existing products or any such products we may want to develop in the future.
28
| PART I | |||||
Bank failures or other events affecting financial institutions could adversely affect our and our customers’ liquidity and financial performance.
We regularly maintain domestic cash deposits in FDIC insured banks, which exceed the FDIC insurance limits. We also maintain cash deposits in foreign banks where we operate, some of which are not insured or are only partially insured by the FDIC or other similar agencies. In addition, our investment portfolio includes investments in securities of certain banking and financial organizations.
If banks and financial institutions where we maintain cash balances, cash equivalents, or financial investments enter receivership or become insolvent, or concerns or rumors about such events occur, our ability to access our cash, the value of our investment in such institutions and/or our liquidity and financial performance may be adversely impacted. 30Table of ContentsPART IIf banks and financial institutions where we maintain cash balances, cash equivalents, or financial investments enter receivership or become insolvent, or concerns or rumors about such events occur, our ability to access our cash, the value of our investment in such institutions and/or our liquidity and financial performance may be adversely impacted. There can be no assurance that our deposits in excess of the FDIC or other comparable insurance limits will be backstopped by the U.S. or applicable foreign government, or that any bank or financial institution with which we do business will be able to obtain needed liquidity in the event of a failure or liquidity crisis.
Our customers, including those that are banks, may be similarly adversely affected by any bank failure or other event affecting financial institutions. Any resulting adverse effects to our customers’ liquidity or financial performance could reduce the demand for our services or affect our allowance for expected credit losses and collectability of accounts receivable. A significant change in the liquidity or financial position, including a credit rating downgrade, of our customers could cause unfavorable trends in receivable collections and cash flows and additional allowances for anticipated losses may be required. These additional allowances could materially affect our future financial results.
Our failure to adapt to technological and industry changes and effectively implement new technology and products could materially affect our competitive position and our business.
WEX is a global commerce platform, and as such we must constantly adapt and respond to the technological advances offered by our competitors, the requirements of our partners, customers, and potential partners, regulatory requirements and evolving industry standards and trends, such as advances made with the further utilization of AI and the expected integration of EVs into mixed fleets, amongst others.WEX is a global commerce platform, and as such we must constantly adapt and respond to the technological advances offered by our competitors, the requirements of our partners, customers, and potential partners, regulatory requirements and evolving industry standards and trends, such as the expected integration of EVs into mixed fleets. Our ability to attract new customers, increase net revenue from and retain existing customers and create new, or replace existing, sources of revenue as technologies such as EVs and AI develop, will depend in significant part on our ability to adapt to industry standards, anticipate trends and the magnitude at which such trends affect the market, and continue to enhance our platform and introduce new products and capabilities on a timely and secure basis to keep pace with technological developments and customer expectations. Our ability to attract new customers, increase net revenue from existing customers and create new, or replace existing, sources of revenue as technologies such as EVs develop, will depend in significant part on our ability to adapt to industry standards, anticipate trends and the magnitude at which such trends affect the market, and continue to enhance our platform and introduce new products and capabilities on a timely and secure basis to keep pace with technological developments and customer expectations. Additionally, our competitors or other third parties may incorporate new technology and products, including AI into their operations, business, services and products more rapidly or more successfully than us. If we are unable to provide enhancements and new products, develop new capabilities that achieve market acceptance, innovate quickly enough to keep pace with rapid technological developments, or experience unintended consequences with enhancements we provide, our competitive position and our business, financial condition, and operating results could be adversely affected. Furthermore, failing to retire legacy systems or modernize our platforms as planned could impact the stability and reliability of our operations and products, impacting customer experience. In addition, customers may not adopt enhancements or new products we introduce or may not use them as intended. We may not be successful in developing modifications, enhancements, and improvements, in bringing them to market quickly or cost-effectively in response to market demands, or at modifying our platform to remain competitive with peers and compliant with applicable legal and regulatory requirements. The expansion of our platform, technological capabilities and product and service offerings also carry risks, including cost overruns, delays in delivery, and performance problems, all of which could materially affect our competitive position and our business. The expansion of our platform, technological capabilities and service offerings also carry risks, including cost overruns, delays in delivery, and performance problems, all of which could materially affect our competitive position and our business. For more information about our use of AI, please see Part I – Item 1A – Risk Factors – “ We use artificial intelligence in our business, and challenges with properly managing its use could result in penalties, harm to our brand, reputation, business or customers, and adversely affect our results of operations.”
We may not realize or sustain the expected benefits from our investments in product development, sales and marketing efforts, technology and risk management capabilities and tools, and other capabilities and initiatives, which could have a material adverse effect on our business, financial condition, and operating results.
We have been, and expect to continue, investing a certain amount of our cash in product development, sales and marketing efforts, technology and risk management capabilities and tools and other capabilities and initiatives that we deem are important to maintaining and growing our business. While we believe many of these expenditures and investments will have a positive impact on our business, certain investments have not had desired impacts and there is no guarantee that future investments will achieve the desired results and outcomes. In addition there is the possibility that certain of the expenditures will have limited or no benefit, or that any benefits received may be received over a longer period of time than initially expected. In addition, we may fail to spend enough on such investments such that we are
29
| PART I | |||||
unable to maximize our opportunities or returns on such investments. Any of the above could materially affect our business, financial condition, and operating results.
We operate in a highly competitive business environment. Such competition could adversely affect the fees we receive, our revenues and margins, and our ability to gain, maintain, or expand customer relationships, all on favorable terms.
We face and expect to continue to face competition in each of our segments from multiple companies offering or seeking to offer competing capabilities and services. Historically, we have been able to provide customers with a wide spectrum of services and capabilities and, therefore, we have not considered price to be the exclusive or even the primary basis on which we compete. As our competitors have continued to develop their service offerings, it has become increasingly more challenging for us to compete solely on the basis of superior capabilities, technology, customer integration or service and price has become an increasingly important decision factor for our customers. In some areas of our business, we have been forced to respond to competitive pressures by reducing our fees and our margins. Moreover, our services are often mission critical services for our customers. For risk management and other purposes, our customers sometimes retain at least one additional vendor that provides them with the services or products that we similarly provide. Accordingly, a customer’s total volume may be apportioned between us and such other vendors. Even if we have minimum annual volume requirements, our customers may meet such requirements or utilize our services in a manner and at times that suits their needs, which may lead to increased volume for us during one period and lighter volume for us during proximate periods, while the customer still achieves its minimum contractual requirements. Our customer could also choose to pay contractual penalties rather than achieve its minimum contractual requirements, which may affect our business results. As such, the competitive landscape in which we operate could affect the amount and consistency of our volumes, revenues and margins and have a material adverse effect on our business, financial condition, and operating results.
Our services are currently focused on the mobility, corporate payments, and benefits businesses. Some of our competitors are larger than we are and have successfully garnered significant share in these businesses. To the extent that our competitors are regarded as leaders in specific businesses, they may have an advantage over us as we attempt to further penetrate these businesses.
We face increasing competition, specifically in our corporate payments segment, from certain companies, including financial technology companies. Some of these companies have applied for or been granted bank charters and special purpose charters by the Office of the Comptroller of the Currency (“OCC” ) or certain U.S. state regulators or agencies. Additionally, the Federal Reserve has introduced a proposal that would enable many of these same institutions to directly facilitate clearing and settlement activities for their own payment transactions with the Federal Reserve Banks through the granting of access to certain specified accounts. If the proposal moves forward or the OCC and such federal and state regulators or agencies continue to grant bank charters to such applicants, which may include current or potential customers of ours, recipients of such accounts or charters may enter or increase their offerings in the corporate payments market, which could increase the competition that we face and reduce our competitive advantage. Because many of our standing arrangements and agreements with customers or other partners contain no minimum purchase, sale or volume obligations and may be terminable by either party upon no or relatively short notice, customers or other partners may not be required to use the services that we provide to a specific degree or at all, even though we are under contract with them. Accordingly, we are subject to risks related to price-based competition, loss of income, margin compression, and loss of deposits related to our corporate payments business. For more information, please see Part I – Item 1A – Risk Factors – “The loss or suspension of WEX Bank's industrial loan company charter or changes in applicable regulatory requirements could be disruptive to certain of our operations, increase costs and increase competition.”
We also face increased competition in our efforts to enter into new customer agreements or strategic relationships, renew or maintain existing agreements or relationships on similar or favorable terms, and grow volumes under existing relationships on favorable terms. For example, the termination of agreements with major oil companies, fuel retailers, and truck stop merchants, would reduce the number of locations where our payment processing services are accepted. As a result, we could lose our competitive advantage and our operating results could be adversely affected. While we regularly monitor these relationships, there can be no guarantee that we will be able to maintain them in the future. In addition, we are also subject to risks as a result of changes in business habits of our vendors and customers as they adjust to the competitive marketplace. Because many of our standing arrangements and agreements with customers or other partners contain no minimum purchase, sale or volume obligations and may be terminable by either party upon no or relatively short notice, customers or other partners may not be required to use the services that we provide to a specific degree or at all, even though we are under contract with them. Additionally, customers and partners may continue to develop the ability to provide services on their own that we’ve historically provided. Accordingly, we are subject to significant risks associated with the loss or change in the business habits and financial condition of these key constituencies as they consider changes in the market, different or less expensive services from competitors or providing such services themselves.
30
| PART I | |||||
Our ability to attract, motivate, and retain qualified employees is critical to our success and the failure to do so may materially adversely affect our performance.
We believe our employees, including our executive leadership team, are our most important resource. The market for workers and leaders of all skill levels in the workplace today, including those with AI expertise, especially in financial technology, technology, and other specialized areas, and in the geographic areas in which our operations are centralized, is intensely competitive. The market for workers and leaders of all skill levels in the workplace today, but especially in fintech, technology and other specialized areas, and in the geographic areas in which our operations are centralized, is intensely competitive. We may be unable to attract highly qualified employees as we grow or retain the individuals we employ, particularly if we do not offer employment terms, benefits and conditions that are attractive to them or competitive with our peers or the rest of the labor market. We may be unable to attract highly qualified and diverse employees as we grow, retain the individuals we employ, or adapt to a remote working environment, particularly if we do not offer employment terms, benefits and conditions that are competitive with the rest of the labor market. Failure to attract, hire, develop, motivate, and retain highly qualified talent; to foster a strong business culture; to make successful hires to fill our leadership ranks and other positions; to maintain a corporate culture that fosters innovation and collaboration; or to design and successfully implement flexible work models that meet the expectations of today’s employees and prospective employees, could disrupt our business, operations and performance and adversely affect our performance and ability to create stakeholder value. Failure to attract, hire, develop, motivate, and retain highly qualified and diverse employee talent; to meet our goals related to fostering a diverse, equitable and inclusive business culture; to make successful hires to fill our leadership ranks and other positions; to maintain a corporate culture that fosters innovation and collaboration; or to design and successfully implement flexible work models that meet the expectations of today’s employees and prospective 32Table of ContentsPART Iemployees, could disrupt our business, operations and performance and adversely affect our performance and ability to create stakeholder value.
We may encounter difficulties realizing the anticipated benefits of any transactions, including acquisitions, investments, or divestitures we have completed or may undertake.
We have been an active acquirer of assets and businesses. We expect that over the long term the Company will continue to allocate capital toward acquisitions and investments, including, for example, the acquisition of, or investments in, businesses, commercial account portfolios and other assets. We have substantially expanded our overall business, operating segments, customer base, headcount and operations through transactions such as these. When we consider deploying capital toward a transaction, we comprehensively evaluate financial and strategic criteria, including those that will allow us to increase our market penetration, technological capabilities, product offerings and distribution capabilities, among other things.
Following an acquisition, we may not operate the acquired business or assets in line with our expectations at the time of acquisition.Following an acquisition, we may not operate the acquired business as successfully as it was previously operated. For instance, we may experience some attrition in the number of clients serviced by the acquired business or fail to expand the number of clients serviced by the acquired business or assets at the expected rate, causing us to not achieve the forecasted revenues and profits from a transaction or to not achieve the level of synergies that we anticipated when entering into the transaction. For instance, we may experience some attrition in the number of clients serviced by the acquired business, causing us to not achieve the forecasted revenues and profits from an acquisition or to not achieve the level of synergies that we anticipated when entering into an acquisition. Moreover, our due diligence review may not adequately uncover all of the contingent, undisclosed, or previously unknown liabilities or issues we may incur or face as a consequence of the transaction, exposing us to potentially significant, unanticipated costs, integration challenges, as well as potential impairment charges. Moreover, our due diligence review may not adequately uncover all of the contingent, undisclosed, or previously unknown liabilities or risks we may incur as a consequence of the acquisition, exposing us to potentially significant, unanticipated costs, as well as potential impairment charges. An acquisition may also subject us to additional regulatory burdens that may significantly affect our business in unanticipated and negative ways.
