Deluxe (DLX) Risk Analysis

Rapid, significant, and disruptive technological changes impact the markets for our products and services, including changes in payment and internet browser technologies and the use of artificial intelligence and machine learning, as well as developments in technologies supporting our regulatory and compliance obligations and in-store, digital, mobile and social commerce. The introduction of competing products and services using new technologies, the evolution of industry standards or the introduction of more attractive products or services, including continued increases in the digitization of payments, could make some of our products and services less desirable, or even obsolete. Our ability to enhance our current products and services and to develop and introduce innovative products and services will significantly affect our future success. The impact is magnified by the intense competition we face. To be successful, our technology-based products and services must keep pace with technological developments and evolving industry standards, address the ever-changing and increasingly sophisticated needs of our customers, and achieve market acceptance. Additionally, we must differentiate our service offerings from those of our competitors and from the in-house capabilities of our customers. We could lose current and potential customers if we are unable to develop products and services that meet changing demands in a timely manner. Additionally, we must continue to develop our skills, tools and capabilities to capitalize on existing and emerging technologies, and this requires significant investment, takes considerable time and ultimately, may not be successful. Any of the foregoing risks could result in harm to our business, results of operations and growth prospects.

We rely on a combination of trademark and copyright laws, trade secret and patent protection, and confidentiality and license agreements to protect our trademarks, software and other intellectual property. These protective measures afford only limited protection. Despite our efforts to protect our intellectual property, third parties may infringe or misappropriate our intellectual property or otherwise independently develop substantially equivalent products or services that do not infringe on our intellectual property rights. Policing unauthorized use of our intellectual property is difficult. We may be required to spend significant resources to protect our trade secrets and to monitor and police our intellectual property rights. The loss of intellectual property protection or the inability to secure or enforce intellectual property protection could harm our business and ability to compete. FINANCIAL RISKS

Information security risks have increased in recent years, in part because of the proliferation of new technologies and an increase in remote work arrangements, as well as the increased sophistication and activities of hackers, terrorists and activists. We use internet-based channels that collect customers' financial account and payment information, as well as other sensitive information, including proprietary business information and personally identifiable information of our customers, employees, contractors, suppliers and business partners. Each year, we process hundreds of millions of records containing data related to individuals and businesses. We also provide services that are instrumental in supporting our customers and their businesses, such as merchant services and remittance processing. Cybersecurity is one of the top risks identified by our Enterprise Risk Management Committee, as technology-based organizations such as ours are vulnerable to targeted attacks aimed at exploiting network and system weaknesses. The secure and uninterrupted operation of our networks and systems, as well as the processing, maintenance and confidentiality of the sensitive information that resides on our systems, is critical to our business operations and strategy. We have a risk-based information/cybersecurity program dedicated to protecting our data and solutions. We employ a defense-in-depth strategy, utilizing the concept of security layers and the CIA (confidential, integrity and availability) triad model. Computer systems and networks are, by nature, vulnerable to unauthorized access. An accidental or willful security breach could result in unauthorized access and/or use of customer information, including consumers' personally identifiable information or, in some cases, the protected health information of certain individuals. Our security measures could be breached by third-party action, computer viruses, accidents, employee or contractor error, or malfeasance by rogue employees. Individuals or third parties may be able to circumvent controls and/or exploit vulnerabilities that may exist, resulting in the disclosure or misuse of sensitive business and personal customer or employee information and data. We depend on a number of third parties, including vendors, developers and partners, that are critical to our business and to which we may grant access to our customer or employee data. We have established a vendor security program that assesses the risk of these partners, and certain of our third-party relationships are subject to security requirements as specified in written contracts. However, we cannot control the actions of our third-party providers, and any cyberattacks or security breaches they experience could adversely affect our ability to service our customers or otherwise conduct our business. Because techniques used to obtain unauthorized access, disable or degrade service, or sabotage computer systems change frequently, may be difficult to detect immediately, and generally are not recognized until they are launched against a target, we may be unable to implement adequate preventive measures. Unauthorized parties may also attempt to gain access to our systems or facilities through various means, including hacking into our systems or facilities, fraud, trickery or other means of deceiving employees and contractors. Additionally, our customers and employees have been and will continue to be targeted by threat actors using social engineering techniques to obtain confidential information or using fraudulent "phishing" emails to introduce malware into the environment. To-date, these various threats and incidents have not materially impacted our customers, our business or our financial results. However, our technologies, systems and networks are likely to be the target of future attacks due to the increasing threat landscape for all technology businesses, and we can provide no assurance that future incidents will not be material. Despite our significant cybersecurity systems and processes, a party that circumvents our security measures could misappropriate our own, our customers' or our partners' personal or proprietary information, cause interruption in our operations, damage our computers or those of our users, or otherwise damage our reputation, all of which could deter clients and consumers from ordering our products and services and result in the termination of client contracts. Additionally, it is possible that there could be vulnerabilities that impact large segments of mobile, computer or server architecture. Any of these events would adversely affect our business, financial condition and results of operations. In addition, if we were to experience a material information security breach, we may be required to expend significant amounts of management time and financial resources to remedy, protect against or mitigate the effects of the breach, and we may not be able to remedy the situation in a timely manner, or at all. Furthermore, under payment card association rules and our contracts with debit and credit card processors, if there is a breach of payment card information that we store or that is stored by third parties with which we do business, we could be liable to the payment card issuing banks for their cost of issuing new cards and other related expenses. We could also lose our ability to accept and process credit and debit card payments, which would likely result in the loss of customers and the inability to attract new customers. We could also be exposed to time-consuming and expensive litigation, government inquiries and/or enforcement actions. If we are unsuccessful in defending a claim regarding information security breaches, we may be forced to pay damages, penalties and fines, and our insurance coverage may not be adequate to compensate us fully for any losses that may occur. Contractual provisions with third parties, including cloud service providers, may limit our ability to recover losses resulting from the security breach of a business partner. There are international, federal and state laws and regulations requiring companies to notify individuals of information security breaches involving their personal data, the cost of which would negatively affect our financial results. These mandatory disclosures regarding an information security breach often lead to widespread negative publicity. If we were required to make such a disclosure, it may cause our clients and customers to lose confidence in the effectiveness of our information security measures. Likewise, general publicity regarding information security breaches at other companies could lead to the perception among the general public that e-commerce is not secure. This could decrease traffic to our websites, negatively affect our financial results and limit future business opportunities.

