Healthequity, Inc.: Form 10-K for the period ended Jan 31, 2025

Company overview

We are a leader and an innovator in providing technology-enabled services that empower consumers to make healthcare saving and spending decisions. We use our innovative technology to manage consumers' tax-advantaged health savings accounts (“HSAs”) and other consumer-directed benefits (“CDBs”) offered by employers, including flexible spending accounts and health reimbursement arrangements (“FSAs” and “HRAs”), and to administer Consolidated Omnibus Budget Reconciliation Act (“COBRA”), commuter and other benefits. As part of our services, we provide consumers with payment processing services, personalized benefit information, the ability to earn wellness incentives, and investment advice to grow their tax-advantaged healthcare savings. We believe the shift to greater consumer responsibility for healthcare costs will require a significant portion of consumers under the age of 65 with private health insurance in the United States to use offerings such as ours.

The core of our offerings is the HSA, a financial account through which consumers spend and save long-term for healthcare expenses on a tax-advantaged basis. As of January 31, 2025, we administered 9.9 million HSAs, with balances totaling $32.1 billion, which we call HSA Assets, as well as 7.1 million complementary CDBs. We refer to the aggregate number of HSAs and other CDBs that we administer as Total Accounts, of which we had 17.0 million as of January 31, 2025.

We reach consumers primarily through relationships with their employers, which we call Clients. We reach Clients primarily through relationships with benefits brokers and advisors, integrated partnerships with a network of health plans, benefits administrators, benefits brokers and consultants, and retirement plan recordkeepers, which we call Network Partners, and a sales force that calls on Clients directly. As of January 31, 2025, our platforms were integrated with more than 200 Network Partners.

We have increased our share of the growing HSA market from 4% in December 2010 to 21% as of June 2024, measured by HSA Assets. According to the 2024 Midyear Devenir HSA Research Report, as of June 2024, we were the largest HSA provider by both accounts and HSA Assets. In addition, we believe we are the largest provider of other CDBs. We seek to differentiate ourselves through our service-driven culture, product breadth, ecosystem connectivity, and proprietary technology. Our proprietary technology allows us to help consumers optimize the value of their HSAs and other CDBs and gain confidence and skills in managing their healthcare costs as part of their financial security.

Our ability to assist consumers is enhanced by our capacity to securely share data in both directions with others in the health, benefits, and retirement ecosystems. Our commuter benefits offering also leverages connectivity to an ecosystem of mass transit, ride hailing, and parking providers.

Our business model provides strong visibility into our future operating performance, with the vast majority of our accounts opened before the start of our fiscal year.

We earn revenue primarily from three sources: service, custodial, and interchange. We earn service revenue mainly from fees paid by our Network Partners, Clients, and members for the administration services we provide in connection with the HSAs and other CDBs we offer. We earn custodial revenue primarily from HSA cash held by our federally insured bank and credit union partners, which we collectively call our Depository Partners, HSA cash held by our insurance company partners, and Client-held funds deposited with our Depository Partners. We earn interchange revenue mainly from fees paid by merchants on payments that our members make using our physical payment cards and on our virtual payment system. See “Key components of our results of operations” for additional information on our sources of revenue.

Recent acquisitions

HealthSavings HSA portfolio acquisition. In March 2022, we acquired the Health Savings Administrators, L.L.C. (“HealthSavings”) HSA portfolio, which consisted of $1.3 billion of HSA Assets held in approximately 87,000 HSAs in exchange for a purchase price of $60 million in cash.

BenefitWallet HSA portfolio acquisition. In fiscal 2025, we acquired the BenefitWallet HSA portfolio, comprised of approximately 616,000 HSAs plus other accounts and $2.7 billion of HSA Assets, from Conduent Business Services, LLC ("Conduent") for a purchase price of $425.0 million. We paid the purchase price using $225.0 million of borrowings under our revolving credit facility, with the remainder paid using cash on hand.

Our products and services

Health savings accounts. The Medicare Modernization Act of 2003 created HSAs, a tax-exempt trust or custodial account managed by a custodian that is a bank, an insurance company, or a non-bank custodian specifically authorized by the Internal Revenue Service, or IRS, as meeting certain ownership, capitalization, expertise, and governance requirements. We are an IRS-approved non-bank custodian of our members' HSAs, designated to serve as both a passive and non-passive non-bank custodian of HSAs.

To be eligible to contribute to an HSA, an individual must be covered under a high deductible healthcare plan, or HDHP, have no additional health coverage, not be enrolled in Medicare, and not be claimed as a dependent on someone else’s tax return. HSAs have several tax-advantaged benefits, which we call the "triple tax savings": (1) individuals can claim a tax deduction for contributions they make to their HSAs, and contributions that their employers make to their HSAs may be excluded from their gross income for purposes of federal and most state income and employment tax; (2) the interest or earnings on the assets in the account, including reinvestment, accumulate without being subject to tax; and (3) distributions may be tax free if they are used to pay qualified medical expenses. There is no requirement to provide receipts to us to substantiate HSA distributions to members, whether made through our payment card or directly from our online HSA platform. Additionally, taxable distributions other than for qualified medical expenses are permitted without penalty (although subject to income tax) after age 65. Balances remain in the account until used, i.e., there is no “use or lose” requirement. An HSA is owned by the account holder; it remains the account holder’s property upon a change of employment, health plan or retirement.

Investment platform and advisory services. We offer an investment platform and access to an online-only automated investment advisory service to all of our members whose account balances exceed a stated threshold. These services are entirely elective to the member. The advisory service is delivered through a web-based tool, Advisor, which is offered and managed by HealthEquity Advisors, LLC, our SEC-registered investment adviser subsidiary. HealthEquity Advisors, LLC provides investment advice to its clients exclusively through the Advisor tool on an interactive website. Members who utilize our investment platform or subscribe for Advisor services pay asset-based fees, subject to a monthly fee cap, which include the cost of the advisory service and all other expenses associated with transactions made through these online tools.

Advisor provides investment education guidance and management, including maintaining HSA cash (liquidity) in amounts directed by the member, targeting risk appropriate portfolio diversification, and mutual fund selection.

We offer investors access to three levels of service:

• Self-driven: For members who do not subscribe for Advisor, we provide an investment platform to invest HSA balances. Neither we nor Advisor provides advice to members in respect of investments on the platform;
• GPS powered by HealthEquity Advisors, LLC: Advisor provides guidance and advice, but the member makes the final investment decisions and implements portfolio allocation and investment advice through the HealthEquity platform; and
• AutoPilot powered by HealthEquity Advisors, LLC: Advisor manages the account and implements portfolio allocation and investment advice automatically for the member.

Regardless of the level of service selected, members are responsible for their proportionate share of fees and expenses payable by the underlying mutual funds and other investment vehicles in which they invest.

Healthcare flexible spending accounts. Healthcare FSAs are employer-sponsored CDBs that enable employees to set aside pre-tax dollars to pay for eligible healthcare expenses that are not generally covered by insurance, such as co-pays, deductibles and over-the-counter medical products, as well as vision expenses, orthodontia, and medical devices. Healthcare FSAs can be customized by employers so they have the freedom to determine what eligible expenses may be reimbursed under these arrangements. Our employer Clients also realize payroll tax (i.e., FICA and Medicare) savings on the pre-tax contributions made by their employees.

The IRS imposes a limit, indexed to inflation, on pre-tax dollar employee contributions made to healthcare FSAs. The IRS also allows a carryover of up to 20% of the indexed contribution limit that does not count against or otherwise affect the indexed salary reduction limit applicable to each plan year. Employers are able to contribute additional amounts in excess of this statutory limit and may choose to do so in an effort to mitigate the impact of rising healthcare costs on their employees.

Dependent care flexible spending accounts. We also administer FSA programs for dependent care plans. These plans allow employees to set aside pre-tax dollars to pay for eligible dependent care expenses, which typically include child care or day care expenses but may also include expenses incurred from adult and elder care.

Current laws and regulations impose a statutory limit on the amount of pre-tax dollars employees can contribute to dependent care FSAs with no carryover allowed. Like healthcare FSAs, employers can also contribute funds to employees’ dependent care FSAs; however, these are subject to the statutory annual limit on total contributions. As with healthcare FSAs, employers realize payroll tax savings on the pre-tax dependent care FSA contributions made by their employees.

Health reimbursement arrangements. Under HRAs, employers provide their employees with a specified amount of reimbursement funds that are available to help employees defray their out-of-pocket healthcare expenses, such as deductibles, co-insurance and co-payments. HRAs may only be funded by employers and there is no limitation on how much employers may contribute; however, similar to other CDBs that are funded with pre-tax dollars, employers are required to establish the programs in such a way as to prevent discrimination in favor of highly compensated employees. HRAs must either be considered an excepted benefit (for example, a dental-only HRA or a vision-only HRA), a retiree HRA or be integrated with another group health plan. HRAs can be customized by employers so employers have the freedom to determine what expenses are eligible for reimbursement under these arrangements. At the end of the plan year, employers have the option to allow all or a portion of the unused funds to roll over and accumulate year-to-year if not spent. All amounts paid by employers into HRAs are deductible for tax purposes by the employer and tax-free to the employee.

COBRA. We offer federal COBRA and state continuation services to employer clients to meet the employer’s obligation to make available continuation of coverage for participants who are no longer eligible for the employer’s COBRA covered benefits, which include medical, dental, vision, HRAs, and certain healthcare FSAs. COBRA requires employers to make health coverage available for qualified beneficiaries for a period of up to 36 months post-termination. As part of our COBRA program, we offer a direct billing service where former employee participants pay us directly as opposed to their employers for coverage they elect to continue. We handle the accounting and customer services for such terminated employees, as well as interfacing with the carrier regarding the employees’ eligibility for participation in the COBRA program.

Commuter programs. We administer pre-tax commuter benefit programs through which employers are permitted to provide employees with commuter benefits including qualified transit and parking. The maximum monthly federal (and sometimes state) tax free exclusion is indexed for inflation. We also offer various other commuter services, including access to real-time commute data, to help employers design and implement flexible return-to-office and hybrid-workplace strategies and benefits.

Our competitive landscape

Our direct competitors are HSA custodians and other CDB providers. Many of these are state or federally chartered banks and other financial institutions for which we believe benefits administration services are not a core business. Some of our direct competitors (including well-known retail investment companies, such as Fidelity Investments, and healthcare service companies such as UnitedHealth Group's Optum and Webster Bank) are in a position to devote more resources to the development, sale and support of their products and services than we have at our disposal. Our CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks. In addition, numerous indirect competitors, including benefits administration service providers, partner with banks and other HSA custodians to compete with us. Our Network Partners and ecosystem partners may also choose to offer competitive services directly, as some health plans have done. Our success depends on our ability to predict and react quickly to these and other industry and competitive dynamics.

Our competitive strengths and strategy

We believe we are well-positioned to benefit from the transformation of the healthcare benefits market. Our technology platforms are aligned with a healthcare environment that rewards consumer engagement and fosters an integrated consumer experience.

Market leadership. We have established a leadership position in the HSA industry through our focus on innovation and differentiated capabilities. Our leadership position is evidenced by the increase in our market share (measured by HSA Assets), from 4% in December 2010 to 21% in June 2024, as reported in the 2024 Midyear Devenir HSA Research Report, which stated that we are the largest HSA custodian measured by both accounts and HSA Assets.

Differentiated consumer experience. We have designed our solution and support services to deliver a differentiated consumer experience, which is a function of our culture and technology. We believe this provides an advantage relative to legacy competitors.

• Culture: We seek to provide remarkable experiences for our members, Clients and Network Partners through what we call our "Purple" service. We believe our Purple culture is a significant factor in our ability to attract and retain customers and to address opportunities in the rapidly changing healthcare sector.
• Technology: We believe our technology helps us drive member outcomes and deliver on our commitment to provide Purple service. We tailor the content of our technology platforms and the guidance of our experts to be timely, personal, and relevant to each member. For example, our technology generates health savings strategies that are delivered to our members when they interact with our platforms or contact us.
• Customer service and education: As a key part of our strategy and commitment to provide Purple service, our team members work directly with our Network Partners, Clients, and members to engage with consumers, educating them about the benefits of our HSAs and our other products and providing personalized guidance. We employ individuals who provide real-time assistance to our members via telephone, email, or chat.

Bundled solution for HSAs and complementary CDBs. We are a market-share leader in each of the major categories of complementary CDBs, including FSAs and HRAs, COBRA and commuter benefits administration. Our Clients and their benefits advisors increasingly seek HSA providers that can deliver an integrated offering of HSAs and complementary CDBs. We believe that our ability to provide a combination of HSA and complementary CDB offerings significantly strengthens our value proposition to employers, health benefits brokers and consultants, and Network Partners as a leading single-source provider.

Large and diversified channel access. We believe our differentiated distribution platforms provide a competitive advantage by efficiently enabling us to reach a growing consumer market. Our solution is built on a business-to-business-to-consumer, or B2B2C, channel strategy, whereby we work with Network Partners and Clients to reach consumers in addition to marketing our services to these potential members directly. Reaching the consumer is critical in order for us to increase the number of our HSA members. Health plan Network Partners have been, and continue to be, a key channel through which we gain access to Clients and members.

We work directly with our Network Partners and Clients to reach the consumer in various ways. Our Network Partners collectively employ thousands of sales representatives and account managers who promote both the health plan and administrator partner’s health insurance products, such as HDHPs, and our products and services. Our Clients collectively employ thousands of human resources professionals who are tasked with explaining the benefits of our HSAs to their employees. Our sales and account management teams work with and train the sales representatives and account management teams of our Network Partners and the human resource professionals of our Clients on the benefits of enrolling in, contributing to, and saving and spending through our HSAs, and our Network Partners and Clients then convey these benefits to prospective members. As a result of this collaboration, we develop relationships with each member who enrolls in an HSA with us. This personalized engagement with our members constitutes our B2B2C channel strategy.

Proprietary and integrated technology solution. We have a proprietary cloud-based technology solution, which we believe is differentiated in the marketplace for the key reasons described below. We are currently investing in a modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy and platform infrastructure, while maintaining existing applications, features, and services.

• Complete solution for managing consumer healthcare saving and spending: We believe our technology platforms drive member outcomes by enabling our members to use this technology based on their own needs and desires. For example, our members utilize our HSA platform to evaluate and pay healthcare bills through the member portal, which allows members to pay their healthcare providers, receive reimbursements and learn of savings opportunities for prescription drugs. Members also utilize the platform’s mobile app, which has been re-launched to drive better outcomes, to view and pay claims on-the-go, including uploading medical and insurance documentation to the platform with their mobile phone cameras.
• Purpose-built technology: Our technology solution was designed specifically to serve the needs of our members, Network Partners, other ecosystem partners and our Clients. We believe our technology enables us to both provide remarkable experiences and drive member outcomes by providing greater functionality and flexibility than the technologies used by our competitors, many of which were originally developed for banking, benefits administration or retirement services. We believe we are one of few providers with a solution that encompasses all of the core functionality of healthcare saving and spending in one integrated, secure, and compliant system, including custodial administration of individual savings and investment accounts, card and electronic funds transaction processing, benefits enrollment and eligibility, electronic and paper medical claims processing, medical bill presentment, tax-advantaged reimbursement account

and health incentive administration, HSA trust administration, online investment advice, and sophisticated analytics.

• Data integration: Our technology solution allows us to integrate data from disparate sources, which enables us to seamlessly incorporate personal health information and individually tailored strategies into the consumer experience. We utilize application programming interfaces (APIs) to integrate with health plans, pharmacy benefit managers, employers, and other benefits provider systems. A key part of our strategy is to integrate into our partners' ecosystems, rather than requiring them to conform to ours, as many of our partners’ systems rely on custom data models, non-standard formats, complex business rules, and security protocols that are difficult or expensive to change. We believe that this integration enables us to deepen our partnerships with our Network Partners and other ecosystem partners.
• Configurability: Our flexible technology solution enables us to create a unique solution for each of our Network Partners. For example, a HealthEquity team member can configure product attributes, including integration with a partner’s chosen healthcare price transparency or wellness tools, single sign on, sales and broker support sites, branding, member communication, custom fulfillment and payment card, savings options and interest rates, fees, and investment choices.
• Innovation: We continue to invest in technology solutions to meet the evolving needs of our Network Partners, Clients and members. Our current innovation efforts include, among others, increasing member and client self-service capabilities, developing APIs, driving electronic communication rather than paper, increasing straight-through processing, improving overall process times utilizing both traditional robotic process automation, and increasingly through artificial intelligence ("AI") tools including the Expedited Claims tool, leveraging chip-enabled stacked cards, and mobile wallet.