Further, a transaction may require us to incur other charges, such as severance expenses, restructuring charges or change of control payments, and substantial debt or other liabilities.Further, an acquisition may require us to incur other charges, such as severance expenses, restructuring charges or change of control payments, and substantial debt or other liabilities. A transaction may also cause adverse tax consequences or substantial depreciation and amortization or deferred compensation charges, may include substantial contingent consideration payments or other compensation that could reduce our earnings during the quarter in which incurred, or may not generate sufficient financial return to offset acquisition costs. These expenses, charges or payments may adversely affect our operating results.
In addition, the process of integrating and operating any acquired business, assets, technology, service or product requires significant resources, and integration may take longer than desired.In addition, the process of integrating and operating any acquired business, technology, service or product requires significant resources, and integration may take longer than desired. If we fail to timely or effectively integrate an acquired business, its employees, its technology or other assets, this failure may lead to us not achieving certain or all of the desired benefits of the acquisition or may otherwise expose us to any shortcomings or risks of the acquired business, prior to their integration into our established systems. Thus, the integration may divert significant management attention from our ongoing business operations and could lead to a disruption of our ongoing business or inconsistencies in our services, standards, controls, procedures and policies, any of which could affect our ability to achieve the anticipated benefits of an acquisition or otherwise adversely affect our business and financial results.
From time to time, we divest businesses, for a variety of reasons. We may not be able to complete desired or proposed divestitures, at all, or may not be able to complete them on favorable terms. Gains or losses on the sales of, or lost operating income from, any such businesses could impact our future growth and profitability. Moreover, we may incur asset impairment charges related to divestitures that reduce our profitability. Divestitures may also present other financial and operational risks, including the diversion of management attention, difficulties separating personnel and financial and other systems, the potential need to provide transition services, adverse effects on existing business relationships and indemnities and potential disputes with the buyers.
31
| PART I | |||||
We are subject to risks associated with our strategic minority equity investments, including a loss of all or part of our invested capital, which could adversely affect our results of operations or fail to enhance stockholder value.
We have made minority investments in the equity securities or instruments convertible into such equity securities of third parties, including funds and other companies, in connection with our strategic initiatives. These investments are inherently risky because the companies are typically early-stage. These investments are inherently risky because the companies are typically early-stage and markets for their technologies or products may never materialize to the levels we expect. Markets for their technologies or products may never materialize to the levels we expect or the technologies or products they develop may not be successful in the market. Further, we may not realize any of the anticipated commercial benefits of working with such third parties. Further, we may not realize the anticipated commercial benefits of such investments. In addition, such investments are non-marketable and illiquid at the time of our initial investment and for some indeterminate period thereafter, and the financial success and appreciation of our investment may be dependent on a liquidity event, such as a public offering, acquisition or other favorable market event. In addition, such investments are non-marketable and illiquid at the time of our initial investment, and the financial success and appreciation of our investment may be dependent on a liquidity event, such as a public offering, acquisition or other favorable market event. If the companies in which we invest experience financial distress and are unable to raise additional financing, we could lose all or part of our investment.
Furthermore, we do not exert managerial or operational influence over these third parties, which could result in additional financial and reputation risks. Additionally, other investors in these entities or the entities themselves may have business goals and interests that are not aligned with ours, or may exercise their rights in a manner in which we do not approve. Additionally, other investors in these entities may have business goals and interests that are not aligned with ours, or may exercise their rights in a manner in which we do not approve. These circumstances could lead to delayed decisions or disputes and litigation with those other investors or the entity in which we are invested, all of which could have an impact on our reputation, business, financial condition and results of operations. These circumstances could lead to delayed decisions or disputes and litigation with those other investors, all of which could have an impact on our reputation, business, financial condition and results of operations. If these entities seek additional financing, such financing or other transactions may result in further dilution of our ownership stakes and such transactions may occur at lower valuations than the investment transactions through which we acquired such interests, which could significantly decrease the fair values of our investments in those entities.
We are exposed to risks associated with operations outside of the United States, which could harm both our U.S. and international operations.
In addition to our operations in the United States, we conduct operations and use contractors and vendors internationally in many foreign countries. In addition, we are subject to risks from operating internationally, some of which we may not typically encounter in the United States, including:
•fluctuation in foreign currencies;
•changes in the relations between the United States and foreign countries, including those affecting trade and foreign investment;
•potentially adverse consequences due to trade restrictions or tariffs;
•increased expense due to the introduction of our corporate policies and controls in our international operations;
•increased expense related to localization of our products and services, including language translation and creation of localized agreements;
•increased infrastructure costs, burdens and complexities with respect to legal, tax, accounting and information technology laws, matters, and treaties;
•interpretation and application of local laws and regulations, including, among others, those impacting anti-money laundering, bribery, financial transaction reporting, privacy, licensing, and positive balance or prepaid cards;
•enforceability of intellectual property and contract rights;
•potentially adverse tax consequences due to, but not limited to, the value added tax systems, the repatriation of cash, and any adverse consequences from changes in tax rates and changes or interpretations of tax laws;
•competitive pressure on products and services from companies based outside the United States that can leverage lower costs of operations;
•increased expense to comply with U.S. laws that apply to foreign operations, including the FCPA and OFAC regulations;
•political, social, and economic instability and war, including as a result of terrorist attacks and security concerns; and
•local labor conditions and regulations.
Our investments, businesses, or operations (including through third parties) outside the United States may not produce desired levels of revenue or costs may be disrupted or affected by one or more of the factors listed above. Any further expansion of our international operations could impose substantial burdens on our resources, divert management’s attention from U.S. operations and otherwise harm our business.
32
| PART I | |||||
Fluctuations in foreign currency exchange rates have affected and could continue to affect our financial results.
We earn revenues, pay expenses, own assets and incur liabilities in countries using currencies other than the U.S. dollar. Such currencies (which currently number over 20 actively) include, but are not limited to, the Australian dollar, the Canadian dollar, the Euro, British Pound sterling, the Singapore dollar, and the New Zealand dollar. Because our consolidated financial statements are presented in U.S. dollars, we must translate revenues, income and expenses, as well as assets and liabilities, into U.S. dollars at exchange rates in effect during or at the end of each reporting period. Realized and unrealized gains and losses on foreign currency transactions as well as the re-measurement of our cash, receivable and payable balances that are denominated in foreign currencies, are recorded directly in the consolidated statements of operation. Therefore, increases or decreases in the value of the U.S. dollar against other major currencies that we use to conduct our business have in the past and will continue to affect our revenues, net income and the value of balance sheet items denominated in those currencies. Volatility in foreign currency exchange rates, particularly fluctuations in the U.S. dollar against other currencies, could have a material adverse effect on our business, financial condition, and operating results.
As a non-bank custodian of HSA assets, WEX Inc.’s failure to adequately place and safeguard our custodial assets, or the failure of any of our depository partners, which include WEX Bank, could have a material adverse effect on our business.
As a non-bank custodian, WEX Inc. relies on various federally insured depository partners, primarily WEX Bank, to hold custodial cash assets. relies on various federally insured depository partners, including WEX Bank, to hold custodial cash assets. If any material adverse event were to affect one or more of these depository partners, including a significant decline in financial condition, a decline in the quality of service, loss of deposits, inability to comply with applicable banking and financial services regulatory requirements, systems failure, or its inability to return principal or pay interest thereon, our business, financial condition, or results of operations could be materially and adversely affected. In addition, if WEX Inc. were required to change depository partners, we could not accurately predict the success of such change or that the terms of our agreements with such new depository partners would be on equal or better terms as the agreements we have with our current depository partners.
We have incurred, and may incur in the future, impairment charges on goodwill or other long-lived assets.
Our goodwill resides in multiple reporting units and the profitability of these individual reporting units may suffer periodically from downturns in customer demand or other economic factors. These individual reporting units may be more greatly impacted by these factors than the Company as a whole, given the different market sectors and geographies in which we operate. If we determine that the fair values of our reporting units are less than their respective carrying values, or the carrying values of our other intangible assets exceed the undiscounted cash flows generated from the use of such assets, a non-cash impairment loss may be recognized and any such write-down could adversely affect our results of operations. While we currently believe that the fair values of our reporting units exceed their respective carrying values and that our goodwill will contribute indefinitely to the cash flows of the Company, unforeseen events, changes in circumstances and market conditions, and differences in estimated future cash flows could adversely affect the fair value of our assets and could result in future impairment charges. In addition, while we believe that the expected future cash flows resulting from the use of our other long-lived assets exceeds the carrying value of such assets, material changes in business strategy, customer attrition in excess of expectations, or technological obsolescence could result in impairment losses and/or an acceleration of amortization or depreciation expense. In addition, while we believe that the expected future cash flows resulting from the use of our other intangible assets exceeds the carrying value of such assets, material changes in business strategy, customer attrition in excess of expectations, or technological obsolescence could result in impairment losses and/or an acceleration of amortization expense.
The Company is, and may in the future become, involved in various claims, investigations, and legal proceedings, some of which could have a material adverse effect on our business, financial condition, or results of operations.
The Company is subject to legal proceedings and claims in the ordinary course of business and may become involved in legal proceedings that could be material. These proceedings may include, without limitation, commercial or contractual disputes, personal injury claims, stockholder claims, and employment matters. Such proceedings and claims could have a material adverse impact on our financial statements. Legal proceedings are inherently uncertain and there is no guarantee that we will be successful in defending ourselves in any such proceedings, or that our assessment of the materiality of these matters and the likely outcome or potential losses and established reserves will be consistent with the ultimate outcome of such matters. The types of claims made in such proceedings may include claims for compensatory damages, punitive and consequential damages, specific performance and/or other injunctive or declaratory relief. We may incur significant expenses in defending ourselves in any proceedings and may be required to pay damage awards or settlements or become subject to equitable remedies that adversely affect our operations and financial statements.
33
| PART I | |||||
Moreover, any insurance or indemnification rights that we may have may be insufficient or unavailable to protect us against such losses. Responding to litigation, claims, proceedings, inquiries, and investigations, even those that we believe we have substantial defenses against, requires us to incur significant expense and devote significant resources, and may generate adverse publicity that damages our reputation, resulting in an adverse impact on our business, financial condition, and operating results.
If we fail to adequately protect our intellectual property and other proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate reduced net revenue, and incur costly litigation to protect our rights.35Table of ContentsPART IIf we fail to adequately protect our intellectual property and other proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate reduced net revenue, and incur costly litigation to protect our rights.
Our success depends in part upon protecting our intellectual property and other proprietary information and technology. We rely on a combination of trademarks, service marks, patents, copyrights, trade secret laws, and contractual restrictions to establish and protect our intellectual property and other proprietary rights. The steps we take to protect these rights, however, may be inadequate. Our currently issued and pending or future trademarks and patents may not provide sufficiently broad protection, or they may not prove to be enforceable in actions against alleged infringers. Additionally, our increasing use of AI related technologies for operational efficiency and productivity and in our offerings may expose us to additional copyright infringement or other intellectual property misappropriation claims. Furthermore, enforcing our intellectual property and other proprietary information and technology protections has and may continue to require us to incur significant expense and devote significant resources. We will not be able to protect our intellectual property and other proprietary information and technology if we are unable to enforce our rights or if we do not timely detect unauthorized use of our intellectual property.
Despite our precautions, it may be possible for unauthorized third parties to copy our global commerce platform, or certain aspects of our platform, and use information that we regard as proprietary to create products that compete with our platform. Some license provisions protecting against unauthorized use, copying, transfer, and disclosure of our platform, or certain aspects of our platform, may be unenforceable under the laws of certain jurisdictions and foreign countries.
Our business could be negatively impacted by stockholder activism.
