Item 1A. Risk Fa ctors

RISK FACTORS

You should carefully consider the risks described below together with the other information set forth in this report, which could materially affect our business, financial condition and future results. The risks described below are not the only risks facing our company. Risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect our business, financial condition and operating results.   If any of the following risks is realized, our business, financial condition, results of operations and prospects could be materially and adversely affected. In that event, the trading price of our common stock could decline.

Our business is dependent upon the availability of tax-advantaged Consumer-Directed Benefits to employers and employees and any diminution in, elimination of, or change in the availability of these benefits would materially adversely affect our results of operations, financial condition, business and prospects.

Our business fundamentally depends on employer and employee demand for tax-advantaged Consumer-Directed Benefits, or CDBs. Any diminution in or elimination of the availability of CDBs for employees would materially adversely affect our results of operations, financial condition, business and prospects. In addition, incentives for employers to offer CDBs may also be reduced or eliminated by changes in laws that result in employers no longer realizing financial gain from the implementation of these benefits. If employers cease to offer CDB programs or reduce the number of programs they offer to their employees, our results of operations, financial condition, business and prospects would also be materially adversely affected. We are not aware of any reliable statistics on the growth of CDB programs and cannot assure you that participation in CDB programs will grow.

In addition, if the payroll tax savings employers currently realize from their employees’ utilization of CDBs become reduced or unavailable, employers may be less inclined to offer these programs to their employees. If the tax savings currently realized by employee participants by utilizing CDBs were reduced or unavailable, we expect employees would correspondingly reduce or eliminate their participation in such CDB plans. Any such reduction in employer or employee incentives would materially adversely affect our results of operations, financial condition, business and prospects.

Future portfolio purchases and acquisitions are an important aspect of our growth strategy, and any failure to successfully identify, acquire or integrate acquisitions or additional portfolio targets could materially adversely affect our ability to grow our business. In addition, costs of integrating acquisitions and portfolio purchases may adversely affect our results of operations in the short term.

Our recent growth has been, and our future growth will be, substantially dependent on our ability to continue to make and integrate acquisitions and complementary portfolio purchases to expand our employer client base and service offerings. Since 2007, we have completed seven portfolio purchases and two acquisitions. Our successful integration of these portfolio purchases and acquisitions into our operations on a cost-effective basis is critical to our future financial performance. While we believe that there are numerous potential portfolio purchases and acquisitions that would add to our employer client base and service offerings, we cannot assure you that we will be able to successfully make a sufficient number of such portfolio purchases or acquisitions in a timely and effective manner in order to support our growth objectives. In addition, the process of integrating portfolio purchases and acquisitions may create unforeseen difficulties and expenditures. We face various risks in making portfolio purchases and any acquisitions, including:

Portfolio purchases and acquisitions may have a short-term material adverse impact on our results of operations, including a potential material adverse impact on our cost of revenues, as we seek to migrate acquired employer clients to our proprietary technology platforms, typically over the succeeding 12 to 24 months, in order to achieve additional operating efficiencies. Additionally, from time to time, we may incur material costs and charges related to consolidating our operations following our portfolio purchases and acquisitions.

If we are unable to retain and expand our employer client base, establish new channel partnerships and exchange relationships, our results of operations, financial condition, business and prospects would be materially adversely affected.

Most of our revenue is derived from the long term, multi-year agreements that we typically enter into with our employer clients. The initial subscription period is typically three years for our enterprise clients and one to three years for our SMB and mid-market clients. We also derive revenue from our channel partner agreements with Aflac Incorporated, or Aflac, and Ceridian. We anticipate in the future establishing new channel partnerships with other companies. Our employer clients, however, have no obligation to renew their agreements with us after the initial term and we cannot assure you that our employer clients will continue to renew their agreements at the same rate, if at all. In addition, employer clients transitioning to us from a channel partner have no obligation to

enter into agreements with us and, if they do, there is no guarantee that they will renew their agreements with us after the initial transition period. In addition, our exchange relationships contribute development revenue as well as monthly subscriber fees to our revenue and there is no guarantee that we will be able to retain and maintain these relationships in their current form or add additional exchange partners.

Moreover, most of our employer clients have the right to cancel their agreements for convenience, subject to certain notice requirements. While few employer clients have terminated their agreements with us for convenience, some of our employer clients have elected not to renew their agreements with us. Our employer clients’ renewal rates may decline or fluctuate as a result of a number of factors, including the prices of competing products or services or reductions in our employer clients’ spending levels.

