HealthEquity, IncHQY

Digital transformation and innovation · Artificial intelligence and automation

The expanding use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase or create new operational and competitive risks. We utilize AI to streamline administrative processes and improve the experience for our members. However, the development and deployment of such technologies also pose significant risks related to the use of personal information, flaws in our models or training datasets that may result in biased or inaccurate results, and potential infringement of third-party intellectual property rights.

Information management · Technology vendor dependence

We rely on certain cloud-based software licensed from third parties to run our business. This software may experience outages, may not continue to be available to us on commercially reasonable terms and any loss of the right to use any of this software could result in delays in producing our financial statements, risks to our security environment, or the provisioning of our products and services.

Cybersecurity and data protection · Insider threats and access controls

Despite our security measures, our information technology and infrastructure are vulnerable to cybersecurity threats, including attacks by hackers, AI-powered threats, human error, insider threats, and other malfeasance or outages.

Digital transformation and innovation · Technology obsolescence and evolution

The market for administering HSAs and other CDBs is characterized by rapid technological change, new product and service introductions, evolving industry standards, changing customer needs, existing competition, price sensitivity, and the entrance of non-traditional competitors. In order to remain competitive, we are continually involved in a number of projects to develop new services or compete with these new market entrants.

Cybersecurity and data protection · Data breaches and cyber attacks

As one of the largest providers of HSAs and other CDBs, our proprietary technology platforms enable the exchange of, and access to, sensitive information. As a result, we are frequently the target of cyber attacks, including ransomware attacks. Security breaches, including a major breach of our network security and systems, could result in serious negative consequences for our business, including the loss of sensitive information, theft or loss of actual funds, litigation, indemnity obligations to our Clients, fines, penalties, regulatory scrutiny, and other liabilities.

Digital transformation and innovation · Digital transformation and modernization

We are currently investing in a modernization of our proprietary technology platforms to support new opportunities and enhance security, privacy, and platform infrastructure, while maintaining existing applications, features, and services. If we are unable to do so on a timely basis or if we are unable to implement this modernization without disruption to our existing applications, features, and services, we may lose potential and existing Clients and Network Partners.

Technology infrastructure · Technology systems and infrastructure failure

Disruptions of service at our facilities, our servers, our third-party data centers, or our cloud service providers have interrupted and delayed our customers' access to our products and services. For example, an unplanned storage service outage in 2024 led to multiple critical services for our members being unavailable and degraded.

Industry regulation · Licensing and permits

If we should fail to comply with the Treasury Regulations' non-bank custodian requirements, including the net worth requirements, such failure would materially and adversely affect our ability to maintain our current custodial accounts and grow by adding additional custodial accounts, and it could result in the institution of procedures for the revocation of our authorization to operate as a non-bank custodian.

Legal and litigation · Litigation and legal proceedings

As a result of the incident, we are now subject to a consolidated putative class action lawsuits seeking unspecified damages, and we are subject to regulatory inquiries related to the incident, which may lead to fines or other enforcement by these regulators.

Human capital and workforce · Talent acquisition and retention

Our success depends, in part, on the skills, working relationships and continued services of our executive team and other key personnel. The departure of key personnel could adversely affect the conduct of our business. In such event, we would be required to hire other personnel to manage and operate our business, and there can be no assurance that we would be able to employ a suitable replacement for the departing individual.

Supply chain and procurement · Supplier operation and dependance

If our Network Partners choose to partner with other providers of, or otherwise reduce offering or cease to offer, our products and services, our business could be materially and adversely affected. Our business increasingly depends on our Network Partners' willingness to partner with us to offer their customers and/or employees our products and services.

Market and investment · Asset valuation and impairment

Our consolidated balance sheet includes significant intangible assets, including approximately $1.65 billion in goodwill and $1.10 billion in intangible assets, together representing approximately 81% of our total assets as of January 31, 2026. Any future determination that these assets are carried at greater than their fair value could result in substantial non-cash impairment charges, which could significantly impact our reported operating results.

Credit and liquidity · Liquidity and cash flow constraints

Certain of our arrangements with our insurance company partners and Depository Partners require that we keep a minimum amount of HSA cash with such partner. If we fail to comply with those minimum HSA cash requirements, including as a result of withdrawals by our members, we may be subject to penalties payable to our partners or a reduction in the interest paid to us under such arrangements.

Market position and competition · Competitive pressure and market share loss

The market for our products and services is highly competitive. Our direct HSA competitors are well-known retail investment companies, such as Fidelity Investments, HSA custodians and administrators that include state or federally chartered banks, such as Webster Bank and Optum Bank, insurance companies, and non-bank custodians approved by the U.S. Treasury.

Market position and competition · Disruptive competitors and new market entrants

Well-known retail mutual fund companies, such as Fidelity Investments, have entered the HSA and CDB business and gained significant market share. Our market share could decline if Fidelity Investments and other mutual fund companies continue expanding their presence in the market.

Strategic execution · Merger acquisition and divestiture risks

Our acquisition and investment strategies may not be successful. As a key part of our strategy, we seek to acquire or invest in assets, businesses, products, or technologies that we believe would complement or expand our products and services. There is no assurance that we will be successful in consummating such acquisitions or investments, or even if consummated, realize the anticipated benefits of these or any future acquisitions or investments.

Corporate governance · Internal controls and risk management

Failure to maintain effective internal control over financial reporting could have a material adverse effect on our reputation, results of operations, and financial condition. Any failure to execute on our internal controls and continue to maintain effective internal controls could result in losses from fraud or error, harm our reputation, result in regulatory fines, penalties, or investigations.

Stakeholder relations · Customer satisfaction and loyalty

Any failure to offer high-quality member, Client, and Network Partner support services could adversely affect our relationships with our members, Clients, and Network Partners and our operating results. Our members, Clients, and Network Partners depend on our support and education organizations to educate them about, and resolve technical issues relating to, our products and services.

Geopolitical and trade · Regulatory and policy uncertainty

The healthcare regulatory and political framework is uncertain and evolving, and we cannot predict the effect that further healthcare reform and other changes in government programs may have on our business, financial condition, or results of operations. Proposals to implement a single payer or 'Medicare for all' system in the U.S. or in individual states, if adopted, could have a material adverse effect on our business.

Economic and market conditions · Economic recession and downturns

Substantially all of our revenue is derived from healthcare-related saving and spending by consumers, which could be affected by changes affecting the broader healthcare industry, including decreased spending in the industry overall. General reductions in expenditures by healthcare industry participants could result from adverse changes in general business or economic conditions affecting healthcare industry participants.