Stockholder activists frequently target public companies and propose to involve themselves in the company’s strategic direction and operations, governance practices, capital allocation and related matters. While we value constructive feedback from our investors and regularly engage in dialogue with them on various matters, the Company may nonetheless be subject to actions or proposals from activist stockholders that may not align with our business strategies or the interests of our other stockholders.
On February 9, 2026, Impactive Capital, an activist hedge fund, delivered a letter to the Company nominating four candidates for election to our board of directors at the Company’s upcoming 2026 Annual Meeting of Stockholders. Responding to this proxy contest and other actions by Impactive Capital, or other activist stockholders, may disrupt our business, cause us to incur substantial costs, and divert the attention of management and employees. For example, we have engaged legal, financial, and communications advisors to assist in responding to the proxy contest, and these costs may adversely impact our financial results.
In addition, any perceived uncertainties as to our future direction resulting from such a situation could result in the loss of potential business opportunities, cause concern to our current or potential customers, and make it more difficult to attract and retain qualified personnel and business partners, any of which could negatively impact our business. The actions of activist stockholders may also cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals of our business. We cannot predict the outcome or timing of any matters relating to the proxy contest or the ultimate impact that such matters may have on our business, liquidity, financial condition, or results of operations.
Risks Related to WEX Bank
The loss or suspension of WEX Bank's industrial loan company charter or changes in applicable regulatory requirements could be disruptive to certain of our operations, increase costs and increase competition.
WEX Bank is a Utah industrial bank that operates under an industrial loan company (“ILC”) charter. WEX Bank is also an FDIC-insured depository institution. Advances from the FHLB and deposits issued by WEX Bank are currently used to support and fund a substantial portion of our U.S. and Canadian operations in our Mobility segment and the global operations of our Corporate Payments segment. WEX Bank's ILC charter enables it to issue certificates of deposit, accept
34
| PART I | |||||
money market deposits and borrow on federal funds lines of credit from other banks, which we believe provides us access to lower cost funds than many of our competitors, thus helping us to offer competitive products to our customers.
WEX Bank operates under a uniform set of state lending laws, and its operations are subject to extensive state and federal regulation. WEX Bank’s primary regulators are the UDFI and the FDIC; however WEX Inc. is not currently subject to the Federal Bank Holding Company Act due to WEX Bank’s status as an industrial bank. Continued licensing and federal deposit insurance are subject to ongoing satisfaction of compliance and safety and soundness requirements. Adverse changes to its ILC charter could impact WEX Bank’s ability to operate and/or attract funds or limit our ability to provide competitive offerings to our customers. If ILC charters were eliminated or if changes to such charters limited or effectively prohibited us from operating as we currently operate, without our operations being “grandfathered,” as a result of newly enacted legislation, or otherwise, we would either need to outsource our credit support activities or perform these activities ourselves, which would subject us to the credit laws of each individual state in which we conduct business. If ILC charters were eliminated or if changes to such charters limited or effectively prohibited us from operating as we currently operate, without our operations being “grandfathered”, we would either need to outsource our credit support activities or perform these activities ourselves, which would subject us to the credit laws of each individual state in which we conduct business. In addition, WEX Inc. might then become subject to or affected by the Bank Holding Company Act. Furthermore, we could not be a Mastercard and/or Visa issuer and would have to work with another financial institution to issue the product or otherwise sell the portfolio. Any such changes would be disruptive to our operations and could result in significant incremental costs and reduce or eliminate any perceived or actual competitive advantage, resulting in a material adverse effect on our business, financial condition and operating results. In addition, changes in the bank regulatory environment, including the implementation of new or varying measures or interpretations by the State of Utah or the federal government, may significantly affect or restrict the manner in which we conduct business in the future, could subject us to greater regulatory oversight requirements or could create a default under our Credit Agreement.
WEX Bank is subject to extensive supervision and regulation that could restrict our activities and impose financial requirements or limitations on the conduct of our business and limit our ability to generate income.
WEX Bank is subject to extensive federal and state regulation and supervision, including that of the FDIC and the UDFI. See Part I – Item 1 – Business – “Regulation and Supervision” above for examples of such regulations applicable to WEX Bank. Banking regulations are primarily intended to protect depositors, depositors’ funds, federal deposit insurance funds, and the banking system as a whole, not shareholders. These regulations affect our payment operations, capital structure, investment practices, dividend policy, and growth, among other things. Failure to comply with laws, regulations, or policies could result in sanctions by regulatory agencies, consent orders with regulatory agencies, damages, civil money penalties or reputational damage, or other written orders, any of which could have a material adverse effect on our business, financial condition, and operating results. Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, consent orders with regulatory agencies, damages, civil money penalties or reputational damage, or other written orders, any of which could have a material adverse effect on our business, financial condition and operating results. While we have policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur. For example, WEX Bank is subject to a consent order issued by the FDIC on September 20, 2023 (the “2023 Order”), which requires WEX Bank to make certain improvements, which include corrections of certain issues identified in the 2023 Order and general enhancements to WEX Bank’s compliance management program. WEX Bank is also subject to a consent order issued by the FDIC on September 20, 2023 (the “2023 Order”), which requires WEX Bank to make certain improvements, which include corrections of certain issues identified in the 2023 Order and general enhancements to WEX Bank’s compliance management program. The terms of the 2023 Order will remain in effect and be enforceable until they are modified, terminated, suspended or set aside by the FDIC. For additional information with respect to the 2023 Order please see Part II – Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations - Regulatory Matters. The U.S. Congress, federal regulatory agencies and state legislatures and regulatory agencies frequently revise banking and securities laws, regulations and policies. We cannot predict whether, or in what form, any other proposed regulations or statutes will be adopted or the extent to which our business may be affected by any new regulation or statute. Such changes could subject our business to additional costs, limit the types of financial services and products we may offer and increase the ability of non-banks to offer competing services and products, among other things.
Volatility or adverse conditions in the economy or credit or other financial markets may have a negative impact on WEX Bank’s ability to attract and retain deposits.
Volatility or adverse conditions in the economy or credit or other financial markets may limit WEX Bank’s ability to attract and retain deposits at a time when it would like or need to do so. In addition, a significant credit rating downgrade, material capital market disruptions, significant reductions to or withdrawals of HSA cash assets, or significant withdrawals by depositors at WEX Bank, among other things, could impact our ability to maintain adequate liquidity and impact our ability to provide competitive offerings to our customers. Further, any such limitation on the availability of deposits to WEX Bank could have an impact on our ability to fund our customers’ purchases, which could have a material adverse effect on our business, financial condition, and operating results.
In an environment of increasing interest rates and changes in the deposit market, WEX Bank’s cost of capital has increased and may continue to increase.
WEX Bank uses FHLB advances, collectively brokered and non-brokered deposits, including certificates of deposit and interest-bearing money-market deposits, in addition to custodial HSA cash assets to finance its operations, which involves financing payments on behalf of our customers and funding our investment portfolio.WEX Bank uses collectively brokered and non-brokered deposits, including certificates of deposit and interest-bearing money-market deposits, in addition to custodial HSA cash assets to finance its operations, which primarily involves financing payments on behalf of our customers. Our FHLB borrowings carry fixed
35
| PART I | |||||
interest rates, which typically move in parallel with the broader interest rate environment. Furthermore, certificates of deposit carry fixed interest rates from issuance to maturity, which vary and are relatively short term in duration. Certificates of deposit carry fixed interest rates from issuance to maturity, which vary and are relatively short term in duration. The interest-bearing money market deposits are issued at both fixed and variable rates. In rising interest rate environments WEX Bank’s FHLB borrowing costs as well as deposit costs would rise as FHLB borrowings, certificates of deposit and interest-bearing money market deposits mature and are replaced or repriced at higher interest rates to the extent they are needed. This would result in reduced net income if we are otherwise unable to, or decide not to, increase the fees we otherwise receive under contracts or find or use alternative cost effective sources of funds, such as HSA cash depository assets. Rising interest rates could also therefore limit our ability to offer competitive product offerings to our customers.
WEX Bank is subject to funding risks associated with its reliance on brokered deposits and advances from the FHLB.WEX Bank is subject to funding risks associated with its reliance on brokered deposits.
As of December 31, 2025, the most recent FDIC exam report categorized WEX Bank as “well capitalized” under the regulatory framework for prompt corrective action. Under applicable regulations, however, if WEX Bank were to be no longer categorized as “well capitalized” under such framework, it would not be able to finance its operations through the acceptance of brokered deposits without the approval of the FDIC and/or could be subject to a rate cap on the deposits. Furthermore, the amount WEX Bank is eligible to borrow from the FHLB could decrease as well. WEX Bank’s inability to accept brokered deposits, a loss of a significant amount of its brokered deposits, or a further limitation on the amount it can borrow from the FHLB could each adversely affect its liquidity and therefore its ability to support and fund the Company’s operations that it currently supports and funds. WEX Bank’s inability to accept brokered deposits, or a loss of a significant amount of its brokered deposits, could adversely affect its liquidity and therefore its ability to support and fund the Company’s operations that it currently supports and funds. Additionally, such circumstances could require WEX Bank to raise deposit rates in an attempt to attract new deposits, or to obtain funds through other sources at higher rates, which would affect the Company’s ability to offer competitive products to our customers in our segments served by WEX Bank and would have a material adverse effect on our business, financial condition, and operating results.
WEX Bank is subject to regulatory requirements that have in the past, and may in the future, require us to make capital contributions to WEX Bank or that may restrict WEX Bank’s ability to make cash available to WEX Inc.
WEX Bank is subject to a number of regulatory requirements and, among other requirements, must maintain minimum amounts of regulatory capital. If WEX Bank does not meet these regulatory requirements, including the capital requirements, its regulators have broad discretion to institute a number of corrective actions that could have a direct material effect on our financial condition. WEX Bank, as an institution insured by the FDIC, must maintain certain capital ratios, paid-in capital minimums and adequate allowances for expected credit losses. WEX Bank, as an institution insured by the FDIC, must maintain certain capital ratios, paid-in capital minimums and adequate allowances for loan losses. Under the Dodd-Frank Act, we are also required to serve as a source of financial strength for WEX Bank. If WEX Bank were to require funds to meet any of the capital requirements to which it is subject, or if required under Dodd-Frank’s source of strength requirements, we may be forced to provide WEX Bank with additional capital, as we have in the past, which could impair our ability to service our indebtedness or may not be permitted under the terms of our Credit Agreement. If WEX Bank were to fail to meet any of the capital requirements to which it is subject, or if required under Dodd-Frank’s source of strength requirements, we may be forced to provide WEX Bank with additional capital, which could impair our ability to service our indebtedness or may not be permitted under the terms of our Amended and Restated Credit Agreement.
Moreover, substantially all of the transactions of, and therefore the revenues derived from, the U.S. and Canadian operations of our Mobility segment and the global operations of our Corporate Payments segment flow through WEX Bank. Due to the applicable regulatory regime, WEX Bank is limited in the ways it can transfer its cash or other assets to WEX Inc. One of the primary methods by which funds are transferred to WEX Inc. is through the payment of a dividend by WEX Bank to us. The other primary method is through a Master Service Agreement between WEX Bank and WEX Inc., which establishes the parameters of services between them with respect to the operation of the following: (i) a fleet card business for regional fleets; (ii) a fleet card business for the over-the-road freight carrier fleets; (iii) a corporate payments business; and (iv) a factoring business (collectively, the “Programs”), with certain of these Programs funded by WEX Bank and others funded by WEX Inc. WEX Bank and WEX Inc. each receive monthly compensation for their respective services to the Programs funded by the other party.
However, WEX Bank is subject to various regulatory requirements relating to the payment of dividends, including requirements to maintain capital above regulatory minimums, and other payments. Further, a banking regulator may determine that the payment of dividends or other payments, including payments under the Master Service Agreement, would be inappropriate and could impose other conditions on the payment of dividends or such other payments or even prohibit their payment. Accordingly, WEX Bank may be unable to make any, or may only be able to make limited amounts, of its cash or other assets available to us, which could affect our ability to service our indebtedness, make acquisitions, enhance product offerings, or fund corporate needs, among other things, any of which could have a material adverse effect on our business, financial condition, and operating results. For a further discussion of certain regulatory matters affecting WEX Bank’s ability to make cash available to WEX Inc. For a further discussion of certain regulatory matters affecting WEX Bank’s ability to make cash available to WEX Inc. , see, Part I – Item 1 – Business – Regulation and Supervision – General Regulation, Supervision and Examination of WEX Bank; Restrictions on Intercompany Borrowings and Transactions; and Restrictions on Dividends.