Another important aspect of our growth strategy depends upon our ability to maintain our existing channel partner relationships and exchange relationships and develop new relationships. No assurance can be given that new channel partners or exchange opportunities will be found, that any such new relationships will be successful when they are in place, or that business with our current channel partners or exchange opportunities will increase at the level necessary to support our growth objectives. If our employer clients do not renew their agreements with us, and we are unable to attract new employer clients, channel or exchange partners, our revenue may decline and our results of operations, financial condition, business and prospects may be materially adversely affected.

The market for our services and our business may not grow if our marketing efforts do not successfully raise awareness among employers and employees about the advantages of adopting and participating in CDB programs.

Our revenue model is substantially based on the number of employee participants enrolled in the CDB programs that we administer. We devote significant resources to educating both employers and their employees on the potential cost savings available to them from utilizing CDB programs. We have created various marketing, educational and awareness tools to inform employers about the benefits of offering CDB programs to their employees and how our services allow them to offer these benefits in an efficient and cost effective manner. We also provide marketing information to employees that informs them about the potential tax savings they can achieve by utilizing CDB programs to pay for their healthcare, commuter and other benefit needs. However, if more employers and employees do not become aware of or understand these potential cost savings and choose to adopt CDB programs, our results of operations, financial condition, business and prospects may be materially adversely affected.

In addition, there is no guarantee that the market for our services will grow as we expect. For example, the value of our services is directly related to the complexity of administering CDB programs and government action that significantly reduces or simplifies these requirements could reduce demand or pricing for our services. Further, employees may not participate in CDB programs  because they have insufficient funds to set aside into such programs, find the rules regarding the use of such programs too complex, or otherwise. If the market for our services declines or develops more slowly than we expect, or the number of employer clients that select us to provide CDB programs to their employee participants declines or fails to increase as we expect, our results of operations, financial condition, business and prospects could be materially adversely affected.

Our business and prospects may be materially adversely affected if we are unable to cross-sell our products and services.

A significant component of our growth strategy is the increased cross-selling of products and services to current and future employer clients. In particular, many of our employer clients use only one of our products so we expect our ability to cross-sell our commuter programs to our healthcare program clients and our healthcare programs to our commuter employer clients to be an important part of this strategy. We may not be successful in cross-selling our products and services if our employer clients find our additional products and services to be unnecessary or unattractive. Any failure to sell additional products and services to current and future clients could materially adversely affect our results of operations, financial condition, business and prospects.

Failure to ensure and protect the confidentiality and security of participant data could lead to legal liability, adversely affect our reputation and have a material adverse effect on our results of operations, business or financial condition.

We must collect, store and use employee participants’ confidential information and transmit that data to third parties, to provide our services. For example, we collect names, addresses, social security numbers and other personally identifiable information from employee participants. In addition, we facilitate the issuance and funding of prepaid debit cards and, in some cases, collect bank routing information, account numbers and personal credit card information for purposes of funding an account or issuing a reimbursement. We have invested significantly in preserving the security of this data.

In addition, we utilize third-party platforms and outsource customer support center services and claims processing services to third-party service providers to whom we transmit certain confidential information of our employee participants. We have security measures in place with each of these service providers to help protect this confidential information, including written agreements that outline how protected health information will be handled and shared. However, there are   no assurances that these measures, or any additional security measures that our service providers may have in place, will be sufficient to protect this outsourced confidential information from unauthorized security breaches.

We cannot assure you that, despite the implementation of these security measures, we will not be subject to a security incident or other data breach or that this data will not be compromised. We may be required to expend significant capital and other resources to protect against security breaches or to alleviate problems caused by security breaches, or to pay penalties as a result of such breaches. Despite our implementation of security measures, techniques used to obtain unauthorized access or to sabotage systems change frequently. As a result, we may be unable to anticipate these techniques or implement adequate preventative measures to protect this data. In addition, security breaches can also occur as a result of non-technical issues, including intentional or inadvertent breaches by our employees or service providers or by other persons or entities with whom we have commercial relationships. Any compromise or perceived compromise of our security could damage our reputation with our clients, brokers and channel partners, and could subject us to significant liability, as well as regulatory action, including financial penalties, which would materially adversely affect our brand, results of operations, financial condition, business and prospects.

We have incurred, and expect to continue to incur, significant costs to protect against and respond to security breaches. We may incur significant additional costs in the future to address problems caused by any actual or perceived security breaches.

