Healthequity (HQY) Risk Factors

We believe that many consumers are not familiar with, or do not fully appreciate, the tax-advantaged benefits of HSAs and other CDBs. Our success depends on the willingness of consumers to increase their use of HSAs and other CDBs, our ability to increase engagement, and our ability to demonstrate the value of our services to our existing and potential Clients, Network Partners and members. If our members do not fully use their HSAs or CDBs, if employers reduce or cease to offer HSAs or other CDB programs, if the rate of adoption of these accounts decreases, if existing Clients, Network Partners and members do not recognize or acknowledge the benefits of our services or we do not drive engagement, then the market for our services might decline or develop more slowly than we expect, which could adversely affect our operating results.

State and federal laws and regulations govern the collection, dissemination, access, and use of personally identifiable information, including HIPAA and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which govern protected health information, and the Gramm-Leach-Bliley Act, which governs nonpublic personal information. In the provision of services, we and our third-party service providers collect, access, use, maintain, and transmit personally identifiable information in ways that are subject to these laws and regulations. Although we have implemented measures to comply with these privacy and data protection laws and regulations, we have experienced data privacy incidents in the past, though none have materially impacted our operations or financial condition. Any further unauthorized disclosure of personally identifiable information experienced by us or our third-party service providers that process such information on our behalf could result in substantial financial and reputational harm to us, including possible criminal and civil penalties. In situations where we are subject to HIPAA and HITECH, in which we are a business associate providing services to covered entities, the covered entities direct HIPAA compliance matters in the event of a security breach, which complicates our ability to address harm caused by the breach. Additionally, as we have in connection with prior security incidents, we may be required to notify impacted individuals, plan sponsors, and regulatory authorities depending on the severity of the breach, our role, legal requirements, and contractual obligations. Privacy and data protection regulation have become priority issues in many states, and as such the regulatory environment is continually changing. For example, the CCPA provides a private right of action for data breaches. Additional privacy requirements are expected as new state and federal privacy laws are enacted. Continued compliance with current and potential new privacy and data protection laws and regulations, and meeting expectations with respect to the control of personal data in a rapidly changing technology environment, could result in higher compliance and technology costs for us, as well as costly penalties in the event we are deemed to not be in compliance with such laws and regulations.

We intend to continue to invest in technology and development to create new and enhanced products and services to offer our customers and to enhance the capabilities of our platforms. We may not be able to anticipate or manage new risks and obligations or legal, compliance, or other requirements that may arise in these areas. The anticipated benefits of such new and improved products and services may not outweigh the costs and resources associated with their development. Some new services may be received negatively by our existing and/or potential customers and strategic partners and have to be put on hold or canceled entirely. Our ability to attract and retain new customer revenue from existing customers will depend in large part on our ability to enhance and improve our existing products and services and to introduce new products and services. The success of any enhancement or new product or service depends on several factors, including the timely completion, introduction, and market acceptance of the enhancement or new product or service. Any new product or service we develop or acquire may not be introduced in a timely or cost-effective manner and may not achieve the broad market acceptance necessary to earn significant revenue. If we are unable to successfully develop or acquire new products or services or enhance our existing products or services to meet member or network partner requirements, our results of operations, financial condition, business or prospects may be materially adversely affected.

Our proprietary technology platforms enable the exchange of, and access to, sensitive information, and, as a result, we are frequently the target of cyber-attacks or other privacy or data security incidents. As one of the largest providers of HSAs and other CDBs, we are an attractive target for cyber-attacks, including ransomware attacks, which means we must continue to secure and monitor each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture. In addition, geopolitical events, including the war between Russia and Ukraine, have resulted in, and may continue to result in, an increase in cyber-attacks. Substantially all of our workforce works remotely. This remote work environment increases the risk of cybersecurity breaches and incidents, and the potential impact of these on our operations is also higher while our team members log in to our network remotely. Our ability to ensure the security of our technology platforms and thus sensitive customer and partner information is critical to our operations. We rely on standard Internet and other security systems to provide the security and authentication necessary to effect secure transmission of data. Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers and other malfeasance. Such security breaches could compromise our networks, or those of third-party service providers on which we rely, and result in the information stored or transmitted there to be accessed, modified or used in an unauthorized manner, publicly disclosed, lost, or stolen. Such access, use, disclosure, or other loss of information could result in regulatory scrutiny, legal claims or proceedings leading to liability, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our Clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position. Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties and other liabilities, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our members, Clients and Network Partners. Such breaches could damage our reputation, and cause a loss of confidence in our products and services, reducing demand and resulting in an unwillingness of members, Clients, Network Partners and other data owners to provide us with their payment information or personal information, and otherwise harm our brand. Furthermore, if third parties improperly obtain and use the personal information of our members, we may be required to expend significant resources to resolve these problems. While we have security measures in place, we have experienced data privacy incidents in the past, including several incidents in 2018. As a result, or if our security measures are breached again or unauthorized access to data is otherwise obtained as a result of third-party action, team member error or otherwise, our reputation could be significantly damaged, our business may suffer and we could incur substantial liability, which could result in loss of sales, Clients and Network Partners. Because techniques used to obtain unauthorized access to or sabotage systems change frequently and such novel techniques may not be identified until they are launched against a target, we may be unable to anticipate, or to implement adequate preventative measures to address, these techniques. Any or all of these issues could negatively impact our ability to attract new, or increase engagement by, members, Clients and Network Partners, and subject us to third-party lawsuits, regulatory fines, contractual liability, and other action or liability, thereby harming our operating results or financial condition.