Scalable operating model. We believe that our model is scalable because our services are accessed primarily through our cloud-based technology platforms. After initial on-boarding and a period of education, our service costs for any given customer typically decline over time. Our opportunity to earn high-margin revenue from existing HSA members grows over time because as our HSA members’ balances grow, our custodial revenue and recordkeeping and advisory service revenues are increased without equivalent incremental cost to us.

Enhanced Rates. We partner with large, highly rated insurance company partners to hold, through group annuity contracts or other similar arrangements, HSA cash. We refer to this as our "Enhanced Rates" offering. Enhanced Rates is our default HSA cash offering, and a significant portion of new HSA cash is placed in Enhanced Rates. An increase in the percentage of HSA cash held in our Enhanced Rates offering positively impacts our custodial revenue, as we generally receive a higher yield on HSA cash held by our insurance company partners compared to cash held by our Depository Partners. In addition, increased participation in our Enhanced Rates offering reduces our exposure to short-term fluctuations in prevailing interest rates because contract repricing occurs gradually, at approximately 10% per year. The percentage of HSA cash held in our Enhanced Rates offering has increased, and we expect that it will continue to increase. As our Basic Rates contracts expire, the HSA cash held in those Basic Rates contracts will transition to Enhanced Rates contracts, subject to our members retaining the right to keep their HSA cash in Basic Rates.

Strong retention rates. Retention of our HSA members has been strong over time. Individually owned trust accounts, including HSAs, have inherently high switching costs, as switching requires a certain amount of effort on the part of the account holder and may result in closure fees. We believe that our retention rates are also high due to our HSA platform’s integration with the broader healthcare system used by our HSA members and our customer engagement and focus on the consumer experience.

Selective acquisition strategy. We have historically acquired HSA portfolios and businesses that strengthen our service offerings. We expect to continue this growth strategy and are regularly engaged in evaluating different opportunities. We have developed an internal capability to source, evaluate, and integrate acquisitions that have created value for stockholders. We believe the nature of our competitive landscape provides significant acquisition opportunities. Many of our competitors view their HSA businesses as non-core functions. We believe they may look to divest these assets and, in certain cases, be limited from making acquisitions due to depository capital requirements.

Our technology

Technology platforms. We provide multiple cloud-based platforms, accessed by our members online via a desktop or mobile device, through which our members can make health saving and spending decisions, pay healthcare bills, receive personalized benefit information, earn wellness incentives, grow their savings, and make investment choices. The platforms provide users with access to services we provide as well as services provided by third parties selected by us or by our Network Partners. Our delivery model for these platforms eliminates the need for our Clients to install and maintain hardware and software in order to support HSA and other CDB programs and enables us to rapidly implement product enhancements across our entire user base.

Among other features, our HSA platform includes the capability to present to users medical bills upon adjudication by a health plan, including details such as the amount paid by insurance, specific nature of the medical service provided, and diagnostic code. Users of our HSA platform can pay these bills from an account of ours or from any bank account, online, via a mobile device, or using our payment card. All users of our HSA platform gain access to our healthcare consumer specialists, available every hour of every day, via a toll-free telephone number or email. Our specialists can assist users with such tasks as optimizing the use of tax-advantaged accounts to reduce medical spending or selecting from among medical plans offered by an employer or health plan.

Our commuter platform provides Clients with various commuter services, including access to real-time commute data, to help Clients design and implement flexible return-to-office and hybrid-workplace strategies and benefits.

We are working to phase out a technology platform that we acquired in the acquisition of Further, which requires us to migrate the associated Clients to one of our other technology platforms.

For a description of our cybersecurity risk management framework for our technology platforms, see Item 1C. Cybersecurity.

Cloud-based solution. Our proprietary technology is deployed as a cloud-based solution that is accessible to customers online and through our mobile app. We utilize a multi-tenant architecture that allows changes made for one Network Partner to be extended to all others. This architecture provides operating leverage by reducing costs and improving efficiencies, enabling us to maximize the utilization of our infrastructure capacity with a reduction in required maintenance. We are increasing investment in our technology and communications systems to support new opportunities and enhance security, privacy, and platform infrastructure.

Our solution is delivered via cloud-based services and hosted in third-party data centers or on a virtual private cloud with an ability to scale on demand. This allows us to quickly support our current and projected growth. We utilize regional cloud failover and multiple redundant third-party data centers to ensure continuous access and data availability. The data centers are purpose-built facilities for hosting mission critical systems with multiple built-in redundancy layers to minimize service disruptions and meet industry-standard measures.

Government regulation

Our business is subject to extensive, complex, and rapidly changing federal and state laws and regulations.

IRS regulations

We are subject to applicable IRS regulations, which lay the foundation for tax savings and eligible expenses under the HSAs, HRAs, tax-advantaged commuter benefits, and FSAs we administer. The IRS issues guidance regarding these regulations regularly. In addition, we are subject to conflict of interest and other prohibited transaction rules that are enforced through excise taxes under the Internal Revenue Code. Although the excise taxes are enforced by the IRS, the underlying rules are promulgated by the Department of Labor.

In February 2006, HealthEquity, Inc. received designation by the U.S. Department of Treasury to act as a passive non-bank custodian, which allows HealthEquity, Inc. to custody HSA Assets for individual account holders. In July 2017, HealthEquity, Inc. received designation by the U.S. Department of Treasury to act as both a passive and non-passive non-bank custodian, which allows HealthEquity, Inc. to custody HSA Assets for individual account holders and use discretion to direct investment of such assets held. As a passive and non-passive non-bank custodian, the Company must maintain net worth (assets minus liabilities) greater than 2% of passive custodial funds held at each fiscal year-end and 4% of the non-passive custodial funds held at each fiscal year-end in order to take on additional custodial assets. As of January 31, 2025, the Company's year-end for trust and tax purposes, the net worth of the Company exceeded the required thresholds.

Privacy and data security regulations

In the provision of HSA custodial services and directed third-party administration services for FSAs and HRAs, we are subject to the Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley Act or GLBA), the Health Insurance Portability and Accountability Act of 1996 (HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act), and similar state laws.

GLBA imposes financial privacy and security requirements on financial institutions that relate to the collection, storage, use, and disclosure of an account holder’s nonpublic personal information. Nonpublic personal information includes information that is collected or generated in the course of offering a financial product or service. For example, nonpublic personal information includes information submitted by a prospective account holder in an application, an account holder’s name and contact information, and transaction information. Because part of our business is the administration of financial products such as HSAs, we are required under GLBA to send a notice of our privacy practices to account holders and to comply with restrictions on the disclosure of nonpublic personal information to non-affiliated third parties. We are also required under GLBA to establish reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of nonpublic personal information pursuant to the Federal Trade Commission’s safeguards rule. Violations of GLBA can result in civil and criminal penalties.

HIPAA covered entities and their business associates are required to adhere to HIPAA privacy and security standards. Covered entities include most healthcare providers, health plans, and healthcare clearinghouses. Because we perform services (such as FSA services) for covered entities that include processing protected health information, we are a business associate and subject to HIPAA. The two rules that most significantly affect our business are: (i) the Standards for Privacy of Individually Identifiable Health Information, or the Privacy Rule; and (ii) the Security Standards for the Protection of Electronic Protected Health Information, or the Security Rule. The Privacy Rule restricts the use and disclosure of protected health information and requires us to safeguard that information and provide certain rights to individuals with respect to that information. The Security Rule establishes requirements for safeguarding protected health information transmitted or stored electronically. Both civil and criminal penalties apply for violating HIPAA, which may be enforced by both the Department of Health and Human Services’ Office for Civil Rights and state attorneys general. Violations of HIPAA may also subject us to contractual remedies under the terms of business associate agreements with covered entities.

Various states also have laws and regulations that impose additional restrictions on our collection, storage, use, and disclosure of personal information. Privacy regulation in particular has become a priority issue in many states and with the federal government. For example, the California Consumer Privacy Act (“CCPA”) protects certain privacy rights of California consumers and requires companies, such as ours, that process information on California residents, to make disclosures to consumers about their data collection, use, and sharing practices, and allows consumers to opt out of certain data sharing with third parties and provides a private right of action for data breaches. The CCPA does not generally apply to data subject to GLBA or HIPAA. We expect further privacy requirements to be applicable to us as a result of additional recently passed, and likely upcoming, state privacy laws similar to CCPA, which may expand consumers’ rights with respect to their personal information. Several of these laws do not apply to entities or data subject to GLBA or HIPAA. The federal government is also considering legislative and regulatory proposals concerning privacy, data protection, and cybersecurity, which may require us to implement and maintain additional operational or compliance measures.

ERISA

Our private-sector clients’ FSAs, HRAs, COBRA continuation insurance, and other account-based retirement plans are covered by the Employee Retirement Income Security Act of 1974, as amended, or ERISA, which governs “employee benefits plans.” Title I of ERISA does not generally apply to HSAs. ERISA generally imposes extensive reporting requirements on employers, as well as an obligation to provide various disclosures to covered employees and beneficiaries; and employers and third-party administrators that have authority or discretion over management, administration, or investment of plan assets are subject to fiduciary responsibility under ERISA. ERISA's requirements affect our FSAs, HRAs, and COBRA administration businesses. The Department of Labor can bring enforcement actions or assess penalties against employers, investment advisers, administrators, and other service providers for failing to comply with ERISA’s requirements. Participants and beneficiaries may also file lawsuits against employers, investment advisers, administrators, and other service providers under ERISA.

Department of Labor

The Department of Labor, or the DOL, regulates plans that are subject to ERISA, including health FSAs, HRAs, and 401(k) and other retirement plans, as well as COBRA administration. The DOL also issues guidance related to fiduciary responsibility and prohibited transactions under ERISA and the Internal Revenue Code that affect administration of HSAs (as well as health FSAs, HRAs, and retirement plans).

The DOL issues regulations, technical releases, and other guidance that apply to employee benefit plans, tax-favored savings arrangements (including HSAs) and COBRA administration, generally. In addition, in response to a request by an individual or an organization, the DOL’s Employee Benefits Security Administration may issue an advisory opinion that interprets and applies ERISA and/or corresponding prohibited transaction rules under the Internal Revenue Code to a specific situation, including issues related to consumer-centric healthcare accounts and retirement plans.

Healthcare reform

In March 2010, the federal government enacted significant reforms to healthcare benefits through the Affordable Care Act. The legislation amended various provisions in many federal laws, including the Internal Revenue Code and ERISA. The reforms included new excise taxes that incentivize employers to provide health benefits (including HSA-compatible benefits) to all full-time employees and new coverage mandates for health plans. The rules directly affect health FSAs and HRAs and have an indirect effect on HSAs. Further changes to the Affordable Care Act and related healthcare regulation remain under consideration, including "Medicare for all" plans. In addition, legislative proposals to either increase access to HSAs and similar accounts, and conversely legislation that would curtail them, are commonly introduced in both chambers of Congress and could be taken up at any time.

Investment Advisers Act of 1940

Our subsidiary HealthEquity Advisors, LLC is an SEC-registered investment adviser that provides web-only automated investment advisory services to members. As an SEC-registered investment adviser, it must comply with the requirements of the Investment Advisers Act of 1940, or the Advisers Act, and related Securities and Exchange Commission, or SEC, regulations and is subject to periodic inspections by the SEC staff. Such requirements relate to, among other things, fiduciary duties to clients, disclosure obligations, recordkeeping and reporting requirements, marketing restrictions limitations on agency cross and principal transactions between the adviser and its clients, and general anti-fraud prohibitions. The SEC is authorized to institute proceedings and impose sanctions for violations of the Advisers Act, ranging from fines and censure to termination of an investment adviser’s registration. Investment advisers also are subject to certain state securities laws and regulations. Failure to comply with the Advisers Act or other federal and state securities and regulations could result in investigations, sanctions, profit disgorgement, fines or other similar consequences.

Intellectual property

Intellectual property is important to our success. We rely on trademarks and other forms of intellectual property rights and measures, including trade secrets, know-how and other unpatented proprietary processes, and nondisclosure agreements, to maintain and protect proprietary aspects of our products and technologies. We require our team members and consultants to execute confidentiality agreements in connection with their employment or consulting relationships with us. We also require our team members and consultants to disclose and assign to us all inventions conceived during the term of their employment or engagement while using our property or which relate to our business.

Geographic areas

Our sole geographic market is the U.S.

Human capital

HealthEquity is comprised of people dedicated to empowering consumers to spend, save, and invest for healthcare by delivering Purple service. We believe that our culture is a key differentiator that drives the success of our company through, among other things, attracting and retaining top talent.

Our board of directors and its committees provide oversight on certain human capital matters. The Talent, Compensation and Culture Committee of our board of directors acts on behalf of the board to review and determine executive compensation plans, policies, and programs; oversee the Company’s culture and related strategies, programs, and risks; and oversee the Company’s talent management, development, and retention efforts.

As of January 31, 2025, we had 3,105 full-time team members and 15 part-time team members.

Talent acquisition and team member development

Our People team seeks to attract, hire, and develop the best, most qualified candidates and team members.

HealthEquity has taken, and continues to take, steps to strengthen our talent:

Our People team uses a hiring framework which seeks to improve candidate experience, ensure quality of hire, and increase our focus on hiring practices that meet or exceed industry and legal standards.

• We continued an early career internship program, offering positions across two key areas: corporate business functions and technology. We strive to attract candidates aligned with our vision and who will provide the unique viewpoints and experiences that help drive our success going forward, including by our engaging in outreach with universities where we have a strong regional presence.
• We offer a library of resources for our “Grow Your Career” series with the Talent Partner and Talent Operations teams. This includes guides on how to write resumes, create a social media presence, and prepare for interviews to support team member development.
• We run the Temporary On-Project Specialist (TOPS) program, which allows Member Service Specialists to experience working in other areas of the business. The program is open to all Member Service Specialists, and selected individuals who are able to support areas that need help while gaining experience that can assist with their personal and professional goals.
• We are implementing a broad leadership development program to improve team member engagement and productivity.
• We coordinate an annual company-wide learning series, Remarkable You. Open to all teammates, sessions include leadership development, emotional intelligence, technical skills, and other professional development topics.
• We also offer DEAL (Dedicated, Engaged, Authentic Leaders), an annual summit for all company leadership that provides an opportunity to discuss strategic priorities and initiatives and focus on leadership development and effective leadership workshops.

Pay equity

Pay equity is a crucial metric in assessing equal opportunity at HealthEquity. We strive to provide a consistent and fair remuneration strategy for all team members through our Total Rewards package. This package includes:

• Base salary
• Incentive/bonus pay
• Stock-based compensation
• 401(k) with company matching
• Health benefits

The Total Rewards philosophy underlying this package is intended to promote fairness and simplicity so that team members and people leaders understand the performance goals they target during the year and the outcomes that result from achieving or exceeding those goals. We strive to administer the Total Rewards package consistently and to ensure equal opportunity as follows:

• Maintaining competitive pay by reviewing market data annually
• Rewarding team members based on their abilities, competencies, experience, and performance levels
• Effectively communicating our Total Rewards policies and practices
• Complying with all applicable federal, state, and local laws and requirements

Team member engagement

We also consider team member engagement an important metric of our organizational health. We regularly seek team member feedback and measure engagement through a survey which contains three engagement key performance indicators (KPIs) that we believe provide a comprehensive measure of team member engagement. The KPIs are designed to determine whether our team members recommend HealthEquity as a great place to work, whether their work gives them a sense of accomplishment, and whether they are motivated to go above and beyond in their work.

As of January 31, 2025, our team member engagement score was 78% favorable, 15% neutral, and 7% unfavorable, based on a participation rate of 88%. We believe that our team member engagement impacts our ability to retain our team members. For the fiscal year ended January 31, 2025, our total team member turnover was 14% and our voluntary turnover was 8%.

Corporate information

HealthEquity, Inc. was incorporated as a Delaware corporation on September 18, 2002. Our principal business office is located at 15 W. Scenic Pointe Dr., Ste. 100, Draper, Utah 84020. Our website address is www.healthequity.com (http://www.healthequity.com). We do not incorporate the information contained on, or accessible through, our corporate website into this Annual Report on Form 10-K, and you should not consider it to be part of this report.

Where you can find additional information

Our website is located at www.healthequity.com (http://www.healthequity.com), and our investor relations website is located at ir.healthequity.com. Information on our website is not incorporated into this report. Copies of our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and any amendments to these reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act are available, free of charge, on our investor relations website as soon as reasonably practicable after we file such material electronically with or furnish it to the SEC. The SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov (http://www.sec.gov).

You should carefully consider the risks described below together with the other information set forth in this Annual Report on Form 10-K. If any of the risks described below are realized, our business, financial condition, results of operations, and prospects could be materially and adversely affected. The risks described below are not the only risks facing our company. Risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect our business, financial condition, and operating results.

