A. [Reserved] B. Capitalization and Indebtedness Not applicable. C. Reasons for the Offer and Use of Proceeds Not applicable. D. Risk Factors You should carefully consider the risks and uncertainties described below and the other information in this Annual Report before making an investment decision. Our business, financial condition, results of operations or strategic objectives could be materially and adversely affected by any of these risks and uncertainties. The trading price and value of our Class A ordinary shares could decline due to any of these risks and uncertainties, and you may lose all or part of your investment. This Annual Report also contains forward-looking statements that involve risks and uncertainties. See “Cautionary Note Regarding Forward-Looking Statements.” Our actual results could differ materially from those anticipated in these forward-looking statements as a result of certain factors, including the risks and uncertainties faced by us described below and elsewhere in this Annual Report. Risks Relating to Our Business and Industry We have experienced substantial growth since our inception. If we fail to manage our growth effectively, then our revenues, results of operations, and financial condition may be adversely affected. We have experienced substantial growth in our business since inception in 2012. Our revenue was $344.6 million and $327.5 million for the years ended December 31, 2025 and 2024, respectively, representing an increase of 5% year-over-year. Our historical revenue growth may not be sustainable and should not be considered indicative of our future performance. Since launching our business, we have frequently expanded and enhanced our products, extended our geographic presence, and changed our pricing methodologies. This evolution and associated growth makes it difficult to evaluate our future operational and financial prospects and to plan for and model future growth in light of the risks and uncertainties we may encounter. These risks and uncertainties include our ability to: •accurately forecast our revenue and plan our operating expenses; •increase the number of new merchants and retain existing merchants using our products; •successfully compete with current and future competitors; •successfully expand our business in existing markets, and enter new markets and geographies; •anticipate and respond to macroeconomic changes and changes in the markets in which we operate; 7 •successfully execute on our growth initiatives while also focusing on enhanced expense discipline and path to profitability; •accurately adjust our pricing structures for our products; •maintain and enhance the value of our reputation and brand; •adapt to rapidly evolving trends in the ways merchants and consumers interact with, and shop using, technology, including the increasing popularity and nascent adoption of Agentic Commerce by consumers; •accurately predict projected chargeback expenses, especially in new industry verticals, new geographies and with respect to new payment methods, if new fraud patterns develop more quickly than our ability to detect and block those new fraud patterns, or if data attributes that we collect and on which our artificial intelligence, machine learning models and automated decision making technologies (collectively, “AI Technologies”) rely change or become unavailable as a result of changes in consumer purchasing practices or for any reason; •avoid interruptions or disruptions to our service; •develop a scalable, high-performance technology infrastructure that can efficiently and reliably handle increased usage, as well as the deployment of new features and products; and •hire, integrate, and retain talented technology, sales, and other personnel. In addition, any material decline in global ecommerce transaction volumes in the future, for whatever reason, may adversely impact our future revenues and financial condition. If we fail to anticipate and address the risks and difficulties we face, including those described elsewhere in this “Risk Factors” section, our business, financial condition, and results of operations could be adversely affected. We are dependent upon the continued use of credit and debit cards and other payment methods that expose our merchants to the risk of payment fraud as a primary means of payment for ecommerce transactions. Changes in laws and regulations, including card scheme rules, related to use of these types of payment methods, the emergence of alternative payment products, or the general public’s use of such alternative payment methods has, and may in the future reduce or change the use-cases for our products, and has and could continue to adversely affect our revenues, our results of operations and financial condition. The future success of our business depends upon the continued use of credit and debit cards and other payment methods that expose our merchants to the risk of payment fraud as a primary means to pay for online purchases and conduct commercial transactions that expose our merchants to the risk of payment fraud. Federal, state or foreign government bodies or agencies have in the past adopted, and may in the future adopt, laws or regulations affecting the use of such payment methods, including with respect to card-not-present transactions. In addition, card schemes such as Visa, Mastercard and American Express, impose rules and other requirements on participants in the payment chain. Changes in these laws, regulations or card scheme rules and terms and conditions of other payment providers could require us to modify our products in order to comply with these changes. In addition, the adoption, implementation and evolution of laws, regulations or card scheme rules that operate to reduce fraudulent transactions, shift liability for certain transactions away from merchants and on to other participants in the payments chain, or route transactions through networks or payments rails with different chargeback rules may adversely affect the use-cases and demand for our products, our business, financial condition, and results of operations or require us to make changes to our business and strategies. In addition, to the extent the performance of strong factor authentication protocols, such as 3D 8 Secure, improves over time, or merchant risk profiles or consumer preferences shift over time, we may begin to see merchants electing to voluntarily adopt similar protocols with respect to online transaction volume. The adoption of 3D Secure or other strong factor authentication protocols that reduce online payment fraud, or shift the liability for online payment fraud away from the merchant, may reduce the demand or use-cases for our products, reduce the GMV available for us to review, and could adversely affect our revenues, our results of operations and financial condition. Further, we depend upon the general public’s continued willingness to use credit cards and other payment methods that expose our merchants to the risk of payment fraud as a primary means to pay for online purchases and conduct commercial transactions. While we are able to review and guarantee transactions completed using alternative ecommerce payment methods, such as Apple Pay, Google Pay and PayPal, the increased availability of, and adoption by our merchants and by the general public of these and other alternative payment methods (such as “buy now pay later” services, cryptocurrencies or “digital wallet” style products or real time payments, including those offered by large “traditional” financial institutions with large customer bases), which may be less susceptible to fraud, include native fraud management features, sit outside of the broader chargebacks regime or allow liability for online transactions to be shifted away from merchants, may reduce the attractiveness or use-cases of our products, reduce demand for our products and the GMV available for us to review, and may adversely affect our business, financial condition, and results of operations. If we are unable to attract new merchants, retain existing merchants or increase sales of our products to existing merchants, our business, financial condition and results of operations may be adversely affected. Our growth is dependent on our ability to continue attracting new merchants while retaining existing merchants and expanding and enhancing the products we sell to them. In particular, if we are not able to attract new merchants and increase the amount of transactions we process within our existing merchant network, we may not be able to continue to improve our products. Growth in the demand for our products may also be inhibited, and we may be unable to grow our merchant base for a number of reasons, including, but not limited to: •our failure to develop or offer new or enhanced products in a timely manner that are comparable with, or superior to, new technologies or competitor offerings, that meet the evolving needs of our merchants and changes in the regulatory environment in which we operate, and that respond to AI-driven advancements in consumer behavior and the payments ecosystem; •difficulties providing high quality support or maintaining a high level of merchant satisfaction, including satisfaction with our pricing and bundling models, which could reduce demand for our products if existing merchants terminate their relationship with us or stop referring prospective merchants to us; •increases in our merchant churn rates, including discounting and churn of significant merchants from whom we derive a significant percent of our revenue, which have in the past occurred and may occur for various reasons including, but not limited to, competition, financial condition of our merchants, corporate reorganizations, mergers and acquisitions or bankruptcies affecting our merchant base; •perceived or actual security, availability, integrity, privacy, reliability, quality, or compatibility problems with our products, including related to unscheduled downtime, outages, or network security breaches; and •continued or increased competition in our industry, including aggressive pricing methodologies, greater marketing efforts or investments by our competitors in advertising and promoting their brands or in product development. 9 Our future success depends, in part, on our ability to sell additional products to our existing merchants. If our merchants do not purchase additional products from us, or do not renew their agreements upon expiration, our business, financial condition, and results of operations may be adversely affected. Our merchant expansions and renewals have in the past, and may continue to, fluctuate as a result of a number of factors, including merchant usage, merchant satisfaction with our products and AI-powered ecommerce risk intelligence platform capabilities and merchant support, the capabilities of competing products, our prices, the prices of competing products, corporate reorganizations, mergers and acquisitions or bankruptcies affecting our merchant base, consolidation of affiliates’ multiple paid business accounts into a single paid business account, the effects of global economic conditions, including recession and inflation, or reductions in our merchants’ spending levels generally. These factors may be exacerbated if, consistent with our growth strategy, our merchant base continues to grow to encompass large online enterprises. We have a history of net losses and there are no assurances that we will achieve profitability in the future. We have not been profitable since our inception in 2012 and have incurred significant net losses in prior years, including net losses of $27.6 million and $34.9 million for the years ended December 31, 2025 and 2024, respectively. In addition, our ability to achieve and maintain profitability will depend, in part, on our ability to effectively manage and decrease our chargeback expenses, which is dependent on our ability to improve the accuracy of our products. The accuracy of our products is, in part, driven by the amount of information we are able to obtain from processing transactions. In addition, higher rates of inflation in the U.S. and globally, the recent strengthening of global currencies (including the New Israeli Shekel, or NIS) against the U.S. Dollar, and demand for high-tech personnel, have impacted, and may continue to impact our costs of labor and the prices at which we are able to acquire goods and services from third-party vendors on which we rely. In many instances, contractual restrictions in our merchant contracts, pricing power dynamics and other commercial considerations, mean that we are not able to, or choose not to increase the prices at which we sell our products and services to offset these higher costs, either partially or at all. We intend to continue enhancing and marketing our existing products and may develop and introduce new products through internal research and development, and we may also selectively pursue acquisitions. These efforts may prove more expensive than we currently anticipate. If our revenue declines, or fails to grow at a rate sufficient to offset increases in our operating expenses, we may continue to generate losses and not be able to achieve and maintain profitability in future periods. In addition, our ongoing focus on expense discipline, dilution management, capital allocation initiatives, and path to profitability may require us to reduce the resources we can allocate to growth initiatives, which may in turn result in slower than anticipated revenue growth. We cannot assure you that we will become profitable, or that if we do become profitable, we will be able to sustain profitability. Our revenue is impacted, to a significant extent, by macroeconomic and geopolitical conditions and the financial performance of our merchants. Our business, the ecommerce retail sector, and our merchants’ businesses are sensitive to macroeconomic and geopolitical conditions. Economic factors, such as interest rates, inflation, currency exchange rates, changes in monetary and related policies, changes in trade policies and tariffs, market volatility, consumer confidence, recession or recessionary indicators, supply chain issues, unemployment rates, shifts in consumer spending patterns (for example, between goods and services), and real wages, are among the most significant factors that impact consumer spending behavior. Weak economic conditions or a significant deterioration in economic conditions, including prolonged recession with sustained high interest rates and unemployment rates, may reduce the amount of disposable income available to consumers, which, in turn, reduces consumer spending and merchant transaction volumes. This has had, and may continue to have an adverse effect on our business, financial condition, and results of operations. 10 In particular, there are certain industries, including the luxury goods industry, that are particularly susceptible to recession and other macroeconomic conditions, such as inflation, that may reduce consumer discretionary spending. Similarly, external macroeconomic factors and business conditions including global supply chain disruptions, such as those experienced in many industries in previous years, resulted in and may in the future result in shortages of raw products and prolonged shipping and delivery times for consumer goods. This may in turn lead to decreased ecommerce transaction volumes as consumers instead opt to purchase stock-on-hand from bricks-and-mortar retailers, rather than transact through digital channels. Additionally, the U.S. government has adopted new approaches to U.S. trade policy, and in some cases has sought to, or may seek to renegotiate, or potentially terminate, certain existing bilateral or multi-lateral trade agreements. The U.S. government has also imposed tariffs on most foreign goods and has raised the possibility of imposing significant tariff increases or expanding the tariffs to capture other countries and types of goods. In response to these tariffs, other countries, including China, Canada, and the European Union, have implemented retaliatory tariffs on U.S. goods, though some retaliatory measures have been subsequently modified or suspended in connection with temporary truces and framework trade agreements. Any changes in the global trade environment, including government policies on international trade, such as export controls, new or increased tariffs for imported goods, new legislation or regulations on manufacturing or foreign investment, renegotiation of existing trade agreements with U.S. trading partners, or any retaliatory trade actions due to existing or future trade tension, including escalating trade tensions between the U.S., China and Europe, may disrupt global supply chains and could materially increase our merchants’ costs, which in turn may increase the costs of consumer goods and reduce our merchants’ ecommerce transaction volume. We cannot predict the likelihood, type, effect, or magnitude of any new tariffs or other trade restrictions or the impact that such restrictions would have on our merchants. Any reduction in our merchants’ transaction volume directly impacts the revenue we derive from them and, if such reduction continues for a prolonged period, could have a material adverse effect on our business, financial condition and results of operations. Our ability to review transactions for fraud, and the fees due to us associated with providing such products, depends upon sales of products and services by our merchants. Certain of our merchants’ sales have and may in the future decrease or fail to increase at rates consistent with prior performance, current expectations, or at all, as a result of factors outside of their control, such as the macroeconomic conditions referenced above, or business conditions affecting a particular industry vertical or region. In our experience, weak economic conditions can also extend the length of our merchants’ sales cycles, and cause consumers to delay making (or not make) purchases of our merchants’ products and services. Even in the absence of macroeconomic factors, the performance of our merchants directly impacts our business, and, as a result, if the sales volume and financial performance of a merchant is negatively impacted for reasons specific to such merchant, our revenues will be negatively impacted. In addition, a reduction in online engagement generally or for any of our individual merchants, including due to a general decrease in online spending or a decreased demand for any of our merchants’ products or services for any reason could lead to a decrease in our merchants’ ecommerce revenues, which, in turn, would harm our revenues or reduce the attractiveness of our products. Our estimates of market opportunity and forecasts of market growth may prove to be inaccurate, and even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all. Our market opportunity estimates and expectations about market growth that we use to manage our business and allocate resources are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. Even if the markets in which we compete meet those size estimates and growth expectations, we may be unable to capture some or all of that expanded opportunity for a variety of reasons and our business could fail to grow, which could adversely affect our results of operations. 11 We operate in a highly competitive industry. Competition presents an ongoing challenge to the success of our business. We operate in a highly competitive industry, and competition continues to increase with the introduction of new technologies and the entry of new competitors into the market, including risk scoring vendors that provide non-guaranteed decisions, typically at a lower price point. This increased competition harms our ability to attract new merchants, increase sales, maintain or increase renewals, and maintain or increase our prices. We believe that our ability to compete depends upon many factors both within and beyond our control, including the following: •the size of our merchant base; •the timing and market acceptance of products, including the developments and enhancements to those products, offered by us or our competitors; •the quality of our products, accuracy of our AI Technologies, and our merchant service and support efforts; •our selling and marketing efforts; •our continued ability to develop technology to support our business model; •our continued ability to develop and implement new products and features that are differentiated from and/or superior to our competitors’ offerings and which meet evolving merchant needs, use-cases and regulatory requirements and respond to technological shifts in consumer purchasing behavior; •our continued ability to expand into and localize our products in new geographies and new industry verticals in a timely manner; •the pricing structures and pricing practices employed by our competitors; •our ability to refine our pricing and product bundling strategies and practices in response to competitive pressures and trends; •our ability to continuously strengthen our contract renewal processes; and •our brand strength relative to our competitors. Many of our existing and potential competitors could have substantial competitive advantages, such as greater name recognition, longer operating histories, larger sales and marketing budgets, greater merchant support resources, lower labor and development costs, larger and more mature intellectual property portfolios and significantly greater financial, technical, marketing and other resources. Further, in addition to fraud detection and prevention, certain of our competitors, such as payment service providers, or PSPs, may offer a more comprehensive portfolio of products and services, which may make them more attractive to potential merchants. Our competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may allow them to attract merchants. Our competitors may develop products that are similar to our products or that are differentiated from our products and that achieve greater market acceptance than our products, which could attract merchants away from our products and reduce our market share. In addition, the industry that we operate in is highly competitive and there has been significant consolidation which is expected to continue. Any consolidation in our industry could result in existing competitors increasing their market share through business combinations and result in stronger competitors, which could adversely impact our business, financial condition and results of operations. We 12 may not be able to compete successfully in a more consolidated industry and cannot predict with certainty how industry consolidation will affect our competitors or us. Our competitors may also establish or strengthen cooperative relationships with our current or future strategic distribution and technology partners or other parties with whom we have relationships (i.e. channel partners), thereby limiting our ability to promote and implement our AI-powered ecommerce risk intelligence platform. These competitive pressures in our market, or our failure to compete effectively, may result in price reductions, lower transaction volumes, reduced revenue and gross profit margins, increased net losses, merchant-churn and loss of market share. Any failure to meet and address these factors may adversely affect our business, financial condition and results of operations. If we are unable to continue to improve our AI Technologies or if our AI Technologies contain errors or are otherwise ineffective, our growth prospects, business, financial condition, and results of operations may be adversely affected. Our products are based on our AI Technologies and our ability to attract new merchants, retain existing merchants, increase sales of our products to existing merchants and compete successfully depends in large part on our ability to maintain a high degree of accuracy and automation in our decisioning process. Maintaining or improving the level of accuracy in our decisioning process in turn allows us to maintain or improve approval rates for our merchants over time. If our AI Technologies fail to accurately detect fraud, detect fraud quickly enough or correctly categorize new risks relating to fraud, or if any of the other components of our automated decisioning process fail, we will typically experience higher than forecasted chargebacks, which in turn puts downward pressure on our gross margins, and may impact our ability to attract new merchants, retain existing merchants or increase sales of our products to existing merchants and our business, financial condition, and results of operations may be adversely affected. Our AI Technologies are designed to analyze data attributes to identify complex transaction and behavior patterns, which enables us to detect fraud and illegitimate consumers quickly and accurately. Our ability to accurately detect fraud even as methods of committing fraud evolve and become more sophisticated is dependent on our ability to