The market for our products and services is highly competitive. We view our competition in terms of direct and indirect competitors. Our direct HSA competitors are HSA custodians and administrators that include state or federally chartered banks, such as Webster Bank and Optum Bank, insurance companies, well-known retail investment companies, such as Fidelity Investments, and non-bank custodians approved by the U.S. Treasury. We also have numerous indirect HSA administration competitors, including benefits administrators and health plans, that license technology platforms and partner with other HSA custodians to provide "white label" HSA offerings. Our other CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks, and these competitors have entered, and others may also enter, the HSA market or expand existing HSA offerings to compete with us. An increased focus on HSA-favorable healthcare regulatory reforms may create renewed interest and investment by our competitors in their HSA offerings and lead to greater competition, which could make it harder for us to maintain our growth trajectory. This risk would be compounded if legal requirements or administrative rules are interpreted in a way that makes compliance more onerous for us than for our competitors. If one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively. Our competitors have and may continue to establish or strengthen cooperative relationships with our current or future Network Partners or other strategic partners, thereby limiting our ability to promote our solution with these parties. We have seen an increase in Network Partners that have decided to offer HSAs or other CDBs directly to their customers, and a continuation of this trend would significantly reduce our channel partner opportunities and result in account attrition. Well-known retail mutual fund companies, such as Fidelity Investments, have entered the HSA and CDB business and gained significant market share. Our market share could decline if Fidelity and other mutual fund companies continue expanding their presence in the market. These investment companies have significant advantages over us in terms of brand name recognition, years of experience managing tax-advantaged retirement accounts (e.g., 401(k) and IRA), highly developed recordkeeping, trust functions, and fund advisory and customer relations management, among others. If we are unable to compete effectively with these mutual fund company competitors, our results of operations, financial condition, business, and prospects could be materially adversely affected. Many of our competitors, in particular banks, insurance companies, and other financial institutions, have longer operating histories and significantly greater financial, technical, marketing, and other resources than we have. As a result, some of these competitors are in a position to devote greater resources to the development, promotion, sale, and support of their products and services and have offered, or may in the future offer, a wider range of products and services that are increasingly desired by potential customers, and they have also used advertising and marketing strategies (including loss-leaders) that achieve broader brand recognition or acceptance. Finally, our competitors may have the ability to devote more financial and operational resources than we can to developing new technologies and services, including services that provide improved operating functionality, and adding features to their existing service offerings. If successful, their development efforts could render our services less desirable, resulting in the loss of our existing customers or a reduction in the fees we earn from our products and services.

Our success depends, in part, on the skills, working relationships and continued services of our executive leadership team and other key personnel. While we have entered into employment agreements with our executive officers, all of our team members are "at-will" employees, and their employment can be terminated by us or them at any time, for any reason, and without notice, subject, in certain cases, to severance payment rights. In order to retain valuable team members, in addition to salary and cash incentives, we provide equity-based awards that vest over time or based on performance. The value to team members of these awards will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other organizations. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual, or that a replacement could be hired on terms that are favorable to us. Volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart. Our success also depends on our ability to attract, retain, and motivate additional skilled management personnel and other team members. For example, competition for qualified personnel in our field is intense due to the limited number of individuals who possess the skills and experience required by our industry. New hires require significant training and, in most cases, take significant time before they achieve full productivity. New team members may not become as productive as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. If our retention efforts are not successful or our team member turnover rate increases in the future, our business, results of operations and financial condition could be materially and adversely affected.