36
| PART I | |||||
If WEX Bank fails to meet certain criteria, WEX Inc. may become subject to regulation under the Bank Holding Company Act, which could force us to divest WEX Bank or become a Bank Holding Company or cease all of our non-banking activities, which could have an adverse effect on our revenue and business or could create a default under our Credit Agreement.
WEX Bank currently meets the criteria for exemption of an industrial bank from the definition of “bank” under the Bank Holding Company Act. The elimination of this exemption, the effects of any potential or pending legislation which could affect the exemption in general or as it applies to or affects WEX Bank, or WEX Bank’s failure to qualify for this exemption in the future, could cause us to become subject to regulation under the Bank Holding Company Act or have other negative impacts. This, in turn, could result in WEX Inc.’s need to divest WEX Bank or become a Bank Holding Company and to possibly cease certain non-banking activities that may be impermissible for a Bank Holding Company and could create a default under our Credit Agreement. Alternatively, if we were to become a Bank Holding Company this could have other adverse effects including an increase to our compliance costs, or making WEX Inc. a less attractive investment. Failure to qualify for or the elimination of this exemption or the effects of any legislation affecting industrial banks could thus have an adverse effect on our revenue and business. Failure to qualify for or the elimination of this exemption or the effects of any legislation affecting industrial banks could thus have an adverse effect on our revenue and business. For additional information of how the loss of our status as an industrial bank could affect our business, please see Part I – Item 1A – Risk Factors – “The loss or suspension of WEX Bank's industrial loan company charter or changes in applicable regulatory requirements could be disruptive to certain of our operations, increase costs and increase competition.”
We are subject to limitations on transactions with WEX Bank, which may limit our ability to engage in transactions with and obtain credit from it.
Sections 23A and 23B of the FRA and the implementing regulations limit the extent to which we can borrow or otherwise obtain credit from or engage in other “covered transactions” with WEX Bank. “Covered transactions” include loans or extensions of credit, purchases of or investments in securities, purchases of assets, including assets subject to an agreement to repurchase, acceptance of securities as collateral for a loan or extension of credit, or the issuance of a guarantee, acceptance, or letter of credit. Although the applicable rules do not serve as an outright ban on engaging in “covered transactions,” they do limit the amount of covered transactions WEX Bank may have with any one affiliate and with all affiliates in the aggregate. The applicable rules also require that we engage in such transactions with WEX Bank only on terms and under circumstances that are substantially the same, or at least as favorable to WEX Bank, as those prevailing at the time for comparable transactions with nonaffiliated companies. The applicable rules also require that we engage in such transactions with WEX Bank only on terms and under circumstances that are substantially the same, or at least as favorable to WEX Bank, as those 38Table of ContentsPART Iprevailing at the time for comparable transactions with nonaffiliated companies. Furthermore, with certain exceptions, each loan or extension of credit by WEX Bank to the Company or its other affiliates must be secured by collateral with a market value ranging from 100 percent to 130 percent of the amount of the loan or extension of credit, depending on the type of collateral. Accordingly, WEX Bank may be unable to provide credit or engage in transactions with us, including transactions intended to help us service our indebtedness.
WEX Bank’s results may be materially and adversely affected by market fluctuations and significant changes in the value of financial instruments.
In addition to the risk that we fail to adequately assess and monitor credit risks posed by our counterparties and the risk that volatility or adverse conditions in the economy or credit or other financial markets may negatively impact us, the value of and return on WEX Bank’s investment of custodial cash assets in securities and other financial instruments can be materially affected by market and interest rate fluctuations, which could affect our business, financial position or results of operations.In addition to the risk that we fail to adequately assess and monitor credit risks posed by our counterparties and the risk that volatility or adverse conditions in the economy or credit or other financial markets may negatively impact us, the value of WEX Bank’s investment of custodial cash assets in securities and other financial instruments can be materially affected by market and interest rate fluctuations, which could affect our business, financial position or results of operations.
Market volatility, including, but not limited to interest rate volatility, illiquid market conditions and other disruptions in the financial markets may make it extremely difficult to value certain financial instruments. Subsequent valuation of financial instruments in future periods, in light of factors then prevailing, may result in significant changes in the value of these instruments. Any of these factors could cause a decline in the value of WEX Bank’s financial instruments, which may have an adverse effect on WEX Bank’s business, financial condition, results of operations, cost of capital, capital requirements, and ability to fund a customer’s withdrawal of depository assets. In addition, at the time of any future disposition of these financial instruments, the price that WEX Bank ultimately realizes will depend on the demand and liquidity in the market at that time and may be materially lower than current fair value.
WEX Bank’s risk management and monitoring processes, including its stress testing framework, seek to quantify and control WEX Bank’s exposure to more extreme market moves. However, WEX Bank’s risk management strategies may not be effective, and we could incur significant losses, if extreme market events were to occur.
37
| PART I | |||||
Risks Related to our Indebtedness
We currently have a substantial amount of indebtedness and may incur additional indebtedness, which could increase our leverage, affect our flexibility in managing our business and could materially and adversely affect our ability to meet our debt service obligations.
At December 31, 2025, we had approximately $4.9 billion of debt outstanding, net of unamortized debt issuance costs and debt discount.At December 31, 2023, we had approximately $3,868.6 million of debt outstanding, net of unamortized debt issuance costs and debt discount. Such amount outstanding includes obligations under (i) our Credit Agreement, which consists of a tranche A-1 term loan facility, a tranche B-2 term loan facility, a tranche B-3 term loan facility and a secured revolving credit facility, (ii) the Senior Notes and (iii) securitized and participation debt and advances from the FHLB. Such amount outstanding includes obligations under (i) our Amended and Restated Credit Agreement, which consists of a tranche A term loan facility, a tranche B term loan facility, and a secured revolving credit facility, and (ii) securitized and participation debt and borrowed federal funds. In addition to our outstanding debt, as of December 31, 2025, we had outstanding letters of credit issued under our Credit Agreement. We have additional indebtedness in the form of deposits held by WEX Bank and other liabilities outstanding.
Our substantial indebtedness currently outstanding, or as may become outstanding if we incur additional indebtedness, and the terms and conditions of such indebtedness, could, among other things:
•lead to difficulty in our ability to generate enough cash flow to satisfy our indebtedness obligations under our credit facilities, and if we fail to satisfy these indebtedness obligations, an event of default could result;
•require us to dedicate a substantial portion of our cash flow to repaying our indebtedness, thus reducing the amount of funds available to execute on our corporate strategy, to fund working capital or capital expenditures or for other general corporate purposes;
•increase our interest expense materially, if interest rates rise as debt under the Credit Agreement bears interest at variable rates;
•increase our leverage ratio and limit our ability to borrow additional funds necessary for working capital, capital expenditures or other general corporate purposes;
•increase our vulnerability to adverse general economic or industry conditions;
•place us at a competitive disadvantage relative to our competitors that have less indebtedness or better access to capital, by, for example, limiting our ability to enter into new markets, upgrade our assets or pursue acquisitions or other business opportunities; and
•limit our flexibility in planning for, or reacting to changes in, our business.
We may also incur substantial additional indebtedness in the future. In addition to available borrowing capacity remaining under the Revolving Credit Facility as of December 31, 2025, we are also permitted under our credit facilities and the Indenture to incur additional indebtedness, subject to specified limitations, with exceptions which permit, among other things, dividends during a period where the Company maintains compliance with covenants contained in our Credit Agreement. In addition to available borrowing capacity remaining under the Revolving Credit Facility as of December 31, 2023, we are also permitted under our credit facilities to incur additional indebtedness, subject to specified limitations, including compliance with covenants contained in our Amended and Restated Credit Agreement. If new debt is incurred under any circumstance, the associated risks faced by the Company, such as those set forth above, could intensify.
Moreover, if we are unable to meet any of our principal, interest, or other payment or settlement obligations under any of our debt agreements, we could be forced to restructure or refinance our obligations, seek additional equity financing or sell assets, which we may not be able to do on satisfactory terms or at all.39Table of ContentsPART IMoreover, if we are unable to meet any of our principal, interest, or other payment or settlement obligations under any of our debt agreements, we could be forced to restructure or refinance our obligations, seek additional equity financing or sell assets, which we may not be able to do on satisfactory terms or at all. Our default on any of our debt agreements could have a material adverse effect on our business, financial condition and results of operations.
In addition, the Credit Agreement requires that we meet certain financial covenants, including a Consolidated EBITDA to consolidated interest charge coverage ratio and a consolidated leverage ratio, as described in Part II – Item 7 – Liquidity and Capital Resources.In addition, the Amended and Restated Credit Agreement requires that we meet certain financial covenants, including a Consolidated EBITDA to consolidated interest charge coverage ratio and a consolidated leverage ratio, as described in Part II – Item 8 – Note 16, Financing and Other Debt. The Credit Agreement also contains various affirmative and negative covenants that, subject to certain customary exceptions, restrict our ability to, among other things, create liens over our property, incur additional indebtedness, enter into sale and lease-back transactions, make loans, advances or other investments, make non-ordinary course asset sales, declare or pay dividends or make other distributions with respect to equity interests, change the nature of our business, enter into certain agreements which restrict our ability to pay dividends or other distributions or create liens on our property, transact business with affiliates and/or merge or consolidate with any other person. The Amended and Restated Credit Agreement also contains various affirmative and negative covenants that, subject to certain customary exceptions, restrict our ability to, among other things, create liens over our property, incur additional indebtedness, enter into sale and lease-back transactions, make loans, advances or other investments, make non-ordinary course asset sales, declare or pay dividends or make other distributions with respect to equity interests, change the nature of our business, enter into certain agreements which restrict our ability to pay dividends or other distributions or create liens on our property, transact business with affiliates and/or merge or consolidate with any other person.
Our ability to comply with these provisions may be affected by events beyond our control, including prevailing economic, financial, and industry conditions. Failure to comply with the financial covenants or any other non-financial or restrictive covenants in our Credit Agreement, for any reason, could create a default. Failure to comply with the financial covenants or any other non-financial or restrictive covenants in our Amended and Restated Credit Agreement, for any reason, could create a default. Upon a default, our lenders could accelerate the indebtedness under the facilities (except only the requisite lenders under the revolving credit facility and the tranche A term loan facility may accelerate the revolving credit facility due to a breach of the financial covenants), foreclose against their collateral or seek other remedies, which could trigger a default under the indenture and could jeopardize our ability to continue our current operations. The Indenture also contains limited covenants that, among other things, restrict our ability and our subsidiaries’ ability, subject to certain exceptions, to create certain liens and enter into certain sale and leaseback transactions. These covenants do not apply to WEX Bank and its subsidiaries. The Indenture also contains customary
38
| PART I | |||||
events of default that if breached could allow the requisite noteholders to accelerate the maturity of the Senior Notes, and to exercise their rights and remedies under the Indenture, and could also trigger a cross-default under the Credit Agreement.
We may want or need to refinance a significant amount of indebtedness or otherwise require additional financings, but we cannot guarantee that we will be able to refinance or obtain additional financing on favorable terms or at all.
We may elect or need to refinance certain of our indebtedness to react to changing economic and business conditions, or for other reasons, even if not required to do so by the terms of such indebtedness. Moreover, we may need, or want, to raise substantial additional financing to replace maturing debt, or to fund working capital, capital expenditures, acquisitions or other general corporate requirements. Our ability to arrange additional financing or refinancing will depend on, among other factors, our financial position and performance, as well as prevailing market conditions and other factors beyond our control. In addition, our access to lenders in the future is also dependent on, among other things, market conditions, which are variable and potentially volatile, and which could result in increased costs for obtaining and servicing our indebtedness. Accordingly, there can be no assurance that we will be able to obtain additional financing or refinancing on terms acceptable to us or at all, which could have a material adverse effect on us.
Risks Related to Regulation
Existing and new laws and regulations and enforcement activities, including those related to a wide variety of consumer protection laws, such as under the Dodd-Frank Act, Federal Trade Commission Act and state legislation, could negatively impact our business and the markets in which we presently operate, limit our expansion opportunities and significantly impact our results of operations and financial condition.