Risks relating to our business and industry

Any diminution in, elimination of, or change in the availability of tax benefits for HSAs and other CDBs would materially adversely affect us.

Substantially all of our revenue is earned from tax-advantaged HSAs and other CDBs. The efforts of governmental and third-party payers to raise revenue or contain or reduce healthcare or other costs could include restructuring the tax benefits available through HSAs and other CDBs, which may adversely affect our business, operating results, and financial condition. For example, the federal government or states may seek to raise revenues by enacting tax laws that limit or eliminate the tax deductions available to individuals who contribute to HSAs and other CDBs. We cannot predict if any new tax reforms will ultimately become law, or if enacted, what their terms or the regulations promulgated pursuant to such reforms will be. If the laws or regulations are changed to limit or eliminate the tax benefits available through these accounts, such a change would have a material adverse effect on our business.

Failure to adequately place and safeguard HSA cash and Client-held funds, or the failure of any of our depository or insurance company partners, could materially and adversely affect our business, financial condition and results of operations.

As a non-bank custodian, we rely on our federally insured custodial Depository Partners and our insurance company partners to hold HSA cash that we custody. The portion of HSA cash held by our insurance company partners continues to increase with the increasing adoption of our Enhanced Rates program. The HSA cash held through our insurance company partners is not federally insured, and our members bear the risk of loss with respect to either the failure of the insurance company partner holding their HSA cash or the breach by the insurance company partner of its obligations to guarantee principal or pay interest thereon. In addition, we deposit Client-held funds with our Depository Partners in interest-bearing demand deposit accounts, and federal deposit insurance may not be available for certain Clients.

If any material adverse event were to affect one of our Depository Partners or our insurance company partners, including a significant decline in its financial condition, a decline in the quality of its service, a loss of deposits, its inability to comply with applicable banking, insurance or other regulatory requirements, systems failure or its inability to return principal or pay interest thereon, our business, financial condition and results of operations could be materially and adversely affected. In addition, in the event of such a failure of, or breach by, one of our insurance company partners, the HSA cash held through that insurance company partner would be at risk and no assurance can be given that our contractual arrangements with that insurance company partner would be sufficient for our members to fully recover their HSA cash, which would in turn result in reputational and financial harm to the Company.

In addition, certain of our insurance company partners have commitments to us with respect to the interest rates paid; however, some of these commitments are conditional upon certain market events and/or satisfaction of our obligations to the partner. A reduction of the interest rate payable, or a requirement that we post collateral in lieu of any such reduction, could have a material and adverse impact on our business, financial condition and results of operations.

Failure to adequately manage the liquidity of the custodial assets held by our Depository Partners and insurance company partners could materially and adversely affect our business, financial condition, and results of operations.

Certain of our arrangements with our Depository Partners and insurance company partners require that we keep a minimum amount of HSA cash with such partner. If we fail to comply with those minimum HSA cash requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest paid to us under such arrangements. Such penalties or reductions, if imposed, could have a material and adverse impact on our business, financial condition and results of operations, and we may not have sufficient capital on hand to pay such penalties.

A decline in interest rates would reduce our income on our HSA Assets and Client-held funds and our ability to attract HSA contributions.

We partner with our Depository Partners and insurance company partners to hold our HSA Assets and other Client-held funds. We earn a substantial portion of our revenue from fees we earn from our Depository Partners and insurance company partners, which comprised approximately 45%, 39%, and 30% of our revenues during the fiscal years ended January 31, 2025, 2024, and 2023, respectively. A decline in prevailing interest rates would negatively impact our business by reducing the yield we realize on our HSA Assets and other Client-held funds. In addition, if we do not offer competitive interest rates on HSA Assets, our members may choose another HSA custodian. Any such scenario could materially and adversely affect our business and results of operations.

A decline in the value of invested HSA Assets would adversely affect our results of operations.

If the value of the invested HSA Assets our members hold declines, whether due to market conditions or other factors, our fees, which are based on a percentage of the asset values, would be adversely affected, which would in turn negatively impact our results of operations.

Integration of our acquisitions may not be successful, and we may not realize the synergies anticipated from our acquisitions.

The success of our acquisitions depends in part on our ability to realize the anticipated business opportunities from combining the operations of the acquired businesses with our business in an efficient and effective manner. Integration of our acquisitions could take longer and be more costly than anticipated, and it could result in the loss of key team members, the disruption of our ongoing business and the acquired business, tax costs or inefficiencies, or inconsistencies in standards, controls, information technology systems, procedures and policies, any of which could adversely affect our ability to maintain relationships with team members, Clients, Network Partners or other third parties, and could harm our financial performance. In addition, we may not realize the anticipated cost, revenue, and other synergies associated with successfully integrating our acquisitions.

Our management team and other team members continue to spend time on integration efforts relating to our recent acquisitions, including the Further acquisition. As part of that integration process, we are working to migrate certain Clients and Network Partners to different technology platforms. We have experienced challenges and increased costs related to Clients' and Network Partners' dissatisfaction as well as technological issues in integrating acquisitions, which could continue to occur as we continue integrating past and future acquisitions.

If we are not successful in adapting to our rapidly evolving industry, our growth may be limited, and our business may be adversely affected.

The market for our products and services is subject to rapid and significant change and competition. The market for administering HSAs and other CDBs is characterized by rapid technological change, new product and service introductions, evolving industry standards, changing customer needs, existing competition, and the entrance of non-traditional competitors. In addition, there may be a limited-time opportunity to achieve and maintain a significant share of this market due in part to our rapidly evolving industry, industry consolidation, and the substantial resources available to our existing and potential competitors. In order to remain competitive, we are continually involved in a number of projects to develop new services or compete with these new market entrants. These projects carry risks, such as cost overruns, delays in delivery, performance problems, and lack of acceptance by our Clients, Network Partners and members.

Achieving our business strategy depends in large part on the success of our recent CEO transition.

On January 6, 2025, our longtime President and Chief Executive Officer, Jon Kessler, retired, at which time Scott Cutler joined the Company as his successor. Any significant leadership change involves inherent risk and can be difficult to manage. Our new CEO is critical to executing on and achieving our business strategy, and our success depends, in large part, on the effectiveness of this transition. If our new CEO is unsuccessful at leading the Company and our management team, or is unable to successfully execute the Company’s strategy, our business may be harmed and our financial condition and results of operations may be adversely affected.

Any diminution in the use of HSAs or other CDBs would materially adversely affect us.

We believe that many consumers are not familiar with, or do not fully appreciate, the tax-advantaged benefits of HSAs and other CDBs. Our success depends on the willingness of consumers to increase their use of HSAs and other CDBs, our ability to increase engagement, and our ability to demonstrate the value of our services to our existing and potential Clients, Network Partners and members.

If our members do not fully use their HSAs or CDBs, if employers reduce or cease to offer HSAs or other CDB programs, if the rate of adoption of these accounts decreases, if existing Clients, Network Partners and members do not recognize or acknowledge the benefits of our services or we do not drive engagement, then the market for our services might decline or develop more slowly than we expect, which could adversely affect our operating results.

The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase or create new operational and competitive risks.

AI technologies – including generative AI –present numerous opportunities, such as benefits from increased operational efficiencies and innovative new products. We expect the use of AI technologies in the marketplace to increase as we, our service providers, and our competitors seek to leverage and maximize those benefits. However, the development and deployment of such technologies also poses certain risks. For example, new products and services incorporating or utilizing AI and machine learning may raise technological, security, legal and other risks and challenges related to, among other items, the use of personal information or the information of clients who have not granted permission for the use of their data in such AI systems, flaws in our models or training datasets that may result in biased or inaccurate results or other unanticipated outcomes, ethical considerations regarding AI, potential infringement of third-party intellectual property rights, exposure of data, and our ability to safely deploy and implement governance and controls for AI systems. We are also exposed to risks arising from the use of AI technologies by bad actors, who may use such technologies to commit fraud, misappropriate funds, and facilitate cyberattacks. Further, our competitors may adopt AI or generative AI more quickly or more effectively than we do, causing competitive harm. Any of these risks could negatively impact our reputation, the demand for our products and services, our financial condition and results of operations, and otherwise draw adverse regulatory scrutiny.

We may be unable to compete effectively against our current and future competitors.

The market for our products and services is highly competitive. We view our competition in terms of direct and indirect competitors. Our direct HSA competitors are well-known retail investment companies, such as Fidelity Investments, HSA custodians and administrators that include state or federally chartered banks, such as Webster Bank and Optum Bank, insurance companies, and non-bank custodians approved by the U.S. Treasury. We also have numerous indirect HSA administration competitors, including benefits administrators and health plans, that license technology platforms and partner with other HSA custodians to provide "white label" HSA offerings. Our other CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks, and these competitors have entered, and others may also enter, the HSA market or expand existing HSA offerings to compete with us.

An increased focus on HSA-favorable healthcare regulatory reforms may create renewed interest and investment by our competitors in their HSA offerings and lead to greater competition, which could make it harder for us to maintain our growth trajectory. This risk would be compounded if legal requirements or administrative rules are interpreted in a way that makes compliance more onerous for us than for our competitors.

If one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively. Our competitors have and may continue to establish or strengthen cooperative relationships with our current or future Network Partners or other strategic partners, thereby limiting our ability to promote our solution with these parties. We have seen an increase in Network Partners that have decided to offer HSAs or other CDBs directly to their customers, and a continuation of this trend would significantly reduce our channel partner opportunities and result in account attrition.

Well-known retail mutual fund companies, such as Fidelity Investments, have entered the HSA and CDB business and gained significant market share. Our market share could decline if Fidelity Investments and other mutual fund companies continue expanding their presence in the market. These investment companies have significant advantages over us in terms of brand name recognition, years of experience managing tax-advantaged retirement accounts (e.g., 401(k) and IRA), highly developed recordkeeping, trust functions, and fund advisory and customer relations management, among others. If we are unable to compete effectively with these mutual fund company competitors, our results of operations, financial condition, business, and prospects could be materially adversely affected.

Many of our competitors, in particular banks, insurance companies, and other financial institutions, have longer operating histories and significantly greater financial, technical, marketing, and other resources than we have. As a result, some of these competitors are in a position to devote greater resources to the development, promotion, sale, and support of their products and services and have offered, or may in the future offer, a wider range of products and services that are increasingly desired by potential customers, and they have also used advertising and marketing strategies (including loss-leaders) that achieve broader brand recognition or acceptance.

Finally, our competitors may have the ability to devote more financial and operational resources than we can to developing new technologies and services, including services that provide improved operating functionality, and adding features to their existing service offerings. They may have a greater ability to use AI to provide enhanced products and service offerings. If successful, their development efforts could render our services less desirable, resulting in the loss of our existing customers or a reduction in the fees we earn from our products and services.

Developments in the rapidly changing healthcare industry could adversely affect our business.

Substantially all of our revenue is derived from healthcare-related saving and spending by consumers, which could be affected by changes affecting the broader healthcare industry, including decreased spending in the industry overall. General reductions in expenditures by healthcare industry participants could result from, among other things:

• government regulation or private initiatives that affect the manner in which healthcare industry participants interact with consumers and the general public;
• consolidation of healthcare industry participants;
• reductions in governmental funding for healthcare; and
• adverse changes in general business or economic conditions affecting healthcare industry participants.

Even if general expenditures by industry participants remain the same or increase, developments in the healthcare industry may result in reduced spending in some or all of the specific market segments that we serve now or in the future. The healthcare industry has changed significantly in recent years, and we expect that significant changes will continue to occur. However, the timing and impact of developments in the healthcare industry are difficult to predict. There is no assurance that the demand for our products and services will continue to exist at current levels or that we will have adequate technical, financial, and marketing resources to react to changes in the healthcare industry.

If our members do not continue to utilize our payment cards, our results of operations, business, and prospects would be materially adversely affected.

We derived 15%, 16%, and 17% of our total revenue during the fiscal years ended January 31, 2025, 2024, and 2023, respectively, from interchange fees that are paid to us when our customers utilize our payment cards. These fees represent a percentage of the expenses transacted on each card. For example, the COVID-19 pandemic had a materially adverse impact on the interchange fees generated due to decreased usage of our payment cards in our commuter product and in healthcare spending. If our customers do not use these payment cards at the rate we expect, if they elect to withdraw funds using a non-revenue generating mechanism such as direct reimbursement, or if other alternatives to these payment cards develop, our results of operations, business, and prospects would be materially adversely affected.

Failure to maintain effective internal control over financial reporting could have a material adverse effect on our reputation, results of operations and financial condition.

Effective internal control over financial reporting is necessary for us to provide reliable financial reports, prevent fraud and operate successfully as a public company. Any failure, whether in connection with our growth, acquisitions, or otherwise, to execute on our internal controls and continue to maintain effective internal controls, to timely implement any necessary additional improvement to our internal controls or to effect remediation of any future material weakness or significant deficiency could, among other things, result in losses from fraud or error, harm our reputation or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our reputation, results of operations, or financial condition.

Management reviews and updates our systems of internal controls and procedures, as appropriate. Any system of controls is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. Any failure or circumvention of our controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on our reputation, results of operations and financial condition.

Data security, technological, and intellectual property risks

Cyber-attacks, including ransomware attacks, or other privacy or data security incidents could materially adversely impact our business.

As one of the largest providers of HSAs and other CDBs, our proprietary technology platforms enable the exchange of, and access to, sensitive information. As a result, we are frequently the target of cyber-attacks, including ransomware attacks, which means we must continue to monitor and take steps to secure each of our technology platforms, making sure these platforms are aligned to our industry benchmark security posture. In addition, geopolitical events, including the war between Russia and Ukraine, have resulted in, and may continue to result in, an increase in cyber-attacks.

Substantially all of our workforce works remotely. This remote work environment increases the risk of cybersecurity breaches and incidents, and the potential impact of these on our operations is also higher while our team members log into our network remotely. In addition, we use third-party partners to service our members. These third-party partners must have access to member information in order to provide this service. Third-party partner remote access to our member information further increases the risk of cybersecurity breaches and incidents through those partners, and from time to time our third-party partners are also the victims of cybersecurity breaches and incidents that may involve member information.

Our ability to ensure the security of our technology platforms and sensitive customer and partner information is critical to our operations. We rely on standard Internet and other security systems to provide the security and authentication necessary to effect secure transmission of data. Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers and other malfeasance. Such threats could result in actual security events that compromise our networks, or those of third-party service providers on which we rely, and result in the information stored or transmitted there to be accessed, modified or used in an unauthorized manner, publicly disclosed, lost, or stolen. Such access, use, disclosure, or other loss of information may result in regulatory scrutiny, and legal claims and liability, including under laws that protect the privacy of personal information, as it has in the past. Cybersecurity events disrupt our operations and the services we provide to our Clients, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, operations, and competitive position.

Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties and other liabilities, including under laws that protect the privacy of personal information, disrupt our operations and the services we provide to our members, Clients and Network Partners. We have been the victim of such breaches, which have damaged our reputation and caused a loss of confidence in our products and services, and may lead to a reduction in demand and result in an unwillingness of members, Clients, Network Partners and other data owners to provide us with their payment information or personal information, and otherwise harm our brand. Furthermore, when third parties improperly obtain and use the personal information of our members, we are required to expend significant resources to investigate and resolve these problems.

While we have security measures in place, we have experienced data privacy incidents in the past, including an incident in 2024 in which a business partner's user account containing personally identifiable information was breached. As a result of the incident, we are now subject to several putative class action lawsuits seeking unspecified damages, and we are subject to regulatory inquiries related to the incident. Whether as a result of these incidents, or if our security measures are breached again or unauthorized access to data is otherwise obtained as a result of third-party action, team member error or otherwise, our reputation could be significantly damaged, our business may suffer and we could incur substantial liability, which could result in loss of sales, Clients and Network Partners.

Because techniques used to obtain unauthorized access to or sabotage systems change frequently and such novel techniques may not be identified until they are launched against a target, we may be unable to anticipate, or to implement adequate preventative measures to address, these techniques. Any or all of these issues could negatively impact our ability to attract new, or increase engagement by, members, Clients and Network Partners, and subject us to third-party lawsuits, regulatory fines, contractual liability, and other action or liability, thereby harming our operating results or financial condition.

Fraudulent activity, whether involving member accounts or our third-party service providers, has led, and could continue to lead, to financial and reputational damage to us and could reduce the use and acceptance of our products and services.