continuously improve and train these models. However, our AI Technologies have at times been, and may in the future prove to be, less accurate than we expect, or than they have been in the past, for a variety of reasons, including inaccurate assumptions or other errors made in building or training such models, incorrect interpretations of the results of such models, increased fraud sophistication beyond the capabilities of our AI Technologies, evolving fraud methodologies (including the use of generative artificial intelligence in perpetrating fraud), evolving consumer ecommerce purchasing behavior (including nascent adoption of Agentic Commerce), and failure to timely update model assumptions and parameters. As a result, our AI Technologies have in the past not been, and may in the future not be able to effectively block fraudulent transactions. In addition, our AI Technologies may initially be less accurate following expansion into new industry verticals, geographic regions and use-cases, such as review of automated clearing house (“ACH”) payments or covering non-fraud related chargebacks. Further, the successful performance of our AI Technologies relies on the ability to constantly review and process large amounts of transactions and other data. If we are unable to attract new merchants, retain existing merchants or increase sales of our products to existing merchants, or if our merchants do not provide us with access to a significant volume of their transaction data, or if our transaction data collection integrations with our merchants’ front-end and back-end systems fail, or if the transaction data utilized by our AI Technologies is not available (for example, as a result of changing consumer ecommerce purchasing behavior), or if the number of transactions processed by our existing merchants declines, the amount of data reviewed and processed by our AI Technologies will be reduced or may fail to grow at a pace that will allow us to continue to improve the efficiency of our AI Technologies, which may reduce the accuracy of such models. Additionally, our AI Technologies may not be able to effectively account for matters that are inherently difficult to predict or are otherwise beyond our control, such as social engineering and other methods of perpetrating fraud, including through the use of 13 generative artificial intelligence or other emerging technologies, that do not lend themselves well to risk-based analysis. Material errors or inaccuracies in such AI Technologies could lead us to make inaccurate or sub-optimal operational or strategic decisions, which could adversely affect our business, financial condition and results of operations. Our inability to train our models or develop new technology that can detect new fraud schemes may also result in significant chargeback expenses, which would materially and adversely impact our business, financial condition, and results of operations. The data gathering for, and development of, our AI Technologies have predominantly occurred during a period of sustained economic growth, and our AI Technologies have not been extensively tested during a down-cycle economy or recession. For example, consumer spending patterns, transaction volumes and fraud patterns experienced during a down-cycle economy or recession may differ from those experienced during periods of sustained economic growth. There is no assurance that our AI Technologies can continue to accurately detect fraud under adverse economic conditions. If our AI Technologies are unable to accurately detect fraud under such economic conditions, the performance of our product may be worse than anticipated and we may be required to issue a significant amount of credits as a result of valid chargebacks, which would adversely affect our business, financial condition and results of operations. Our CTB Ratio and gross profit margin have historically and may in the future fluctuate from quarter-to-quarter, which makes these metrics difficult to predict. These metrics are managed, and should be analyzed, on an annual basis. Our CTB Ratio, which we use to evaluate the performance of our business operations and the effectiveness of our models, and gross profit margin are managed, and are best analyzed, on an annual basis. Historically, our CTB Ratio and gross profit margin have fluctuated between periods, and we expect that these financial metrics will continue to fluctuate between periods in the future, based on a number of factors, including changes in the mix of our merchant industry base, our entry into new geographies and industries, changes in the mix of credit and debit card transactions and transactions made via alternative payment methods, the risk profile of orders approved in the period, technological improvements in the performance of our models, seasonality, large-scale merchant fraud events or security incidents, expansion into other use-cases and other factors. For example, our CTB Ratio and gross profit margins are sometimes negatively impacted in the first several quarters following the onboarding of significant merchants in new industry verticals or geographic regions, as our AI Technologies adapt to the unique fraud patterns and other characteristics associated with transaction volume in those industries or regions. Model performance will generally normalize over time as our AI Technologies gather more data and their accuracy improves. We believe that similar trends will continue to affect our future quarterly performance. In addition, order populations in certain industry verticals or geographic regions may be more or less risky. For example, historically “tickets and travel” has been a higher-risk, lower-margin industry, while other industry verticals, such as “electronics” and “fashion and luxury” have been lower-risk, higher-margin industries. Any change in our merchant industry mix between periods is likely to impact our CTB Ratio and gross profit margin between periods. The variability and unpredictability of these or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to gross profit, EBITDA, Adjusted EBITDA and other operating results for a particular period. If we fail to meet or exceed such expectations, the market price of our Class A ordinary shares could fall substantially, and we could face costly lawsuits. Our products enable the collection and storage of Personal Information, as well as confidential or proprietary information of our merchants and their consumers, and security concerns could result in liability to us or inhibit sales of our products. In conducting our business, we rely heavily on computer systems, hardware, software, technology infrastructure and online websites and networks (collectively, “IT Systems”), including those of third-party service providers, for both internal and external operations. Our operations involve the storage, transmission and processing of our merchants’ and their consumers’ confidential proprietary data, which 14 can include information that relates to individuals and/or constitutes “personal data,” “personal information,” and “personally identifiable information,” as such terms and any similar terms are commonly understood and/or defined under applicable data privacy laws (collectively, “Personal Information”). Because we make extensive use of third-party suppliers and service providers, successful cyberattacks against such third parties’ IT Systems can also materially impact our operations and financial results. While we have developed systems and processes to protect our IT Systems and the integrity, confidentiality, availability and security of our data, our security measures or those of our third-party service providers, including, but not limited to, certain third-party providers of cloud-based infrastructure, such as Public Cloud Providers, have in the past resulted and could in the future result in unauthorized access to or disclosure, modification, misuse, loss or destruction of data, including Personal Information. Significant security breaches, computer malware, ransomware or extortion based attacks, exploited hardware or software bugs, distributed denial-of-service (“DDoS”) attacks, social engineering/phishing attacks, misconfigurations or similar vulnerabilities experienced by us or by our third-party service providers, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, could expose us to material impacts due to, for example, loss of Personal Information, confidential or proprietary information, operational disruptions, loss of business, severe reputational damage adversely affecting merchant or investor confidence, regulatory investigations and orders, litigation (including class action lawsuits), indemnity obligations, damages for contract breaches, fines and penalties for violations of applicable laws or regulations, significant costs for remediation, incentives offered to merchants or other business partners in an effort to maintain business relationships, and other liabilities. We regularly experience and expect to continue to experience actual and attempted cyber-attacks on our IT Systems, such as through phishing scams and ransomware. For example, in the aftermath of Hamas’ attack on Israel on October 7, 2023, many Israeli websites reported a significant increase in DDoS attacks. Although no actual or attempted cyber-attacks to date, individually or in the aggregate, has had a material adverse impact on our operations or financial condition, we cannot guarantee that material incidents will not occur in the future. Cyberattacks and other malicious Internet-based activity continue to increase generally. Further, because our products and services are integrated with our customers’ systems and processes, the circumvention, disruption or failure of our cybersecurity defenses or measures could compromise the confidentiality, integrity, and availability of our customers’ own IT Systems and/or our customers’ proprietary or other sensitive information. We and our third-party providers cannot anticipate or prevent all threats to our IT Systems and data because threat actors use sophisticated techniques and tools – including artificial intelligence – that change frequently, circumvent controls and may remove forensic evidence, which makes incident detection and remediation challenging. As adoption of our products by merchants continues to increase and our brand becomes more widely known and recognized, we expect to be a target for threat actors seeking to compromise our IT Systems or gain unauthorized access to our or our merchants’ data. Moreover, if a high-profile security breach occurs with respect to another cloud platform provider, our merchants and potential merchant customers may lose trust in the security of cloud platforms generally, which could adversely impact our ability to retain existing merchants or attract new ones. If we are not able to detect activity on our AI-powered ecommerce risk intelligence platform that might be nefarious in nature or if we are not able to design processes or systems to reduce the impact of similar activity on a platform of a third-party service provider, our merchants could suffer harm. In such cases, we could face exposure to legal claims, business disputes and other liability. There can be no assurance that our or our third-party providers’ cybersecurity risk management program and processes, including policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and information. In addition, given the scanning tools deployed in our IT environment, we regularly identify and track security vulnerabilities but cannot guarantee that patches or mitigating measures will be applied before vulnerabilities can be exploited by a threat actor. 15 We also cannot assure you that any limitation of liability provisions in our contracts for a security lapse or breach would be enforceable, adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim related to such lapse or breach. Our existing insurance policies may not be adequate, or available in the future on acceptable terms and there is no guarantee that insurers will accept and cover any future claims related to cybersecurity incidents, which could therefore expose us to a material adverse effect on our business, financial condition and results of operations. Lengthy sales cycles with large enterprises make it difficult to predict our future revenue and may cause variability in our operating results. Our sales cycle can vary substantially from merchant to merchant, but with large enterprises it typically requires 25 to 55 weeks on average from the time we designate a merchant as a sales qualified lead to execution of an agreement with that merchant. Our ability to forecast revenue accurately is affected by our ability to forecast sales pipelines and the timing of new merchant acquisitions. Lengthy sales cycles make it difficult to predict the quarter in which revenue from a new merchant may first be recognized. If we overestimate new merchant growth in a particular period or generally, our revenue will not grow as quickly as our forecasts, our costs and expenses may continue to exceed our revenue, and our results of operations will be adversely affected. In addition, we may not meet or may be required to revise guidance that we have provided to the public, if any. In addition, we plan our operating budget, including sales and marketing expenses, and our hiring needs, in part, based on our forecasts of new merchant growth and future sales. If new merchant growth or sales for a particular period is lower than expected, we may not be able to proportionately reduce our operating expenses for that period, which could harm our operating results for that period. Delays in our sales cycles could cause significant variability in our revenue and operating results for any particular period. We have experienced in the past, and expect to continue to experience, seasonal fluctuations in our revenues. If we fail to accommodate increased volumes during peak seasons and events, our business, financial condition, and results of operations may be adversely affected. Our business is seasonal in nature and our GMV and revenues are typically highest in the calendar fourth quarter. Our revenue is directly correlated with the level of revenue that our merchants generate, and our merchants typically generate the most revenue in the calendar fourth quarter, which includes Black Friday, Cyber Monday, the holiday season, and other peak events included in the ecommerce calendar, such as Chinese Singles’ Day, Thanksgiving, Christmas and Boxing Day. Our gross profit margin typically follows a similar trend. For the years ended December 31, 2025 and 2024, calendar fourth quarter revenue represented approximately 29% and 29% of our total revenues, respectively. Any service disruption affecting our products, especially during the calendar fourth quarter, could have a disproportionately negative effect on our operating results. Surges in volumes during peak periods may strain our technological infrastructure and merchant support activities, which may reduce our revenue and the attractiveness of our products. Any disruption to our operations or the operations of our merchants during the calendar fourth quarter could lead to a material decrease in revenues relative to our expectations for the calendar fourth quarter, which could in turn result in a significant shortfall in revenue, results of operations and operating cash flows for the full year. We have a substantial merchant concentration, with a limited number of merchants accounting for a substantial portion of our revenues. The loss of a significant merchant could materially and negatively affect our business, financial condition and results of operations. We derive a significant portion of our revenues from a few significant merchants, each of which operates in the ecommerce retail sector. For the three years ended December 31, 2025, 2024 and 2023, 16 our three largest merchants in the aggregate accounted for 25%, 25%, and 28% of our revenues, respectively. In addition, our five largest merchants in aggregate accounted for approximately 32%, 34%, and 38% of our revenues for the years ended December 31, 2025, 2024 and 2023, respectively. If any of these merchants experience declining or delayed sales or other business interruptions due to market, economic, or competitive conditions or for any other reason, the fees we receive from such merchant will decline proportionally. Further, because the retail sector, where most of our major merchants operate, is generally susceptible to macroeconomic factors, we too are susceptible to macroeconomic factors. See “Item 3.D. “Risk Factors-Risks Relating to our Business and Industry-Our revenue is impacted, to a significant extent, by macroeconomic conditions and the financial performance of our merchants.” In addition, we could be pressured to reduce our prices, make other contractual concessions or we could experience a decline in the demand for our products. We have in the past and could in the future experience a loss of merchants or merchant transaction volume due to competition, merchants moving volume in-house or other changes in a merchants’ financial profile or internal leadership that may impact their decision to use our products and services. The foregoing has in the past and may in the future negatively affect our business, financial condition, and results of operations. If any of our five largest merchants terminate their relationships with us, become subject to bankruptcy proceedings, or otherwise cease operating, such termination, bankruptcy or cessation of operations would materially negatively affect our business, financial condition, and results of operations. Furthermore, if any of our largest merchants terminate their relationships with us, or if these merchants experience declining or delayed ecommerce sales or other business interruptions, our estimates and forecasts relating to the size and expected growth of our market and our revenues may prove to be inaccurate. The risk of losing merchants as a result of bankruptcies may be higher due to challenging macroeconomic conditions (including a recession), and could materially and negatively affect our business, financial condition and results of operations. We have in the past had, and may in the future have, merchants, including significant merchants, whose financial condition deteriorates significantly, or who become subject to bankruptcy proceedings. In particular, merchants who are highly leveraged, operate on narrow margins, or are otherwise susceptible to changes in economic, competitive and market conditions, may be at an increased risk of bankruptcy in a recessionary environment. In addition to a reduction in these merchants’ ecommerce sales volumes, possibly to zero as a result of such bankruptcies, we are not always able to recover amounts due to us from these merchants, which has in the past and may in the future have a material adverse impact on our business, financial condition, and results of operations, including reduced transaction volumes, contract terminations, and difficulties recovering outstanding receivables. If we are unable to develop enhancements to our products, increase adoption and usage of our products, and introduce new products and capabilities that achieve market acceptance or effectively manage the impact of new product introductions on our existing product portfolio, our business, financial condition and results of operations may be adversely affected. Our ability to attract new merchants and increase revenue from existing merchants depends on numerous factors, including our ability to enhance and improve our existing products, increase adoption and usage of our products, and introduce new products and capabilities. In particular, if we are not able to develop technology that is able to keep pace with new and increasingly complex fraud schemes or that is able to solve new or different problems for our merchants or that is differentiated and/or superior to products offered by our competitors, we may not be able to achieve a return on investment that satisfies our merchants, and may be unable to increase adoption and usage of our products. The success of any enhancements or new products depends on several factors, including timely completion, adequate quality testing, introduction to the market, and market acceptance. Additionally, new products and capabilities that we introduce may intentionally or inadvertently reduce demand for our existing products. Any products we develop may not be introduced in a timely or cost-effective manner (or at all), may contain errors or defects, or may not achieve the broad market acceptance necessary to generate sufficient revenue. If we are unable to successfully enhance our existing products to meet merchant 17 requirements, increase adoption and usage of our products, develop new products or manage the impact of new product introductions on our existing product portfolio, our business, financial condition, and results of operations may be adversely affected. If we are unable to continue to increase the sales of our products to large enterprises while mitigating the risks associated with serving such merchants, our business, financial condition and results of operations may be adversely affected. Our growth strategy is dependent, in large part, upon the continued increase of sales to large enterprises. For the year ended December 31, 2025, we estimate that over 90% of our Billings were derived from merchants generating over $75 million in online sales per year. Sales to large enterprises involve risks that may not be present or that are present to a lesser extent with sales to smaller entities, such as longer sales cycles, more complex merchant requirements, substantial upfront sales costs, and less predictability in completing some of our sales. For example, large enterprises may require considerable time to evaluate and test our applications and those of our competitors prior to making a purchase decision and placing an order. A number of factors influence the length and variability of our sales cycle, including the need to educate potential merchants about the uses and benefits of our products, the discretionary nature of purchasing and budget cycles, and the competitive nature of evaluation and purchasing approval processes. As a result, the length of our sales cycle may vary significantly from merchant to merchant, and sales to large enterprises typically take longer to complete. Moreover, large enterprises often request pilot periods or begin by deploying our products on a limited basis, but nevertheless require configuration, integration services, and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these merchants will deploy our products widely enough across their organization to justify the substantial upfront investment. Our ability to improve our sales to such large enterprises is also partially dependent on our ability to continue to attract, train and retain sales personnel with experience selling to large enterprises, and competition for such personnel can be intense. In addition, as security breaches with respect to larger, high-profile enterprises are likely to be heavily publicized, there is an increased reputational risk associated with serving such merchants. If we are unable to continue to increase sales of our products to large enterprises while mitigating the risks associated with serving such merchants, our business, financial condition, and results of operations may be adversely affected. We may need to change our prices and pricing structure from time to time, which may negatively impact our business. We typically charge our merchants a percentage of the value of the transactions that we approve. The fee we charge our merchants is a risk-adjusted price (based on a variety of factors including historical fraud levels, approval rate commitment, industry vertical and geographic region), which is expressed as a percentage of the GMV dollars that we approve. We expect we may need to change our pricing models and pricing structures from time to time, including as a response to updates or enhancements to our product suite, and in response to changes in global economic conditions, competitive pressures, competitor pricing practices, and trends or reductions in our merchants’ spending levels generally. Any changes to our pricing models or pricing structures resulting in decreased revenue from, or loss of, any merchant, could negatively impact our business operations and financial performance. Through our Chargeback Guarantee product, we provide a Chargeback Guarantee to our merchants for transactions that our AI-powered ecommerce risk intelligence platform approves that are subsequently determined to be fraudulent and for which a valid chargeback reimbursement request is received by our merchant. Pursuant to our Chargeback Guarantee, we may be required to issue a significant amount of credits to merchants. The credit issued via the invoice we provide to our merchants generally equates to the approved