Our operations are subject to substantial regulation both domestically and internationally. In addition, there are often new regulatory efforts, which could result in significant constraints and may impact our operations. These existing and emerging laws and regulations, which may increase in complexity, quantity and scope as a result of heightened geopolitical tensions, can make the expansion or operations of our business very difficult and negatively impact our revenue or increase our compliance costs. We also conduct business with other highly regulated businesses such as banks, payment card issuers, and health insurance providers. These industries are subject to significant potential new regulations, laws, or reforms that could negatively affect these businesses, their ability to maintain or expand their products and services, and the costs associated with doing so. Any such developments could also negatively impact our business and operations. The Dodd-Frank Act, generally resulted in increased government regulation and supervision of our business, including in the regulation of derivatives, capital market activities, consumer finances and certain requirements relating to executive compensation. In particular, the Dodd-Frank Act established federal oversight and regulation of the over-the-counter derivatives market and entities that participate in that market. Derivatives regulations have added costs to our business, and any additional requirements, such as future registration requirements or increased regulation of derivative contracts, may add additional costs or may require us to change any fuel price, currency and interest rate hedging practices we may then use to comply with new regulatory requirements. Additionally, we are required to pay to the lenders under the Credit Agreement, any increased costs associated with the Dodd-Frank Act and other changes in laws, rules or regulations, subject to the terms of the Credit Agreement. Additionally, we are required to pay to the lenders under the Amended and Restated Credit Agreement, any increased costs associated with the Dodd-Frank Act and other changes in laws, rules or regulations, subject to the terms of the Amended and Restated Credit Agreement. The Dodd-Frank Act also created the CFPB to regulate the offering of consumer financial products or services under the federal consumer financial laws, including rulemaking and regulation of the payments industry, in particular with respect to prepaid cards. The extensive nature of consumer finance regulations and the implementation dates for any such additional rulemaking may result in additional compliance obligations and expense for our business and our customers. The CFPB also has broad rulemaking authority for a wide range of consumer protection laws, which it has exercised as described in Item 1 under the heading “Regulation and Supervision – Consumer Protection.” It is unclear what future regulatory changes may be promulgated by the CFPB and what effect, if any, such changes would have on our business and operations.
WEX Inc. and its U.S. subsidiaries are also subject to the Federal Trade Commission Act and similar state laws and regulations, which prohibit unfair or deceptive acts or practices in or affecting commerce. WEX Bank is subject to FDIC jurisdiction as it relates to the Federal Trade Commission Act.
Failure to comply with applicable laws or regulations may result, among other things, in the suspension or revocation of licenses or registrations, the limitation, suspension or termination of services, and/or the imposition of civil and criminal penalties, including fines. For example, WEX Bank entered into the 2023 Order with the FDIC, which requires WEX Bank to make certain improvements, which include corrections of certain issues identified in the 2023 Order and general enhancements to WEX Bank’s compliance management program. For additional information regarding the 2023 Order please see Part II – Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations -
39
| PART I | |||||
Regulatory Matters. Among the regulations that impact us or could impact us are those governing: interchange rates, interest rate and fee restrictions, credit access and disclosure requirements, collection and pricing requirements, compliance obligations, data privacy and security and data breach requirements, identity theft avoidance programs, health care mandates, the cost and scope of public and private health insurance coverage, requirements relating to the development and deployment of artificial intelligence systems, and anti-money laundering compliance programs. Among the regulations that impact us or could impact us are those governing: interchange rates, interest rate and fee restrictions, credit access and disclosure requirements, collection and pricing requirements, compliance obligations, data security and data breach requirements, identity theft avoidance programs, health care mandates, the cost and scope of public and private health insurance coverage, and anti-money laundering compliance programs. We also often must obtain permission from government regulators to conduct business in new locations or in connection with the transfer of licenses for businesses that we acquire. Changes to these regulations, including expansion of consumer-oriented regulation to B2B transactions, could materially adversely affect our operations, financial condition and results of operations and could further increase our compliance costs and limit our ability to expand to new markets.
Compliance with anti-money laundering, counter-terrorism and sanctions laws and regulations creates additional compliance costs and reputational risk.
The applicable laws and regulations in the various jurisdictions in which WEX operates impose significant anti-money laundering compliance and due diligence obligations on the local entities, including WEX Bank, WEX Payments, OFEL, and OFL, as well as our other regulated subsidiaries. We must verify the identity of customers, monitor and report unusual or suspicious account activity, as well as transactions involving amounts in excess of prescribed limits, and refrain from transacting with designated persons or in designated regions, in each case as required by the applicable laws and regulations (such as the Bank Secrecy Act and regulations of the United States Treasury Department and the Internal Revenue Service regulations in the United States, and the Money Laundering and Terrorist Financing Regulations 2019 in the U.K).
We are also subject to certain economic and trade sanctions programs that are administered by OFAC, which prohibit or restrict transactions to or from or dealings with specified countries, their governments, and in certain circumstances, their nationals, and with individuals and entities that are specially designated nationals of those countries, narcotics traffickers, and terrorists or terrorist organizations. Similar anti-money laundering and counter-terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified in lists maintained by the country equivalent to OFAC lists in several other countries and require specific data retention obligations to be observed by intermediaries in the payment process.
Financial regulators have issued various implementing regulations and have made enforcement a high priority. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could result in the imposition of fines or penalties, severe criminal or civil sanctions and other serious legal and reputational consequences, including restrictions on regulated subsidiaries’ ability to take on new business, which may impact our business, financial condition, and operating results. In addition, we cannot predict the nature, scope or effect of future regulatory requirements to which our operations might be subject or the manner in which existing laws and regulations might be administered or interpreted.
Laws or regulations developed in one jurisdiction or for one product could result in new laws or regulations in other jurisdictions or for other products.
Regulators often monitor other approaches to the governance of the payment industry. As a result, a law or regulation enacted in one jurisdiction could result in similar developments in another. In addition, laws and regulations involving one product could influence the extension of regulations to other product offerings.
The expansion of certain regulations could negatively impact our business in other geographies or for other products. Rules and regulations concerning interchange and business operations regulations, for example, may differ from country to country, which adds complexity and expense to our operations. These varying and increasingly complex regulations could limit our ability to globalize our products and could significantly and adversely affect our business, financial condition and operating results.
Regulations and industry standards intended to protect or limit access to personal information could adversely affect our ability to effectively provide our services, impose significant compliance burdens, and expose us to liability relating to our handling of and safeguarding of personal information.
Practices regarding the collection, use, storage, transmission and security of personal information by companies are under increased public scrutiny, particularly with regards to the processing of sensitive personal information, such as financial information.Practices regarding the collection, use, storage, transmission and security of personal information by companies operating over the internet have recently come under increased public scrutiny. Governmental bodies in the United States and abroad have adopted, or are considering the adoption of, laws and regulations relating to the handling of, restricting the transfer of, and requiring safeguarding of, personal information. Governmental bodies in the United States and abroad have adopted, or are considering the adoption of, laws and regulations restricting the transfer of, and requiring safeguarding of, personal information. For example, in the United States, all financial institutions are subject to certain federal and state laws and regulations to ensure the privacy and security of consumer financial information. For example, in the United States, all financial institutions must undertake certain steps to ensure the privacy and security of consumer financial information. In April 2022, a final rule jointly issued by several U.S. federal banking regulators became effective that requires banking organizations to notify their primary federal regulators within 36 hours of certain computer security incidents. The California Consumer Privacy Act, as amended by the California
40
| PART I | |||||
Privacy Rights Act, imposes additional restrictions on the collection, processing and disclosure of personal information by covered businesses. Many other states have also passed or intend to pass similar data privacy legislation that has or will become effective in the future. In Europe and the United Kingdom, the GDPR and the UK GDPR also require additional privacy protections and apply to all companies processing the personal data of EU/UK residents, regardless of the company’s location. In Europe and the United Kingdom, the GDPR and the UK GDPR also require additional privacy protections and applies to all companies processing data of EU/UK residents, regardless of the company’s location. If more restrictive privacy laws or rules are adopted by authorities in the future on the federal, state or international level, our compliance costs may increase, our opportunities for growth may be curtailed by our compliance capabilities or reputational harm and our potential exposure to regulatory enforcement, litigation and liability arising from security and data privacy breaches may increase, all of which could have a material adverse effect on our business, financial condition and operating results. If more restrictive privacy laws or rules are adopted by authorities in the future on the federal or state level, our compliance costs may increase, our opportunities for growth may be curtailed by our compliance capabilities or reputational harm and our potential liability for security and data privacy breaches may increase, all of which could have a material adverse effect on our business, financial condition and operating results.
Additionally, in connection with providing services to our clients, we are required by regulations and arrangements with payment networks and certain clients to provide assurances regarding the confidentiality and security of personal information and other confidential data. Pursuant to these requirements and arrangements, we are subject to periodic audits regarding payment card industry standards. Pursuant to these arrangements, we are subject to periodic audits regarding payment card industry standards. Our ability to maintain compliance with these standards and satisfy these audits will affect our ability to attract and maintain business in the future. If we fail to comply with these standards, we could be exposed to suits for breach of contract or to governmental enforcement proceedings. In addition, our client relationships and reputation could be harmed.
Changes in our tax rates, the adoption of new U.S. or international tax legislation or exposure to additional tax liabilities could affect our future results.
We are subject to taxes in the U.S. and numerous foreign jurisdictions. Significant judgment is required in determining our global provision for income taxes, deferred tax assets or liabilities and in evaluating our tax positions on a worldwide basis. Forecasting our future effective tax rates is complex, subject to uncertainty and could be affected by changes in the mix of earnings in countries with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, or changes in tax laws or their interpretation. Changes in tax laws and regulations, as well as changes and conflicts in related interpretations and other tax guidance, could materially impact our tax receivables and liabilities and our deferred tax assets and deferred tax liabilities. Any of these changes could have a material adverse effect on our profitability. The 2017 Tax Act, CARES Act of 2020, and the Inflation Reduction Act of 2022 significantly changed the U.S. Internal Revenue Code, including taxation of U.S. corporations, by, among other things, reducing the federal corporate income tax rate, limiting interest deductions, altering the expensing of capital expenditures, imposing a 1 percent excise tax on share repurchases and enacting a new corporate alternative minimum tax. The issuance of additional regulatory or accounting guidance related to the 2017 Tax Act, or other Congressional or executive actions in the U.S. could materially increase our tax obligations and significantly impact our effective tax rate in the period such guidance is issued or such actions take effect, and in future periods. In addition, the OBBBA was enacted in July 2025, which makes permanent certain provisions of the 2017 Tax Act and introduces additional changes affecting businesses, which may impact our operations and effective tax rate. We are also subject to the examination of our income tax returns by the Internal Revenue Service and other tax authorities. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for taxes. There can be no assurance that the outcomes from these examinations will not materially adversely affect our financial condition and operating results.
We urge our stockholders to consult with their legal and tax advisors with respect to such legislation and the potential tax consequences of investing in or holding our common stock.
As a non-bank custodian WEX Inc. is subject to regulation and noncompliance could render it unable to maintain its non-bank custodian status.
WEX Inc. is a passive non-bank custodian, under designation by the U.S. Department of the Treasury, of HSA assets, a portion of which are in investment funds for individual HSA holders at third-party brokerage firms, and the remaining portion of which are in cash and have been placed with various depository institutions, including WEX Bank.
As a non-bank custodian, WEX Inc. is required to comply with the provisions of the Treasury Regulations, including the net worth and administration of fiduciary duties requirements, among other requirements. If WEX Inc. should fail to comply with the Treasury Regulations, including the net worth and administration of fiduciary duties requirements, such failure would materially and adversely affect its ability to maintain its current custodial accounts and to grow by adding additional custodial accounts, and it could result in the institution of procedures for the revocation of its authorization to operate as a non-bank custodian, any or all of which could materially adversely affect our business, financial condition, or results of operations. Additionally, revocation of WEX Inc.’s status as a non-bank custodian would affect our ability to earn revenues from certain custodial assets, which could have a material adverse effect on our business, financial condition and operating results.
41
| PART I | |||||
The healthcare regulatory and political framework is uncertain and evolving, and we cannot predict the effect that further healthcare reform and other changes in government programs may have on our business, results of operations or financial condition.