Criminals are using increasingly sophisticated methods to obtain personal information, which they then use to commit fraud. As a non-bank custodian of HSAs, we are frequently targeted by sophisticated and persistent bad actors for fraudulent activity, through various tactics such as high-volume credential stuffing attacks, denial of service attacks, and social engineering attacks, among others. We have experienced a significant increase in the volume and sophistication of outside fraudulent activity targeting member accounts, resulting in a significant loss to us as we incurred service costs to reimburse and protect impacted members. Losses due to fraud committed against us and our Clients, members, and Network Partners may not be covered by insurance policies, and losses not covered by insurance may be material. Even in the event that losses relating to fraudulent activity are covered by insurance, premiums and/or deductibles related to our insurance coverage may increase or the scope of our coverage may decrease, any of which could have an adverse impact on our financial results.

We are also vulnerable to criminal fraudulent activity through our third-party service providers. We rely upon third parties to provide certain services, such as some transaction processing services and data feeds, and such reliance subjects us to risks related to the vulnerabilities of those third parties. For example, we are exposed to risks relating to the theft of payment card numbers housed in a merchant's point of sale systems if our members use our payment cards at a merchant whose systems are compromised. We may reimburse our members for losses sustained when using our payment cards, even in instances where we are not directly responsible for the underlying cause of such loss.

In addition, because of a significant increase in outside fraudulent member account activity, we have suffered reputational damage that could reduce the use and acceptance of our products and services, or cause our Clients, members, and Network Partners to look for alternative providers. Further fraud incidents, or increases in the overall level of fraud involving either member accounts, our reimbursement administrative services, or our third-party service providers, could result in financial and reputational damage to us. If we fail to successfully protect against fraud in the future, our business and financial results may be adversely affected.

We rely on software licensed from third parties that may be difficult to replace or that could cause errors or failures of our technology platforms that could lead to lost customers or harm to our reputation.

We rely on certain cloud-based software licensed from third parties to run our business. This software may experience outages, may not continue to be available to us on commercially reasonable terms and any loss of the right to use any of this software could result in, among others, delays in producing our financial statements, risks to our security environment, or the provisioning of our products and services until equivalent technology is either developed by us, or, if available, identified, obtained, and integrated into our systems and processes, which would likely take a significant amount of time and harm our business. In addition, we have service level agreements with certain of our Clients and Network Partners for which the availability of this software is critical. Any decrease in the availability of our services as a result of errors, defects, a disruption or failure of our licensed software may require us to provide significant fee credits or refunds to our customers. Our software licensed from third parties is also subject to change or upgrade, which may result in us incurring significant costs to implement such changes or upgrades and interruptions or delays in our services as a result of such changes or upgrades.

Developing and implementing new and updated applications, features, and services for our technology platforms may be more difficult than expected, may take longer and cost more than expected, or may result in the platforms not operating as expected.

Attracting and retaining new Clients and Network Partners requires us to continue to improve the technology underlying our proprietary technology platforms and requires our technology to operate as expected. In addition, potential Clients and Network Partners are increasingly seeking a bundled solution, encompassing a wide range of features. We are currently investing in a modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy and platform infrastructure, while maintaining existing applications, features, and services. If we are unable to do so on a timely basis or if we are unable to implement this modernization without disruption to our existing applications, features and services, or if we encounter technical obstacles that result in the technology not operating properly, we may lose potential and existing Clients and Network Partners. We rely on a combination of internal development, strategic relationships, licensing, and acquisitions to develop our content offerings, products and services. These efforts may be more expensive than expected, take longer to develop and implement, and require additional personnel and resources.

The revenue opportunities earned from these efforts may fail to justify the effort or resources spent and may not have the anticipated returns on attracting and retaining new Clients and Network Partners. In addition, material performance problems, defects or errors in our existing or new software have occurred and may occur in the future. Similar challenges in the future may affect our reputation, the demand for our products and services, our financial condition and results of operations, and otherwise draw adverse regulatory scrutiny.

New products and services, including those incorporating or utilizing AI and machine learning, may raise technological, security, legal and other risks and challenges related to, among other items, the use of personal information in such AI systems, flaws in our models or training datasets that may result in biased or inaccurate results or other unanticipated outcomes, ethical considerations regarding AI, potential infringement of third-party intellectual property rights, and our ability to safely deploy and implement governance and controls for AI systems. Realization of these risks could negatively impact our reputation, the demand for our products and services, our financial condition and results of operations, and otherwise draw adverse regulatory scrutiny.

Disruptions of service at our facilities, our servers, our third-party data centers, or our cloud service providers have interrupted and delayed our customers’ access to our products and services and will be harmful if repeated.

The ability of our team members, members, Network Partners, and Clients to access our technology platforms is critical to our business. We may experience disruptions to certain data centers and servers upon which we rely to provide timely services to our clients. For example, an unplanned storage service outage in 2024 led to multiple critical services for our members being unavailable and degraded. We cannot ensure that the measures we have taken to enable access to our technology platforms, including changes in response to previous disruptions to important platforms, will be effective to prevent or minimize interruptions to our operations. Our technology platforms are hosted by third-party data centers, and we increasingly rely on third-party cloud service providers to support our technology platforms. Our facilities, our third-party data centers, and our cloud service providers are vulnerable to interruption or damage from a number of sources, many of which are beyond our control, including, without limitation:

• extended power loss;
• telecommunications failures from multiple telecommunications providers;
• natural disaster or an act of terrorism;
• software and hardware errors, or failures in our own systems or in other systems;
• mistakes in updating, maintaining, and accessing databases, data centers, and servers;
• network environment disruptions such as computer viruses, hacking and similar problems in our own systems and in other systems;
• theft and vandalism of equipment; and
• actions or events caused by or related to third parties.

We attempt to mitigate these risks through various business continuity efforts, including redundant infrastructure, 24/7/365 system activity monitoring, backup and recovery procedures, use of a secure storage facility for backup media, separate production and test systems, and change management and system security measures, but our precautions, even after previous incidents, may not protect against all potential problems. Our data recovery centers are equipped with physical space, power, storage and networking infrastructure and Internet connectivity to support our technology platforms in the event of the interruption of services at our data centers. Even with these data recovery centers, our operations can be interrupted during transition processes when our primary and other data centers experienced failures. Disruptions at our data centers may cause disruptions to our technology platforms and lead to data loss or corruption. We have experienced interruptions and delays in service and availability for data centers, and bandwidth and other technology issues in the past. Frequent or persistent system failures that result in the unavailability of our technology platforms or slower response times could reduce our members', Clients' and Network Partners' ability to access our technology platforms, impair the delivery of our products and services, and harm the perception of our platforms as reliable, trustworthy, and consistent. Any future errors, failure, interruptions or delays experienced in connection with these third-party technologies could delay access to our products by members, Clients and Network Partners, which would harm our business. This could damage our reputation, subject us to potential liability or costs related to defending against claims or cause our members, Clients and Network Partners to cease doing business with us, any of which could negatively impact our financial results.

Our technology platforms may link to or utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Our technology platforms may incorporate software covered by open source licenses. The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unfavorable conditions on us. For example, by the terms of certain open source licenses, we could be required to offer our technology platforms that incorporate the open source software for no cost, that we make publicly available source code for modifications or derivative works that we created based upon, incorporating or using the open source software, and/or that we license such modifications or derivative works under the terms of the particular open source license. If portions of our proprietary software are determined to be subject to an open source license, then the value of our technologies and services could be reduced.

In addition to risks related to license requirements, usage of open source software may be riskier than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Legal and regulatory risks

The healthcare regulatory and political framework is uncertain and evolving, and we cannot predict the effect that further healthcare reform and other changes in government programs may have on our business, financial condition, or results of operations.

Healthcare laws and regulations are rapidly evolving and may change significantly, which could adversely affect our financial condition and results of operations. These changes may accelerate under the new U.S. administration (and through reactions to the administration) in ways we cannot predict. In addition, proposals to implement a single payer or "Medicare for all" system in the U.S. or in individual states, if adopted, could have a material adverse effect on our business. The full impact of healthcare reform and other changes in the healthcare industry and in healthcare spending is unknown. Accordingly, we are unable to predict what effect healthcare reform measures will have on our business.

Changes in applicable federal and state laws relating to HSAs and other CDBs could materially adversely affect our business.

HSAs and other CDBs exist as a result of provisions in the Internal Revenue Code and other laws and regulations. Changes to the regulatory landscape impacting our products require substantial time and costs for us to ensure our products are compliant. For example, regulatory changes related to our FSA and COBRA products enacted in the wake of the COVID-19 pandemic created uncertainty and additional workload on our team members and resulted in additional costs. In addition, federal or state governments could impose laws that limit the eligibility requirements for our products, which could limit our ability to grow or cause us to lose existing members, or such governments could change the eligibility requirements we must meet to maintain the licenses we need to offer our products. We cannot predict if any new reforms will ultimately become law, or if enacted, what their terms or the regulations promulgated pursuant to such reforms will be, and such reforms could have a material adverse effect on our business.

We are subject to privacy regulations, including regarding the access, use, and disclosure of personally identifiable information, and the privacy breaches that we or our third-party service providers have experienced or may experience in the future could result in substantial financial and reputational harm, including possible criminal and civil penalties.

State and federal laws and regulations govern the collection, dissemination, access, and use of personally identifiable information, including HIPAA and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which govern protected health information, and the Gramm-Leach-Bliley Act, which governs nonpublic personal information. In the provision of services, we and our third-party service providers collect, access, use, maintain, and transmit personally identifiable information in ways that are subject to these laws and regulations. Although we have implemented measures to comply with these privacy and data protection laws and regulations, we have experienced data privacy incidents, including an incident in 2024 in which a business partner's user account containing personally identifiable information was breached, though none have materially impacted our operations or financial condition. Any further unauthorized disclosure of personally identifiable information experienced by us or our third-party service providers that process such information on our behalf could result in substantial financial and reputational harm to us, including possible criminal and civil penalties. In situations where we are subject to HIPAA and HITECH, for which we are a business associate providing services to covered entities, the covered entities direct HIPAA compliance matters in the event of a security breach, which complicates our ability to address harm caused by the breach. Additionally, as we have in connection with prior security incidents, we may be required to notify impacted individuals, plan sponsors, and regulatory authorities depending on the severity of the breach, our role, legal requirements, and contractual obligations.

Privacy and data protection regulation have become priority issues in many states, and as such the regulatory environment is continually changing. For example, many states provide a private right of action for data breaches. Additional privacy requirements are expected as new state and federal privacy laws are enacted.

Compliance with current and potential new privacy and data protection laws and regulations, and meeting expectations with respect to the control of personal data in a rapidly changing technology environment, could result in higher compliance and technology costs for us, as well as costly penalties in the event we are deemed to not be in compliance with such laws and regulations.

Legislative, regulatory, and legal developments involving taxes could adversely affect our results of operations and cash flows.

We are subject to U.S. federal and state income, payroll, property, sales and use, and other types of taxes in numerous jurisdictions. Significant judgment is required in determining our provisions for income taxes. Changes in tax rates, enactments of new tax laws, revisions of tax regulations, and claims or litigation with taxing authorities could result in substantially higher taxes.

We do not collect sales and use taxes in all jurisdictions in which our customers are located, other than from sales of certain commuter services, based on our belief that such taxes are generally not applicable to our services. Sales and use tax laws and rates vary by jurisdiction and such laws are subject to interpretation. In those jurisdictions and in those cases where we do believe sales taxes are applicable, we collect and file timely sales tax returns. Currently, such sales taxes apply to certain commuter services, but otherwise are minimal to the rest of our services. Jurisdictions in which we do not collect sales and use taxes may assert that such taxes are applicable, which could result in the assessment of such taxes, interest, and penalties, and we could be required to collect such taxes in the future. Such additional sales and use tax liability could adversely affect the results of our operations.

Regulatory changes and changes in the enforcement environment under the new U.S. administration may have an adverse result on our business.

The new U.S. administration has already made, and expects to further make, many changes to the federal government and federal law and enforcement. These include changes to federal workforce headcount, a high volume of executive orders, and many new or modified regulations and guidance. Such changes create uncertainty around our business and our Clients. In addition, changes to the legal, regulatory or political environment may require management's attention, divert resources from other areas, and expose us to potential liability.

As a federal contractor, we are required to follow federal law, including executive orders, directed at federal contractors. We are unable to anticipate the scope of potential changes federal contractors will be required to comply with and cannot predict what impact any such changes may have on us or whether we will be able to implement adequate preventative measures to address any future requirements.

Additionally, we administer programs allowing eligible federal government employees access to our technology platforms and services. We generate revenue from this relationship, and in the event that the program or the number of federal employees who participate in the program change significantly, our financial results could be affected.

Changes in laws and regulations relating to interchange fees on payment card transactions could adversely affect our revenue and results of operations.

Existing laws and regulations limit the fees or interchange rates that can be charged on payment card transactions. For example, the Federal Reserve Board has the power to regulate payment card interchange fees and has issued a rule setting a cap on the interchange fee an issuer can receive from a single payment card transaction. Our HSA-linked payment cards are exempt from this rule, although we are subject to a general requirement of reasonable compensation for services rendered. To the extent that our payment cards lose their exempt status, the interchange rates applicable to transactions involving our payment cards could be impacted, which could have a material adverse effect on our financial condition and results of operations.

Failure to comply with, or changes in, payment card industry, credit card association or other network rules or standards set by Visa or changes in card association and debit network fees or products or interchange rates, could materially adversely affect us.

We, and the banks that issue our prepaid debit cards, are subject to Payment Card Industry Data Security Standards and Visa association rules that could subject us to a variety of fines or penalties that may be levied by the card associations or networks for acts or omissions by us or businesses that work with us, including card processors. Failure to comply with these rules and standards could result in significant fines, other penalties, or the termination of our interchange revenue agreements. The termination of the card association registrations held by us or any of the banks that issue our cards, or any changes in card association or other debit network rules or standards, including interpretation and implementation of existing rules, participants deciding to use PIN networks, standards or guidance that increase the cost of doing business or limit our ability to provide our products and services, or limit our ability to receive interchange fees, could have a material adverse effect on our results of operations, financial condition, business, and prospects. In addition, from time-to-time, card associations increase the organization or processing fees that they charge, which could increase our operating expenses, reduce our profit margin and materially adversely affect our results of operations, financial condition, business, and prospects.

We are subject to complex regulation, and any compliance failures or regulatory action could adversely affect our business.

Our business, including HSAs and many of the CDBs we administer and our investment adviser and trust company subsidiaries, is subject to extensive, complex, and frequently changing federal and state laws and regulations, including IRS, Health and Human Services (“HHS”), and Department of Labor (“DOL”) regulations; ERISA, HIPAA, HITECH, and other privacy and data security regulations; the Advisers Act; state banking laws; state third-party administrator laws; the Patient Protection and Affordable Care Act; and developing regulation regimes for the use of AI.

Our subsidiary HealthEquity Advisors, LLC is an SEC-registered investment adviser that provides automated web-only investment advisory services. As such, it must comply with the requirements of the Advisers Act and related SEC regulations and is subject to periodic inspections by the SEC staff. Such requirements relate to, among other things, fiduciary duties to clients, disclosure obligations, recordkeeping and reporting requirements, marketing restrictions, limitations on agency cross and principal transactions between the adviser and its clients, and general anti-fraud prohibitions. The SEC is authorized to institute proceedings and impose sanctions for violations of the Advisers Act, ranging from fines and censure to termination of an investment adviser’s registration. Investment advisers also are subject to certain state securities laws and regulations.

Our subsidiary HealthEquity Trust Company is a non-depository trust company and subject to regulation and supervision by the Wyoming Division of Banking.

As we continue to innovate and improve our products and services by leveraging automated decision making, machine learning and AI, our business model may be affected by global trends and laws that regulate the use of these developing technologies. Such laws or regulations may restrict or impose burdensome and costly requirements on our ability to use AI and machine learning and also may impact our ability to use certain data for developing our products and services.

Compliance with regulatory requirements requires resources and takes significant time and effort. Any claim of non-compliance, regardless of merit or ultimate outcome, could subject us to investigation by the HHS, the DOL, the SEC, the Wyoming Division of Banking, or other regulatory authorities. This in turn could result in additional claims or class action litigation brought on behalf of our members, Clients or Network Partners, any of which, regardless of merit or ultimate outcome, could result in substantial cost to us and divert management’s attention and other resources away from our operations. Furthermore, investor perceptions of us may suffer, and this could cause a decline in the market price of our common stock. Our compliance processes may not be sufficient to prevent assertions that we failed to comply with any applicable law, rule or regulation. In addition, all of our business is subject, to varying degrees, to fiduciary and other service provider obligations under ERISA, the Internal Revenue Code, and underlying regulations. A failure to comply with these or other regulatory and compliance obligations could subject us to disgorgement of profits, excise taxes, civil penalties, private lawsuits, and other costs, including reputational harm.

If we are unable to meet or exceed the net worth test required by the IRS, we could be unable to maintain our non-bank custodian status.

