Fiscal period ending 2026-04-03 versus 2025-03-28
— view filing on EDGAR →
Regulatory and legal exposure has materially broadened across consumer financial services, earned wage access, digital assets, AI, and data privacy — with new disclosures of potential fines, product pauses, and business discontinuation risks spanning multiple regulators (SEC, CFPB, state agencies, GDPR authorities). AI-related risks have escalated on two fronts simultaneously: expanded regulatory scrutiny (AI-washing, federal-state conflict) and a materially enlarged cyber attack surface from agentic AI systems. The one partial offset — removal of detailed blockchain/digital assets risk language — likely reflects business exit rather than resolved regulatory risk, and does not meaningfully counterbalance the breadth of new exposures.
5 company-specific
· 1 eased/removed
· 3 common-mode
Company-specific changes
New
New disclosure of material licensing and regulatory risks across consumer financial services, earned wage access, loans, and digital assets. Explicitly warns of potential fines, injunctive relief, business discontinuation, and uninsured customer losses.
If we fail to operate in compliance with state or local licensing requirements, it could adversely affect our business, financial condition, results of operations and cash flows. Certain states and…
Revised
New specific risks added: AI-washing allegations, agentic AI threats, federal-state regulatory conflict, and customer reliance on AI outputs for critical decisions.
Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational…
Revised
New specific disclosure of earned wage access (Instacash) regulatory risk, including state-level inquiries, potential product pauses, and litigation exposure from regulatory changes.
The legal and regulatory regimes governing certain of our products and services are uncertain and evolving. Changes in the laws, regulations and enforcement priorities applicable to our business…
Revised
New disclosure of SEC regulation of ML Wealth investment adviser subsidiary and expanded CFPB supervisory risk. Escalates regulatory exposure materially.
RISKS RELATED TO LEGAL AND COMPLIANCE Our solutions are highly regulated, which could impede our ability to market and provide our solutions, increase regulatory scrutiny or adversely affect our…
Revised
Added forward-looking language about ongoing and future litigation/investigations by governmental agencies and private parties, broadening disclosed legal exposure beyond the specific CFPB Military Lending Act case.
If loans made by our lending subsidiaries in our consumer lending business are found to violate applicable federal or state interest rate limits or other provisions of applicable consumer lending…
Eased / removed
Removed
Removal of detailed digital assets regulatory risk disclosure signals material de-escalation or exit from blockchain business exposure previously flagged as significant.
The regulatory regime governing blockchain technologies and digital assets is uncertain, and new laws, regulations or policies may alter our business practices with respect to digital assets. We…
Also disclosed — common-mode (Generative AI competition disruption, AI cybersecurity escalation, Data privacy regulation)
Generative AI competition disruption
Revised
Added explicit acknowledgment of "significant competitive pressures" already experienced and expected to continue. New emphasis on pricing pressure risk and native OS security features reducing demand.
We operate in a highly competitive and dynamic environment, and if we are unable to compete effectively, we could experience a loss in market share and a reduction in revenue. We operate in intensely…
AI cybersecurity escalation
Revised
New disclosure of agentic AI attack surface risk—autonomous systems with data/tool access enabling multi-step attacks evading traditional controls. Material escalation of cyber threat profile.
Our solutions, systems, websites and the data on these sources have been and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales. Information…
Data privacy regulation
Revised
Added explicit GDPR/UK GDPR exposure with substantial fines risk and new AI data transparency concerns regarding third-party AI training data sources and validation risks.
We collect, use, disclose, store or otherwise process personal information and other sensitive data, which is subject to stringent and changing state and federal laws and regulations. In the…