The products that WEX Health’s software and payment solutions support are subject to various state and federal laws, including the Health Care Reform laws, which have been subject to persistent political pressure to be modified or repealed, and certain Medicare reporting rules. As a result, the U.S. healthcare laws and regulations are evolving and may change significantly in the future. Any future changes and resulting challenges may lead to uncertainty and unpredictability in the U.S. health care market, which may materially affect the availability and cost of health coverage, the viability of health care providers and health benefit plans, and the proportion of persons in the U.S. who have health insurance, the distribution between privately funded and government funded health insurance, and the future demand for, and profitability of, the offerings of our health and benefits-related business under our current business model, which could adversely affect our business. The full impact of Health Care Reform and other changes in the healthcare industry and in healthcare spending is unknown, and therefore, we are unable to predict what effect healthcare reform measures will have on our business.
Evolution and expansion of our business may subject us to additional regulatory requirements and other risks, for which failure to comply or adapt could harm our operating results.
The evolution and expansion of our business may subject us to additional risks and regulatory requirements, including laws governing money transmission and payment processing services. These requirements vary throughout the markets in which we operate, and have increased over time as the geographic scope and complexity of our payments product services have expanded. While we maintain a compliance program focused on applicable laws and regulations throughout the payments industry, there is no guarantee that we will not be subject to fines, criminal and civil lawsuits or other regulatory enforcement actions in one or more jurisdictions, or be required to adjust business practices to accommodate future regulatory requirements.
In order to maintain flexibility in the growth and expansion of our payments operations, we must ensure we are in compliance with various U.S. laws and regulations governing money transmission and the issuance and sale of payment instruments, through registration and licensing requirements in most states, or meet an exception from such registration and licensing requirements. Additionally, we have obtained necessary licenses required for business in certain non-U.S. jurisdictions where we provide payment services, including but not limited to the European Union, Ireland, the United Kingdom, Singapore and Australia. Evaluation of our compliance efforts, as well as the questions of whether and to what extent our products and services are considered money transmission, are matters of regulatory interpretation and could change over time. Our efforts to ensure we are authorized to provide money transmission services, including any efforts to acquire and maintain licenses could result in significant management time, effort, and cost, and may still not guarantee compliance or our ability to provide money transmission products and services given the constant state of change in these regulatory frameworks. An acquisition may also cause adverse tax consequences or substantial depreciation and amortization or deferred compensation charges, may include substantial contingent consideration payments or other compensation that could reduce our earnings during the quarter in which incurred, or may not generate sufficient financial return to offset acquisition costs. Accordingly, costs and operational disruptions resulting from changes in compliance requirements, regulatory audits, enforcement actions, reputational harm, revocation of licenses or other regulatory limits on our ability to grow our payment processing business could adversely affect our financial results. For a further discussion of laws and regulations governing our money transmission operations, see, Part I - Item 1 – Business - Regulation and Supervision - Money Transmission and Payment Instrument Licensing Regulations.
Our increased presence in foreign jurisdictions increases the possibility of foreign law violations or violation of the FCPA and the United Kingdom’s Bribery Act 2010.
We are subject to the FCPA and the UKBA, as we own subsidiaries organized under UK law, which serve as holding companies for other subsidiaries. The FCPA generally prohibits U.S. companies and their intermediaries from making improper payments to foreign officials for the purpose of obtaining or retaining business. The UKBA is broader in its reach and prohibits bribery in purely commercial contexts in addition to bribery of government officials, and it does not allow certain exceptions that are permitted by the FCPA. Other countries in which we operate or have operated, including Brazil, and other countries where we intend to operate, also have anti-corruption laws, which we are, have been or will be subject to.
Our employees and agents interact with government officials on our behalf, including as necessary to obtain licenses and other regulatory approvals necessary to operate our business. We also have a number of contracts with third-parties that are owned or controlled by foreign governments. These interactions and contracts create a risk of unauthorized payments or offers of payments by one of our employees or agents that could be in violation of the FCPA, UKBA or other similar laws, and we could be held liable for such unauthorized actions taken by our employees or agents.
In recent years, there have been significant regulatory reviews and actions taken by the United States and other regulators related to anti-bribery laws, and the trend appears to be applying greater scrutiny around payments to, and
42
| PART I | |||||
relationships with, foreign entities and individuals, and companies’ controls and procedures related to compliance with anti-bribery laws.
Although we have policies and procedures designed to ensure that we, our employees, agents and intermediaries comply with the FCPA and UKBA, such policies or procedures may not work effectively all of the time or protect us against liability for actions taken by our employees, agents and intermediaries with respect to our business or any businesses that we may acquire. In the event that we believe, or have reason to believe, that our employees, agents or intermediaries have or may have violated applicable anti-corruption laws, we may be required to investigate or have a third party investigate the relevant facts and circumstances, which can be expensive and require significant time and attention from senior management. Our continued operation and expansion outside the United States could increase the risk of such violations in the future. Violations of the FCPA, the UKBA or similar laws and regulations, can result in significant expenses, require implementation of new and additional controls and procedures, divert management attention, and otherwise have a negative impact on us. Any determination that we have violated the FCPA, UKBA or laws of any other jurisdiction can subject us to, among other things, penalties and legal expenses that could harm our reputation and have a material adverse effect on our financial condition and results of operations. The possibility of violations of the FCPA, UKBA or other similar laws or regulations may increase as we expand globally and into countries with recognized corruption problems.
Legislation and regulation of, and private business actions related to sustainability issues, including as to climate-related disclosure and the reduction of GHG emissions could adversely affect our business.Legislation and regulation of, and private business actions related to the reduction of GHG emissions could adversely affect our business.
We are subject to overlapping, yet distinct, climate-related disclosure regulations in multiple jurisdictions. The State of California has enacted legislation that will require large U.S. companies doing business in California to make climate-related disclosures starting in 2026, and other states are also considering new climate-related disclosure requirements. In addition, the EU Corporate Sustainability Reporting Directive (“CSRD”) became effective in 2023. CSRD applies to both EU and non-EU in-scope entities and would require them to provide expansive disclosures on various sustainability topics. The EU Corporate Sustainability Due Diligence Directive (“CSDDD”) became effective in July 2024, with applicability delayed to 2029, and may impose additional sustainability-related obligations on us directly and/or indirectly as part of our customers’ supply chain. The CSRD and CSDDD are in the process of being amended to among other things, increase the applicability thresholds such that fewer entities will be in scope. In addition, the Australian Sustainability Reporting Standards (“ASRS”) were finalized in September 2024, and requires certain large entities in Australia to provide disclosures on financially material climate-related risks and opportunities. We are further assessing our obligations under California legislation, CSRD, CSDDD, and ASRS, while developing a compliance strategy and preparing for compliance. The United Kingdom government is expected to finalize UK Sustainability Reporting Standards during early 2026, which are based on International Sustainability Standards Board standards and require certain UK companies to provide climate-related disclosures. Complying with such requirements in multiple jurisdictions may lead us to incur significant expense and devote significant resources and the failure to comply with such legislation and regulations could result in fines and could affect our business, financial condition, results of operations and cash flows. We could also face increased costs related to defending and resolving legal claims and other litigation related to climate change and the alleged impact of our operations on climate change and other sustainability issues including the extent to which our business helps operators reduce their carbon footprint. Furthermore, any legislation or regulation promulgated by states, foreign countries, or geographic regions that particularly aim to control or limit GHG emissions or otherwise seek to address climate change and the impact thereof could adversely affect our, our partners’ and our merchants’ operations. At the same time, an increasing number of lawmakers have expressed or pursued contrary views, legislation and investment expectations with respect to sustainability-related ambitions and disclosures, including the enactment or proposal of “ anti-ESG” legislation, regulation or policies, which may expose us to additional legal, financial or reputational risks based on our disclosures.
Finally, many private businesses, including vehicle manufacturers, are increasingly taking proactive steps to control or limit GHG emissions, including by producing and/or purchasing vehicles that operate fully using alternative fuels, electricity or hybrid EVs. Many auto and truck manufacturers have announced plans to electrify a portion of their fleet over the next decade and we expect the trend toward use of EVs and hybrid EVs to continue to grow. Many auto and truck manufacturers have announced plans to electrify large portions of their fleet over the next decade and the trend toward use of hybrid EVs continues to grow. Because our business is currently heavily reliant on the level of transactions involving gasoline and diesel fuels, existing or future laws or regulations or business actions related to sustainability and GHG emissions, including incentives to conserve energy or use alternative energy sources, could have a negative impact on our business if any of the same serve to reduce demand for gasoline and diesel fuels and we do not or are unable to develop products or relationships to adapt to such potential events. Because our business is currently heavily reliant on the level of transactions involving gasoline and diesel fuels, existing or future laws or regulations or business actions related to GHGs and climate change, including incentives to conserve energy or use alternative energy sources, could have a negative impact on our business if any of the same serve to reduce demand for gasoline and diesel fuels and we do not or are unable to develop products or relationships to adapt to such potential events. For further information on how the increase in usage of alternative fuels in vehicles affects our business, please see Part I – Item 1A – Risk Factors – “A significant portion of our revenue is generated by the purchase and sale of gasoline and diesel fuel by or through our customers and from our fuel retailer partners, and, as a result, a reduction in the demand for or supply of gasoline and/or diesel fuel and/or volatility or decline in such fuel prices could have a material adverse effect on our business, financial condition, and operating results.”
43
| PART I | |||||
Risks Related to our Dependence on Technology
We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability, damage to our reputation, and other financial impacts. Our efforts to implement robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access.
Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks and expect they will continue in the future. We have not experienced a material loss from such an attack to date but could suffer such a loss in the future.
We collect and store sensitive data about individuals, including health and healthcare related information, financial information (e.g., bank account information and payment card information), government identification documents or numbers (e.g., social security numbers and tax identification numbers), information regarding protected categories and spending data. We are required to take commercially reasonable measures to prevent and mitigate the impact of cyberattacks, as well as the unauthorized access, acquisition, release and use of personal information. In the event of a security breach, we are required to investigate and determine the types of information compromised and determine corrective actions and next steps under applicable laws, including potentially costly notification obligations to affected individuals and regulators, which requires us to expend capital and other resources to address the security breach and protect against future breaches. In addition, as outsourcing, specialization of functions, third-party digital services and technology innovation within the payments industry increase (including with respect to artificial intelligence, mobile technologies, tokenization, big data and cloud solutions), more third parties are involved in processing card transactions. In addition, as outsourcing, specialization of functions, third-party digital services and technology innovation within the payments industry increase (including with respect to mobile technologies, tokenization, big data and cloud storage solutions), more third parties are involved in processing card transactions. Accordingly, there is a risk that the confidentiality, integrity, privacy and/or security of data held by, or accessible to, third parties, including merchants that accept our cards, payment processors and our business partners, may be materially compromised, which could lead to unauthorized transactions on our cards, regulatory scrutiny and costs associated with responding to such an incident. In addition, high profile data breaches could change consumer behaviors, impact our ability to access data to make product offers and credit decisions, result in new or expanded legislation and regulatory requirements, and result in increases in our compliance and monitoring costs. In addition, high profile data breaches could change consumer behaviors, impact our ability to access data to make product offers and credit decisions, result in legislation and additional regulatory requirements, and result in increases in our compliance and monitoring costs.
The techniques used in attempts to obtain unauthorized, improper or illegal access to our systems, our data or our customers’ data, to degrade service, or to sabotage our systems are constantly evolving, are difficult to detect quickly, and may not be recognized until after a successful penetration of our information security systems. Additionally, the emergence of AI technology and the increased use of AI tools by our employees and in our internal systems may also lead to new and/or more sophisticated cyber-attack techniques, including fraud that relies upon impersonation technology or other forms of generative automation that may increase the effectiveness of these techniques. Legal proceedings are inherently uncertain and there is no guarantee that we will be successful in defending ourselves in any such proceedings, or that our assessment of the materiality of these matters and the likely outcome or potential losses and established reserves will be consistent with the ultimate outcome of such matters. Cyber threats include, but are not limited to: malicious software; destructive malware; ransomware; attempts to gain unauthorized access to systems or data; disruption to operations or critical systems; denial of service attacks; unauthorized release of confidential, personal or otherwise protected information (ours or that of our employees, customers or partners); corruption or encryption of data, networks or systems; harm to individuals; and loss of assets. Unauthorized parties attempt to gain access, and in some instances have gained access, to our systems or facilities through various means, including, among others, targeting our systems or facilities or our third-party vendors or customers, or attempting to fraudulently induce our employees, partners, customers or others into disclosing user names, passwords, payment card information, or other sensitive information, which may in turn be used to access our information technology systems. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more difficult to detect, prevent and mitigate. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them 45Table of ContentsPART Ieven more difficult to detect, prevent and mitigate. Our security measures may also be breached due to employee error, malfeasance, system errors or vulnerabilities, or other irregularities. We have developed robust systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and we will continue to expend significant additional resources to bolster these protections. However, these security measures cannot provide absolute security and may be insufficient, circumvented or become obsolete in response to evolving threats.