As a non-bank custodian, we are required to comply with Treasury Regulations Section 1.408-2(e), including the net worth requirements set forth therein. If we should fail to comply with the Treasury Regulations’ non-bank custodian requirements, including the net worth requirements, such failure would materially and adversely affect our ability to maintain our current custodial accounts and grow by adding additional custodial accounts, and it could result in the institution of procedures for the revocation of our authorization to operate as a non-bank custodian.

Risks relating to our service and culture

Any failure to offer high-quality member, Client and Network Partner support services could adversely affect our relationships with our members, Clients, and Network Partners and our operating results.

Our members, Clients and Network Partners depend on our support and education organizations to educate them about, and resolve technical issues relating to, our products and services. We may be unable to respond quickly enough to accommodate short-term increases in demand for education and support services. Increased demand for these services, without a corresponding increase in revenue, could increase costs and adversely affect our operating results.

Our sales process is highly dependent on the reputation of our products, services, and business and on positive recommendations from our existing members, Clients and Network Partners. Further, we use third-party service providers for certain call centers and COBRA claims and transaction processing, including certain offshore service providers for member chat service, which service providers may not provide the same quality of support services for our Clients and members. Any failure to maintain high-quality education and technical support, or a market perception that we do not maintain high-quality education support, could adversely affect our reputation, our ability to sell our products and services to existing and prospective customers and our business and operating results. We promote 24/7/365 education and support along with our proprietary technology platforms. Interruptions or delays that inhibit our ability to meet that standard have hurt our reputation and ability to attract and retain customers, and any such interruptions or delays in the future would likely also do so.

We rely on our management team (including our new CEO) and team members and our business could be harmed if we are unable to retain qualified personnel.

Our success depends, in part, on the skills, working relationships and continued services of our executive team, including our new CEO, and other key personnel. While we have entered into employment agreements with our executive officers, all of our team members are “at-will” employees, and their employment can be terminated by us or them at any time, for any reason, and without notice, subject, in certain cases, to severance payment rights. In order to retain valuable team members, in addition to salary and cash incentives, we provide equity-based awards that vest over time or based on performance. The value to team members of these awards will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other organizations. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual, or that a replacement could be hired on terms that are favorable to us. Volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

Our success also depends on our ability to attract, retain, and motivate additional skilled management personnel and other team members. For example, competition for qualified personnel in our field is intense due to the limited number of individuals who possess the skills and experience required by our industry. New hires require significant training and, in most cases, take significant time before they achieve full productivity. New team members may not become as productive as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. If our retention efforts are not successful or our team member turnover rate increases, our business, results of operations and financial condition could be materially and adversely affected.

If we cannot maintain our corporate culture as we grow, we could lose the innovation, teamwork, passion, and focus on execution that we believe contribute to our success.

We believe that a critical component to our success has been our corporate culture. We have invested substantial time and resources in building our team. As we continue to grow, including through the integration of team members joining us through our acquisitions, we have found it difficult to maintain these important aspects of our corporate culture. In addition, it is difficult to instill our culture in our now predominantly remote workforce. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel and to effectively focus on and pursue our corporate objectives.

Risks relating to our partners and service providers

If our Network Partners choose to partner with other providers of, or otherwise reduce offering or cease to offer, our products and services, our business could be materially and adversely affected.

Our business increasingly depends on our Network Partners’ willingness to partner with us to offer their customers and/or employees our products and services. In particular, certain of our Network Partners enjoy significant market share in various geographic regions. In other geographies, we have multiple Network Partners that compete against each other for the same business, which at times results in our inability to bid for certain business or in us upsetting a Network Partner that we choose not to partner with in a certain bid or that expects us to bid exclusively with them. If these Network Partners choose to instead partner with our competitors, or otherwise reduce offering, or cease to offer, our products and services, our results of operations, business, and prospects could be materially adversely affected.

A change in relationship with our bank identification number sponsor, or the failure by our sponsor to comply with certain banking regulations, could materially and adversely affect our business.

We rely on a single bank identification number ("BIN") sponsor in relation to the payment cards we issue. A BIN sponsor is a bank or credit union that provides the BIN that allows a prepaid card program to run on one of the major card brand networks (e.g., VISA, MasterCard, Discover or American Express). Our BIN sponsor enables us to link the payment cards that we offer our members to the VISA network, thereby allowing our members to use our payment cards to pay for expenses with a “swipe” of the card. If any material adverse event were to affect our BIN sponsor, including a significant decline in the financial condition of such BIN sponsor, a decline in the quality of service provided by our BIN sponsor, the inability of our BIN sponsor to comply with applicable banking and financial service regulatory requirements or industry standards, systems failure or the inability of our BIN sponsor to pay us fees, our business, financial condition, and results of operations could be materially and adversely affected because we may be forced to reduce the availability of, or eliminate entirely, our payment card offering, which would materially impact our interchange revenue. In addition, we do not have long-term contracts with our BIN sponsor, and our BIN sponsor may increase the fees charged to us or terminate our relationship. If we were required to change BIN sponsor, we could not accurately predict the success of such change or that the terms of our agreement with a new BIN sponsor would be as favorable to us, especially in light of the regulatory scrutiny of the payment card industry, which has rendered the market for BIN sponsor services less competitive.

Replacing our third-party service providers would be difficult and disruptive to our business.

We have entered into contracts with third-party service providers to provide critical services relating to our business, including the redesign of our technology platforms, fraud management and other customer verification services, transaction processing and settlement, telephony services, call centers and card production. In the past, certain of these service providers have failed to maintain adequate levels of support, did not provide high quality service to us and our members, increased the fees they charge us, discontinued their lines of business, terminated our contractual arrangements or ceased or reduce operations, and as a result, we suffered additional costs and were required to pursue new third-party relationships, which resulted in reputational harm, material disruption of our operations and our ability to provide our products and services, missed service-level agreements with Clients and Network Partners, and diverted management’s time and resources, and these events and consequences could happen with our current service providers moving forward. Transitioning to a new service provider often takes a significant amount of time and resources and, if we are unable to complete a transition to a new provider on a timely basis, or at all, we could be forced to temporarily or permanently discontinue certain services, such as our payment card services, which could disrupt services to our customers and adversely affect our business, financial condition, reputation, and results of operations. We may also be unable to establish comparable new third-party relationships on as favorable terms or at all, which could materially and adversely affect our business, financial condition, and results of operations.

Growth-related risks

Our acquisition strategy may not be successful.

As a key part of our strategy, we seek to acquire or invest in assets, businesses, products, or technologies that we believe would complement or expand our products and services, enhance our technical capabilities, or otherwise offer growth opportunities. There is no assurance that we will be successful in consummating such acquisitions, or even if consummated, realize the anticipated benefits of these or any future acquisitions. The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses related to identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

Acquisitions also increase the risk of unforeseen legal liability, including for potential violations of applicable law or industry rules and regulations, arising from prior or ongoing acts or omissions by the acquired businesses that are not discovered by due diligence during the acquisition process. Generally, if an acquisition fails to meet our expectations, our operating results, business, and financial condition may suffer. Certain of our past acquisitions also resulted in dilutive issuances of equity securities and the incurrence of additional debt, and future acquisitions could result in additional dilutive issuances of equity securities or the incurrence of additional debt, which could adversely affect our business, results of operations, or financial condition.

Failure to manage future growth effectively could have a material adverse effect on our business, financial condition, and results of operations.

The continued rapid expansion and development of our business has placed a significant strain upon our management and administrative, operational, and financial infrastructure. As of January 31, 2025, we had approximately 9.9 million HSAs and $32.1 billion in HSA Assets representing growth of 14% and 27%, respectively, from January 31, 2024. Our growth strategy contemplates further increasing the number of our HSAs, CDBs and our HSA Assets at relatively higher growth rates than industry averages. However, the rate at which we have been able to add new HSAs, CDBs and HSA Assets in the past may not be indicative of the rate at which we will be able to grow in the future.

Our success depends in part upon the ability of our executive officers to manage growth effectively. Our ability to grow also depends upon our ability to successfully hire, train, supervise, and manage new team members, obtain financing for our capital needs, expand our systems effectively, control increasing costs, allocate our human resources optimally, maintain clear lines of communication between our operational functions and our finance and accounting functions, and manage the pressures on our management and administrative, operational, and financial infrastructure. There can be no assurance that we will be able to accurately anticipate and respond to the changing demands we will face as we continue to expand our operations or that we will be able to manage growth effectively or to achieve further growth at all. If our business does not continue to grow or if we fail to effectively manage any future growth, our business, financial condition, and results of operations could be materially and adversely affected.

We may not accurately estimate the impact on our business of developing, introducing, and updating new and existing products and services.

We intend to continue to invest in technology and development to create new and enhanced products and services to offer our customers and to enhance the capabilities of our platforms. We may not be able to anticipate or manage new risks and obligations or legal, compliance, or other requirements that may arise in these areas. The anticipated benefits of such new and improved products and services may not outweigh the costs and resources associated with their development. Some new services may be received negatively by our existing and/or potential customers and strategic partners and have to be put on hold or canceled entirely.

Our ability to attract and retain new customer revenue from existing customers will depend in large part on our ability to enhance and improve our existing products and services and to introduce new products and services. The success of any enhancement or new product or service depends on several factors, including the timely completion, introduction, and market acceptance of the enhancement or new product or service. Any new product or service we develop or acquire may not be introduced in a timely or cost-effective manner and may not achieve the broad market acceptance necessary to earn significant revenue. If we are unable to successfully develop or acquire new products or services or enhance our existing products or services to meet member or network partner requirements, our results of operations, financial condition, business or prospects may be materially adversely affected.

We may need to record write-downs from future impairments of identified intangible assets and goodwill.

Our consolidated balance sheet includes significant intangible assets, including approximately $1.65 billion in goodwill and $1.20 billion in intangible assets, together representing approximately 83% of our total assets as of January 31, 2025. The determination of related estimated useful lives and whether these assets are impaired involves significant judgments. We test our goodwill for impairment each fiscal year, but we also test goodwill and other intangible assets for impairment at any time when there is a change in circumstances that indicates that the carrying value of these assets may be impaired. This is particularly relevant to us given our recent acquisition history and the amount of goodwill and intangible assets on our balance sheet associated with those acquisitions. Any future determination that these assets are carried at greater than their fair value could result in substantial non-cash impairment charges, which could significantly impact our reported operating results.

Financing and related risks

Our substantial debt could limit our ability to fund operations, expose us to interest rate volatility, limit our ability to raise additional capital and have a material adverse effect on our ability to fulfill our obligations under our Credit Agreement and Indenture and to our Network Partners, Clients and members.

We are party to a credit agreement (the "Credit Agreement"), which consists of a five-year senior secured revolving credit facility in the aggregate principal amount of $1 billion (the “Revolving Credit Facility”), of which $461.9 million was outstanding as of January 31, 2025. We have also issued $600 million of 4.50% unsecured Senior Notes due 2029 (the "Notes"). Under the Credit Agreement, we have the right to request additional loans or commitments for in an amount up to $450 million, plus (ii) an additional amount so long as the pro forma First Lien Net Leverage Ratio (as defined in the Credit Agreement) does not exceed 3.85 to 1.00 as of the date such loans or commitments are incurred. We also have the right to incur additional debt from time to time, subject to the restrictions contained in the Credit Agreement and the indenture under which the Notes were issued (the "Indenture"). The substantial debt we have outstanding, combined with our other financial obligations and contractual commitments, has important consequences, including the following:

• our level of debt may make it more difficult for us to satisfy our obligations with respect to our debt, and any failure to comply with the obligations under any of our debt instruments, including restrictive covenants, could result in an event of default under the Credit Agreement or the Indenture and the agreements governing such other debt;
• we use a portion of our cash flow from operations to pay principal and interest on our debt, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, strategic acquisitions, investments and alliances and other general corporate requirements;
• our interest expense has increased substantially, and could continue to increase if interest rates increase beyond current levels, because any outstanding borrowings under the Revolving Credit Facility are based on variable interest rates;
• the interest rate on our Revolving Credit Facility will depend on the level of its specified financial ratios, and therefore could increase if such specified financial ratios increase;
• such substantial debt could leave us vulnerable to general economic downturns and adverse competitive and industry conditions and could place us at a competitive disadvantage compared to those of our competitors that are less leveraged;
• our debt service obligations could limit our flexibility to plan for, or react to, changes in our business and the industry in which we operate;
• our level of debt may restrict us from raising additional financing on satisfactory terms to fund working capital, capital expenditures, strategic acquisitions, investments and joint ventures and other general corporate requirements;
• our level of debt may prevent us from raising the funds necessary to repurchase all of the Notes tendered to us upon the occurrence of a change of control, which would constitute an event of default under the Indenture; and
• a potential failure to comply with the financial and other restrictive covenants in any of our debt instruments, which, among other things, require us to maintain specified financial ratios, could, if not cured or waived, have a material adverse effect on our ability to fulfill our obligations under the Notes and on our business and prospects generally.

The Indenture and the Credit Agreement contain covenants that impose significant operational and financial restrictions on us, and the failure to comply with these covenants would result in an event of default under these instruments.

The Indenture and the Credit Agreement impose on us operating and other restrictions. These restrictions affect, and in many respects limit or prohibit, among other things, our ability to:

• incur additional debt and issue certain capital stock;
• create liens;
• make investments or acquisitions;
• enter into transactions with affiliates;
• sell assets;
• guarantee debt;
• declare or pay dividends or other distributions to shareholders;
• repurchase equity interests;
• redeem debt that is subordinated in right of payment to certain debt instruments;
• enter into agreements that restrict dividends or other payments from subsidiaries; and
• consolidate, merge or transfer all or substantially all of our assets and the assets of our subsidiaries on a consolidated basis.

The terms of the Revolving Credit Facility in the Credit Agreement also require us to achieve and maintain compliance with specified financial ratios and contain the following restrictions:

• limit our ability to plan for or react to market conditions or meet capital needs or otherwise restrict our activities or business plans; and
• adversely affect our ability to finance our operations, strategic acquisitions, investments or alliances or other capital needs or to engage in other business activities that would be in our interest.

A breach of any of these restrictive covenants or our inability to comply with the required financial ratios would result in a default under some or all of the debt agreements. During the occurrence and continuance of a default, lenders under our Revolving Credit Facility may elect to declare all outstanding borrowings, together with accrued interest and other fees, to be immediately due and payable, which would result in an event of default under the Indenture. The lenders will also have the right in these circumstances to terminate any commitments they have to provide further borrowings. Additionally, our Credit Agreement contains a cross-default provision, which generally causes a default or event of default under the Credit Agreement upon a qualifying default or event of default under any other debt instrument (including under the Indenture) and the Indenture contains a cross-acceleration provision. If we are unable to repay outstanding borrowings when due, the lenders under our Revolving Credit Facility will also have the right to proceed against the collateral granted to them to secure the debt. If lenders under the Revolving Credit Facility accelerate the debt thereunder, then the obligations under the Notes would be accelerated. We cannot provide assurance that, if the indebtedness under our Revolving Credit Facility or the Notes were to be accelerated, our assets would be sufficient to repay in full that indebtedness and our other indebtedness. If not cured or waived, such acceleration could have a material adverse effect on our business and our prospects.

General risk factors

Provisions in our charter documents and under Delaware law could discourage a takeover that stockholders may consider favorable.

Certain provisions in our governing documents could make a merger, tender offer or proxy contest involving us difficult; even if such events would be beneficial to the interests of our stockholders. These provisions include the inability of our stockholders to act by written consent and certain advance notice procedures with respect to stockholder proposals and nominations for candidates for the election of directors. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law which, subject to certain exceptions, prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Accordingly, our board of directors could rely upon these or other provisions in our governing documents and Delaware law to prevent or delay a transaction involving a change in control of our company, even if doing so would benefit our stockholders.

The exclusive forum provision in our amended and restated certificate of incorporation could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or team members.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware is the exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim for breach of a fiduciary duty owed by any of our directors and officers to us or our stockholders, any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws, or any action asserting a claim governed by the internal affairs doctrine. The choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or other team members, which may discourage such lawsuits against us and our directors, officers, and other team members. Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could adversely affect our business and financial condition.

Overview

Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners, and our relationships with them. As further described below, we take various steps designed to help ensure that our platforms, data, and other systems remain available, resilient, and secure in the face of risks presented both by inadvertent actions (e.g., software that fails to operate properly) and by malicious activities (e.g., threat actors deliberately seeking to steal data or otherwise cause disruption). In particular, our industry continues to be a target for increasingly sophisticated cyber threats, including those driven by the rapid advancement of AI, adoption of public cloud environments, and reliance on third parties. We take a security-by-design and risk-based approach to our cybersecurity program, which emphasizes continual improvement to safeguard non-public information and enable our business operations.