transaction amount, which exceeds the fee we charge for the associated transaction. This business model requires us to accurately predict the amount of credits we expect to issue in order to determine the appropriate pricing structure for our products, and failure to do so may negatively affect our 18 financial condition. While chargebacks are intended as a consumer protection mechanism from fraudulent transactions, they are also susceptible to abuse and “friendly fraud”. For example, friendly fraud may occur when a consumer, rather than returning an order they are dissatisfied with, instead initiates the chargeback process to avoid a complicated returns process. Friendly fraud may violate the merchant’s cancellation policies and, depending on the jurisdiction, may also be unlawful. Nevertheless, to the extent a chargeback reimbursement request is received by our merchants, even in instances of friendly fraud or other chargeback abuse, we may be required to issue significant credits to our merchants in respect of these transactions. In addition, the increasing availability and adoption of generative artificial intelligence tools and other emerging technologies by fraudsters is changing the way that fraud, including friendly fraud, is perpetrated. While we employ a variety of strategies to minimize our exposure to friendly fraud and other chargeback abuses, it is often difficult to differentiate friendly fraud and other chargeback abuses from “true” fraud. Any increase in chargeback abuse, including friendly fraud, may impact our ability to accurately predict the amount of credits we expect to issue in order to determine the appropriate pricing structure for our products, which could negatively impact our business operations and financial performance. Similarly, as we introduce new products, or as a result of the evolution of our existing products, including reviewing ACH payments, uncovered decisioning, and covering non-fraud related chargebacks, and as the methods and techniques used to perpetrate fraud evolve (including through the use of generative artificial intelligence and other emerging technologies), we may have difficulty determining the appropriate pricing structure for our products. Any failure by us to appropriately price our products could negatively impact our business operations and financial performance. In addition, as new and existing competitors introduce new products that compete with ours, or revise their pricing structures, we may be unable to attract new merchants or retain existing merchants at the same price, or based on the same pricing model as we have used historically. Moreover, as we continue to target selling our products to large enterprises, these large enterprises may demand substantial price concessions. As a result, we may be required, from time to time, to revise our pricing structure or reduce our prices, which could adversely affect our business, financial condition and results of operations. The loss of the services of any of our executive leadership team, including our co-founders, who are also our Chief Executive Officer and Chief Technology Officer, could materially and adversely affect our revenues, our results of operations and financial condition. Our success and future growth depend largely upon the continued services of our executive officers and other key employees in the areas of research and development, marketing, business development, sales, products, and general administrative functions. In particular, the experiences of Eido Gal, our co-founder and Chief Executive Officer, and Assaf Feldman, our co-founder and Chief Technology Officer, are valuable assets to us. Mr. Gal and Mr. Feldman both have significant experience in developing automated risk and identity products and developing robust systems with machine learning algorithms and intelligent UIs for risk management applications and would be difficult to replace. Competition for senior executives in our industry is intense, and we may not be able to attract and retain qualified personnel to replace or succeed Mr. Gal, Mr. Feldman or other key executives. Failure to retain Mr. Gal, Mr. Feldman or other key executives in core leadership roles could have a material adverse effect on our business, financial condition and results of operations. In addition, executive leadership transition periods are often difficult as the new executives gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management turnover inherently causes some loss of institutional knowledge, which can negatively affect strategy and execution. If we are unable to attract and retain executives and employees that we need to support our operations and growth, our revenues, our results of operations and financial condition may be adversely affected. 19 To execute our growth plan, we must attract and retain highly qualified personnel. Competition for qualified personnel is intense, especially for software engineers experienced in designing and developing software as a service (“SaaS”) applications and experienced sales professionals. In particular, competition for talent in Israel has in the past been and remains intense. If we are unable to attract such personnel remotely or in cities or countries where we are located, we may need to hire in other locations which may add to the complexity and costs of our business operations. In particular, we established a secondary research and development facility in Portugal, and have implemented additional offshoring strategies in order to enhance and expand our talent pool and to help rationalize our labor costs. There can be no guarantee that these strategies will be successful, that such initiatives will lead to meaningful and sustainable cost savings, or that we will be able to manage our offshored workforce effectively. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources. In addition, prospective and existing employees often consider the value of the equity awards they receive in connection with their employment, in addition to their cash compensation. The market price of our stock has experienced significant volatility. Significant declines in the value of our stock, has, and may in the future, impact our ability to compensate employees appropriately and to attract and retain talent. If the total compensation, including the amount or value of equity awards offered to employees is perceived to be less favorable than total compensation or equity awards offered by other companies with whom we compete for talent, or the perceived value of our equity awards declines, experiences significant volatility, or increases such that prospective employees believe that they are not being fairly compensated or that there is limited upside to the value of the Company’s equity awards, it may adversely affect our ability to recruit and retain key employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business, financial condition and results of operations may be adversely affected. In the event of continued stock price volatility in the future, we may determine that it is necessary to grant equity awards to our employees, outside of ordinary ranges, to recalibrate total compensation and help recruit and retain talent. Existing shareholders may experience significant dilution of their ownership interests as a result of such grants. We may need to periodically realign our organization and may experience difficulties in managing either potential growth or reductions in force, which could disrupt our operations. As we mature, we have in the past and may in the future need to realign our full-time employee base. This can include expansion or reductions in force, depending on our needs. For example, during 2025 we undertook certain actions to restructure our workforce by relocating some positions to lower-cost geographies and reducing headcount in other areas, in order to align our expense base to our long-term strategy and to strengthen and optimize our business. Our management has, and may need to continue to devote a substantial amount of time toward managing these realignment activities. These initiatives may be disruptive to our operations, and there is no guarantee that they will achieve the intended benefits. We may not be able to effectively manage a potential realignment of our operations, which may result in the loss of business opportunities, operational mistakes, difficulty implementing our business strategy due to the loss of institutional knowledge and expertise, attrition beyond the intended number of employees, and reduced productivity among remaining employees. If our management is unable to effectively manage our internal realignment, these activities could yield unanticipated consequences and costs, and our ability to generate and/or grow revenues could be reduced. Our future financial performance and our ability to compete effectively will depend, in part, on our ability to effectively manage any future realignment of our employee base. We have been subject to securities class-action litigation and may be subject to similar or other litigation in the future, all of which will require significant management attention, could result in significant legal expenses and may result in unfavorable outcomes, all or any of which could 20 adversely affect our operating results, harm our reputation or otherwise negatively impact our business. We have been, and may in the future become, subject to litigation or claims arising in or outside the ordinary course of business that could negatively affect our business operations and financial condition, including securities class actions and shareholder derivative actions, both of which are typically expensive to defend. The outcome of any litigation, regardless of its merits, is inherently uncertain. Any claims and lawsuits, and the disposition of such claims and lawsuits, could be time-consuming and expensive to resolve, divert management attention and resources, cause reputational harm, and lead to attempts on the part of other parties to pursue similar claims. Any adverse determination related to litigation could adversely affect our operating results, harm our reputation or otherwise negatively impact our business. In addition, depending on the nature and timing of any such dispute, a resolution of a legal matter could materially affect our future operating results, our cash flows or both. We are exposed to fluctuations in currency exchange rates, which could negatively affect our operating results. A majority of our merchant agreements and partner and services contracts are denominated in U.S. dollars, and therefore substantially all of our revenue transactions are not subject to foreign currency risk as the U.S. dollar is also the functional currency of our consolidated subsidiaries. A portion of our revenue is denominated in foreign currencies, in particular the Euro ("EUR"). A weakening of foreign currencies against the U.S. dollar will negatively affect our revenues. In addition, a portion of our operating expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. In particular, the recent strength, and any future strengthening of the NIS against the U.S. dollar has resulted and will in the future result in increasing costs. If we are not able to successfully hedge against these risks, or adjust or optimize our expense base or make other operational changes that offset such exposures in the future, our operating results could be adversely affected. For discussion of the impact of fluctuations in foreign currency exchange rates on our business, see Item 11. “Quantitative and Qualitative Disclosures About Market Risk-Foreign Currency Exchange Risk.” We may need additional capital, and we cannot be sure that additional financing will be available on favorable terms, if at all. Historically, we have funded our operations and capital expenditures primarily through equity issuances and cash generated from our operations. Although we currently anticipate that our available funds and cash flow from operations will be sufficient to meet our cash needs for the foreseeable future, we may require additional financing and we may not be able to obtain such financing on favorable terms, or at all. Our ability to obtain financing will depend on, among other things, our development efforts, business plans, operating performance and the condition of capital markets at the time we seek financing. In addition, various macroeconomic factors, such as the increasingly high U.S. national debt and sustained high interest rates, can reduce the availability of, or increase the price at which we can access additional capital. If we raise additional funds through the issuance of equity, equity-linked, or convertible debt securities, to fund operations or on an opportunistic basis, those securities may have rights, preferences, or privileges senior to the rights of our Class A ordinary shares, or may require us to agree to restrictive covenants or unfavorable terms, and our existing shareholders may experience significant dilution of their ownership interests. Any debt financing we may secure in the future could involve restrictive covenants that may impose significant operating and financial restrictions on us, and may limit our ability to engage in acts that may be in our long-term best interest, including restrictions on our ability to incur indebtedness, incur liens, enter into mergers or consolidations, dispose of assets, pay dividends, make acquisitions and make investments, loans and advances. These restrictions may affect our ability to grow in accordance with our strategy, limit our ability to raise additional debt or equity financing to operate our business, including during economic or business downturns, and limit our ability to compete effectively or take advantage of new business opportunities. If we are unable to obtain adequate financing 21 or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth, scale our infrastructure, develop product enhancements, and respond to business challenges could be significantly impaired, and our business, financial condition and results of operations may be adversely affected. In deploying our SaaS products, we rely upon third-party providers of cloud-based infrastructure, or Public Cloud Providers, such as Amazon Web Services. In addition, many of our merchants utilize those same Public Cloud Providers. Any disruption in the operations of Public Cloud Providers or interference with our use of Public Cloud Providers would adversely affect our business, financial condition, and results of operations. We outsource substantially all of the infrastructure relating to our cloud offerings to Public Cloud Providers, such as Amazon Web Services. Merchants of our cloud-based SaaS products need to be able to access our AI-powered ecommerce risk intelligence platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Our cloud-based SaaS products depend on protecting the virtual cloud infrastructure hosted by Public Cloud Providers by maintaining its configuration, architecture, features and interconnection specifications, as well as maintaining the information stored in these virtual data centers and transmitted by third-party internet service providers. While our Public Cloud Providers typically have robust backup and disaster recovery plans and processes in place, any incident affecting our Public Cloud Providers’ infrastructure that may be caused by fire, flood, severe storm, earthquake or other natural disasters, viruses, cyberattacks, terrorist or other attacks, and other similar events beyond our control could negatively affect our cloud-based SaaS products. Certain of these events may become more frequent or severe as a result of climate change. Climate change may also result in certain chronic changes to the physical environment, such as changes to temperature/precipitation patterns or sea-level rise, which may adversely impact the infrastructure we rely on or otherwise adversely impact our operations. A prolonged service disruption affecting our cloud-based offerings for any of the foregoing reasons would negatively impact our ability to serve our merchants and could damage our reputation with current and potential merchants, expose us to liability, cause us to lose merchants or otherwise have an adverse effect on our business, financial condition, and results of operations. We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the Public Cloud Provider services we use. In the event that our service agreements with our Public Cloud Providers are terminated, or there is a lapse of service, elimination of services or features that we utilize, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our AI-powered ecommerce risk intelligence platform as well as significant delays and additional expenses in arranging or creating new facilities and services and/or re-architecting our cloud offering for deployment on a different cloud infrastructure service provider, which may adversely affect our business, financial condition and results of operations. Any failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and our brand. We rely on a combination of trademark, trade secret, copyright and other intellectual property laws as well as contractual provisions, such as confidentiality clauses, to establish and protect our proprietary technology, our brand and other intellectual property. While it is our policy to protect and defend our intellectual property, our efforts may be inadequate to prevent unauthorized use of our intellectual property rights. We will not be able to protect our intellectual property if we are unable to secure or enforce our rights or if we do not detect unauthorized use of our intellectual property. In addition, defending our intellectual property rights may entail significant expense. Any patents, trademarks, or other intellectual property rights that we obtain may be challenged by others or invalidated through administrative process or litigation. We do not currently have any patents or pending patent applications; however, in the future, we may seek patent protection for our technology, which protection we may not be able to obtain or maintain. In addition, any patents we obtain in the future may not issue with the scope of 22 the claims we seek or may not provide us with meaningful protections or competitive advantages, or may be successfully challenged, invalidated, or circumvented by third parties. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain, particularly in certain foreign countries in which we do business, such as China. We also have chosen not to register any copyrights, and instead rely primarily on trade secret protection to protect our proprietary software. While we also own unregistered copyrights in our software, copyrights must be registered before bringing a copyright infringement lawsuit in the United States. Because we have chosen not to register our copyrights, the remedies and damages available to us for unauthorized use of software may be limited. Despite our efforts to maintain our source code and certain other technologies as trade secrets, it may still be possible for unauthorized third parties to copy our products and AI-powered ecommerce risk intelligence platform capabilities and use information that we regard as proprietary to create products that compete with ours. Further, effective patent, trademark, copyright and trade secret protection may not be available to us in every country in which our products are or may become available, or our attempts to register intellectual property rights may be challenged or rejected. The laws of some foreign countries, such as China, may not be as protective of intellectual property rights as those in the United States, and mechanisms for enforcement of intellectual property rights may be inadequate. As we expand our international activities, our exposure to unauthorized copying and use of our products and platform capabilities and proprietary information will likely increase. Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our intellectual property. Third parties, including former employees, may also breach duties of confidentiality to us. Further, we may be unable to prevent competitors from acquiring trademarks or domain names that are similar to or diminish the value of our intellectual property. We are and may become party to certain agreements that may limit our trademark rights in certain jurisdictions; our ability to use our existing trademarks in new business lines in the future may be limited. We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with other parties. We also attempt to protect our proprietary technologies by implementing administrative, technical and physical practices, including source code access controls, to secure our proprietary information. However, no assurance can be given that these agreements or practices will be effective in controlling access to and distribution of our proprietary information. Further, these agreements and practices may not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our products and AI-powered ecommerce risk intelligence platform capabilities. In relation to the field of AI Technologies, there is uncertainty and ongoing litigation in different jurisdictions as to the extent, if any, of protection warranted for AI Technologies, including as to materials that were created, in whole or in part, through the utilization of such AI Technologies. If we fail to protect our intellectual property rights adequately, including with respect to any AI Technologies, our competitors may gain access to our technology or develop similar competing technologies, and as a result, our business, financial condition, and results of operations may be adversely affected. Additionally, we may use artificial intelligence tools, including tools provided by third parties, to develop or assist in the development of our own software code. While use of such tools makes our development process more efficient, artificial intelligence tools have sometimes generated content that is “substantially similar” to proprietary or open source code on which the artificial intelligence tool was trained. If such artificial intelligence tools generate code that is too similar to other proprietary code, or to software processes that are protected by patent, we could be subject to intellectual property infringement claims. Further, we may be unable to recover any or all defense costs or damages as a result of infringement claims from the third-party providers of such artificial intelligence tools. If the artificial intelligence tools we use generate code that is too similar to open source code, we risk losing protection of our own proprietary code that is commingled with such code. In addition, we may experience difficulties in enforcing the intellectual property rights in code generated by artificial intelligence tools. Copyright protection in the United States has been denied for images generated by artificial intelligence tools, and United States courts have ruled that an artificial intelligence tool cannot be an “inventor” of a patent, rendering it impossible to obtain 23 patent protection for inventions created solely by artificial intelligence tools. Finally, the terms of use of any third-party artificial intelligence tools may state that the third-party provider retains rights in the generated code. We may be required to spend significant resources in order to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time-consuming, and distracting to management. Further, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the ownership, scope, validity and enforceability of our intellectual property rights, which could result in the impairment or loss of portions of our intellectual property. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our products and AI-powered ecommerce risk intelligence platform capabilities, impair the functionality of our products and platform capabilities, delay development and introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation. Any of the foregoing could materially and adversely affect our business, financial condition and results of operations. Interruptions or performance problems associated with our technology and infrastructure may adversely affect our revenues, our results of operations and financial condition. Our continued growth depends in part on the ability of our existing and potential merchants to access our products and AI-powered ecommerce risk intelligence platform capabilities at any time and within an acceptable amount of time. Interruptions in our products or performance problems, for whatever reason, could undermine our merchants’ confidence in our products and cause us to lose merchants or make it more difficult to attract new ones. We have experienced, and may in the future experience, disruptions, outages, and other performance problems due to a variety of factors, including infrastructure changes, third-party vendor downtime, introductions of new functionality, human or software errors, capacity constraints due to an overwhelming number of users accessing our products and platform capabilities simultaneously, DDoS attacks, or other security-related incidents or attacks. It may become increasingly difficult to maintain and improve our performance, especially during peak usage times and as our products and platform capabilities become more complex and our user traffic increases. If our products and platform capabilities are unavailable or if our merchants are unable to access our products and platform capabilities within a reasonable amount of time or at all, our revenues, our results of operations and financial condition may be adversely affected. We provide credits to our merchants for consumer transactions that our platform approves that are subsequently determined to be fraudulent and for which our merchants receive a chargeback. Any performance malfunction in our platform could result in us approving fraudulent consumer transactions in excess of anticipated levels and, to the extent chargebacks are received by our merchants, require us to issue a significant amount of credits to merchants. Issuing a significant amount of credits or refunds to merchants would negatively impact our financial position. To the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, this may cause merchants to terminate their agreements with us, impair our ability to grow our merchant base, subject us to financial liabilities and our business, financial condition and results of operations may be adversely affected. Our proprietary AI Technologies rely in part on the use of our merchants’ data and other third-party data, and if we lose the ability to use such data, if our merchants fail to collect or transmit such data, if there are disruptions in our ability to access such data, or if such data contain inaccuracies, our business could be adversely affected. We rely on our proprietary AI Technologies, which are statistical models built using a variety of data-sets. Our AI Technologies rely on a wide variety of data sources, including data collected from our merchants as part of our automated decisioning process and in some cases data collected from third parties. Under our agreements with certain merchants, we receive licenses to use data collected directly from those merchants’ consumers’ internet browsers. Such licenses may impose restrictions on how such 24 data may be used, including, for example, restrictions on the collection or use of data from certain jurisdictions. If we are unable to access and use data collected from our merchants or their consumers as part of our automated decisioning process, or other third-party data used in our AI Technologies, or our access to such data is limited, for example, due to new or changing laws, regulations or policies of third parties, changes in the use of cookies or other technological changes, commercial disputes, or access disruptions to merchant or third-party data sources due to integration failures, DDoS attacks, or other security-related incidents or attacks impacting our merchants or third-party data sources, our ability to accurately evaluate potential transactions, detect fraud and verify consumers’ data would be compromised. In addition, technology strategies employed by certain merchants, including “headless commerce”, which refers to the decoupling of a merchant’s front-end customer experience technology from their back-end ecommerce platform, may result in the fragmentation of consumer data points across sources. If our merchants are unable to capture all the data points from their consumers that our AI Technologies require, the accuracy of our AI Technologies may be affected, or we may not be able to do business with merchants employing this, or similar, technology strategies. Third-party data sources on which we rely include Maxmind, Ekata and Emailage. The data received from these third-parties is used by our AI Technologies, including to evaluate transactions for potential fraud. Data collected from our merchants as part of our automated decisioning process and other information that we receive from third parties may not accurately detect fraud for a variety of reasons, including errors or inconsistencies in the information collected, changing methods of perpetrating fraud (including through the use of generative artificial intelligence and other emerging technologies) or lack of available information upon which to make a decision. For example, if the information provided by a merchant is inaccurate or incomplete, it may cause us to inaccurately link a legitimate order with other fraudulent orders. In addition, if third-party data used to train and improve our AI Technologies is inaccurate, or access to such third-party data is limited or becomes unavailable to us, our ability to continue to improve our AI Technologies would be adversely affected. Although we believe that there are commercially reasonable alternatives to the third-party data we currently license available, this may not always be the case, or it may be difficult or costly to migrate to other third-party data. Our use of additional or alternative third-party data would require us to enter into license agreements with third parties. In addition, integration of the third-party data used in our AI Technologies with new third-party data may require significant work and require substantial investment of our time and resources. Additionally, we may not be able to obtain third party data sets required to support new or alternate payment methods. Any of the foregoing could negatively impact our product offerings and our relationships with our merchants, impair our ability to grow our merchant base, subject us to financial liabilities and our business, financial condition and results of operations may be adversely affected. The increasing adoption of Agentic Commerce may adversely affect our products, our pricing structures, the performance of our AI Technologies, and our financial results. Emerging forms of ecommerce increasingly involve the use of autonomous or semi-autonomous artificial intelligence agents (“AI Agents”) that initiate, negotiate, and execute transactions on behalf of consumers without direct, contemporaneous human interaction (“Agentic Commerce”). While Agentic Commerce may create new efficiencies for merchants and consumers, its adoption presents new and evolving risks to our business model, products and financial performance. The legal and regulatory frameworks governing transactions executed by AI Agents is ever-evolving. In particular, it is unclear how existing card scheme rules (including new trust protocols implemented by card issuers), as well as state laws will apply to transactions executed by AI Agents, including whether liability for disputed or fraudulent transactions ultimately will rest with the consumer, the merchant, the AI Agent provider, the PSP, or another participant in the payments ecosystem, absent allocation of liability in the card scheme rules or agreement. To the extent that liability for such transactions is allocated in a way that reduces merchants’ exposure to chargebacks, the demand for our products and services, the GMV 25 available for us to review, and the economic value proposition of our Chargeback Guarantee may be reduced. Agentic Commerce has the potential to increase the incidence of disputed transaction and chargeback abuse. Consumers may seek to disclaim responsibility for transactions executed by AI Agents, including by asserting that transactions were unauthorized, unintended, or erroneous, even where the AI Agent acted pursuant to consumer-defined parameters or directions. Although this situation may ultimately be addressed by card scheme rules and regulations (which may set out the allocation of liability for any actions taken by an AI Agent as part of an agentic transaction), it is possible that this dynamic may exacerbate so-called “friendly fraud” and other forms of chargeback abuse, making it more difficult to identify “true” fraud and increasing the volume and costs of chargebacks for which we may be responsible. Any sustained increase in chargeback abuse associated with Agentic Commerce could adversely affect our CTB Ratio, gross profit margins, and pricing accuracy. In addition, the growing use of AI Agents by consumers may reduce the availability, consistency, or predictive value of the data attributes on which our AI Technologies rely. Transactions executed by AI Agents may not generate the same behavioral, device-level, or contextual signals as transactions initiated directly by a human or may generate new signals that differ materially from historical patterns on which our models have been trained. As a result, our AI Technologies may initially be less effective at identifying fraud associated with Agentic Commerce, may require significant retraining, or may experience periods of reduced accuracy. If we are unable to timely adapt our models to these changes in consumer behavior and data availability, our ability to accurately detect and block fraud may be adversely affected. Finally, online Agentic Commerce may enable new, large-scale, or rapidly propagating fraud schemes that differ from traditional fraud patterns, including coordinated misuse of AI Agents across multiple merchants or platforms. Such events may be difficult to detect or mitigate in their early stages and could result in elevated and unexpected chargeback volumes, particular where fraudulent activity scales faster than our ability to identify the scheme, retrain models or adjust risk thresholds. Any such large-scale fraud events could materially increase our chargeback expenses, negatively impact our financial results, harm merchant confidence in our products, and adversely affect our business, financial condition, and results of operations. If we fail to effectively anticipate, adapt to, and manage the risks associated with the adoption of Agentic Commerce, including changes in liability regimes, data availability, fraud patterns, and consumer behavior, our products may become less effective or less attractive to merchants, our pricing and risk assumptions may prove inaccurate, and our business, financial condition, and results of operations could be materially and adversely affected. Compliance with continuously evolving privacy laws and regulations, including laws and regulations governing processing of Personal Information, including payment card data, and our actual or perceived failure to comply with such laws and regulations may result in significant liability, negative publicity, and/or erosion of trust and could have an adverse effect on our revenues, our results of operations and financial condition. We and certain of our third-party service providers are subject to federal, state, and international laws and other obligations relating to the collection, use, storage, disclosure, retention, security, transfer and other processing of Personal Information. The regulatory framework worldwide for privacy and security, particularly as it relates to the use of Personal Information and other data in artificial intelligence and machine learning is rapidly evolving and as a result implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. The increasing use of AI-enabled intermediaries, including systems that act on behalf of consumers in initiating or executing transactions, may further complicate the allocation of roles and responsibilities under privacy and data protection laws, including with respect to data collection, consent, purpose limitation, and cross-border data transfers. As a result, certain data that our products rely on may become 26 unavailable, restricted, or subject to differing legal interpretations across jurisdictions, or other contractual limitations. Complying with these data, data protection, privacy and security laws, regulations, contractual obligations, and industry standards has required and may continue to require us to incur substantial operational costs and Company resources. Because the interpretation and application of many privacy and data protection laws and contractually imposed industry standards are uncertain, it is possible that these laws may be inconsistent or conflicting with each other or interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our products and AI-powered ecommerce risk intelligence platform capabilities. If so, in addition to the possibility of fines, lawsuits, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our products and platform capabilities, which could have an adverse effect on our revenues, our results of operations and financial condition. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our merchants may limit the use and adoption of, and reduce the overall demand for, our products. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and foreign countries. If we are not able to adjust to changing laws, regulations, and standards related to the Internet, our business, financial condition and results of operations may be adversely affected. United States U.S. state laws in this area are complex and developing rapidly. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to consumers whose Personal Information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also constantly amending existing laws, requiring attention to frequently changing regulatory requirements. The California Consumer Privacy Act, or the CCPA, among other things, gives California residents rights over their Personal Information, provides for civil penalties for violations (as well as a private right of action certain for data breaches) and establishes a dedicated California privacy regulator, the California Privacy Protection Agency. Following the enactment of the CCPA, numerous comprehensive privacy statutes that share similarities with the CCPA have been enacted or are being considered in a number of states. Any failure or perceived failure by us to comply with these laws could result in proceedings or actions against us. In 2024, the National Security Division of the U.S. Department of Justice (DOJ) issued a new rule - referred to as the “Data Security Program” (DSP) - to implement Executive Order 14117 aimed at preventing access to “bulk U.S. sensitive personal data” and “government-related data” by “countries of concern” (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such there is a risk that our interpretation of its applicability, scope, and requirements is incorrect, incomplete, or misapplied. Based on our assessment of the DSP, we likely engage in covered data transactions. Compliance with the DSP has required us to invest heavily in data security and compliance measures, such as implementing and complying with the Cybersecurity and Infrastructure Security Agency’s guidelines and other burdensome recordkeeping, reporting, and auditing requirements. It also has required us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or 27 hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations, and financial condition. These laws demonstrate a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our revenues, our results of operations and financial condition. European Economic Area, United Kingdom and Israel. The European Economic Area’s (“EEA”) and United Kingdom’s data protection landscape is evolving, resulting in possible significant and operational costs for internal compliance and risks to our business. The General Data Protection Regulation 2016/679 (the “EU GDPR”), and the UK Data Protection Act 2018 and the UK General Data Protection Regulation (together the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”), impose robust obligations on controllers and processors for the processing of Personal Information. Failure to comply with these obligations can result in significant fines and other liability under applicable law. In particular, since we are under the supervision of relevant data protection authorities in both the EEA and the United Kingdom, we may be fined under both the EU GDPR and UK GDPR in respect of the same breach. There is currently complexity and uncertainty regarding transfers of Personal Information from the EEA or UK to countries outside the EEA or UK, as applicable. We expect this complexity and uncertainty, and enhanced scrutiny by regulators, to continue and we cannot guarantee the ongoing efficacy and longevity of our data transfer mechanisms (including the European Commission’s standard contractual clauses, or SCCs, and the UK Addendum to the SCCs, as well as the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework). As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer Personal Information between and among countries and regions in which we operate, it could affect the manner in which we provide our products, the geographical location or segregation of our relevant systems and operations, and could adversely affect our business, financial condition and results of operation. The GDPR also imposes stringent rules and restrictions on automated decision making including profiling, that results in a legal or similarly significant effect on an individual. Depending on how regulators and courts interpret this requirement going forward, it may have a significant impact on our business operations including our use of automated data processing to enable merchants to accept or decline an order. The European Commission’s Digital Omnibus Proposal, published in November 2025, includes proposed amendments to certain EU laws and regulations, including (among others) the GDPR. However the proposals remain at an early stage of the EU legislative process. In addition to the GDPR, we are subject to evolving EU and UK laws on cookies, tracking technologies and e-marketing. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target individuals, may lead to broader restrictions and impairments on our marketing and personalization activities, may negatively impact our efforts to understand users, and, as a result of us being able to process less data, make our automated decisioning process less accurate. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies, as well as civil claims including class actions, and reputational damage. Additionally, the U.S. has recently seen an increase in claims and litigation based on the California Invasion of Privacy Act (“CIPA”) and the Electronic Communications Privacy Act (“ECPA”) in regard to tracking tools such as cookies and similar 28 technologies. This trend exposes companies to potential statutory damages, class action lawsuits, and reputational harm. On November 1, 2022, the Digital Markets Act, or the DMA, entered into force and on November 16, 2022, the Digital Services Act, or the DSA, followed. For the DSA, most provisions became applicable on February 17, 2024. The DSA and the DMA focus on creating a safer digital space, protecting fundamental rights of all users of digital services, and establishing a level playing field for businesses and consumers with regards to online platforms. The DSA and DMA, to the extent applicable, may require us to modify our practices and policies and we could incur substantial costs as a result. In addition, we are subject to the Israeli Privacy Protection Law, 5741-1981, and its regulations, including the Israeli Privacy Protection Regulations (Data Security), 5767-2017, or the Data Security Regulations (together, the “PPL”), which impose obligations with respect to the manner Personal Information is processed, maintained, transferred, disclosed, accessed, and secured. In this context, material amendments to the PPL were approved by the Israeli Parliament in August 2024 and became effective on August 14, 2025 (“Amendment 13”). Amendment 13 expands the Israeli Privacy Protection Authority (“PPA”) authority under the PPL, to investigate incidents where there is concern of privacy violations, and to impose monetary sanctions that are significantly higher than those previously available under the PPL. Additionally, Amendment 13 introduced new obligations for parties processing Personal Information, which may require us to modify our data practices and policies, and consequently, to incur substantial costs to align our privacy and data protection practices in Israel. We conduct ongoing compliance assessments and work to implement measures necessary to address applicable requirements as they evolve over time. In addition, the Privacy Protection Regulations (Transfer of Data to Databases Outside the State Borders), 5761-2001 (the “Cross-Border Transfer Regulations”) restrict and impose conditions on the transfer of Personal Information from databases in Israel to locations outside Israel, and may require us to implement additional contractual, technical and organizational measures to enable such transfers and maintain compliance, which could increase our costs. Additionally, our use of AI tools in connection with the processing of Personal Information is subject to the PPL and may present unique privacy and information security challenges. We conduct ongoing compliance assessments and apply legal, technical, and operational controls designed to help ensure that our use of AI remains compliant with applicable laws and regulatory expectations Failure to comply with the PPL (including in connection with our AI Technologies) may expose us to administrative fines (which in some cases may reach millions of NIS), civil claims (including class actions) and in certain cases criminal liability. In addition, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs. While it is generally the laws of the jurisdiction in which a business is located that apply, there is a risk that data protection regulators of other countries may seek jurisdiction over our remote activities in locations in which we process data or serve merchants or shoppers but do not have an operating entity. Where the local data protection and privacy laws of a jurisdiction apply, we may be required to register our operations in that jurisdiction or make changes to our business so that shopper data is only collected and processed in accordance with applicable local law. In addition, because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with their privacy and data protection laws, including in jurisdictions where we have no local entity, employees or infrastructure. In such cases, we may require additional legal review and resources to ensure compliance with any applicable privacy or data protection laws and regulations. In addition, in many jurisdictions there may in the future be new legislation that may affect our business and require additional legal review. China 29 We are subject to various Chinese laws and regulations which impose strict requirements on cybersecurity, data handling and Personal Information protection. For example, under China’s Cybersecurity Law (“CSL”), any collection, use, transfer and storage of Personal Information of a Chinese citizen through a network by the network operator should be based on the three principles of legitimacy, justification and necessity and requires the consent of the data subject. China’s Data Security Law (“DSL”) regulates data activities and entities and individuals carrying out data (including those relating to Personal Information) activities must abide by various data security obligations. The CSL and DSL both have a data localization requirement. Finally, China’s Personal Information Protection Law (“PIPL”) clarifies the scope of application, the definitions of Personal Information and sensitive Personal Information (which includes medical and health information), the legality of Personal Information processing and the basic requirements of notice and consent, among other things. The Chinese government authorities also have promulgated several regulations or released a number of draft regulations for public comments which are designed to provide further implemental guidance in accordance with the laws mentioned above. For example, the Regulations on Network Data Security Management (“Regulations”), which took effect on January 1, 2025 in China, have extraterritorial effect and apply broadly to any network data processing activities (not only personal data processing activities). We cannot predict what impact Chinese laws and regulations, in particular the CSL, DSL and PIPL, or the increased costs of compliance, if any, will have on our operations in China due to their recent enactment and the limited guidance available, which entities are awaiting further guidance on. It is also generally unclear how the laws will be interpreted and enforced in practice by the relevant government authorities as often the abovementioned laws are drafted broadly and thus leaves great discretion to the relevant government authorities to exercise. As the regulatory framework for machine learning technology and artificial intelligence evolves, including with respect to unintentional bias and discrimination, our business, financial condition, and results of operations may be adversely affected. Our business heavily relies on artificial intelligence, machine learning and automated decision making. The regulatory framework for this technology is rapidly evolving, and we may not always be able to anticipate how to respond to these laws or regulations. Many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations governing the use of such technologies. There is also an increase in litigation in a number of jurisdictions, including the United States, relating to the development, security and use of artificial intelligence. In addition, emerging uses of artificial intelligence, including autonomous or semi-autonomous systems that initiate or execute transactions on behalf of consumers, may result in existing consumer protections, payments, data protection and other laws being applied in novel or unforeseen ways. Legal and card scheme frameworks governing such uses of AI remain nascent, and regulators, the card schemes and courts may interpret or enforce existing laws (or rules) inconsistently across jurisdictions or over time. The interaction between evolving AI-specific regulations and existing legal and card scheme regimes may create uncertainty regarding compliance obligations, permissible data uses and potential exposure, and may require us to modify our products, governance frameworks or business practices, or limit our ability to deploy certain technologies. We cannot completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to such laws or regulations. Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have either entered into force in the United States and the EU in 2025 and China or are expected to enter into force in 2026. In the United States, there has been uncertainty regarding the applicable regulations that will apply to the development and use of AI technologies. U.S. legislation related to AI Technologies has been 30 introduced at the federal level and has been passed or proposed at the state level. For example, the California Privacy Protection Agency’s new regulations under the CCPA regarding the use of automated decision-making went into effect on January 1, 2026. California also enacted more than 25 new laws in 2024 and 2025 that regulate use of AI Technologies and provide consumers with additional protections around companies’ use of certain AI Technologies, such as requiring companies to disclose certain uses of generative artificial intelligence, disclose the data used to train their AI Technologies, and provide risk disclosures around the operation of their AI Technologies. Other states have also passed artificial-intelligence-focused legislation, such as Colorado’s Artificial Intelligence Act, which will require developers and deployers of “high-risk” artificial intelligence systems to implement certain safeguards against algorithmic discrimination, Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative artificial intelligence in certain consumer interactions, and Texas’ Responsible AI Governance Act, which prohibits specified harmful uses of AI, including behavioral manipulation and unlawful discrimination. Such additional regulations, and uncertainty around whether they will survive legal challenges or how they will be enforced may impact our ability to develop, use, procure and commercialize artificial intelligence and machine learning technologies in the future. In the United States, the Trump administration’s approach to investment in and regulation of AI technologies has and is expected to continue to deviate from that of the previous administration and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders. For instance, the federal government may seek to preempt state laws when they seek to govern certain topics involving AI, as evidenced by the Trump administration’s “Ensuring a National Policy Framework for Artificial Intelligence” Executive Order signed on December 11, 2025. This order calls for federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court. The Trump administration may continue to implement new or rescind existing federal orders and/or administrative policies relating to AI technologies. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. Additionally, new laws regulating artificial intelligence have been enacted in China and Europe. The European Union's Artificial Intelligence Act (the “EU AI Act”) was entered into force in August 2024, establishing a comprehensive legal framework for the regulation of artificial intelligence across the EU. Certain provisions regulating prohibited AI practices and AI literacy came into effect on February 2, 2025, and provisions pertaining to general purpose AI models on August 2, 2025. The majority of obligations under the EU AI Act are expected to apply from August 2026, although the European Commission has proposed an extension to December 2027 (such extension is not yet finalized or effective). Once fully applicable, the EU AI Act will have a material impact on the way artificial intelligence is regulated in the EU, including requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, data transparency, copyright compliance, and technical documentation, and fines for breach of up to 7% of worldwide annual turnover. In addition, the revised EU Product Liability Directive came into force in December 2024, to be implemented into EU member state national law by December 2026. This Directive extends the EU’s existing strict product liability regime to AI technologies and AI-enabled products, and facilitates civil claims in respect of harm caused by artificial intelligence. Once fully applicable, the EU AI Act and the EU Product Liability Directive will have a material impact on the way artificial intelligence is regulated in the EU. In addition, the European Commission’s Digital Omnibus Proposal, published in November 2025, includes proposed amendments to certain EU laws and regulations, including (among others) the EU AI Act. However the proposals remain at an early stage of the EU legislative process. The EU AI Act, and developing interpretation and application of the GDPR in respect of automated decision making, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. 31 In the past few years, China has implemented a number of regulations to govern generative artificial intelligence, algorithmic recommendation and deep synthesis technologies, namely the Interim Provisions on Management of Generative Artificial Intelligence Services, Administrative Provisions on Algorithm Recommendation for Internet Information Services and Provisions on Management of Deep Synthesis in Internet Information Service, respectively. Such regulations impose strict obligations on service providers, among other entities, with respect to their provision and use of generative artificial intelligence, algorithmic recommendation and deep synthesis technologies. For example, service providers must file the algorithms used and complete a security assessment with the local CAC before the provision of the service. The regulatory framework in China is expected to have a material impact on the way artificial intelligence is regulated in China, and together with developing guidance and/or decisions in this area, may affect our use of artificial intelligence and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition. It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or the interpretation and enforcement of existing laws and regulations may change, and such developments may affect the way in which we develop and use AI Technologies, including with respect to how we train our models. Failure to comply with such changing laws or regulations could subject us to legal or regulatory liability. Further, the cost to comply with such laws or regulations, or to adjust our business plans based on changes to how such laws are enforced, including adapting to loosened regulation to remain competitive, could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations. Our implementation and use of AI Technologies may not be successful, which may impair our ability to compete effectively, result in reputational harm and have an adverse effect on our business. We use AI Technologies throughout our business, and are making significant investments to continuously improve our use of such technologies. For example, we use AI Technologies (including generative artificial intelligence) to power our AI-powered ecommerce risk intelligence platform. In addition, we have adopted various third-party AI products and solutions to assist in back-end workflows. As with many technological innovations, there are significant risks and challenges involved in developing, maintaining and deploying these technologies and there can be no assurance that the usage of such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability. Further, changes and ongoing development in how we use certain AI Technologies and how we train our AI Technologies, particularly if those artificial intelligence or machine learning models are (i) incorrectly designed or implemented; (ii) trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; and/ or (iii) are adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, could negatively impact the performance of our AI-powered ecommerce risk intelligence platform and business, as well as our reputation and the reputations of our customers and partners, or we could incur liability through the violation of laws or contracts to which we are a party or through civil claims. Additionally, we incorporate generative AI Technologies (i.e. AI Technologies that can produce and output new content, software code, data and information) into our solutions and internal business practices. There is a risk that generative AI Technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results, all of which could harm our reputation, business, or customer relationships. While we take measures designed to ensure the accuracy of such artificial intelligence-generated content, those measures may not always be successful, and in some cases, we may need to rely on end users to report such inaccuracies. Furthermore, our generative AI Technologies could generate output that is infringing, and we could be subject to claims or lawsuits, 32 including for infringement of third-party intellectual property rights as a result of the output of such generative AI Technologies. While some providers of AI Technologies offer to indemnify their end users for any copyright or other intellectual property infringement claims arising from the output of their AI Technologies, we may not be successful in adequately recovering our losses in connection with such claims. In addition, as we expand our use of generative AI Technologies, including agentic systems capable of initiating actions across systems and workflows, we may face heightened security and data governance risks. The rapid evolution and increasing capabilities of such technologies may outpace the development and corresponding security, monitoring and governance tools. As a result, existing cybersecurity controls and detection frameworks, which were primarily designed for traditional software architectures and human-driven workflows, may not be fully effective in addressing the novel threat vectors, emergent behaviors and system interactions introduced by generative or autonomous AI systems. Such systems may increase our attack surface and could be susceptible to prompt injection, tool misuse, unauthorized actions, indirect data exfiltration or other emergent, compound or previously unidentified attack vectors. AI Technologies that access or synthesize information across systems may unintentionally expose, infer, correlate, or recombine sensitive or confidential data through outputs, summaries, logs or memory mechanisms, even where access controls are in place. Further, traditional role-based access control frameworks may not align effectively with goal-driven autonomous AI agents, which could result in inappropriate access, privilege escalation or unintended system interactions. Any such failures or vulnerabilities could result in security incidents, regulatory exposure, financial loss, reputational harm or legal liability. In addition, the market for AI security and governance solutions is itself rapidly evolving and may remain reactive to newly emerging risks. Security vendors and internal control frameworks may not be able to anticipate or mitigate novel vulnerabilities at the pace at which new AI capabilities are developed or adopted. This dynamic may require us to operate with a degree of residual risk that cannot be fully eliminated through currently available technical safeguards. Conversely, efforts to materially restrict, delay or limit the deployment of generative AI Technologies in order to reduce risk exposure could impair our operational efficiency, innovation velocity, competitive position and ability to meet customer expectations. As a result, we may face strategic trade-offs between accelerating AI adoption to remain competitive and maintaining conservative risk postures, and either approach could have a material adverse effect on our business, financial condition, results of operations and reputation. Any such failures, vulnerabilities, misalignments or governance gaps could result in security incidents, regulatory exposure, financial loss, reputational harm or legal liability. The market for AI Technologies is rapidly evolving and remains unproven in many industries, including our own. We cannot be sure that the market will continue to grow or that it will grow in ways we anticipate. We are in varying stages of development in relation to our products or services which utilize proprietary AI Technologies, and we may not be successful in our ongoing development of these technologies in the face of novel and evolving technical, reputational and market factors. Our failure to successfully develop and commercialize our products or services which utilize proprietary AI Technologies could depress the market price of our stock and impair our ability to (i) raise capital; (ii) expand our business; (iii) provide, improve and diversify our product offerings; (iv) continue our operations and efficiently manage our operating expenses; and (v) respond effectively to competitive developments. We also use AI Technologies licensed from third parties in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to specific third-party software and infrastructure. We cannot control the availability or pricing of such third-party AI Technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI Technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI Technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, to the extent any third party AI Technologies are used as a hosted service, any disruption, outage, or loss of 33 information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider. The continuous development, maintenance and operation of our AI Technologies is expensive and complex, and may involve unforeseen difficulties including material performance problems, undetected defects or errors. For instance, a machine learning model can experience decay (also known as “model drift”) in which its performance and accuracy decreases over time without further human intervention to correct such decay. We may encounter technical obstacles, and it is possible that we may discover additional problems that may prevent our proprietary technologies from operating properly, which could adversely affect our business, customer relationships and reputation. We also increasingly utilize AI Technologies, including generative AI, to assist in software development, engineering processes and other operations. While such tools may increase code output and development velocity, traditional productivity metrics (such as lines of code, commits, pull requests, story points, ticket throughput or cycle time) may become less reliable indicators of delivered customer value or software quality. AI-assisted development may result in superficial correctness while embedding latent defects, edge-case failures, architectural inconsistencies, insecure coding patters, outdated dependencies or licensing risks. AI-generated code may optimize for discrete prompts rather than overall system architecture or long-term maintainability, potentially increasing technical debt and operational complexity. As AI-generated codebases expand, we may face increased review burden, greater maintenance costs, reduced system transparency, and potential erosion of institutional knowledge or code ownership. If engineering oversight, code review rigor or governance processes are not appropriately adapted, these factors could adversely affect software quality, security posture, operational resilience and our reputation. We face significant competition from other companies in our industry in relation to the development and deployment of AI Technologies. Those other companies may develop AI Technologies that are similar or superior to ours and/or are more cost-effective and/or quicker to develop and deploy. If we cannot develop, offer or deploy new AI Technologies as effectively, as quickly and/ or as cost-efficiently as our competitors, we could experience a material adverse effect on our operating results of operation, customer relationships and growth. Additionally, if we do not continue to invest resources to develop and support our AI Technologies, we may fall behind technological developments and evolving industry standards, which would likely harm our ability to compete. Further, our ability to continue to develop or use such technologies may be dependent on access to specific third-party software, services and infrastructure, such as processing hardware, and we cannot control the availability or pricing of such third-party software and infrastructure, especially in a highly competitive environment. Our use of open-source software could negatively affect our ability to sell our products and subject us to possible litigation. Our products incorporate open-source software, and we expect to continue to incorporate open-source software in our products in the future. Few of the licenses applicable to open-source software have been interpreted by courts, and there is a risk that these licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to commercialize our products. Certain open-source licenses may give rise to requirements to disclose or license our source code or other intellectual property if such open-source software is incorporated in, integrated with, or linked to our proprietary software in certain ways. We have guidelines in place which help us to regulate the use and incorporation of open-source software into our products in a manner that is intended to help mitigate the risk of subjecting our proprietary code to these restrictions. However, we cannot be certain that we have incorporated open-source software in our products in a manner that is consistent with these guidelines. If we fail to comply with our guidelines, or if they are flawed, we may be subject to certain requirements, including requirements that we offer our products that incorporate, integrate or link to the open-source 34 software for free, or that we make available our proprietary source code to our licensees. If a third party were to allege that we had not complied with the conditions of one or more of these licenses, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from merchants using products that contained the open-source software and required to comply with onerous conditions or restrictions on these products. In any of these events, we and our merchants could be required to seek licenses from third parties in order to continue offering our products and to re-engineer our products or we could be required to discontinue offering our products to merchants in the event re-engineering cannot be accomplished on a timely basis. Any of the foregoing could require us to devote additional research and development resources to re-engineer our products, could result in merchant dissatisfaction and may adversely affect our business, financial condition and results of operations. In addition, the use of open-source software may entail greater risks than the use of third-party commercial software, as open-source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. To the extent that our AI-powered ecommerce risk intelligence platform depends upon the successful operation of the open-source software we use, any undetected errors or defects in this open-source software could prevent the deployment or impair the functionality of our platform, delay the introduction of new products, result in a failure of our platform, and injure our reputation. For example, undetected errors or defects in open-source software could render it vulnerable to breaches or security attacks and make our systems more vulnerable to data breaches. Our business depends on the strength of our brand, and if we are not able to maintain and enhance our brand, we may be unable to sell our products, which could have a material adverse effect on our business, financial condition and results of operations. Our brand is integral to the growth of our business and to the implementation of our strategies for expanding our business. We believe that our brand has significantly contributed to the success of our business and is critical to maintaining and expanding our merchant base. Maintaining and enhancing our brand may require us to make substantial investments in areas such as research and development, marketing, ecommerce, and merchant experience, and these investments may not be successful. We anticipate that, as our business expands into new markets and new product categories, and as the industries in which we operate become increasingly competitive, maintaining and enhancing our brand may become difficult and expensive. For example, consumers in any new international markets into which we expand may not know our brand and/or may not accept our brand, resulting in increased costs to market to and attract merchants to our brand. Further, as we continue to grow our retail partnerships, it may be difficult for us to maintain control of our brand with our retail partners, which may result in negative perceptions of our brand. Our brand may also be adversely affected if our public image or reputation is tarnished by negative publicity, including negative social media campaigns, security breaches, poor reviews of our products or merchant experiences or negative publicity associated with claims or litigation brought against the Company or against our merchants for fraud-related allegations, regardless of the merit. In addition, ineffective marketing, product diversion to unauthorized distribution channels, product defects, unfair labor practices, spurious lawsuits, and failure to protect our intellectual property rights are some of the potential threats to the strength of our brand, and those and other factors could rapidly and severely diminish customer confidence in us. Maintaining and enhancing our brand will depend largely on our ability to continue to be a leader in the industries in which we operate and to continue to offer a range of high-quality products as well as a leading end-to-end experience to our merchants, which we may not execute successfully. Failure to maintain the strength of our brand could have a material adverse effect on our business, financial condition and results of operations. Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify, pose integration challenges, divert the attention of management, disrupt our business, dilute shareholder value, and adversely affect our business, financial condition and results of operations. 