The satisfactory performance, reliability and availability of our information technology systems, and those of our third-party service providers, is critical to our reputation and our ability to attract and retain customers. We could experience temporary interruptions in our websites, transaction and payment processing systems, network infrastructure, service technologies, printing production facilities or customer service operations for a variety of reasons, including, among others, human error, software errors or design faults, security breaches, power loss, telecommunications failures, equipment failures, electrical disruptions, labor issues, vandalism, fire, flood, extreme weather, terrorism and other events beyond our control. In addition, certain of the services we deliver to the payments technology market are designed to process complex transactions and deliver reports and other information on those transactions, all at very high volumes and processing speeds. Any failure to deliver an effective and secure product or any performance issue that arises with a new product or service could result in significant processing or reporting errors or other losses. We have invested, and will continue to invest, significant resources to build out, maintain and improve our technology platforms. Any disruptions, delays or deficiencies in the design, implementation or operation of our systems, particularly any disruptions, delays or deficiencies that impact our operations, could adversely affect our ability to effectively run and manage our business. Frequent or persistent interruptions in our operations could cause customers to believe that our products and services are unreliable, leading them to switch to our competitors or to avoid our products and services. A substantial portion of our applications reside in a cloud-based environment. While we maintain redundant systems and backup databases and applications software designed to provide continuous access to cloud services, it is possible that access to our software capabilities could be interrupted and our disaster recovery planning may not account for all eventualities. The failure of our systems could interfere with the delivery of products and services to our customers, impede our customers' ability to do business and result in the loss or corruption of critical data. In addition to the potential loss of customers, we may be required to incur additional development costs and divert technical and other resources, and we may be the subject of negative publicity and/or liability claims. If any of our significant information technology systems suffer severe damage, disruption or shutdown, and our disaster recovery and business continuity plans do not effectively resolve the issue in a timely manner, our results of operations would be adversely affected, and our business interruption insurance coverage may not be adequate to compensate us fully for any losses we may incur. Moreover, to the extent that any system failure or similar event results in damages to our customers or contractual counterparties, those customers and contractual counterparties could seek compensation from us for their losses, and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address.