Any actual or perceived breach of our security could interrupt our operations; result in our systems or services being unavailable; result in platform, information and network shutdowns; result in improper disclosure of data; materially harm our reputation and brand; result in significant legal and financial exposure; lead to loss of customer confidence in, or decreased use of, our products and services; and, adversely affect our business and results of operations. Any breaches of network or data security at our partners, some of whom maintain information about our customers, or breaches of our customers’ systems could have similar effects. In addition, our third party partners, customers or vendors could have vulnerabilities on their own computer systems that are entirely unrelated to our systems, but could mistakenly attribute their own vulnerabilities to us. While we take commercially appropriate steps to safeguard data used by and contained on
44
| PART I | |||||
the systems of our partners, customers and vendors, we cannot control all access to those systems and they are therefore subject to the risk of cyberattacks and fraud.
We are subject to U.S. and international privacy and data protection regulations, including health and financial privacy regulations, which impose requirements concerning the handling, transfer, and protection of data, and compliance with these regulations could impose significant compliance burdens and failure to comply with such regulations could result in penalties, cause harm to our reputation and have a negative impact on our business.
The regulatory framework for privacy and data protection in the U.S. and worldwide is growing in complexity and is likely to become more complicated for the foreseeable future as the number of privacy and data protection laws increases. Comprehensive state privacy laws in the U.S., including the CCPA, as well as many more coming into effect, each require covered businesses to maintain data security programs, as well as to provide specific disclosures of our data use to residents of such states and maintain systems that enable us to receive and respond to requests from such state residents concerning their personal data, including requests to delete, correct, or obtain access to such data. The evolving complexity of this regulatory framework is likely to increase our compliance costs. Additionally, if we are found to have violated any of these requirements, we may be subject to civil penalties and, in some cases, private litigation. If we are found to have violated any of these requirements, we may be subject to civil penalties and, in some cases, private litigation.
Under the GLBA, and some U.S. state laws, WEX Bank is required to develop, implement, and maintain a comprehensive written information security program that includes administrative, technical and physical safeguards relating to customer information. This requirement generally does not extend to information about companies or about individuals who obtain financial products or services for business, commercial, or agricultural purposes.
The GLBA also requires WEX Bank to provide initial and annual privacy notices to customers that describe in general terms our information sharing practices. If WEX Bank intends to share nonpublic personal information about consumers with affiliates and/or nonaffiliated third parties, WEX Bank must provide customers with a notice and a reasonable period of time for each customer to “opt out” of any such disclosure. The GLBA also regulates certain activities of WEX Inc., with respect to privacy and information security practices. In addition to U.S. federal privacy laws with which we must comply, states also have adopted statutes, regulations and other measures, such as the CCPA, governing the collection and distribution of personal information. In some cases, these state measures exempt certain data regulated by federal law, but with respect to certain other categories of personal information we and WEX Bank must monitor and seek to comply with individual state privacy laws in the conduct of our businesses.
When we handle protected health information, regulations issued under HIPAA, and HITECH, our contracts with our customers, and supplemental state laws require us to implement privacy and data security measures and to comply with breach notification requirements. We may be subject to contractual damages and civil or criminal penalties if we are found to violate these privacy, security and breach notification requirements. An amendment to the HITECH Act enacted in January 2021 requires consideration of a company’s implementation of recognized security standards in assessing administrative fines and penalties under the HIPAA security standards. This action potentially heightens enforcement risks if we fail to adequately implement the recognized security standards, while mitigating such risks if the recognized measures are successfully implemented.
Our efforts to comply with existing and future privacy and financial data protection laws and regulations, both in the U.S. and abroad, are costly and time-consuming. In addition, any cybersecurity incident, any incident involving our handling of protected and sensitive information, failure to comply with applicable breach notification and reporting requirements, or any violation of international, federal or state privacy laws could consume significant financial and managerial resources, expose us to liability in excess of any applicable insurance policies, litigation, regulatory scrutiny, and/or cause damage to our reputation, which may discourage customers from using, renewing, or expanding their use of our services or cause us to be in breach of our contracts with them. We may also be required to expend significant resources to implement additional data protection measures or to modify the features and functionality of our system offerings in a way that is less attractive to customers.
If the technologies we use in operating our business and interacting with our customers fail, are unavailable, or do not operate to expectations, or we fail to successfully implement technology strategies and capabilities in connection with our third-party technology arrangements, our business and results of operations could be adversely impacted.
We utilize a combination of proprietary and third-party technologies, including third-party owned and operated cloud technologies or third-party managed technology platforms, data-centers, and processing systems, to conduct our business and interact with our customers, partners and suppliers, among others. This includes technology that we have developed, have contracted with others to develop, have outsourced to a single provider to operate or have obtained through third-parties by way of service agreements. As we have increased the number of platforms as well as the size of
45
| PART I | |||||
our networks and information systems, our reliance on these technologies has become increasingly important to our operating activities.
The potential negative impact that a platform, network or information system shutdown may have on our operating activities has increased. To the extent that our proprietary technology or a third-party provider’s technology does not work as agreed to or as expected, or if we experience outages or unavailability resulting from ours or our third-party providers’ operations and the services provided, which has occurred from time to time, our ability to efficiently and effectively deliver services could be adversely impacted, which could and has, from time to time, caused us to miss service level agreements, and our business and results of operations could be adversely affected. To the extent that our proprietary technology or a third-party provider’s technology does not work as agreed to or as expected, or if we experience outages or unavailability resulting from ours or our third-party providers’ operations and the services provided, our ability to efficiently and effectively deliver services could be adversely impacted and our business and results of operations could be adversely affected. Shutdowns may be caused by a number of sources, many of which are beyond our control, including, without limitation: cyberattacks, unexpected catastrophic events such as natural disasters or acts of terrorism, software or hardware defects, network disruptions such as computer viruses or hacking, theft or vandalism of equipment, employee error and/or actions or events caused by or related to third party vendors. Any failure by our customers or partners to access the technology that we develop internally or provide through 3rd-party technology partners could have an adverse effect on our business, results of operations and financial condition. Any failure by our customers or partners to access the technology that we develop internally could have an adverse effect on our business, results of operations and financial condition. In addition, we and our customers could suffer harm if valuable business data or employee, customer and other proprietary information processed by such technology were corrupted, lost or accessed or misappropriated by third parties due to a security failure in our systems or those of our suppliers or service providers. Any such failure or breach could require significant expenditures to remediate, severely damage our reputation and our relationships with customers, including an obligation to notify individuals, regulatory authorities, the media and other stakeholders in connection with any such failure or breach, result in unwanted media attention and lost sales and expose us to risks of litigation and liability. Although we make substantial investments in technology, there is no guarantee that it will function as intended once it is placed into operation. Our technology infrastructure, such as our cloud services, backup and recovery procedures, or active system monitoring may not function as intended and may negatively impact WEX’s business. We may conclude that certain technologies should be retired, that existing platforms should be consolidated, or that we should change our technology strategies, and we may be required to impair or accelerate depreciation on certain assets. Any of these potential changes or failures in our technology strategies may also divert management’s attention and have a material adverse effect on our business, financial condition and operating results.
Our business is dependent on electronic communications networks managed by third parties, which could result in our inability to prevent service disruptions.
Our ability to process and authorize transactions electronically depends on our ability to electronically communicate with our third party providers through point-of-sale devices and electronic networks that are owned and operated by third parties. The electronic communications networks upon which we depend are often subject to disruptions of various magnitudes and durations. Any severe disruption of one or more of these networks could impair our ability to authorize transactions or collect information about such transactions, which, in turn, could harm our reputation for dependable service and adversely affect our results of operations. In addition, our ability to collect enhanced data relating to our customers’ purchases may be limited by the use of older point-of-sale devices by certain providers. To the extent that these providers within our network are slow to adopt advanced point-of-sale devices, we may not be able to offer the latest services and capabilities that our customers demand.
We use artificial intelligence in our business, and challenges with properly managing its use could result in penalties, harm to our brand, reputation, business or customers, and adversely affect our results of operations.We use artificial intelligence in our business, and challenges with properly managing its use could result in harm to our brand, reputation, business or customers, and adversely affect our results of operations.
We use AI tools including machine learning, generative AI, technologies and data analytics tools which may generate outputs to assist in the development of our platform, offerings, services, products and in the use of internal tools that support our business.We use artificial intelligence (“AI”) solutions including machine learning and generative AI tools that collect, aggregate and analyze data to assist in the development of our platform, offerings, services, products and in the use of internal tools that support our business. These applications have and likely will continue to become increasingly important in our operations over time. These applications may become increasingly important in our operations over time. The adoption of AI tools presents a number of risks inherent in its use, including risks related to cybersecurity, data privacy and bias. More specifically, AI algorithms are based on machine learning and predictive analytics, which can create accuracy issues, unintended biases and discriminatory outcomes that could harm our brand, reputation, business or customers. Additionally, AI algorithms are based on machine learning and predictive analytics, which can create accuracy issues, 47Table of ContentsPART Iunintended biases and discriminatory outcomes that could harm our brand, reputation, business or customers. Additionally, no assurance can be made that the usage of AI will assist us in being more efficient. Implementing the use of AI successfully, ethically and as intended, will require significant resources, including having the technical expertise required to develop, test and maintain our platform, offerings, services and products. Implementing the use of AI successfully, ethically and as intended, will require significant resources, including having the technical complexity and expertise required to develop, test and maintain our platform, offerings, services and products. In addition, the use of AI may increase cybersecurity risks and operational and technological risks. The technologies underlying AI and their use cases are rapidly developing, and it is not possible to predict all of the legal, operational or technological risks related to the use of AI.
Moreover, AI is subject to rapidly evolving domestic and international laws and regulations, which could impose significant costs and obligations on us. In the United States, federal lawmakers are considering legislation that could restrict the development and use of AI, although it remains unclear whether such proposals will become law. Multiple states have already enacted and are considering additional measures governing areas such as model transparency and disclosures,
46
| PART I | |||||
safety testing and risk management, data protection, automated decision-making and labeling of generative AI content, compliance with which may require increased technical and personnel resources and be costly. Federal and state agencies have also issued guidance and initiated rulemakings. Given our global operations, comparable non-U.S. regimes also remain relevant, including the European Union Artificial Intelligence Act, which applies to companies that develop, use, or provide AI in the EU and imposes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI, and foundation models and the United Kingdom’s regulator-led framework. Additionally, existing laws and regulations could be interpreted in ways that would affect our use of AI and our AI offerings. We also expect that regulators may continue to apply existing consumer protection and other laws to the development and deployment of AI. Moreover, AI usage is the subject of evolving review by various U.S. regulatory agencies, including the SEC and the U.S. Federal Trade Commission, and state regulatory agencies and attorneys general. It is possible that governments may also seek to regulate, limit, or block the use of AI in our products and services or otherwise impose other restrictions that may hinder the usability or effectiveness of our products and services. Any failure to accurately identify and address our responsibilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with AI technologies and use cases could negatively affect the adoption of our products and services and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. Any such failure or breach could require significant expenditures to remediate, severely damage our reputation and our relationships with customers, including an obligation to notify individuals, regulatory authorities, the media and other stakeholders in connection with any such failure or breach, result in unwanted media attention and lost sales and expose us to risks of litigation and liability.
Risks Relating to Ownership of Our Common Stock
The failure to maintain effective systems of internal control over financial reporting and disclosure controls and procedures could result in the inability to accurately report our financial results or prevent material misstatement due to fraud, which could cause current and potential shareholders to lose confidence in our financial reporting, adversely affect the trading price of our securities, harm our operating results, trigger a default under the Credit Agreement or result in regulatory proceedings against us.