Our cybersecurity program is structured to identify, assess, and mitigate risks through continuous monitoring, proactive threat intelligence, and a multi-layered defense strategy. We implement security controls, tools, and incident response procedures to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including cybersecurity incidents. We emphasize fraud prevention, data protection, and securing our core platforms, while also prioritizing zero trust architecture, third-party risk management, immutable backups, training our staff and others who may have access to our data and systems, and improvement of our security personnel.

In the event of a security risk or breach, we are prepared with response protocols aligned with National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and testing guidelines. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. In addition, we have an organic threat model to evaluate our security controls against attacker tactics, techniques, and procedures.

This adaptive approach strengthens our ability to anticipate and counter emerging threats. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.

Risk management and strategy

We have implemented the Three Lines of Defense Model as the foundation of our risk management approach. Our information security team serves as a First Line, working with our Enterprise Risk Management & Compliance functions as a Second Line, and our Internal Audit function as the Third Line.

Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers’ data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18.

We regularly engage external and internal assessors and auditors to evaluate and audit our cybersecurity policies, procedures, standards, and practices. Results from these assessments are shared with management for remediation and with the Cybersecurity and Technology Committee of our board of directors on a regular basis. We have obtained, or are working toward obtaining, industry certifications and attestations and have aligned our cybersecurity program with the NIST Cybersecurity Framework and related controls.

As part of our Third Party Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.

During the fiscal year ended January 31, 2025, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.

Governance

The Cybersecurity and Technology Committee of our board of directors provides oversight of the Company’s cybersecurity threat landscape, risks and data security programs, and the Company’s management and mitigation of cybersecurity risks and potential breach incidents. The Audit and Risk Committee of our board of directors provides an additional layer of cybersecurity oversight, as it provides oversight of the Company’s enterprise risk management program, which includes management of cybersecurity risks and the potential fraud and privacy risks that could arise from a cybersecurity incident.

The Chief Security Officer ("CSO") and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company’s cybersecurity program and related risk management programs, and discuss the Company’s cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.

Our enterprise cybersecurity program is led by the CSO, who brings more than two decades of cybersecurity leadership experience and oversees both information technology and information security functions. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas:

• Threat & Vulnerability Management: We follow a defense-in-depth security model with a Joint Security Operations Center, Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack.
• Governance, Risk, and Compliance: Our Security Governance, Risk, and Compliance team helps drive trust, compliance, and data protection by managing risks, including supply chain risks, to strengthen customer confidence, support innovation, and protect our reputation.
• Fraud Prevention: Our Fraud Strategy and Prevention team seeks to employ industry best practices of fraud prevention, identity and access management ("IAM"), and cybersecurity monitoring to protect the

transactions of our members and Clients. We continue to invest in people, processes, and technology solutions to enhance our fraud prevention program.

• Security Engineering & Architecture: Our Security Engineering & Architecture team designs and implements resilient security solutions, embedding security into cloud and on-premise environments while automating controls and integrating security into development lifecycles.
• Identity & Access Management: Our IAM team enforces zero trust principles, least privilege access, and adaptive authentication, managing multi-factor authentication, privileged access management, and just-in-time access to protect critical systems while ensuring seamless and compliant user access.

We do not currently own any of our facilities. Our principal executive offices are located in Draper, Utah. Since a majority of our workforce is now permanently working remotely, we no longer use portions of our office space and we have subleased, or are seeking opportunities to sublease, these offices.

For information regarding legal proceedings in which we are involved, refer to Note 6—Commitments and contingencies to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. This discussion contains forward-looking statements that reflect our plans, estimates and beliefs, and involve risks and uncertainties. Our actual results and the timing of certain events could differ materially from those anticipated in these forward-looking statements as a result of several factors, including those discussed in the section titled “Risk factors” included under Part I, Item 1A and elsewhere in this report. See “Special note regarding forward-looking statements” on page 1 of this Annual Report.

Overview

We are a leader and an innovator in providing technology-enabled services that empower consumers to make healthcare saving and spending decisions. We use our innovative technology to manage consumers' tax-advantaged HSAs and other CDBs offered by employers, including FSAs and HRAs, and to administer COBRA, commuter and other benefits. As part of our services, we provide consumers with payment processing services, personalized benefit information, the ability to earn wellness incentives, and investment advice to grow their tax-advantaged healthcare savings.

The core of our offerings is the HSA, a financial account through which consumers spend and save long-term for healthcare expenses on a tax-advantaged basis. As of January 31, 2025, we administered 9.9 million HSAs, with balances totaling $32.1 billion, which we call HSA Assets, as well as 7.1 million complementary CDBs. We refer to the aggregate number of HSAs and other CDBs that we administer as Total Accounts, of which we had 17.0 million as of January 31, 2025.

We reach consumers primarily through relationships with their employers, which we call Clients. We reach Clients primarily through relationships with benefits brokers and advisors, integrated partnerships with a network of health plans, benefits administrators, benefits brokers and consultants, and retirement plan recordkeepers, which we call Network Partners, and a sales force that calls on Clients directly. As of January 31, 2025, our platforms were integrated with more than 200 Network Partners.

We have increased our share of the growing HSA market from 4% in December 2010 to 21% as of June 2024, measured by HSA Assets. According to the 2024 Midyear Devenir HSA Research Report, as of June 2024, we were the largest HSA provider by both accounts and HSA Assets. In addition, we believe we are the largest provider of other CDBs. We seek to differentiate ourselves through our service-driven culture, product breadth, ecosystem connectivity, and proprietary technology. Our proprietary technology allows us to help consumers optimize the value of their HSAs and other CDBs and gain confidence and skills in managing their healthcare costs as part of their financial security.

Our ability to assist consumers is enhanced by our capacity to securely share data in both directions with others in the health, benefits, and retirement ecosystems. Our commuter benefits offering also leverages connectivity to an ecosystem of mass transit, ride hailing, and parking providers.

We earn revenue primarily from three sources: service, custodial, and interchange. We earn service revenue mainly from fees paid by our Network Partners, Clients, and members for the administration services we provide in connection with the HSAs and other CDBs we offer. We earn custodial revenue primarily from HSA cash held by our federally insured bank and credit union partners, which we collectively call our Depository Partners, HSA cash held by our insurance company partners, and Client-held funds deposited with our Depository Partners. We earn interchange revenue mainly from fees paid by merchants on payments that our members make using our physical payment cards and on our virtual payment system. See “Key components of our results of operations” for additional information on our sources of revenue.

Recent acquisitions

HealthSavings HSA portfolio acquisition. In March 2022, we acquired the HealthSavings HSA portfolio, which consisted of $1.3 billion of HSA Assets held in approximately 87,000 HSAs in exchange for a purchase price of $60 million in cash.

BenefitWallet HSA portfolio acquisition. In fiscal 2025, we acquired the BenefitWallet HSA portfolio, comprised of approximately 616,000 HSAs plus other accounts and $2.7 billion of HSA Assets, from Conduent for a purchase price of $425.0 million. We paid the purchase price using $225.0 million of borrowings under our revolving credit facility, with the remainder paid using cash on hand.

Key factors affecting our performance

We believe that our future performance will be driven by a number of factors, including those identified below. Each of these factors presents both significant opportunities and significant risks to our future performance. See also the section entitled “Risk factors” included in Part 1, Item 1A of this Annual Report on Form 10-K and our other reports filed with the SEC.

Our acquisition and integration strategy

We have historically acquired HSA portfolios and businesses that strengthen our service offerings. We plan to continue this growth strategy and are regularly engaged in evaluating different opportunities. We have developed an internal capability to source, evaluate, and integrate acquired HSA portfolios. Our success depends in part on our ability to successfully integrate acquired businesses and HSA portfolios with our business in an efficient and effective manner.

Structural change in U.S. health insurance

We derive revenue primarily from healthcare-related saving and spending by consumers in the U.S., which are driven by changes in the broader healthcare industry, including the structure of health insurance. The average family premium for employer-sponsored health insurance has risen by 24% since 2019 and 52% since 2014, resulting in increased participation in HSA-qualified health plans and HSAs and increased consumer cost-sharing in health insurance more generally. We believe that continued growth in healthcare costs and related factors will spur continued growth in HSA-qualified health plans and HSAs and may encourage policy changes making HSAs or similar vehicles available to new populations such as individuals in Medicare. However, the timing and impact of these and other developments in U.S. healthcare are uncertain. Moreover, changes in healthcare policy, such as "Medicare for all" plans, could materially and adversely affect our business in ways that are difficult to predict.

Trends in U.S. tax law

Tax law has a profound impact on our business. Our offerings to members, Clients, and Network Partners consist primarily of services enabled, mandated, or advantaged by provisions of U.S. tax law and regulations. Changes in tax policy are speculative and may affect our business in ways that are difficult to predict.

Our client base

Our business model is based on a B2B2C distribution strategy, whereby we work with Network Partners and Clients to reach consumers to increase the number of our members with HSA accounts and complementary CDBs. We believe that there are significant opportunities to expand the scope of services that we provide to our current Clients.

Broad distribution footprint

We believe we have a diverse distribution footprint to attract new Clients and Network Partners. Our sales force calls on enterprise and regional employers in industries across the U.S., as well as potential Network Partners from among health plans, benefits administrators, and retirement plan record keepers. Our Network Partners are a key channel through which we gain access to Clients and members. Our Network Partners collectively employ thousands of sales representatives and account managers who promote both the Network Partners' products and our products and services. Our sales representatives and account management teams work with and train the sales representatives and account management teams of our Network Partners.

Product breadth

We are the largest custodian and administrator of HSAs, as well as a market-share leader in each of the major categories of complementary CDBs, including FSAs and HRAs, COBRA and commuter benefits administration. Our Clients and their benefits advisors increasingly seek HSA providers that can deliver an integrated offering of HSAs and complementary CDBs. With our CDB capabilities, we can provide employers with a single partner for both HSAs and complementary CDBs, which is preferred by the vast majority of employers, according to research conducted for us by Aite Group. We believe that the combination of HSA and complementary CDB offerings significantly strengthens our value proposition to employers, health benefits brokers and consultants, and Network Partners as a leading single-source provider.

Interest rates

As a non-bank custodian, our members’ custodial HSA cash assets are held by either our federally insured Depository Partners (our "Basic Rates" offering), pursuant to contractual arrangements we have with these Depository Partners, or by our insurance company partners through group annuity contracts or other similar arrangements (our "Enhanced Rates" offering). For the reasons described below, we have encouraged our members to place more of their HSA cash in our Enhanced Rates offering. As our Basic Rates contracts expire, the HSA cash held in those Basic Rates contracts will transition to Enhanced Rates contracts, subject to our members retaining the right to keep their HSA cash in Basic Rates.

The lengths of our agreements with Depository Partners typically range from three to five years and may have fixed or variable interest rate terms. The terms of new and renewing agreements with our Depository Partners are impacted by the then-prevailing interest rate environment, which in turn is driven by macroeconomic factors and government policies over which we have no control. Such factors, and the response of our competitors to them, also determine the amount of interest retained by our members.

HSA members who place their HSA cash into our Enhanced Rates offering retain a higher yield compared to our Basic Rates offering. An increase in the percentage of HSA cash held in our Enhanced Rates offering also positively impacts our custodial revenue, as we generally receive a higher yield on HSA cash held by our insurance company partners compared to cash held by our Depository Partners. As with our Depository Partners, yields paid by our insurance company partners are impacted by the prevailing interest rate environment, which in turn is driven by macroeconomic factors and government policies over which we have no control. Such factors, and the response of our competitors to them, also determine the amount of interest retained by our members.

We believe that increased participation in our Enhanced Rates offering, diversification of Depository Partners and insurance company partners, varied contract terms, and other factors reduce our exposure to short-term fluctuations in prevailing interest rates and mitigate the short-term impact of sustained increases or declines in prevailing interest rates on our custodial revenue. Over longer periods, sustained shifts in prevailing interest rates affect the amount of custodial revenue we can realize on custodial assets and the interest retained by our members.

Interest on our revolving credit facility changes frequently due to variable interest rate terms, and as a result, our interest expense is expected to fluctuate based on changes in prevailing interest rates.

Our proprietary technology

We believe that innovations incorporated in our technology differentiate us from our competitors and help drive our growth by enabling us to better assist consumers to make healthcare saving and spending decisions and maximize the value of their tax-advantaged benefits. Our full suite of CDB offerings complements our HSA solution and enhances our leadership position within the HSA sector. We are currently investing in a modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy and platform infrastructure, while maintaining existing applications, features, and services. For example, we are making investments in the architecture and infrastructure of the technology that we use to provide our services to improve our transaction processing capabilities and support continued account and transaction growth, as well as in data-driven personalized engagement to help our members spend less, save more, and build wealth for retirement. In addition, we are investing in technology solutions to meet the evolving needs of our members, Clients and Network Partners. Our current innovation efforts include, among others, increasing member and client self-service capabilities, developing APIs, driving electronic communication rather than paper, increasing straight-through processing, improving overall process times utilizing both traditional robotic process automation, and increasingly through AI tools including the Expedited Claims tool, leveraging chip-enabled stacked cards, and mobile wallet.

Our Purple culture

A successful healthcare consumer needs education and guidance delivered by people as well as by technology. The education and customer service we provide is driven by our Purple culture, which we believe is a significant factor in our ability to attract and retain customers and to address opportunities in the rapidly changing healthcare sector. We invest in and intend to continue to invest in human capital through technology-enabled training, career development, and advancement opportunities.

Our competition and industry

Our direct competitors are HSA custodians and other CDB providers. Many of these are state or federally chartered banks and other financial institutions for which we believe benefits administration services are not a core business. Some of our direct competitors (including well-known retail investment companies, such as Fidelity Investments, and healthcare service companies such as UnitedHealth Group's Optum and Webster Bank) are in a position to devote more resources to the development, sale, and support of their products and services than we have at our disposal. Our other CDB administration competitors include health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third-party administrators, and commercial banks. In addition, numerous indirect competitors, including benefits administration service providers, partner with banks and other HSA custodians to compete with us. Our Network Partners and ecosystem partners may also choose to offer competitive services directly, as some health plans have done. Our success depends on our ability to predict and react quickly to these and other industry and competitive dynamics.

Regulatory environment

Federal law and regulations, including the Affordable Care Act, the Internal Revenue Code, the Employee Retirement Income Security Act and Department of Labor regulations, and public health regulations that govern the provision of health insurance and provide the tax advantages associated with our services, play a pivotal role in determining our market opportunity. Privacy and data security-related laws such as the Health Insurance Portability and Accountability Act, or HIPAA, and the Gramm-Leach-Bliley Act, laws governing the provision of investment advice to consumers, such as the Investment Advisers Act of 1940, or the Advisers Act, the USA PATRIOT Act, anti-money laundering laws, and the Federal Deposit Insurance Act, all play a similar role in determining our competitive landscape. In addition, state-level regulations also have significant implications for our business in some cases. For example, our subsidiary HealthEquity Trust Company is regulated by the Wyoming Division of Banking, and several states are considering, or have already passed, new privacy regulations that can affect our business. Various states also have laws and regulations that impose additional restrictions on our collection, storage, and use of personally identifiable information. Privacy regulation in particular has become a priority issue in many states, including, for example, the California Privacy Rights Act. Our ability to predict and react quickly to relevant legal and regulatory trends and to correctly interpret their market and competitive implications is important to our success.

Key financial and operating metrics

We regularly review a number of key operating and financial metrics to evaluate our business, determine the allocation of our resources, make decisions regarding corporate strategies, and evaluate forward-looking projections and trends affecting our business. We discuss certain of these key financial metrics, including revenue, below in the section entitled “Key components of our results of operations.” In addition, we utilize other key metrics as described below.

For a discussion related to key financial and operating metrics for fiscal year 2024 compared to fiscal year 2023, refer to Part II, Item 7. Management's discussion and analysis of financial condition and results of operations in our fiscal year 2024 Form 10-K, filed with the SEC on March 22, 2024.

Total Accounts

The following table sets forth our HSAs, CDBs, and Total Accounts as of and for the periods indicated:

(in thousands, except percentages)

* Not meaningful

The number of our HSAs and CDBs are key metrics because our revenue is driven by the amount we earn from them. The number of our HSAs increased by 1.2 million, or 14%, from January 31, 2024 to January 31, 2025, driven by new HSAs from sales and new HSAs added through the BenefitWallet HSA portfolio acquisition. The number of our CDBs increased by 0.1 million, or 2%, from January 31, 2024 to January 31, 2025, primarily driven by an increase in HRA accounts.

HSA Assets

The following table sets forth HSA Assets as of and for the periods indicated:

(in millions, except percentages)

HSA Assets includes our HSA members’ custodial assets, which consists of the following components: (i) HSA cash, which includes member cash held by our Depository Partners and our insurance company partners, and (ii) HSA investments, which includes member investments held by our custodial investment partner. Measuring HSA Assets is important because our custodial revenue is directly affected by average daily custodial balances for HSA Assets that are revenue generating.