We operate in a rapidly changing technological environment that requires a wide ranging set of expertise and intellectual capital. To successfully compete and grow, we must recruit, develop, motivate and retain personnel who can provide the needed expertise across the organization. In addition, we must develop our personnel to fulfill succession plans capable of maintaining continuity in the midst of the inevitable unpredictability of human capital. Competition for employees is intense. We have implemented various human capital initiatives, including employee wellness initiatives, employee resource groups and a revised performance management process, to make Deluxe an attractive place to work. As remote working arrangements have become more widely accepted, it is more challenging for us to maintain and enhance our corporate culture and to navigate the flexible working arrangements that employees may demand. Our work environment may not meet the needs or expectations of our employees or may be perceived as less favorable compared to other companies' polices, which could negatively impact our ability to hire and retain qualified personnel. We can provide no assurance that key personnel, including our executive officers, will continue to be employed, or that in the event we have to replace key employees, that labor costs will not increase. Failure to retain or attract key personnel could have a material adverse effect on our business, financial condition and results of operations.

We have entered into agreements with third-party providers for information technology services, including telecommunications, network server, cloud computing and transaction processing services. In addition, we have agreements with companies to provide services related to our online payment solutions, including financial institutions that provide clearing services in connection with our merchant services settlement activities, and we have outsourced certain activities, including portions of our finance and procurement functions. A service provider's ability to provide services could be disrupted for a variety of reasons, including, among others, human error, software errors or design faults, security breaches, power loss, telecommunications failures, equipment failures, electrical disruptions, labor issues, vandalism, fire, flood, extreme weather, terrorism and other events beyond their control. In the event that one or more of our service providers is unable to provide adequate or timely services, our ability to deliver products and services to our customers could be adversely affected. Although we believe we have taken reasonable steps to protect our business through contractual arrangements with our service providers, we cannot completely eliminate the risk of disruption in service. Any significant disruption could harm our business, including damage to our brand and loss of customers. Additionally, although we believe that most of these services are available from numerous sources, a failure to perform by one or more of our service providers could cause a material disruption in our business while we obtain an alternative service provider. The use of substitute third-party providers could also result in increased expense. Additionally, while we have policies and procedures for managing these relationships, they inherently involve a lesser degree of control over business operations, governance and compliance, thereby potentially increasing our financial, legal, reputational and operational risk.

Competition in the payments industry is intense. We are competing against numerous financial technology ("Fintech") companies, including independent payment processors, credit card processing firms and treasury management service providers, as well as financial institution in-house capabilities. Volume is the key to remaining cost-competitive, and breadth of services is critical to staying relevant to customers. In addition, although we are a leading check printer in the U.S., we face considerable competition in the check printing portion of the payments industry from another large check printer in our traditional financial institution sales channel, from direct mail and internet-based sellers of personal and business checks, from check printing software vendors, and from certain significant retailers. Pricing continues to be competitive in our financial institution sales channel, as financial institutions seek to maintain their previous levels of profitability, even as check usage declines. Within our Data Solutions segment, our data-driven marketing services face competition from a wide variety of companies in the data solutions space, including advertising agencies, marketing technology firms, data aggregators and brokers, and source data providers. Adapting to new technology is a key challenge in this business, along with hiring and retaining the right people. Within our Promotional Solutions segment, the markets for business forms and promotional products are intensely competitive and highly fragmented. Current and potential competitors include traditional storefront printing companies, office superstores, wholesale printers, online printing companies, small business product resellers, and providers of custom apparel and gifts. The competitive landscape for online suppliers continues to be challenging as new businesses enter the space. We can provide no assurance that we will be able to compete effectively against current and future competitors. Our competitors may develop better products or technologies and may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. Continued competition could result in price reductions, reduced profit margins and/or loss of customers, all of which would have an adverse effect on our results of operations and cash flows.