Effective internal control over financial reporting and disclosure controls and procedures are necessary for us to provide reliable financial reports and effectively prevent fraud and operate successfully as a public company. The failure to develop or maintain effective internal control over financial reporting and disclosure controls and procedures could harm our reputation or operating results, or cause us to fail to meet our reporting obligations, or trigger a default under the Credit Agreement.
Our financial reporting and disclosure controls and procedures are reliant, in part, on information we receive from disparate internal financial reporting systems and third parties that supply information to us regarding transactions that we process. In addition, because our strategy includes pursuing growth through acquisitions of other businesses, which are at different levels of maturity and which may have underdeveloped financial reporting systems and processes, we depend on disparate financial systems to process, summarize and report financial transactions. To the extent these systems do not properly transmit information to our financial ledgers, we could fail to properly summarize and report financial results.
As we expand our business operations domestically and internationally, and as we implement new accounting standards promulgated by the FASB, we will need to maintain effective internal control over financial reporting and disclosure controls and procedures. If we are unable to do so, our external auditors could issue a qualified opinion on the effectiveness of our internal control over financial reporting.
Ineffective internal control over financial reporting and disclosure controls and procedures could cause investors to lose confidence in our reported financial information, which could have a negative effect on the trading price of our securities or affect our ability to access the capital markets and could result in regulatory proceedings against us by, among others, the SEC.
Material weaknesses in internal control over financial reporting have in the past and could in the future lead to deficiencies in the preparation of financial statements. Deficiencies in the preparation of financial statements, could lead to litigation or regulatory investigations or proceedings against us. The defense of any such claims may cause the diversion of management’s attention and resources, and we may be required to pay damages if any such claims or proceedings are not resolved in our favor. Any litigation or regulatory investigations or proceeding, even if resolved in our favor, could cause us to incur significant legal and other expenses. Such events could also affect our ability to raise capital to fund future business initiatives.
47
| PART I | |||||
We may not realize the anticipated long-term stockholder value of our share repurchase programs, and there can be no assurance that we will repurchase shares or that we will repurchase shares at favorable prices, which may negatively affect our stock price.
During both 2025 and 2024, we expended a significant amount of funds toward the return of capital to shareholders through the repurchase of shares of our common stock subject to an authorized and outstanding share repurchase program. Authorization under our most recent share repurchase program expired on January 1, 2026. However, our board of directors may authorize similar share repurchase programs in the future. Share repurchases may be made through a variety of methods, which may include open market purchases, privately negotiated transactions, block trades, tender offers or accelerated share repurchase transactions or by any combination of such methods. The Company may issue secured and unsecured debt to finance a portion of any future share repurchases. Any such repurchases will be made from time to time subject to market and economic conditions, applicable legal requirements, and other relevant factors. The manner, timing and amount of any share repurchases may fluctuate and will be determined by us based on a variety of factors, including the market price of our common stock, our liquidity and capital availability, our priorities for the use of cash to support our business operations and plans, general business and market conditions, tax laws, regulatory developments relating to share repurchase programs, the ability to obtain financing at attractive rates, alternative investment opportunities, and our determination that share repurchases are in the best interest of our stockholders and are in compliance with all respective laws and our applicable agreements. Our ability to repurchase shares in the future will depend upon, among other factors, our cash balances and potential future capital requirements for strategic transactions, our results of operations, our financial condition and other factors beyond our control that we may deem relevant. Any severe disruption of one or more of these networks could impair our ability to authorize transactions or collect information about such transactions, which, in turn, could harm our reputation for dependable service and adversely affect our results of operations. If the Board authorizes any future share repurchase program, we expect that such plan may be modified, suspended, or terminated at any time, which could result in a decrease in the trading prices of our common stock. We can provide no assurance that we will repurchase shares, if authorized by the Board to do so in the future, at favorable prices, if at all.
Provisions in our charter documents, Delaware law and applicable banking laws may delay or prevent our acquisition by a third party, and could adversely impact the market price of our common stock.•Provisions in our charter documents, Delaware law and applicable banking law may delay or prevent our acquisition by a third party, and could adversely impact the market price of our common stock.
Our certificate of incorporation and by-laws contain several provisions that may make it more difficult for a third party to acquire control of us without the approval of our board of directors. These provisions include, among other things, the prohibition of stockholder action by written consent, advance notice requirements for raising business or making nominations at meetings of stockholders and “blank check” preferred stock. These provisions may make it more difficult or expensive for a third party to acquire a majority of our outstanding voting common stock or change control of our board of directors. We also are subject to certain provisions of Delaware law, including Section 203 of the Delaware General Corporation Law, which could delay, deter or prevent us from entering into an acquisition. These provisions may also delay, prevent or deter a merger, acquisition, tender offer, proxy contest or other transaction that might otherwise result in our stockholders receiving a premium over the market price for their common stock.
Furthermore, banking laws impose notice, approval, and ongoing regulatory requirements on any shareholder or other party that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution or its parent company. Under the Change in Bank Control Act of 1978, as amended (“CIBC Act”) and the FDIC’s regulations thereunder, any person, either individually or acting through or in concert with one or more other persons, must provide notice to, and effectively receive prior approval from, the FDIC before acquiring “control” of us. Under the CIBC Act, control is conclusive if, among other things, a person or company, or a group of persons deemed to be acting in concert acquires 25 percent or more of any class of our voting stock. Under the CIBC Act, control is conclusive if, among other things, a person or company acquires 25 percent or more of any class of our voting stock. A rebuttable presumption of control arises if a person or company, or a group of persons deemed to be acting in concert acquires 10 percent or more of any class of our voting stock. A rebuttable presumption of control arises if a person or company acquires 10 percent or more of any class of our voting stock.
Under the Utah Financial Institutions Act (“UFIA”), no person may acquire direct or indirect “control” of a depository institution without first receiving the formal written approval of the UDFI’s commissioner. Under the UFIA, control is defined to include having the power to vote 25 percent or more of any class of our voting securities. A rebuttable presumption of control arises if a person has the power, directly or indirectly, or through or in concert with one or more persons, to vote more than 10 percent but less than 25 percent of any class of our voting securities. Any person seeking to rebut a presumption of control is required to do so by submitting an application to the UDFI’s commissioner.
Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our common stock in excess of the amount which can be acquired without regulatory approval. In practice, the process for obtaining such approval is complicated and time-consuming, often taking longer than six months, and a proposed acquisition may be disapproved for a variety of factors, including, but not limited to, antitrust concerns, financial condition and managerial competence of the applicant, and failure of the applicant to furnish all required information.
Finally, our certificate of incorporation requires that if any stockholder fails to provide us with satisfactory evidence that any required approvals have been obtained, we may, or will if required by state or federal regulators, restrict such stockholder’s ability to vote such shares with respect to any matter subject to a vote of our stockholders.
48
| PART I | |||||
Collectively, these provisions could delay or prevent a third party from acquiring us, by discouraging a hostile bid; delaying, preventing or deterring a merger, acquisition or tender offer in which our shareholders could receive a premium for their shares; or impeding a proxy contest for control of our company or other changes in our Board or management, despite the possible benefit to our stockholders, or otherwise adversely affect the market price of our common stock. Further, as a result of these requirements, certain existing and potential stockholders may choose not to invest further in our stock or invest in our stock at all. This could limit the number of potential investors and impact our results of operations. This could limit the number of potential investors and impact our ability to attract further funds.
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks aimed at our information systems and networks, including those that store sensitive data about third parties. We have established a Global Information Security Program, which is administered and overseen by the Company’s Chief Information Security Officer (“CISO”), that establishes minimum requirements we adhere to in order to provide a secure environment for developing, implementing, and supporting our information technology and systems. Our Global Information Security Program is designed to maintain compliance with various regulatory requirements and certification standards, including those under HIPAA, HITECH, PCI, ISO, SOC, SOX, DORA, FFIEC and RPAA as we aim to have world-wide, generally accepted, best practices.
Periodic assessments of the Global Information Security Program are conducted to ensure it is well-positioned to meet its objective of reducing the threat of known and emerging cybersecurity risks, as well to confirm ongoing compliance with legal and industry best practices and standards. Assessments of the program are continuously conducted by management and by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. Assessments of the program are continuously conducted by management 49Table of ContentsPART Iand by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS, HITRUST, DORA, FFIEC and RPAA in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS and HITRUST, in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the board of directors (the “Technology Committee”), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the Board (the “Technology Committee”), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective.
In addition to the processes we have put in place to ensure our information systems and networks continue to evolve and adapt to the ongoing cybersecurity threat environment, we have designed an enterprise security architecture system that deploys layers of security controls to continuously monitor for potential cybersecurity vulnerabilities and threats in a situation when a potential incident does arise. Our systems are configured to generate alerts in the event of any potential breach or intrusion with a team in place to receive and act upon such alerts. Additionally, all WEX systems that store, process, transmit, or could affect the security of confidential data are logged and monitored, with our information security team conducting a daily review of any such systems. If an alert is triggered automatically by our system or as a result of our team’s review and a potential cyber or information security incident is detected, the alert will be elevated within the information security incident response team and the CISO will become responsible for informing the crisis management team to facilitate the Company’s assessment and response to the potential incident. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. Furthermore, the crisis management team, in conjunction with members of senior management will determine whether to engage third parties , including outside counsel, consultants, law enforcement and external forensic firms, to provide support in the assessment of and response to the incident.
49
| PART I | |||||
Additionally, we have policies and procedures in place to help oversee and identify material risks from cybersecurity threats associated with third-party service providers. Prior to engaging vendors, specifically those involved in the processing, storage or transmission of certain data, the information security team completes a due diligence process, including requiring proof of the potential vendor’s PCI, HIPAA, HITRUST, and/or SOC 2 compliance, as applicable. During the due diligence process the information security team assigns a risk ranking as it relates to information security risk and may perform additional due diligence if appropriate based on such ranking. Further, we engage an external vendor risk monitoring and alert service to monitor the cyber health of our third-party vendors. If there is a change in the vendor’s risk profile, we review the risk and initiate an action plan in response, which could include additional monitoring, remediation requests or termination. If the vendor is a key technology vendor and/or a vendor with access to protected data, any action plan will be escalated to the CISO and require the CISO’s approval before proceeding.
Governance
WEX has established an AI Systems & Model Governance Committee, comprised of representatives from key functional areas of the organization, including risk, compliance, privacy, security, and technology. This governance structure is designed to foster a culture of responsible AI innovation by promoting transparency, accountability, fairness, and security in all AI-related activities.
50
| PART I | |||||
robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access.”
Recently Filed
Click on a ticker to see risk factors
| Ticker * | File Date |
|---|---|
| HTH | 15 hours ago |
| HASI | 15 hours ago |
| OSCR | 15 hours ago |
| HCSG | 15 hours ago |
| MTH | 15 hours ago |
| MORN | 15 hours ago |
| DOV | 15 hours ago |
| PLD | 15 hours ago |
| CPS | 15 hours ago |
| EQR | 15 hours ago |
| VRTX | 15 hours ago |
| JPM | 15 hours ago |
| NEE | 16 hours ago |
| WY | 16 hours ago |
| HR | 16 hours ago |
| AON | 16 hours ago |
| ROKU | 16 hours ago |
| KMI | 16 hours ago |
| FROG | 16 hours ago |
| VRT | 16 hours ago |
| EXAS | 16 hours ago |
| UBER | 16 hours ago |
| AMGN | 16 hours ago |
| TRUP | 16 hours ago |
| NTGR | 16 hours ago |
| INSP | 16 hours ago |
| LEA | 16 hours ago |
| AAP | 16 hours ago |
| LSCC | 16 hours ago |
| NWL | 16 hours ago |
| TRIP | 16 hours ago |
| OM | 16 hours ago |
| WAB | 16 hours ago |
| TEX | 16 hours ago |
| RHI | 17 hours ago |
| GPI | 17 hours ago |
| HBAN | 17 hours ago |
| FCX | 17 hours ago |
| AGCO | 17 hours ago |
| PII | 17 hours ago |
| CHRW | 17 hours ago |
| CSL | 18 hours ago |
| WEX | 18 hours ago |
| ATMU | 18 hours ago |
| MHO | 18 hours ago |
| ITW | 18 hours ago |
| SXT | 18 hours ago |
| AXTA | 19 hours ago |
| TROW | 19 hours ago |
| DCH | 19 hours ago |