HSA cash increased by $2.4 billion, or 16%, from January 31, 2024 to January 31, 2025, due to HSA cash added through the BenefitWallet HSA portfolio acquisition and net HSA contributions from new and existing HSA members, partially offset by transfers to HSA investments.

HSA investments increased by $4.5 billion, or 44%, from January 31, 2024 to January 31, 2025, due to the increased market value of invested balances, transfers from HSA cash, and HSA investments added through the BenefitWallet HSA portfolio acquisition.

Total HSA Assets increased by $6.9 billion, or 27%, from January 31, 2024 to January 31, 2025, primarily due to the increased market value of invested balances, HSA Assets added through the BenefitWallet HSA portfolio acquisition, and net HSA contributions from new and existing HSA members.

The following table summarizes the amount of HSA cash held by our Depository Partners and insurance company partners that is expected to reprice by fiscal year and the respective average annualized yield currently earned on that HSA cash as of January 31, 2025:

(1) Excludes $0.8 billion of HSA cash held in floating-rate contracts as of January 31, 2025.

Client-held funds

(in millions, except percentages)

Client-held funds are interest-earning deposits from which we generate custodial revenue. These deposits are amounts remitted by Clients and held by us on their behalf to pre-fund and facilitate administration of CDBs. We deposit the Client-held funds with our Depository Partners in interest-bearing demand deposit accounts that have a floating interest rate and no set term or duration. Client-held funds fluctuate depending on the timing of funding and spending of CDB balances and the number of CDBs we administer.

Adjusted EBITDA

We define Adjusted EBITDA, which is a non-GAAP financial metric, as earnings before interest, taxes, depreciation and amortization, amortization of acquired intangible assets, stock-based compensation expense, merger integration expenses, acquisition costs, gains and losses on equity securities, amortization of incremental costs to obtain a contract, costs associated with unused office space, and certain other non-operating items. We believe that

Adjusted EBITDA provides useful information to investors and analysts in understanding and evaluating our operating results in the same manner as our management and our board of directors because it reflects operating profitability before consideration of non-operating expenses and non-cash expenses and serves as a basis for comparison against other companies in our industry.

The following table presents a reconciliation of net income, the most comparable GAAP financial measure, to Adjusted EBITDA for the periods indicated:

(in thousands)

The following table sets forth our net income as a percentage of revenue:

(in thousands, except percentages)

The $41.0 million, or 74%, increase in net income from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in total revenue, partially offset by an increase in operating expenses, including the settlement of a lawsuit related to a lease termination (the "Lease Settlement"), as described in Note 6—Commitments and contingencies to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K, and an increase in cost of revenue, including increased costs incurred to reimburse and protect members from outside fraud activity. For additional information, refer to the section entitled "Results of operations."

The following table sets forth our Adjusted EBITDA as a percentage of revenue:

(in thousands, except percentages)

The $102.6 million, or 28%, increase in Adjusted EBITDA from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in total revenue, partially offset by increases in personnel-related costs, professional fees, and costs incurred to reimburse and protect members from outside fraud activity.

Our use of Adjusted EBITDA, including as a percentage of revenue, has limitations as an analytical tool and should not be considered in isolation or as a substitute for analysis of our results as reported under GAAP.

Non-GAAP net income

Non-GAAP net income is calculated by adding back to GAAP net income before income taxes the following items: amortization of acquired intangible assets, stock-based compensation expense, merger integration expenses, acquisition costs, gains and losses on equity securities, costs associated with unused office space, and losses on extinguishment of debt, and subtracting a non-GAAP tax provision using a normalized non-GAAP tax rate. We believe that non-GAAP net income and non-GAAP net income per diluted share provide useful information to investors and analysts in understanding and evaluating our operating results in the same manner as our management and our board of directors because these non-GAAP metrics reflect operating profitability before consideration of certain non-operating expenses and non-cash expenses and serve as a basis for comparison against other companies in our industry.

The following table presents a reconciliation of net income, the most comparable GAAP financial measure, to non-GAAP net income for the periods indicated:

(in thousands, except per share data)

(1) The Company utilizes a normalized non-GAAP tax rate to provide better consistency across the interim reporting periods within a given fiscal year by eliminating the effects of non-recurring and period-specific items, which can vary in size and frequency, and which are not necessarily reflective of the Company’s longer-term operations. The normalized non-GAAP tax rate applied to each period presented was 25%. The Company may adjust its non-GAAP tax rate as additional information becomes available and in conjunction with any other significant events occurring that may materially affect this rate, such as merger and acquisition activity, changes in business outlook, or other changes in expectations regarding tax regulations.

The $81.7 million, or 42%, increase in non-GAAP net income from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in total revenue, partially offset by increases in personnel-related costs, professional fees, and costs incurred to reimburse and protect members from outside fraud activity.

Our use of non-GAAP net income has limitations as an analytical tool and should not be considered in isolation or as a substitute for analysis of our results as reported under GAAP.

Key components of our results of operations

Revenue

We generate revenue from three primary sources: service revenue, custodial revenue, and interchange revenue.

Service revenue. We earn service revenue from the fees we charge our Network Partners, Clients, and members for the administration services we provide in connection with the HSAs and other CDBs we offer. With respect to our Network Partners and Clients, our fees are generally based on a fixed tiered structure for the duration of the relevant service agreement and are paid to us on a monthly basis. In addition, once a member’s HSA cash balance reaches a certain threshold, the member is able to invest his or her HSA Assets through our investment partner from which we earn recordkeeping and advisory fees, calculated as a percentage of the member's HSA investments. We recognize revenue on a monthly basis as services are rendered to our members and Clients.

Custodial revenue. We earn custodial revenue primarily from HSA cash held by our Depository Partners or our insurance company partners and Client-held funds held by our Depository Partners. HSA cash is held by our

Depository Partners pursuant to contracts that (i) typically have terms ranging from three to five years, (ii) provide for a fixed or variable interest rate payable on the average daily cash balances held by the relevant Depository Partner, and (iii) have minimum and maximum required balances. HSA cash held by our insurance company partners is held in group annuity contracts or similar arrangements. Client-held funds held by our Depository Partners are held in interest-bearing demand deposit accounts that have a floating interest rate and no set term or duration. We earn custodial revenue on HSA cash and Client-held funds that is based on the interest rates offered to us by these Depository Partners and insurance company partners.

Interchange revenue. We earn interchange revenue each time one of our members uses one of our physical payment cards or virtual platforms to make a purchase. This revenue is collected each time a member “swipes” our payment card to pay expenses. We recognize interchange revenue monthly based on reports received from third parties, namely, the card-issuing banks and card processors.

Cost of revenue

Service costs. Service costs are comprised of costs related to servicing accounts, managing Client and Network Partner relationships and processing reimbursement claims. Expenditures include personnel-related costs, depreciation, amortization, stock-based compensation, common expense allocations (such as office rent, supplies, and other overhead expenses), costs to reimburse members from outside fraud activity, new member and participant supplies, and other operating costs related to servicing our members.

Custodial costs. Custodial costs are comprised of interest retained by our HSA members on HSA cash and fees we pay to banking consultants whom we use to help secure agreements with our Depository Partners. Interest retained by HSA members is calculated on a tiered basis. The interest rates retained by HSA members can change based on a formula or upon required notice.

Interchange costs. Interchange costs are comprised of costs we incur in connection with processing payment transactions initiated by our members. Due to the substantiation requirement on FSA/HRA-linked payment card transactions, payment card costs are higher for FSA and HRA transactions than for HSA transactions. In addition to fixed per card fees, we are assessed additional transaction costs determined by the amount of the transaction.

Gross profit and gross margin

Our gross profit is our total revenue minus our total cost of revenue, and our gross margin is our gross profit expressed as a percentage of our total revenue. Our gross margin has been and will continue to be affected by a number of factors, including interest rates, the amount we charge our Network Partners, Clients, and members, the mix of our sources of revenue, how many services we deliver per account, and payment processing costs per account.

Operating expenses

Sales and marketing. Sales and marketing expenses consist primarily of personnel and related expenses for our sales and marketing staff, including sales commissions for our direct sales force, external agent/broker commission expenses, marketing expenses, depreciation, amortization, stock-based compensation, and common expense allocations.

Technology and development. Technology and development expenses include personnel and related expenses for software development and delivery, licensed software, information technology, data management, product, and security. Technology and development expenses also include software engineering services, the costs of operating our technology infrastructure, depreciation, amortization of capitalized software development costs, stock-based compensation, and common expense allocations.

General and administrative. General and administrative expenses include personnel and related expenses of, and professional fees incurred by our executive, finance, legal, internal audit, corporate development, compliance, and people departments. They also include depreciation, amortization, stock-based compensation, and common expense allocations.

Amortization of acquired intangible assets. Amortization of acquired intangible assets results primarily from intangible assets acquired in connection with business combinations. The assets include acquired customer relationships, acquired developed technology, and acquired trade names and trademarks, which we amortize over the assets' estimated useful lives, estimated to be 7-15 years, 2-5 years, and 3 years, respectively. We also acquired intangible HSA portfolios from third-party custodians. We amortize these assets over the assets’ estimated useful life of 15 years. We evaluate our acquired intangible assets for impairment annually, or at a triggering event.

Merger integration. Merger integration expenses include personnel and related expenses, including severance, professional fees, legal expenses and settlements, and facilities and technology expenses directly related to integration activities to merge operations as a result of acquisitions.

Interest expense

Interest expense consists primarily of accrued interest expense and amortization of deferred financing costs associated with our long-term debt. Interest on our revolving credit facility changes frequently due to variable interest rate terms, and as a result, our interest expense is expected to fluctuate based on changes in prevailing interest rates.

Other income, net

Other income, net, consists of interest income earned on corporate cash and other miscellaneous income and expense.

Income tax provision

We are subject to federal and state income taxes in the United States based on a January 31 fiscal year end. We use the asset and liability method to account for income taxes, under which current tax liabilities and assets are recognized for the estimated taxes payable or refundable on the tax returns for the current fiscal year. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases, net operating loss carryforwards, and tax credit carryforwards. Deferred tax assets and liabilities are measured using enacted statutory tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be realized or settled. Valuation allowances are established when necessary to reduce net deferred tax assets to the amount expected to be realized. As of January 31, 2025, we have not recorded a valuation allowance on federal deferred tax assets, but we have recorded a valuation allowance on certain state deferred tax assets. We maintain an overall net federal and state deferred tax liability on our consolidated balance sheet.

We evaluate our tax positions in accordance with Accounting Standards Codification (“ASC”) 740-10-25, Accounting for Uncertainty in Income Taxes, which prescribes a recognition threshold and measurement attribute for a tax position taken or expected to be taken in a tax return.

Results of operations

For a discussion related to results of operations for the fiscal year ended January 31, 2024 compared to the fiscal year ended January 31, 2023, refer to Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations included in our Annual Report on Form 10-K for the fiscal year ended January 31, 2024, filed with the SEC on March 22, 2024.

Revenue

The following table sets forth our revenue for the periods indicated:

(in thousands, except percentages)

Service revenue. The $22.6 million, or 5%, increase in service revenue from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to the increases in the number of HSAs and the amount of HSA investments, partially offset by lower average service fees per account.

We expect service revenue to continue to increase, primarily due to an increase in Total Accounts, partially offset by lower average service fees per account.

Custodial revenue. The $158.8 million, or 41%, increase in custodial revenue from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in average annualized yield on HSA cash from 2.49% for the fiscal year ended January 31, 2024 to 3.11% for the fiscal year ended January 31, 2025 (due to both higher market interest rates and an increase in participation in our Enhanced Rates offering from 32% of HSA cash as of January 31, 2024 to 49% as of January 31, 2025), the $2.1 billion, or 15%, increase in the average daily balance of HSA cash, as described above, and an increase in interest rates on the portion of our Client-held funds held by our Depository Partners in interest-bearing demand deposit accounts that have a floating interest rate.

Assuming the current interest rate environment continues, we expect our average annualized yield on HSA cash to further increase as our existing agreements with our Depository Partners are renewed or replaced with agreements with higher rates, resulting in higher custodial revenue. In addition, we expect an increase in the percentage of HSA cash held in our Enhanced Rates offering to continue to positively impact our average annualized yield and thus our custodial revenue. As Basic Rates contracts mature, we intend to transfer the associated HSA cash into Enhanced Rates contracts unless the HSA member affirmatively opts to remain in the Basic Rates offering.

Interchange revenue. The $18.7 million, or 12%, increase in interchange revenue from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in Total Accounts and an increase in spend per account using our payment cards.

We expect interchange revenue to continue to increase, primarily due to an increase in Total Accounts.

Total revenue. Total revenue increased by $200.2 million, or 20%, from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025, due to the increases in custodial, service, and interchange revenues, described above.

Cost of revenue

The following table sets forth our cost of revenue for the periods indicated:

(in thousands, except percentages)

Service costs. The $34.2 million, or 11%, increase in service costs from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to a $19.1 million increase in costs incurred to reimburse members impacted by outside fraud activity and increases in costs to support the increase in Total Accounts and member interactions, partially offset by efficiencies resulting from our technology investments.

For the fiscal year ending January 31, 2026, we expect service costs to decrease as a result of our technology investments in security and further operational efficiencies, partially offset by costs resulting from an increase in Total Accounts.

Custodial costs. The $7.2 million, or 22%, increase in custodial costs from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to the $2.1 billion, or 15% increase in the average daily balance of HSA cash, as described above, an increase in fees charged by our Depository Partners, and an increase in the average annualized rate of interest retained by HSA members on HSA cash, from 0.22% during the fiscal year ended January 31, 2024 to 0.23% during the fiscal year ended January 31, 2025.

On an annual basis, we expect custodial costs to increase due to an increase in the year-over-year average daily balance of HSA cash, an increase in fees charged by our Depository Partners, and an increase in the average annualized rate of interest retained by HSA members on HSA cash.

Interchange costs. The $4.2 million, or 15%, increase in interchange costs from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in Total Accounts and certain costs associated with our transition to a single card processor during the fiscal year ended January 31, 2025, partially offset by efficiencies resulting from the transition.

Total cost of revenue. For the fiscal year ending January 31, 2026, we expect that our cost of revenue will decrease in dollar amount, primarily due to a decrease in service costs. We expect our cost of revenue to decrease as a percentage of our total revenue, primarily due to an increase in custodial revenue and a decrease in service costs, partially offset by costs resulting from an increase in Total Accounts. Cost of revenue as a percentage of total revenue decreased to 35% for the fiscal year ended January 31, 2025 compared to 38% for the fiscal year ended January 31, 2024, due to total revenue increasing at a significantly higher rate (20%) than total cost of revenue (12%). Cost of revenue will continue to be affected by a number of different factors, including our ability to scale our service delivery, Network Partner implementation, and account management functions.

Operating expenses

The following table sets forth our operating expenses for the periods indicated:

(in thousands, except percentages)

Sales and marketing. The $11.5 million, or 14%, increase in sales and marketing expenses from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to an increase in personnel-related expenses.

We expect our sales and marketing expenses to increase as we continue to focus on our cross-selling and member engagement programs. On an annual basis, we expect our sales and marketing expenses to remain relatively steady as a percentage of our total revenue. However, our sales and marketing expenses may fluctuate as a percentage of our total revenue from period to period due to the seasonality of our total revenue and the timing and extent of our sales and marketing expenses.

Technology and development. The $20.7 million, or 9%, increase in technology and development expenses from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to increases in personnel-related expenses and software costs.

We expect our technology and development expenses to increase as we continue to invest in the development and security of our proprietary technology, including our ongoing modernization project described earlier. On an annual basis, we expect our technology and development expenses to remain relatively steady as a percentage of our total revenue. However, our technology and development expenses may fluctuate as a percentage of our total revenue from period to period due to the seasonality of our total revenue and the timing and extent of our technology and development expenses.

General and administrative. The $28.6 million, or 28%, increase in general and administrative expenses from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to accelerated stock-based compensation expense recognized with respect to certain performance restricted stock units granted during the current fiscal year, as described in Note 9—Stock-based compensation to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K, and increases in professional services expense.

For the fiscal year ending January 31, 2026, we expect our general and administrative expenses to decrease, primarily due to a decrease in stock-based compensation expense, partially offset by additional demands on our legal, compliance, and finance functions as we continue to grow our business. We expect our general and administrative expenses to decrease as a percentage of our total revenue. However, our general and administrative expenses may fluctuate as a percentage of our total revenue from period to period due to the seasonality of our total revenue and the timing and extent of our general and administrative expenses.