35 We may in the future seek to acquire or invest in businesses, joint ventures, products and platform capabilities, or technologies that we believe could complement or expand our products and platform capabilities, enhance our technical capabilities, or otherwise offer growth opportunities. Any such acquisition or investment may cause us to incur various expenses in identifying, investigating, and pursuing suitable opportunities, whether or not the transactions are completed, and may result in unforeseen operating difficulties and expenditures. In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products and platform capabilities, accounting and financial controls, personnel, or operations of the acquired companies, particularly if we are unable to retain the key personnel of the acquired company, their software is not easily adapted to work with our AI-powered ecommerce risk intelligence platform, or we have difficulty retaining the merchants of any acquired business due to changes in ownership, management, or otherwise. These transactions may also disrupt our business, divert our resources, impact company culture and require significant management attention that would otherwise be available for development of our existing business. We have not historically made any acquisitions and have limited experience in valuing prospective acquisitions and acquiring other businesses. Any such transactions that we are able to complete may not result in any synergies or other benefits we had expected to achieve, which could result in substantial impairment charges. In addition, we may not be able to find and identify desirable acquisition targets or business opportunities or be successful in entering into an agreement with any particular strategic partner. We expect that certain of our competitors, many of which have greater resources than we do, will compete with us in acquiring complementary businesses or products. This competition could increase prices for potential acquisitions that we believe are attractive. Also, acquisitions are often subject to various regulatory approvals. If we fail to receive the appropriate regulatory approvals, we may not be able to consummate an acquisition that we believe is in our best interests and may incur significant costs. These transactions could also result in transaction fees, dilutive issuances of our equity securities, incurrence of debt or contingent liabilities, and fluctuations in quarterly results and expenses. We could also face risks related to liability for activities of any acquired company as conducted before any acquisition, including intellectual property infringements claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities and litigation or other claims in connection with the acquired company, including claims from any terminated employees, customers, users, former shareholders or other third parties, and our efforts to limit such liabilities could be unsuccessful. Further, if the resulting business from such a transaction fails to meet our expectations, our business, financial condition and results of operations may be adversely affected, or we may be exposed to unknown risks or liabilities. We may be sued by third parties for alleged infringement, misappropriation or other violation of their intellectual property rights. There is considerable technology development activity in our industry, and our competitors are vigilant in protecting and asserting their intellectual property rights. Accordingly, our success depends in part on avoiding infringing or otherwise violating the intellectual property rights of others. From time to time, our competitors or other third parties have claimed, and may in the future claim that we are infringing upon their intellectual property rights, and we may be found to be infringing upon such rights. Any claims or litigation, regardless of merit, could cause us to incur significant expenses and, if successfully asserted against us, could require us to pay substantial damages or ongoing royalty payments, could prevent us from offering our products and AI-powered ecommerce risk intelligence platform capabilities, or could require us to redesign or rebrand our products so that they are non-infringing. Furthermore, we do not currently have a patent portfolio, which could prevent us from deterring patent infringement claims due to our inability to credibly threaten patent infringement counterclaims. Even if we obtain patents in the future, our competitors and others may have significantly larger patent portfolios. Further, non-practicing entities seeking to extract a settlement from companies like us may not be deterred by a patent portfolio of any size because their sole or primary business is the assertion of patent claims. Litigation is inherently uncertain and even if we were to prevail in the event of claims or litigation against us, these claims, and the time and resources necessary to resolve them, could divert the 36 resources of our management and adversely affect our revenues, our results of operations and financial condition. Moreover, as part of any settlement or other compromise to avoid complex, protracted litigation, we may agree not to pursue future claims against a third party, including claims related to alleged infringement of our intellectual property rights. Any settlement or other compromise with another party may resolve a potentially costly dispute but may also affect our ability to defend and protect our intellectual property rights, which in turn could adversely affect our business, financial condition, and results of operations. We expect that the occurrence of infringement claims is likely to grow as the market for our products grows. Accordingly, our exposure to damages resulting from infringement claims could increase and this could further exhaust our financial and management resources. Patent infringement, trademark infringement, trade secret misappropriation and other intellectual property claims and proceedings brought against us, whether successful or not, could adversely affect our business, financial condition and results of operations. Our failure to comply with the anti-corruption, trade compliance, anti-money laundering and terror finance and economic sanctions laws and regulations of the United States and applicable international jurisdictions could materially adversely affect our reputation and results of operations. We must comply with anti-corruption laws and regulations imposed by governments around the world with jurisdiction over our operations, which may include the U.S. Foreign Corrupt Practices Act of 1977, or the FCPA, the U.K. Bribery Act 2010, or the Bribery Act, and Chapter 9 (sub-chapter 5) of the Israeli Penal Law, 5737-1977 and the Israeli Prohibition on Money Laundering Law, 5760-2000, collectively, the Israeli Anti-Corruption Laws, as well as the laws of the countries where we do business. These laws and regulations apply to companies, individual directors, officers, employees and agents acting on our behalf. Where they apply, the FCPA, the Bribery Act, and the Israeli Anti-Corruption Laws prohibit us and our officers, directors, employees and business partners acting on our behalf, including joint venture partners and agents, from corruptly offering, promising, authorizing or providing anything of value to public officials for the purposes of influencing official decisions or obtaining or retaining business or otherwise obtaining favorable treatment. The Bribery Act also prohibits non-governmental “commercial” bribery and accepting bribes. As part of our business, we may deal with governments and state-owned business enterprises, the employees and representatives of which may be considered public officials for purposes of anti-corruption laws, including the FCPA, the Bribery Act, and the Israeli Anti-Corruption Laws. We also are subject to the jurisdiction of various governments and regulatory agencies around the world, which may bring our personnel and agents into contact with public officials responsible for issuing or renewing permits, licenses or approvals or for enforcing other governmental regulations. In addition, some of the international locations in which we operate are considered to lack a developed legal system and have elevated levels of corruption. Our business also must be conducted in compliance with applicable economic and financial sanctions, trade embargoes, and export controls, such as those administered and enforced by the U.S. Department of Treasury’s Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council, the State of Israel, and other relevant sanctions and export control authorities. Our global operations expose us to the risk of violating, or being accused of violating, anti-corruption laws, anti-money laundering laws, economic and financial sanctions, trade embargoes and export controls. Our failure to comply with these laws and regulations may expose us to reputational harm as well as significant penalties, including criminal fines, imprisonment, civil fines, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. Despite our compliance efforts and activities we cannot assure compliance by our employees or representatives for which we may be held responsible, and any such violation could materially adversely affect our business or customers, financial condition and results of operations. 37 While we may not be able to enforce non-compete agreements we enter into with employees in certain locations, our current and future competition may attempt to enforce similar agreements with individuals we recruit or attempt to recruit. We generally enter into agreements with employees in certain locations which prohibit those employees, if they cease working for us, from competing directly with us or working for our current and future competition for a limited period. However, we may be unable to enforce these agreements under the laws of the jurisdictions in which our employees work, and it may be difficult for us to restrict our current and future competition from benefiting from the expertise our former employees developed while working for us. For example, Israeli labor courts have required employers seeking to enforce non-compete undertakings of a former employee to demonstrate that the competitive activities of the former employee will harm one of a limited number of material interests of the employer that have been recognized by the courts, such as the protection of a company’s trade secrets or other intellectual property. If we hire employees from our current and future competition or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources. In a similar manner, should our current and future competition succeed in hiring some of our employees and executives, and should some of these employees or executives breach their legal obligations and divulge commercially sensitive information to our current and future competition, our ability to successfully compete with our current and future competition may be hindered. If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired. The Sarbanes-Oxley Act of 2002 (the “Sarbanes-Oxley Act”) requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are continuing to develop and refine our disclosure controls and other procedures that are designed to ensure that information required to be disclosed by us in the reports that we will file with the SEC is recorded, processed, summarized, and reported within the time periods specified in SEC rules and forms and that information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers as appropriate to allow timely decisions regarding required disclosure. In order to maintain the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related as well as outside consultants-related costs. If any of these controls and systems do not perform as expected, we may experience material weaknesses in our controls. We are required to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting pursuant to Section 404(a) of the Sarbanes-Oxley Act in our annual reports. This assessment must include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. The rules governing the standards that must be met for our management to assess our internal control over financial reporting are complex and require significant documentation, testing and possible remediation. Despite our efforts, there is a risk that we will not be able to conclude that our internal control over financial reporting is effective. Any failure to maintain effective controls could cause us to fail to meet our reporting obligations and may result in a restatement of our consolidated financial statements for prior periods. If we identify one or more material weaknesses, it could result in an adverse reaction in the financial markets due to a loss of confidence in the reliability of our financial statements. Additionally, following the loss of our “emerging growth company” status, no later than December 31, 2026 (which is the last day of the fiscal year following the fifth anniversary of our IPO), our independent registered public accounting firm will be required to formally attest to the effectiveness of our internal control over financial reporting pursuant to Section 404(b) of the Sarbanes-Oxley Act. At such time, our independent registered public accounting firm may issue a report 38 that is adverse in the event it is not satisfied with the level at which our internal control over financial reporting is documented, designed or operating. Ineffective disclosure controls and procedures and internal control over financial reporting could cause investors to lose confidence in our reported financial and other information and we could become subject to investigations by the SEC or other regulatory authorities, which could have a material negative effect on the trading price of our Class A ordinary shares. In addition, failure to meet these requirements could result in delisting from the New York Stock Exchange (“NYSE”). If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our business, financial condition and results of operations may be adversely affected. The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported and disclosed in our consolidated financial statements and accompanying notes. Actual results could differ materially from these estimates. We base our estimates on assumptions (both historical and forward-looking), trends, and various other assumptions that are believed to be reasonable, as provided in Note 2 to our consolidated financial statements. The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, in addition to the amount of revenue and expenses that are not readily apparent from other sources. Significant assumptions and estimates are used to prepare our consolidated financial statements, including those related to the estimated period of benefit on deferred contract costs, the capitalization of certain costs to fulfill a contract, the allowance for credit losses, the fair value of financial assets and liabilities including the fair value of derivatives, the useful lives of property and equipment, capitalization and estimated useful life of internal-use software, share-based compensation including the fair value of indemnification guarantees and the associated systematic and rational amortization method, provisions for chargebacks, incremental borrowing rate (“IBR”) used for operating lease right-of-use (“ROU”) assets and operating lease liabilities, and the valuation of deferred tax assets and uncertain tax positions. Our business, financial condition and results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A ordinary shares. We conduct business in China, which exposes us to political, legal, and economic risks, and we may be subject to negative publicity in China, which could damage our reputation and have an adverse effect on our revenues, our results of operations and financial condition. Conducting business in China exposes us to political, legal, and economic risks. In particular, the political, legal, and economic climate in China, both nationally and regionally, and the state of China-U.S. relations are fluid and unpredictable. Our products may be subject to regulations in China now or in the future, including with respect to data privacy, foreign exchange controls, and licensing, that may require us to incur new or additional compliance or other administrative costs, and it is possible that such regulations may conflict with other jurisdictions in which we operate. Applicable laws and regulations in China may not be well publicized and may not be known to us in advance of us becoming subject to them, and the implementation and enforcement of such laws and regulations may be inconsistent. Changes in Chinese laws and regulations, including, among others, with regards to disclosure of information, data privacy, intellectual property, tax matters, or changes in their implementation by local authorities, could affect us as well as our merchants and could have a material adverse impact on our business, financial condition, and results of operations. Furthermore, our brand could be subject to adverse publicity if incidents related to our image or the products we offer occur or are perceived to have occurred, whether or not we are at fault. In particular, given the popularity of social media in China, including WeChat and Weibo, any negative publicity, regardless of its truthfulness, could quickly proliferate and harm consumer perceptions of and confidence in the Company. 39 Scrutiny of, and evolving expectations for, sustainability and environmental, social, and governance (“ESG”) initiatives could increase our costs, harm our reputation, or otherwise adversely impact our business. We, as with other companies, face scrutiny from various stakeholders on ESG matters. Stakeholder expectations vary and, at times, can conflict. Both advocates and opponents to certain ESG matters, including climate change and human capital, among others, are increasingly resorting to a range of activism forms, including media campaigns and litigation, to advance their perspectives. Such increased scrutiny or any failure to successfully address stakeholder expectations may result in increased costs, changes in demands for certain products, enhanced compliance or disclosure obligations, reputational harm (including through ratings), or other adverse impacts on our business, financial condition or results of operations. While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others), such initiatives may be costly and may not have the desired effect. For example, ESG-related initiatives are often based on methodologies, standards, or data that are still evolving and subject to varying interpretations. As ESG best practices, reporting standards and disclosure requirements continue to develop, we may incur increasing costs related to ESG monitoring and reporting. In addition, various policymakers have adopted (or are considering adopting) new sustainability rules and regulations, including requirements for the disclosure of certain climate- or other ESG-related information. However, such requirements are not uniform and some policymakers have sought to constrain companies’ consideration of ESG matters. Operating in more than one jurisdiction is likely to make our compliance with ESG and sustainability-related rules more complex and expensive, and potentially expose us to greater levels of legal risks associated with our compliance. Our failure to comply with any applicable rules or regulations, or new interpretations of existing requirements, could lead to penalties and adversely impact our reputation, customer attraction and retention, access to capital and employee retention. Such ESG matters may also impact our suppliers and customers, which may augment or cause additional impacts on our business, financial condition, or results of operations. Further, there is particular focus on concerns relating to AI and its impact on the environment, including the power-intensive nature of the industry and potential impacts to the climate, high consumption of water, and reliance on critical minerals and rare elements. We may experience heightened scrutiny from our stakeholders and investors around these issues. Changes in tax laws or regulations that we are subject to in various tax jurisdictions or disagreements with tax authorities over the application of the current tax laws or regulations may have an adverse effect on us or our merchants and could increase our costs and harm our business. New income, sales, use, or other tax laws, regulations, or ordinances could be enacted or new interpretations of existing tax laws, regulations, or ordinances could be adopted at any time. Those changes could adversely affect our domestic and international business operations, results of operations and financial condition. These events could require us or our merchants to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our merchants to pay fines and/or penalties and interest for past amounts deemed to be due. If we are required to collect such additional tax amounts from our merchants and are unsuccessful in collecting such taxes due from our merchants, we could be held liable for such costs, thereby adversely affecting our results of operations and harming our business. If we raise our prices to offset the costs of these changes, existing and potential future merchants may elect not to purchase our products in the future. Additionally, new, changed, modified, or newly interpreted or applied tax laws could increase our merchants’ and our compliance, operating, and other costs. Further, these events could decrease the capital we have available to operate our business. Any or all of these events could harm our business, results of operations, and financial condition. In addition, we are subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. We have in the past been and are currently 40 the subject of routine tax audits in Israel, administered by the Israel Tax Authority and the Israel National Insurance Institute. As a result of these audits or a review of our tax returns by the tax authorities in any other jurisdiction in which we do business, certain additional tax, interest or penalties have been, and may in the future be, imposed on us. Tax authorities in these jurisdictions may also assert that various withholding requirements apply to us or our subsidiaries or that benefits of tax treaties are not available to us or our subsidiaries. Moreover, given the multijurisdictional developments under the Organization for Economic Co-operation and Development’s, or the OECD, efforts to standardize and modernize global corporate tax policy described further below, it is generally expected that tax authorities in various jurisdictions in which we operate may increase their audit activity and may seek to challenge some of the tax positions we have adopted. It is difficult to assess if and to what extent such challenges, if raised, might impact our effective tax rate. Any of these actions by tax authorities could harm our business and our results of operations. Our results of operations may be harmed if we are required to collect sales or other similar taxes for the sale of our products in jurisdictions where we have not historically done so. The application of indirect taxes (such as sales and use tax, VAT, GST, business tax, and gross receipt tax) to businesses that transact online, such as ours, is a complex and evolving area. An increasing number of states have considered or adopted laws that attempt to impose tax collection obligations on out-of-state companies. Following the U.S. Supreme Court decision in South Dakota v. Wayfair, Inc., U.S. states are free to levy taxes on sales of goods and services based on an “economic nexus,” regardless of whether the seller has a physical presence in the state. As a result, it may be necessary to reevaluate whether our activities give rise to sales, use, and other indirect taxes as a result of any nexus in those states in which we are not currently registered to collect and remit taxes. Additionally, we may need to assess our potential tax collection and remittance liabilities based on existing economic nexus laws’ dollar and transaction thresholds. It is possible that we could face sales tax, VAT, or GST audits and that our liability for these taxes could exceed our estimates as state tax authorities could still assert that we are obligated to collect additional tax amounts from our merchants and remit those taxes to those tax authorities. Further, one or more U.S. state or non-U.S. authorities could seek to impose additional sales, use, or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us. We could also be subject to tax audits in U.S. states and international jurisdictions for which we have not accrued tax liabilities. A successful assertion by one or more states requiring us to collect taxes where we presently do not do so could result in substantial tax liabilities (including taxes on past sales, as well as penalties and interest), discourage organizations from purchasing our products, or otherwise harm our business, results of operations, and financial condition. We continue to analyze our exposure for such taxes and liabilities, including the need to provide for loss contingencies resulting from these potential taxes and liabilities. There have been, and will continue to be, substantial ongoing costs associated with complying with the various indirect tax requirements in the numerous markets in which we conduct or will conduct business. The enactment of legislation implementing changes in taxation of international business activities, the adoption of other corporate tax reform policies, or changes in tax legislation or policies could impact our future financial position and results of operations. Corporate tax reform, tackling base-erosion efforts, and tax transparency continue to be high priorities in many tax jurisdictions where we have business operations. As a result, policies regarding corporate income and other taxes in numerous jurisdictions are under heightened scrutiny, and tax reform legislation is being proposed or enacted in a number of jurisdictions. In 2015, the OECD released various reports under its Base Erosion and Profit Shifting, or BEPS, action plan to reform international tax systems and prevent tax avoidance and aggressive tax planning. These actions aim to standardize and modernize global corporate tax policy, including cross-border taxes, transfer-pricing