We have developed a strong and trusted brand that has contributed significantly to the success of our business. We believe that maintaining and promoting our brand in a cost-effective manner is critical to achieving widespread acceptance of our products and services, expanding our base of customers, and attracting and retaining top talent. We believe that the importance of brand recognition and trust is particularly essential for the success of our various service offerings because of the level of competition for these services. Customer awareness of our brand, as well as the perceived value of our brand, depends largely on the success of our marketing efforts, our ability to continue to provide useful, reliable, secure and innovative products and services, and our ability to maintain trust and be a technology leader. If we fail to successfully promote and maintain our brand or if we incur excessive expenses in this effort, our business could be materially and adversely affected. There is also the risk that adverse publicity, whether or not justified, could adversely affect our business. If our business partners or key employees are the subject of adverse news reports or negative publicity, our reputation may be tarnished and our results of operations could be adversely affected. A component of our brand promotion strategy is building on our relationship of trust with our customers, which we believe can be achieved by providing a high-quality customer experience. We have invested, and will continue to invest, in website development, design and technology, and customer service and production operations. Our ability to provide a high-quality customer experience is also dependent on external factors, including the reliability and performance of our suppliers, telecommunications providers and third-party carriers. Our brand value also depends on our ability to protect and use our customers' data in a manner that meets expectations. The failure of our brand promotion activities to meet our expectations or the failure to provide a high-quality customer experience for any reason could adversely affect our ability to attract new customers and maintain customer relationships, which would adversely harm our business and results of operations.

From time to time, we are involved in claims, litigation and other proceedings related to the conduct of our business, including purported class action litigation. Such legal proceedings may include claims related to our employment practices; claims alleging breach of contractual obligations; claims asserting deceptive, unfair or illegal business practices; claims alleging violations of consumer protection-oriented laws; claims related to legacy distributor account protection rights; or claims related to environmental matters. In addition, third parties may assert patent and other intellectual property infringement claims against us and/or our clients, which could include aggressive and opportunistic enforcement of patents by non-practicing entities. Any such claims could result in litigation against us and could also result in proceedings being brought against us by various federal and state agencies that regulate our businesses. The number and significance of these claims and proceedings has increased as our businesses have evolved and expanded in scope. These claims, whether successful or not, could divert management's attention, result in costly and time-consuming litigation, or both. Accruals for identified claims or lawsuits are established based on our best estimate of the probable liability. However, we cannot accurately predict the ultimate outcome of any such proceedings due to the inherent uncertainties of litigation and other dispute resolution mechanisms. Any unfavorable outcome of a material claim or material litigation could require the payment of monetary damages or fines, attorneys' fees or costly and undesirable changes to our products, features or business practices, which would result in a material adverse effect on our business, financial condition and results of operations.

Economic conditions have affected, and will continue to affect, our results of operations and financial position. Current and future economic conditions that affect inflation, business and consumer spending, including levels of business and consumer confidence, unemployment levels, consumer spending and the availability of credit, as well as uncertainty or volatility in our customers' businesses, may adversely affect our business and results of operations. A challenging economic environment could cause existing and potential customers to not purchase or to delay purchasing our products and services. Continued inflationary pressures could negatively impact our customers' ability to purchase our products and services, thereby negatively impacting our revenue and results of operations. A significant portion of our business relies on small business spending. We believe that small businesses are more likely to be significantly affected by economic conditions than larger, more established companies. During a sluggish economy, it may be more difficult for small businesses to obtain credit and they may choose to spend their limited funds on items other than our products and services. As such, the level of small business confidence, the rate of small business formations and closures, and the availability of credit to small businesses all impact our business. A significant portion of our business also relies upon the health of the financial services industry. As a result of global economic conditions in past years, a number of financial institutions sought additional capital, merged with other financial institutions and, in some cases, failed. The failure of one or more of our larger financial institution clients, or large portions of our customer base, could adversely affect our operating results. In addition to the possibility of losing a significant client, the inability to recover prepaid product discount payments made to one or more of our larger financial institution clients, or the inability to collect accounts receivable or contractually required contract termination payments, could have a negative impact on our results of operations. There may also be an increase in financial institution mergers and acquisitions during periods of economic uncertainty or as a result of other factors affecting the financial services industry. Such an increase could adversely affect our operating results. Often the newly combined entity seeks to reduce costs by leveraging economies of scale in purchasing, including its check supply and business services contracts. This results in providers competing intensely on price in order to retain not only their previous business with one of the financial institutions, but also to gain the business of the other party in the combined entity. Although we devote considerable effort toward the development of a competitively-priced, high-quality selection of products and services for the financial services industry, there can be no assurance that significant financial institution clients will be retained or that the impact of the loss of a significant client can be offset through the addition of new clients or by expanded sales to our remaining clients. Global events, such as outbreaks of illnesses, pandemics like COVID-19, or other political and economic instability, significantly increase economic uncertainty. Given the ongoing and dynamic nature of these events, we cannot predict the impact on our business, financial position or results of operations. Even after such impacts subside, the U.S. economy may experience a recession, and our business could be adversely affected by a prolonged recession.