Amortization of acquired intangible assets. The $19.1 million, or 21%, increase in amortization of acquired intangible assets from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to the new intangible assets added through the BenefitWallet HSA portfolio acquisition.

On an annual basis, we expect amortization of acquired intangible assets to decrease, primarily due to a smaller carrying amount of intangible assets that have not been fully amortized.

Merger integration. The $30.1 million, or 288%, increase in merger integration expense from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to the Lease Settlement, as described in Note 6—Commitments and contingencies to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K. Other merger integration expenses during the fiscal year ended January 31, 2025 consisted of professional fees, including expenses incurred in conjunction with the migration of accounts, technology-related expenses directly related to the Further acquisition and certain ongoing merger integration expenses related to the acquisition of WageWorks, Inc. ("WageWorks").

On an annual basis, we expect merger integration expense to decrease as we complete the remaining merger integration activities.

Interest expense

The $5.2 million, or 9%, increase in interest expense from the fiscal year ended January 31, 2024 to the fiscal year ended January 31, 2025 was primarily due to a higher average principal balance and a $0.4 million increase in losses on extinguishment of debt. The increase was partially offset by a lower average interest rate on borrowings with variable interest rate terms.

On August 23, 2024, we entered into the Credit Agreement pursuant to which the Company established a new five-year senior secured revolving credit facility (the “Revolving Credit Facility”) in an aggregate principal amount of up to $1.0 billion, a portion of which was used to repay all outstanding obligations under our prior credit agreement (the "Prior Credit Agreement").

As of January 31, 2025, borrowings under our Revolving Credit Facility were $461.9 million and had a stated interest rate of 5.91%. As of January 31, 2024, borrowings under our Prior Credit Agreement were $286.9 million and had a stated interest rate of 6.69%. The increase in principal was due to $225.0 million of borrowings to pay a portion of the BenefitWallet HSA portfolio acquisition purchase price, partially offset by prepayments of $50.0 million during the fiscal year ended January 31, 2025.

The interest rate on our Revolving Credit Facility is variable and, accordingly, we may incur additional expense if interest rates increase in future periods.

Other income, net

The $1.5 million increase in other income, net, was due to an increase in interest income on corporate cash, partially offset by a decrease in other miscellaneous income, net.

Income tax provision

We recorded an income tax provision of $19.3 million in each of the fiscal years ended January 31, 2025 and 2024. Relative to the year ended January 31, 2024, we had an increase in pre-tax book income, an increase in nondeductible executive compensation, and increased expense from deferred tax rate adjustments due to state apportionment changes, which were offset by an increase in tax deductible stock-based compensation compared to GAAP stock-based compensation expense and a decrease in expense from unrecognized tax benefits.

Seasonality

Seasonal concentration of our growth combined with our recurring revenue model create seasonal variation in our results of operations. Revenue results are seasonally impacted due to ancillary service fees, timing of HSA contributions, and timing of card spend. Cost of revenue is seasonally impacted as a significant number of new and existing Network Partners bring us new HSAs and CDBs beginning in January of each year concurrent with the start of many employers’ benefit plan years. Before we realize any revenue from these new accounts, we incur costs related to implementing and supporting our new Network Partners and new accounts. These costs of services relate to activating accounts and hiring additional staff, including seasonal help to support our member support center. These expenses begin to ramp up during our third fiscal quarter, with the majority of seasonal expenses incurred in our fourth fiscal quarter.

Liquidity and capital resources

For a discussion related to liquidity and capital resources for the fiscal year ended January 31, 2024 compared to the fiscal year ended January 31, 2023, refer to Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations included in our Annual Report on Form 10-K for the fiscal year ended January 31, 2024, filed with the SEC on March 22, 2024.

Cash and cash equivalents overview

Our principal sources of liquidity are our current cash and cash equivalents balances, collections from our custodial, service, and interchange revenue activities, and availability under our Revolving Credit Facility. We rely on cash provided by operating activities to meet our short-term liquidity requirements, which primarily relate to the payment of corporate payroll and other operating costs, interest payments on our long-term debt, and capital expenditures.

As of January 31, 2025 and January 31, 2024, cash and cash equivalents were $295.9 million and $404.0 million, respectively.

Capital resources

We maintain a “shelf” registration statement on Form S-3 on file with the SEC. A shelf registration statement, which includes a base prospectus, allows us at any time to offer any combination of securities described in the prospectus in one or more offerings. Unless otherwise specified in a prospectus supplement accompanying the base prospectus, we would use the net proceeds from the sale of any securities offered pursuant to the shelf registration statement for general corporate purposes, including, but not limited to, working capital, sales and marketing activities, general and administrative matters, capital expenditures, and repayment of indebtedness, and if opportunities arise, for the acquisition of, or investment in, assets, technologies, solutions or businesses that complement our business. Pending such uses, we may invest the net proceeds in interest-bearing securities. In addition, we may conduct concurrent or other financings at any time.

On August 23, 2024, we entered into the Credit Agreement, which includes a five-year senior secured Revolving Credit Facility in an aggregate principal amount of up to $1.0 billion, a portion of which was used to refinance our Prior Credit Agreement. The Revolving Credit Facility may be used in the future for working capital and general corporate purposes, including the financing of acquisitions and other investments. For a description of the terms of the Credit Agreement, refer to Note 7—Indebtedness to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K. As of January 31, 2025, the outstanding balance under the Revolving Credit Facility was $461.9 million. We were in compliance with all covenants under the Credit Agreement as of January 31, 2025, and for the period then ended.

Use of cash

During the fiscal year ended January 31, 2025, we used $452.2 million of cash, which includes $225.0 million borrowed under our prior revolving credit facility, to pay for the BenefitWallet HSA portfolio acquisition.

In August 2024, in connection with our entry into the Credit Agreement, we repaid all outstanding obligations in the amount of $511.9 million under the Prior Credit Agreement and terminated all commitments thereunder. During the fiscal year ended January 31, 2025, we prepaid $50.0 million under the Credit Agreement.

During the fiscal year ended January 31, 2025, we used $121.5 million of cash for common stock repurchases. See Note 10—Stockholders' equity to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K for additional information related to our stock repurchase program.

Capital expenditures for the fiscal years ended January 31, 2025 and 2024 were $53.2 million and $42.8 million, respectively. We expect to continue our current level of capital expenditures during the fiscal year ending January 31, 2026 as we continue to invest in improving the architecture and functionality of our proprietary systems. Capital expenditures to improve the architecture of our proprietary systems include computer hardware, personnel and related costs for software engineering, and outsourced software engineering services.

We believe our existing cash, cash equivalents, and Revolving Credit Facility will be sufficient to meet our operating and capital expenditure requirements for at least the next 12 months. To the extent these current and anticipated future sources of liquidity are insufficient to fund our future business activities and requirements, we may need to raise additional funds through public or private equity or debt financing. In the event that additional financing is required, we may not be able to raise it on favorable terms, if at all.

The following table shows our cash flows from operating activities, investing activities, and financing activities for the stated periods:

(in thousands)

Cash flows from operating activities. Net cash provided by operating activities increased by $97.0 million, primarily due to increased cash receipts with respect to our custodial, service, and interchange revenues and a decrease in income tax payments, partially offset by an increase in cash payments with respect to operating expenses, cost of revenue, and interest on our long-term debt.

Cash flows from investing activities. Net cash used in investing activities increased by $459.4 million, primarily due to a $449.0 million increase in cash used to acquire HSA portfolios and a $10.0 million increase in cash used for purchases of software and capitalized software development costs.

Cash flows from financing activities. Net cash provided by financing activities was $57.6 million during the fiscal year ended January 31, 2025, compared to $47.0 million of net cash used in financing activities during the fiscal year ended January 31, 2024. The change was due to a $736.9 million increase in proceeds from long-term debt and a $3.0 million increase in proceeds from the exercise of common stock options, partially offset by a $511.2 million increase in cash used for principal payments and debt issuance costs associated with our long-term debt, a $121.5 million increase in cash used for repurchases of common stock, and a $2.5 million increase in net cash used in the settlement of client-held funds obligations.

Contractual obligations

See Note 6—Commitments and contingencies to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K for information about our contractual obligations.

Off-balance sheet arrangements

As of January 31, 2025, we did not have any off-balance sheet arrangements that have, or are reasonably likely to have, a current or future material effect on our consolidated financial condition, results of operations, liquidity, capital expenditures, or capital resources.

Critical accounting policies and significant management estimates

Our consolidated financial statements are prepared in accordance with GAAP. The preparation of these consolidated financial statements requires us to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues, and expenses. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable in the circumstances. In many instances, we could have reasonably used different accounting estimates, and in other instances, changes in the accounting estimates are reasonably likely to occur from period to period. Accordingly, actual results could differ significantly from the estimates made by our management. To the extent that there are material differences between these estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows will be affected.

In many cases, the accounting treatment of a particular transaction is specifically dictated by GAAP and does not require management’s judgment in its application, while in other cases, management’s judgment is required in selecting among available alternative accounting standards that allow different accounting treatment for similar transactions. We believe that there are several accounting policies that are critical to understanding our business and prospects for future performance, as these policies affect the reported amounts of revenue and other significant areas that involve management’s judgment and estimates. These significant policies and our procedures related to these policies are described in detail below.

Capitalized software development costs

We account for the costs of computer software developed or obtained for internal use in accordance with Accounting Standards Codification, or ASC, 350-40, Internal-Use Software. Costs incurred during operation and post-implementation stages are charged to expense. Costs incurred that are directly attributable to developing or obtaining software for internal use incurred in the application development stage are capitalized. Management’s judgment is required in determining the point when various projects enter the stages at which costs may be capitalized, in assessing the ongoing value of the capitalized costs and in determining the estimated useful lives over which the costs are amortized.

Valuation of goodwill and other long-lived assets

We review goodwill for impairment at least annually or more frequently if events or changes in circumstances would more likely than not reduce the fair value of our single reporting unit below its carrying value. The Company’s annual goodwill impairment test resulted in no impairment charges in any of the periods presented in the accompanying consolidated financial statements.

Long-lived assets, including property and equipment and intangible assets are reviewed for possible impairment whenever events or circumstances indicate that the carrying amount of such assets may not be recoverable. The evaluation is performed at the lowest level for which identifiable cash flows are largely independent of the cash flows of other assets and liabilities. Recoverability of these assets is measured by a comparison of the carrying amounts to the future undiscounted cash flows the assets are expected to generate from the use and eventual disposition. If such review indicates that the carrying amount of property and equipment and intangible assets is not recoverable, the carrying amount of such assets is reduced to fair value. We have not recorded any significant impairment charges during the years presented.

Recent accounting pronouncements

See Note 1—Summary of business and significant accounting policies within the financial statements included in this Form 10-K for further discussion.

Market risk

Concentration of market risk. We derive a substantial portion of our revenue from providing services to tax-advantaged healthcare account holders. A significant downturn in this market or changes in state and/or federal laws impacting the preferential tax treatment of healthcare accounts such as HSAs could have a material adverse effect on our results of operations. During the fiscal years ended January 31, 2025, 2024, and 2023, no customer accounted for greater than 10% of our total revenue. We monitor market and regulatory changes regularly and make adjustments to our business if necessary.

Inflation. Inflationary factors may adversely affect our operating results. Although we do not believe that inflation has had a material impact on our financial position or results of operations to date, a high rate of inflation in the future may have an adverse effect on our ability to maintain current levels of expenses as a percentage of revenue if our revenue does not correspondingly increase with inflation.

Concentration of credit risk

Financial instruments, which potentially subject us to concentrations of credit risk, consist primarily of cash and cash equivalents. We maintain our cash and cash equivalents in bank and other depository accounts, which frequently exceed federally insured limits. Our cash and cash equivalents as of January 31, 2025 and 2024 were $295.9 million and $404.0 million, respectively, the vast majority of which was not covered by federal depository insurance. We have not experienced any material losses in such accounts. Our accounts receivable balance as of January 31, 2025 and 2024 was $118.0 million and $104.9 million, respectively. We have not experienced any significant write-offs to our accounts receivable and believe that we are not exposed to significant credit risk with respect to our accounts receivable. We continue to monitor our credit risk and place our cash and cash equivalents with reputable financial institutions.

Interest rate risk

HSA Assets and Client-held funds. HSA Assets consist of custodial HSA funds we hold in custody on behalf of our members. As of January 31, 2025 and 2024, we held in custody HSA Assets of $32.1 billion and $25.2 billion, respectively. As a non-bank custodian, we contract with our Depository Partners and insurance company partners to hold HSA cash on behalf of our members, and we earn a significant portion of our total revenue from interest paid to us by these partners. HSA cash held by our insurance company partners is held in group annuity contracts or similar arrangements. The lengths of our agreements with Depository Partners typically range from three to five years and have either fixed or variable interest rates.

As HSA Assets increase and existing contracts with Depository Partners expire, we seek to enter into new contracts with Depository Partners and insurance company partners, the terms of which are impacted by the then-prevailing interest rate environment. We believe that increased participation in our Enhanced Rates offering, diversification of Depository Partners and insurance company partners, and varied contract terms, substantially reduces our exposure to short-term fluctuations in prevailing interest rates and mitigates the short-term impact of a sustained increase or decline in prevailing interest rates on our custodial revenue.

A sustained decline in prevailing interest rates may negatively affect our business by reducing the size of the interest rate yield, or yield, available to us and thus the amount of the custodial revenue we can realize. Conversely, a sustained increase in prevailing interest rates can increase our yield. An increase in our yield would increase our custodial revenue as a percentage of total revenue. In addition, if our yield increases, we expect the spread to also increase between the interest offered to us by our Depository Partners and insurance company partners and the interest retained by our members, thus increasing our profitability. However, we may be required to increase the interest retained by our members in a rising prevailing interest rate environment. Changes in prevailing interest rates are driven by macroeconomic trends and government policies over which we have no control.

Client-held funds are interest earning deposits from which we generate custodial revenue. As of January 31, 2025 and 2024, we held Client-held funds of $896 million and $842 million, respectively. These deposits are amounts remitted by Clients and held by us on their behalf to pre-fund and facilitate administration of our other CDBs. These deposits are held with Depository Partners. We deposit the Client-held funds with our Depository Partners in interest-bearing demand deposit accounts that have a floating interest rate and no set term or duration. A sustained decline in prevailing interest rates may negatively affect our business by reducing the size of the yield available to us and thus the amount of the custodial revenue we can realize from Client-held funds. Conversely, a sustained increase in prevailing interest rates may increase our yield. Changes in prevailing interest rates are driven by macroeconomic trends and government policies over which we have no control.

Cash and cash equivalents. We consider all highly liquid investments purchased with an original maturity of three months or less to be unrestricted cash equivalents. Our unrestricted cash and cash equivalents are held in institutions in the U.S. and include deposits in a money market account that is unrestricted as to withdrawal or use. As of January 31, 2025 and 2024, we had unrestricted cash and cash equivalents of $295.9 million and $404.0 million, respectively. Due to the short-term nature of these instruments, we believe that we do not have any material exposure to changes in the fair value of our cash and cash equivalents as a result of changes in interest rates.

Long-term debt. As of January 31, 2025 and 2024, we had $461.9 million and $286.9 million, respectively, outstanding under our Revolving Credit Facility and our Prior Credit Facilities, respectively. The stated interest rate on our Revolving Credit Facility is variable and was 5.91% as of January 31, 2025. Our overall interest rate sensitivity under the Revolving Credit Facility is primarily influenced by any amounts borrowed and prevailing interest rates. For example, a one percent increase in the interest rate on the amount outstanding under our Revolving Credit Facility as of January 31, 2025 would result in approximately $4.7 million of additional interest expense over the next 12 months. The interest rate on our $600 million of unsecured Senior Notes due 2029 is fixed at 4.50%.

Evaluation of disclosure controls and procedures

Management, with the participation of the Company’s Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), has evaluated the effectiveness of the Company’s disclosure controls and procedures as of January 31, 2025, the end of the period covered by this Annual Report on Form 10-K. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on such evaluation, our CEO and our CFO have concluded that as of January 31, 2025, the Company's disclosure controls and procedures were effective at the reasonable assurance level.

Management's report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. The Company’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of January 31, 2025 based on criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in *Internal Control - Integrated Framework (2013) (“*COSO Framework”).

Based on that assessment, management has concluded that, as of January 31, 2025, the Company’s internal control over financial reporting was effective.

The Company’s independent registered public accounting firm, PricewaterhouseCoopers LLP, has audited the effectiveness of the Company’s internal control over financial reporting as of January 31, 2025. Its report appears in Part II, Item 8 of this Annual Report on Form 10-K.

Changes in Internal Control Over Financial Reporting

There were no changes in the Company’s internal control over financial reporting identified in connection with the evaluation required by Rules 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2025 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.