documentation rules, and nexus-based tax incentive practices which in part are focused on challenges arising from the digitalization of the economy. The reports have a very broad scope, including, but not limited to, neutralizing the effects of hybrid mismatch arrangements, limiting base 41 erosion involving interest deductions and other financial payments, countering harmful tax practices, preventing the granting of treaty benefits in inappropriate circumstances, and imposing mandatory disclosure rules. It is the responsibility of OECD members to consider how the BEPS recommendations should be reflected in their national legislation. Many countries are beginning to implement legislation and other guidance to align their international tax rules with the OECD’s BEPS recommendations ― for example, by signing the Multilateral Convention to Implement Tax Treaty Related Measures to Prevent BEPS, or the MLI, which currently has been signed by over 100 jurisdictions, including Israel, which signed the MLI on June 7, 2017. On September 13, 2018, Israel submitted the ratification documents for the agreement, and the agreement entered into effect in Israel on January 1, 2019. The MLI implements some of the measures that the BEPS initiative proposes to be transposed into existing treaties of participating states. Such measures include the inclusion in tax treaties of one, or both, of a “limitation-on-benefit,” or LOB, rule and a “principle purposes test,” or PPT, rule. The application of the LOB rule or the PPT rule could deny the availability of tax treaty benefits (such as a reduced rate of withholding tax) under tax treaties. In January 2019, the OECD announced further work in continuation of the BEPS project, focusing on two “pillars.” On October 8, 2021, 136 countries approved a statement known as the OECD BEPS Inclusive Framework, which builds upon the OECD’s continuation of the BEPS project. The first pillar is focused on the allocation of taxing rights between countries for in-scope large multinational enterprises (with revenue in excess of €20 billion and profitability of at least 10%) that sell goods and services into countries with little or no local physical presence. The second pillar is focused on ensuring large multinational enterprises (“MNEs”) pay a minimum level of tax on the income arising in each jurisdiction where they operate. Taxpayers in scope (MNEs with global revenue of at least €750 million in at least two out of the four previous years) should calculate their effective tax rate according to the relevant rules in each jurisdiction, which are essentially based on the OECD model rules, with respect to the second pillar. According to the model rules provisions for relevant jurisdictions, taxpayers should pay top-up tax on the difference between their effective tax rate per jurisdiction and a 15% minimum tax rate. Temporary relief from the scope of the second pillar effective tax rate calculations is available for jurisdictions in which the applicable MNE operates, if it can be demonstrated that the specific jurisdiction satisfies one of three “safe harbor tests” during a “transitional period” from 2024 to 2026. Israel is one of the 136 countries that has agreed in principle to the adoption of the global minimum tax rate and has recently announced it would implement some parts of pillar two commencing January 1, 2026, specifically the Qualified Domestic Top Up Tax which would require in scope Israeli companies to supplement Israeli corporate tax if their effective tax rate as computed under the rules of pillar two is below 15%. Numerous countries have enacted legislation to implement the second pillar rules, effective beginning January 1, 2025, or are expected to enact similar legislation. In response to concerns raised by the United States, the OECD recently finalized a “side-by-side” approach, under which certain U.S.-parented multinational enterprises may be exempt from certain pillar two rules. It is not entirely clear how this side-by-side agreement will be implemented by each participating jurisdiction. As a result, pillar two remains under negotiation and continues to evolve. Tax and compliance costs are expected to be increased by the continuing adoption of the second pillar rules in various countries. Although many of the BEPS measures have already been implemented or are currently being implemented globally, it is still difficult in some cases to assess to what extent these changes our tax liabilities in the jurisdictions in which we conduct our business or to what extent they may impact the way in which we conduct our business or our effective tax rate due to the unpredictability and interdependency of these potential changes. Such legislative initiatives may materially and adversely affect our plans to expand internationally and may negatively impact our financial condition, tax liability, and results of operations, and could increase our administrative expenses. Changes in, or adverse applications of, insurance laws or regulations in the jurisdictions in which we operate could subject our business to additional regulation, which could impact our future financial position and results of operations. New insurance laws, regulations, or ordinances could be enacted or new interpretations or adverse applications of existing insurance laws, regulations, or ordinances could be adopted at any time. If the 42 company is classified as an insurance company in any jurisdiction due to our product, the Chargeback Guarantee, such classification could adversely affect our future financial position and results of operations by, among other things, increasing the costs of regulatory compliance, limiting or restricting the products we provide, including our ability to provide the Chargeback Guarantee, or the methods by which we provide them and subjecting us to the possibility of regulatory actions or proceedings. If we are unable to comply with such regulations, we may be precluded or temporarily suspended from carrying on some or all of the activities of our business or otherwise be fined or penalized in a given jurisdiction. Risks Relating to Our Class A Ordinary Shares The share price of our Class A ordinary shares has been and may continue to be volatile The market price of our Class A ordinary shares has experienced significant price and volume volatility and may continue to fluctuate in the future, substantially as a result of many factors, including: •actual or anticipated fluctuations in our revenues, our gross profit, our results of operations, and our financial condition; •variance in our financial performance from the expectations of securities analysts; •announcements by us or our direct or indirect competitors of significant business developments, changes in service provider relationships, acquisitions, consolidations, or expansion plans; •geopolitical conditions or uncertainty, which may include war, political instability or unrest, or terrorism; •changes or proposed changes in laws or regulations or differing interpretations or enforcement of laws or regulations affecting our business, including the laws, regulations, card scheme rules or any other frameworks that have the effect of shifting liability for fraud away from merchants; •changes in our pricing model; •merchant-churn, including discounting and churn of significant merchants; •our involvement in litigation or regulatory actions; •sales of our Class A ordinary shares by us or our shareholders, including any sales of Class B ordinary shares, which will automatically convert into Class A ordinary shares upon transfer thereof; •market conditions in our industry; •changes in key personnel; •the trading volume of our Class A ordinary shares; •the timing and amount of our share repurchases (if any); •publication of research reports or news stories about us, our competition, or our industry, or positive or negative recommendations or withdrawal of research coverage by securities analysts; •changes in the estimation of the future size and growth rate of our markets; and •general economic and market conditions, including inflation, employment rates and global trade conditions. In addition, the stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to 43 the operating performance of those companies. Broad market and industry factors have, and may in the future, materially harm the market price of our Class A ordinary shares, regardless of our actual operating performance. In addition, in the past, securities class action litigation has often been instituted against companies whose stock price have declined, especially following periods of volatility in the overall market. We have been subject to securities class action litigation in the past. Any securities class action litigation could result in substantial costs and a diversion of our management’s attention and resources. We cannot predict the impact our dual class structure may have on the market price of our Class A ordinary shares. We cannot predict whether our dual class structure will result in a lower or more volatile market price of our Class A ordinary shares, in adverse publicity or other adverse consequences. Certain investors, including large institutional investors, may prefer companies that do not have multiple share classes or may have investment guidelines that preclude them from investing in companies that have multiple share classes. In addition, certain index providers have previously implemented, and may in the future determine to implement, restrictions on including companies with multiple share classes in certain of their indices. For example, from July 2017 to April 2023, S&P Dow Jones excluded companies with multiple share classes from the S&P Composite 1500 (composed of the S&P 500, S&P MidCap 400 and S&P SmallCap 600). Indices have discretion to reassess and implement such policies with respect to multi-class differing voting right structures. Under any such policies, our dual class share structure would make us ineligible for inclusion in any of these indices. As a result, the market price of our Class A ordinary shares could be materially adversely affected. The dual class structure of our ordinary shares has the effect of concentrating voting power with our management and other pre-IPO shareholders, which will limit your ability to influence the outcome of important transactions, including a change in control. Our Class B ordinary shares have ten votes per share, and our Class A ordinary shares have one vote per share. As of December 31, 2025, our named executive officers collectively held approximately 35.13% of the voting power of our outstanding ordinary shares, and our pre-IPO shareholders collectively held approximately 84.34% of the voting power of our outstanding ordinary shares. Accordingly, although there are no voting agreements among our pre-IPO shareholders, our management and pre-IPO shareholders, including our co-founders, hold together all of our issued and outstanding Class B ordinary shares and therefore, individually or together, are able to significantly influence matters submitted to our shareholders for approval, including the election of directors, amendments of our organizational documents, executive compensation items and any merger or other major corporate transactions that require shareholder approval. Our management and pre-IPO shareholders, including our co-founders, individually or together, may vote in a way with which you disagree and which may be adverse to your interests. This concentrated voting power may have the effect of delaying, preventing or deterring a change in control of our Company, could deprive our shareholders of an opportunity to receive a premium for their shares as part of a sale of our company and might ultimately materially and adversely affect the market price of our Class A ordinary shares. Future transfers by the holders of Class B ordinary shares will result in those shares converting into Class A ordinary shares, subject to limited exceptions. As long as at least 13,468,409 Class B ordinary shares remain outstanding, and without giving effect to any future issuances, the holders of our Class B ordinary shares will hold a majority of the outstanding voting power and will continue to control the outcome of matters submitted to shareholders for approval. While our amended and restated articles of association generally prohibit us from issuing additional Class B ordinary shares (other than with the affirmative vote of the holders of at least seventy-five percent (75%) of our outstanding Class B ordinary shares), any future issuance of Class B ordinary shares may be dilutive to Class A ordinary shareholders. For additional information about our dual class structure, see Exhibit 2.2 to this Annual Report. 44 An active trading market for our Class A ordinary shares may not be sustained to provide adequate liquidity. An active trading market may not be sustained for our Class A ordinary shares. The lack of an active market may impair your ability to sell your shares at the time you wish to sell them or at a price that you consider reasonable. An inactive market may also impair our ability to raise capital by selling Class A ordinary shares and may impair our ability to acquire other companies by using our shares as consideration. If we do not meet the expectations of securities analysts, if they do not publish research or reports about our business, or if they issue unfavorable commentary or downgrade our Class A ordinary shares, the price of our Class A ordinary shares could decline. The trading market for our Class A ordinary shares relies in part on the research and reports that securities analysts publish about us and our business. The analysts’ estimates are based upon their own opinions and are often different from our estimates or expectations. If our revenues, our results of operations, or our financial condition are below the estimates or expectations of public market analysts and investors, the price of our Class A ordinary shares could decline. Moreover, the price of our Class A ordinary shares could decline if one or more securities analysts downgrade our Class A ordinary shares or if those analysts issue other unfavorable commentary or cease publishing reports about us or our business. We qualify as an “emerging growth company” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our Class A ordinary shares less attractive to investors because we may rely on these reduced disclosure requirements. We qualify as an “emerging growth company,” as defined in the JOBS Act. Under the JOBS Act, emerging growth companies can delay adopting new or revised financial accounting standards until such time as those standards apply to private companies. We have elected to use this extended transition period under the JOBS Act for adopting new or revised financial accounting standards. For as long as we continue to be an “emerging growth company,” we may also take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including presenting only limited selected financial data and not being required to comply with the auditor attestation requirements of Section 404(b) of the Sarbanes-Oxley Act. As a result, our shareholders may not have access to certain information that they may deem important. We will remain an “emerging growth company” until the earliest of: (1) December 31, 2026; (2) the last day of the first fiscal year in which our annual gross revenue is $1.235 billion or more; (3) the date on which we have, during the previous rolling three-year period, issued more than $1 billion in non-convertible debt securities; and (4) the date we qualify as a “large accelerated filer.” We expect to lose our “emerging growth company” status as of December 31, 2026 (which is the last day of the fiscal year following the fifth anniversary of our IPO) and as a result expect to incur significant expenses and devote substantial management effort toward ensuring compliance with the requirements of Section 404 of the Sarbanes-Oxley Act. We cannot predict if investors will find our Class A ordinary shares less attractive because we may rely on these exemptions. If some investors find our Class A ordinary shares less attractive as a result, there may be a less active trading market for our Class A ordinary shares and our share price may be more volatile. We are a “foreign private issuer,” and, as a result, we are not subject to U.S. proxy rules and will be subject to Exchange Act reporting obligations that, to some extent, are more lenient and less frequent than those of a U.S. domestic public company. We report under the Exchange Act as a non-U.S. company with “foreign private issuer” status (as such term is defined in Rule 3b-4 under the Exchange Act). Because we qualify as a “foreign private issuer” under the Exchange Act, we are exempt from certain provisions of the Exchange Act that are applicable to U.S. domestic public companies, including (1) the sections of the Exchange Act regulating 45 the solicitation of proxies, consents, or authorizations in respect of a security registered under the Exchange Act; (2) the rules under the Exchange Act requiring the filing with the SEC of current reports on Form 8-K upon the occurrence of specified significant events, although we are subject to Israeli laws and regulations with regards to certain of these matters; and (3) the rules under the Exchange Act requiring the filing with the SEC of quarterly reports on Form 10-Q containing unaudited financial and other specified information, although we are subject to Israeli laws and regulations with regard to certain of these matters and have historically announced, and intend to continue announcing quarterly unaudited results in earnings press releases. The Holding Foreign Insiders Accountable Act was signed into law on December 18, 2025 and will require directors and officers of “foreign private issuers” to make insider reports under Section 16(a) of the Exchange Act, effective March 18, 2026, unless an exemption becomes available. Directors and officers of “foreign private issuers” will remain exempt from the short-swing profit disclosure and recovery provisions of Section 16 of the Exchange Act. In addition, “foreign private issuers” are not required to file their annual report on Form 20-F until four months after the end of each fiscal year, while U.S. domestic issuers that are accelerated filers are required to file their annual report on Form 10-K within 75 days after the end of each fiscal year, and U.S. domestic issuers that are large accelerated filers are required to file their annual report on Form 10-K within 60 days after the end of each fiscal year. “Foreign private issuers” are also exempt from Regulation FD, which prohibits selective disclosures of material information. As a result of all of the above, investors may not have the same protections or information afforded to shareholders of a U.S domestic issuer. We may lose our “foreign private issuer” status in the future, which could result in significant additional costs and expenses. We are a “foreign private issuer,” and therefore, we are not required to comply with all of the periodic disclosure and current reporting requirements of the Exchange Act. The determination of “foreign private issuer” status is made annually on the last business day of an issuer’s most recently completed second fiscal quarter. In the future, we would lose our “foreign private issuer” status if (1) more than 50% of our outstanding voting securities are owned by U.S. residents and (2) a majority of our directors or executive officers are U.S. citizens or residents, or we fail to meet additional requirements necessary to avoid loss of “foreign private issuer” status. If we lose our “foreign private issuer” status, we will be required to file with the SEC periodic reports and registration statements on U.S. domestic issuer forms, which are more detailed and extensive than the forms available to a “foreign private issuer.” We will also have to mandatorily comply with U.S. federal proxy requirements, and our officers, directors, and more than 10% shareholders will become subject to the short-swing profit disclosure and recovery provisions of Section 16 of the Exchange Act. In addition, we will lose our ability to rely upon exemptions from certain corporate governance rules of the NYSE. As a U.S. listed public company that is not a “foreign private issuer,” we will incur significant additional legal, accounting, and other expenses that we will not incur as a “foreign private issuer.” As a “foreign private issuer” we follow certain home country corporate governance practices. As a result, our shareholders may not have the same protections afforded to shareholders of companies that are subject to all corporate governance rules of the New York Stock Exchange. As a “foreign private issuer,” we are permitted to comply with certain Israeli corporate governance practices instead of the corporate governance rules of the NYSE, provided that we disclose which requirements we are not following and the equivalent Israeli requirement. We intend to rely on this “foreign private issuer exemption” with respect to NYSE rules for shareholder meeting quorums. See Item 6.C. “Board Practices ― Corporate Governance Practices.” We may in the future elect to follow Israeli practices with regard to other matters. As a result, our shareholders may not have the same protections afforded to shareholders of companies that are subject to all corporate governance rules of the NYSE. The market price of our Class A ordinary shares could be negatively affected by future issuances and sales of our Class A ordinary shares. 46 As of December 31, 2025, there were 104,034,048 Class A ordinary shares and 44,118,455 Class B ordinary shares outstanding. Sales by us or our shareholders of a substantial number of Class A ordinary shares, including Class B ordinary shares, which will automatically convert into Class A ordinary shares upon transfer, in the public market, or the perception that these sales might occur, could cause the market price of our Class A ordinary shares to decline or could impair our ability to raise capital through a future sale of, or pay for acquisitions using, our equity securities. Of our issued and outstanding shares, all the Class A ordinary shares, including Class B ordinary shares, which automatically convert into Class A ordinary shares upon transfer, are freely transferable, except for any shares held by our “affiliates,” as that term is defined in Rule 144 under the Securities Act. As of December 31, 2025, we had 12,733,513 Class A ordinary shares available for future grants under our equity incentive plans and 22,685,953 Class A ordinary shares that were subject to outstanding share options and restricted share units, or RSUs. Of this amount, 5,243,915 options were vested and exercisable as of December 31, 2025. Future grants under our equity incentive plans, whether in the ordinary course of business or otherwise, will result in dilution of the ownership interests of our existing shareholders. We may issue Class A ordinary shares or securities convertible into our Class A ordinary shares from time to time in connection with financings, acquisitions, investments, or otherwise, which may give new investors rights, preferences, and privileges senior to those of holders of our Class A ordinary shares. Any such issuance could result in substantial dilution to our existing stockholders and cause the trading price of our Class A ordinary shares to decline. Provisions of Israeli law and our amended and restated articles of association may delay, prevent, or make undesirable an acquisition of all or a significant portion of our shares or assets. Provisions of Israeli law and our amended and restated articles of association could have the effect of delaying or preventing a change in control and may make it more difficult for a third party to acquire us or our shareholders to elect different individuals to our board of directors, even if doing so would be considered beneficial by some of our shareholders, and may limit the price that investors may be willing to pay in the future for our Class A ordinary shares. Among other things: •the Israeli Companies Law, 5759-1999 (the “Companies Law”) regulates mergers and requires that a tender offer be effected when one or more shareholders propose to purchase shares that would result in it or them owning more than a specified percentage of shares in a company; •the Companies Law requires special approvals for certain transactions involving directors, officers, or significant shareholders, and regulates other matters that may be relevant to these types of transactions; •the Companies Law does not provide for shareholder action by written consent for public companies, thereby requiring all shareholder actions to be taken at a general meeting of shareholders; •our amended and restated articles of association divide our directors into three classes, each of which is elected once every three years; •an amendment to our amended and restated articles of association generally requires, in addition to the approval of our board of directors, a vote of the holders of a majority of our outstanding ordinary shares entitled to vote present and voting on the matter at a general meeting of shareholders (referred to as simple majority), and the amendment of a limited number of provisions, such as the provision empowering our board of directors to determine the size of the board, the provision dividing our directors into three classes, the provision that sets forth the procedures and the requirements that must be met in order for a shareholder to require the Company to include a matter on the agenda for a general meeting of the shareholders, the provisions relating to the election and removal of members of our board of directors and 47 empowering our board of directors to fill vacancies on the board, requires, in addition to the approval of our board of directors, a vote of the holders of 65% of our outstanding ordinary shares entitled to vote at a general meeting; •our amended and restated articles of association do not permit a director to be removed, except by a vote of the holders of at least 65% of our outstanding shares entitled to vote at a general meeting of shareholders; •our dual class ordinary share structure, which provides our existing shareholders, individually or together, with the ability to significantly influence the outcome of matters requiring shareholder approval, even if they own significantly less than a majority of our outstanding Class A ordinary shares and Class B ordinary shares; and •our amended and restated articles of association provide that director vacancies may be filled by our board of directors. Further, Israeli tax considerations may make potential transactions undesirable to us or to some of our shareholders whose country of residence does not have a tax treaty with Israel, granting tax relief to such shareholders from Israeli tax. For example, Israeli tax law does not recognize tax-free share exchanges to the same extent as U.S. tax law. With respect to mergers, Israeli tax law allows for tax deferral in certain circumstances, but makes the deferral contingent on the fulfillment of numerous conditions, including a holding period of two years from the date of the transaction during which certain sales and dispositions of shares of the participating companies are restricted. Moreover, with respect to certain share swap transactions, the tax deferral is limited in time, and when such time expires, the tax becomes payable even if no disposition of the shares has occurred. We do not expect to pay any dividends in the foreseeable future. We have never declared nor paid any dividends on our ordinary shares. We do not anticipate paying any dividends in the foreseeable future. We currently intend to retain future earnings, if any, to finance operations and expand our business. Consequently, investors who purchase Class A ordinary shares may be unable to realize a gain on their investment, except by selling such shares after price appreciation, which may never occur. Our board of directors has sole discretion whether to pay dividends. If our board of directors decides to pay dividends, the form, frequency and amount will depend upon our future operations and earnings, capital requirements and surplus, general financial condition, contractual restrictions and other factors that our directors may deem relevant. The Companies Law imposes restrictions on our ability to declare and pay dividends. Payment of dividends may also be subject to Israeli withholding taxes. See Item 10.E. “Taxation —Israeli Tax Considerations” for additional information. We cannot guarantee that our share repurchase program will be utilized to the full value approved or that it will enhance long-term shareholder value. Repurchases we consummate could increase the volatility of the price of our Class A ordinary shares and could have a negative impact on the liquidity of our Class A ordinary shares. As of December 31, 2025, our Board of Directors had approved a share repurchase program for the purchase of an aggregate of up to $300 million of our Class A ordinary shares (the “Repurchase Program”), of which approximately $269 million had been utilized. On March 2, 2026, our Board of Directors authorized the repurchase of an additional $75 million of the Company’s Class A ordinary shares, subject to the completion of Israeli regulatory procedures. Assuming completion of the required Israeli regulatory procedures, the total aggregate repurchase authorization outstanding under the Repurchase Program as of March 2, 2026 was approximately $85.1 million. Under the Repurchase Program, repurchases can be made from time to time using a variety of methods, which may include 48 open market purchases, privately negotiated transactions or otherwise, all in accordance with U.S. federal securities laws. The timing, as well as the number and value of any shares repurchased under the program, will be determined at our discretion and will depend on a variety of factors, including management's assessment of the intrinsic value of our ordinary shares, the market price of our ordinary shares, general market and economic conditions, available liquidity, alternative investment opportunities, and applicable legal requirements. Share repurchases could have an impact on the trading price of our Class A ordinary shares, increase the volatility of the price of our Class A ordinary shares, or reduce the liquidity of our Class A ordinary shares. Additionally, repurchases under the Repurchase Program may diminish our cash reserves, which could impact our ability to finance future growth and to pursue possible strategic opportunities and acquisitions and could result in lower overall returns on our cash balances. The Repurchase Program does not obligate us to acquire a particular amount of Class A ordinary shares, and the Repurchase Program may be suspended, modified or discontinued at any time at our discretion and without prior notice, which may result in a decrease in the trading prices of our Class A ordinary shares. We cannot assure you that any share repurchases will enhance shareholder value because the market price of our Class A ordinary shares could decline. We will continue to incur increased costs as a result of operating as a public company, and our management will be required to devote substantial time to new compliance initiatives and corporate governance practices. As a public company we incur, and particularly after we are no longer an “emerging growth company,” or no longer qualify as a “foreign private issuer,” we have incurred and will continue to incur significant legal, accounting, and other expenses that we did not incur as a private company. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform, and Consumer Protection Act, the listing requirements of the NYSE and other applicable securities rules and regulations impose various requirements on public companies, including the establishment and maintenance of effective disclosure and financial controls and corporate governance practices. Our management and other personnel continue to devote a substantial amount of time to these compliance initiatives. Moreover, we will continue to incur substantial legal and financial compliance costs, and certain activities will be more time-consuming and costly, as a result of these rules and regulations. For example, these rules and regulations make it more difficult and more expensive for us to obtain director and officer liability insurance, and could also make it more difficult for us to attract and retain qualified members of our board. Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our Class A ordinary shares from the NYSE, fines, sanctions, and other regulatory action and potentially civil litigation. We cannot predict or estimate the amount of additional costs we may incur or the timing of such costs. These rules and regulations are often subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. Our amended and restated articles of association provide that, unless we consent to an alternative forum, the federal district courts of the United States shall be the exclusive forum for resolution of any complaint asserting a cause of action arising under the Securities Act, and the competent courts of Tel Aviv, Israel, shall be the exclusive forum for resolution of substantially all disputes between the Company and its shareholders under the Companies Law and the Israeli Securities Law, which could limit our shareholders’ ability to choose the judicial forum for disputes with us, our directors, shareholders, or other employees. Our amended and restated articles of association provide that, unless we consent to the selection of an alternative forum, the federal district courts of the United States shall be the exclusive forum for any claim asserting a cause of action arising under the Securities Act. Section 22 of the Securities Act creates concurrent jurisdiction for U.S. federal and state courts over all such Securities Act actions. Accordingly, 49 both U.S. state and federal courts have jurisdiction to entertain such claims. To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated articles of association provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act. This exclusive forum provision will not apply to suits brought to enforce any liability or duty created by the Exchange Act, and our shareholders cannot and will not be deemed to have waived our compliance with the U.S. federal securities laws and the rules and regulations thereunder as a result of our exclusive forum provision. Our amended and restated articles of association further provide that, unless we consent in writing to the selection of an alternative forum, the competent courts of Tel Aviv, Israel, is the exclusive forum for the resolution of (i) any derivative action or proceeding brought on behalf of the Company, (ii) any action asserting a claim of breach of fiduciary duty owed by any director, officer or other employee of the Company to the Company or the Company’s shareholders, or (iii) any action asserting a claim arising pursuant to any provision of the Companies Law or the Israeli Securities Law, 1968, or the Israeli Securities Law. Such exclusive forum provision is intended to apply to claims arising under Israeli law and does not apply to claims for which the federal courts would have exclusive jurisdiction, whether by law or pursuant to our amended and restated articles of association, as described above. Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to the foregoing provisions of our amended and restated articles of association. However, the enforceability of similar forum provisions (including exclusive federal forum provisions for actions, suits, or proceedings asserting a cause of action arising under the Securities Act) in other companies’ organizational documents has been challenged in legal proceedings, and there is uncertainty as to whether courts would enforce the exclusive forum provisions in our amended and restated articles of association. If a court were to find the exclusive forum provisions contained in our amended and restated articles of association to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could materially adversely affect our business, financial condition, and results of operations. Although we believe these exclusive forum provisions benefit us by providing increased consistency in the application of U.S. federal securities laws or the Companies Law, as applicable, in the types of lawsuits to which they apply, such exclusive forum provisions may limit a shareholder’s ability to bring a claim in the judicial forum of their choosing for disputes with us or any of our directors, shareholders, officers, or other employees, which may discourage lawsuits with respect to such claims against us and our current and former directors, shareholders, officers, or other employees. There could be adverse U.S. federal income tax consequences to United States Holders of our Class A ordinary shares if we are classified as a passive foreign investment company for United States federal income tax purposes. We would be classified as a passive foreign investment company, or PFIC, for any taxable year if, after the application of certain look-through rules, either: (i) 75% or more of our gross income for such year is “passive income” (as defined in the relevant provisions of the Internal Revenue Code of 1986, as amended, or the Code) (the “income test”); or (ii) 50% or more of the value of our assets (generally determined on the basis of a quarterly average) during such year is attributable to assets that produce or are held for the production of passive income (the “asset test”). For these purposes, cash and other assets readily convertible into cash or that do or could generate passive income are categorized as passive assets, and the value of goodwill and other unbooked intangible assets is generally taken into account. Passive income generally includes, among other things, rents, dividends, interest, royalties, gains from the disposition of passive assets and gains from commodities and securities transactions. For purposes of the income and asset tests, we will be treated as owning a proportionate share of the assets and earning a proportionate share of the income of any other corporation of which we own, directly or indirectly, at least 25% (by value) of the stock. Based on our market capitalization and the composition of 50 our income, assets, and operations, we believe we were not a PFIC for the year ending December 31, 2025. However, this is a factual determination that must be made annually after the close of each taxable year. Moreover, the aggregate value of our assets for purposes of the PFIC determination may be determined by reference to the trading value of our Class A ordinary shares. The trading value of our Class A ordinary shares is likely to continue to fluctuate while the market price of the shares of U.S. listed technology companies continues to be volatile, which may affect the determination of whether we will be considered a PFIC. In addition, we have a substantial balance of cash and other liquid investments, which are passive assets for purposes of the PFIC determination. Accordingly, as our market capitalization and the composition of our income, assets, and operations are subject to change, we cannot assure you that we will not be considered a PFIC for any taxable year. In addition, it is possible that the United States Internal Revenue Service (the “IRS”) may take a contrary position with respect to our determination in any particular year. Certain adverse U.S. federal income tax consequences could apply to a United States Holder (as defined in Item 10.E. “Taxation ― U.S. Federal Income Tax Considerations”) if we are treated as a PFIC for any taxable year during which such United States Holder holds our Class A ordinary shares. We are not providing any U.S. tax opinion to any United States Holder concerning our potential PFIC status, and United States Holders should consult their tax advisors about the potential application of the PFIC rules to their investment in our Class A ordinary shares. For further discussion, see Item 10.E. “Taxation ― U.S. Federal Income Tax Considerations ― Passive Foreign Investment Company.” Risks Relating to Our Incorporation and Location in Israel Conditions in Israel, including Israel’s conflicts with Hamas and other parties in the region, as well as political and economic instability in the region, may adversely affect our revenues, our results of operations and our financial condition. We are incorporated under Israeli law, and many of our employees operate from our offices located in Israel. Accordingly, our business and operations are directly affected by economic, political, geopolitical and military conditions in Israel. Since the establishment of the State of Israel in 1948 and in recent years, armed conflicts between Israel and its neighboring countries and terrorist organizations active in the region have involved missile strikes, hostile infiltrations, terrorism against civilian targets in various parts of Israel, and recently abduction of soldiers and citizens. Following attacks by Hamas in southern Israel on October 7, 2023, Israel declared war against Hamas and since then, Israel has been involved in military conflicts with Hamas, Hezbollah, a terrorist organization based in Lebanon, and Iran, both directly and through proxies like the Houthi movement in Yemen, armed groups in Iraq and other terrorist organizations, as well as a brief war with Iran itself (also known as “Operation Rising Lion”). Additionally, following the fall of the Assad regime in Syria, Israel has conducted limited military operations targeting the Syrian army, Iranian military assets and infrastructure linked to Hezbollah and other Iran-supported groups. In addition, more recently, Israel, together with the United States, has expanded military operations against Iranian targets and key officials under “Operation Epic Fury”, a joint U.S.-Israel initiative. The scope, duration and potential expansion of this operation remain uncertain, and there can be no assurance that it will not result in broader regional hostilities or retaliatory actions by Iran or Iranian-aligned groups. Any prolongation or expansion of Operation Epic Fury could further destabilize the region, disrupt international shipping lanes, air travel corridors and energy markets, and may adversely affect global trade flows. The situation remains volatile, with the potential for escalation into a broader regional conflict involving additional terrorist organizations and possibly other countries. While our facilities have sustained only minor damage during the ongoing wars, the hostilities with Hamas, Hezbollah, Iran and its proxies and others have caused and may continue to cause significant 51 damage to private and public facilities, infrastructure, utilities, and telecommunication networks, which could disrupt our operations and supply chains. In addition, Israeli organizations, government agencies and companies have been subject to extensive cyber attacks. This could lead to increased costs, risks to employee safety, and challenges to business continuity, all of which could adversely affect our business and results of operations. The war has also led to a deterioration of certain indicators of Israel’s economic standing, including, a downgrade in Israel’s credit rating by rating agencies (such as Moody’s, S&P Global and Fitch). In connection with the war, several hundred thousand Israeli military reservists were drafted to perform immediate military service, and are expected to be required to perform long-lasting reserve duty service in the coming years. Although many of such military reservists have since been released from active service, they may be called up from time to time for additional reserve duty as the security situation requires. As of the date of this Annual Report, only a small number of our employees are engaged in active reserve duty service. The absence of our employees due to their such service, both now or in the future has disrupted, and may in the future disrupt our operations, which disruption may materially and adversely affect our business and results of operations. Our commercial insurance does not cover losses that may occur as a result of events associated with war and terrorism. Although the Israeli government currently covers the reinstatement value of certain direct damages that are caused by terrorist attacks or acts of war, we cannot assure you that such government coverage will be maintained or that it will sufficiently cover our potential damages. Any losses or damages incurred by us could have a material adverse effect on our business. The global perception of Israel and Israeli companies, influenced by actions of international judicial bodies, may lead to increased sanctions and other negative measures against Israel, as well as Israeli companies and academic institutions. There is also a growing movement among countries, activists, and organizations to boycott Israeli goods, services and academic research or restrict business with Israel, which could affect business operations. If these efforts become widespread, along with any future rulings from international judicial bodies against Israel, our business operations may be materially adversely impacted. Prior to October 2023, the Israeli government pursued changes to Israel’s judicial system and has recently renewed its efforts to effect such changes. Such proposed changes may also lead to political instability or civil unrest. If such changes to Israel’s judicial system are pursued by the government and approved by the parliament, this may have an adverse effect on our business, results of operations and our ability to raise additional funds, if deemed necessary by our management and board of directors. It may be difficult to enforce a U.S. judgment against us, our officers, and our directors named in this Annual Report in Israel or the United States, or to assert U.S. securities laws claims in Israel or serve process on our officers and directors. Not all of our directors or officers are residents of the United States, and certain assets are therefore located outside the United States. Service of process upon us or our non-U.S. resident directors and officers, and enforcement of judgments obtained in the United States against us or our non-U.S. resident directors and officers may be difficult to obtain within the United States. We have been informed by our legal counsel in Israel that it may be difficult to assert claims under U.S. securities laws in original actions instituted in Israel or obtain a judgment based on the civil liability provisions of U.S. federal securities laws. Israeli courts may refuse to hear a claim based on an alleged violation of U.S. securities laws against us or our non-U.S. officers and directors reasoning that Israel may not be the most appropriate forum in which to bring such a claim. In addition, even if an Israeli court agrees to hear a claim, it may determine that Israeli law and not U.S. law is applicable to the claim. If U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact by an expert witnesses, which can be a time-consuming and costly process. Certain matters of procedure will also be governed by Israeli law. There is little binding case law in Israel addressing the matters described above. Israeli courts might not enforce 52 judgments rendered outside Israel, which may make it difficult to collect on judgments rendered against us or our non-U.S. officers and directors. Moreover, an Israeli court will not enforce a non-Israeli judgment if it was given in a state whose laws do not provide for the enforcement of judgments of Israeli courts (subject to exceptional cases), if its enforcement is likely to prejudice the sovereignty or security of the State of Israel, if it was obtained by fraud or in the absence of due process, if it is at variance with another valid judgment that was given in the same matter between the same parties, or if a suit in the same matter between the same parties was pending before a court or tribunal in Israel at the time the foreign action was brought. Your rights and responsibilities as our shareholder will be governed by Israeli law, which may differ in some respects from the rights and responsibilities of shareholders of U.S. corporations. We are incorporated under Israeli law. The rights and responsibilities of holders of our Class A ordinary shares and Class B ordinary shares are governed by our amended and restated articles of association and the Companies Law. These rights and responsibilities differ in some respects from the rights and responsibilities of shareholders in typical U.S. corporations. In particular, pursuant to the Companies Law, each shareholder of an Israeli company has to act in good faith and in a customary manner in exercising his, her, or its rights and fulfilling his, her, or its obligations toward the Company and other shareholders, and to refrain from abusing his, her, or its power in the Company, including, among other things, in voting at the general meeting of shareholders, on amendments to a company’s articles of association, and with regard to increases in a company’s authorized share capital, mergers, and certain transactions requiring shareholders’ approval under the Companies Law. In addition, a controlling shareholder of an Israeli company or a shareholder who knows that it possesses the power to determine the outcome of a shareholder vote or who has the power to appoint or prevent the appointment of a director or officer in the Company, or has other powers toward the Company has a duty of fairness toward the Company. However, Israeli law does not define the substance of this duty of fairness. There is little case law available to assist in understanding the implications of these provisions that govern shareholder behavior.