Breaches of our security measures or those of our third-party service providers or security incidents could result in unauthorized access to our sites, networks and systems; unauthorized access to, misuse or misappropriation of employer client or employee participants’ information, including personally identifiable information, or other confidential or proprietary information of ourselves or third parties; viruses, worms, spyware or other malware being served from our sites, networks or systems; deletion or modification of content or the display of unauthorized content on our sites; interruption, disruption or malfunction of operations; costs relating to notification of individuals, or other forms of breach remediation; deployment of additional personnel and protection technologies; response to governmental investigations and media inquiries and coverage; engagement of third-party experts and consultants; litigation, regulatory investigations, prosecutions, and other actions, and other potential liabilities. If any of these events occurs, or is believed to occur, our reputation and brand could be damaged, our business may suffer, we could be required to expend significant capital and other resources to alleviate problems caused by such actual or perceived breaches, we could be exposed to a risk of loss, litigation or regulatory action and possible liability, and our ability to operate our business, including our ability to provide access, usage or maintenance and support services to our customers, may be impaired. If current or prospective employer clients or employee participants believe that our systems and solutions do not provide adequate security for the storage of personal or other sensitive information or its transmission over the Internet, our business and our financial results could be harmed. Additionally, actual, potential or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants.

Although we maintain privacy, data breach and network security liability insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Any actual or perceived compromise or breach of our security measures, or those of our service providers, or any unauthorized access to, misuse or misappropriation of consumer information or other confidential business information, could violate applicable laws and regulations, contractual obligations or other legal obligations and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, any of which could have an material adverse effect on our business, financial condition and operating results.

Our business is subject to a variety of laws and regulations, including those regarding privacy, data protection and information security, and our customers, channel partners and service providers are subject to regulations related to the handling and transfer of certain types of sensitive and confidential information. Any failure of our infrastructure, our platform, third-party platforms that we utilize, or our solutions to enable us or our customers, channel partners and service providers to comply with applicable laws and regulations would harm our business, financial condition and operating results.

As part of our business, we collect employee participants’ personal data for the sole purpose of processing their benefits. Our services and solutions are subject to privacy- and data protection-related laws and regulations that impose obligations in connection with the collection, processing and use of personal data, financial data, health data or other similar data. Among other things, we have access to, and our employer clients and employee participants are able to use our solutions to handle and transfer, personally identifiable information and other data of our current and prospective employee participants and others. The U.S. federal and various state and other jurisdictional governments have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of personally identifiable information and other data, and the Federal Trade Commission and numerous state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of data, and to the security measures applied to such data. In addition, we may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy- or data protection-related organizations that require compliance with their rules pertaining to privacy and data protection. We are also bound by contractual obligations relating to our collection, use and disclosure of personal, financial and other data. Although we are comply with applicable laws, regulations, industry standards, contractual obligations and other legal obligations that apply to us, these are constantly evolving and may be modified, may be interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations or our practices. 

In addition, various federal, state and other legislative or regulatory bodies have in place and may enact new or additional laws and regulations mandating certain disclosures, including disclosures of personally identifiable information, to domestic enforcement bodies, which could adversely impact our business, our brand or our reputation with employer clients and employee participants. Despite our efforts to protect customer data, perceptions that the privacy of personal information is not satisfactorily protected in connection with our products or services could inhibit sales of our products or services, could limit adoption of our services by consumers, businesses, and government entities, and could expose us to claims or litigation. Additional privacy- or data security-related measures we may take to address such customer concerns, constraints on our flexibility to determine how to respond to customer expectations or governmental rules or actions, or costs associated with compliance with law enforcement or other regulatory authority demands or requests may adversely affect our business and operating results.

Any failure or perceived failure by us to comply with applicable laws, regulations, policies, industry standards, contractual obligations or other legal obligations relating to privacy or data security, or any security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other customer data may result in governmental or regulatory investigations, inquiries, enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity and could cause our employer clients, employee participants, and others to lose trust in us, which could have an adverse effect on our reputation, business, financial condition and results of operations.

Our services and solutions are subject to numerous laws and regulations related to the privacy and security of personal health information, including those promulgated pursuant to HIPAA, as well as HITECH, which was enacted as part of the American Recovery and Reinvestment Act of 2009, which require the implementation of administrative, physical and technological safeguards to ensure the confidentiality and integrity of individually identifiable health information in electronic form. Further, our services and solutions are subject to Payment Card Industry, or PCI, data security standards that impose requirements regarding the storage and processing of payment card information. If we cannot comply with, or if we incur a violation of, any of these obligations, we could incur significant liability or our growth could be adversely impacted, either of which could have an adverse effect on our reputation, business, financial condition and operating results.

We expect that there will continue to be new proposed laws, regulations, industry standards, contractual obligations and other obligations concerning privacy, data protection and information security and we cannot yet determine the impact of such future laws, regulations, standards and obligations may have on our business. Future laws, regulations, standards and other obligations, or changed interpretations of the foregoing, could, for example, impair our ability to collect, use or store information that we utilize to provide our services, thereby impairing our ability to maintain and grow our total customer base and increase revenues. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, contractual obligations and other obligations may impact our business and practices. We may be required to expend significant resources to modify our solutions and otherwise adapt to these changes, which we may be unable to do on commercially reasonable terms or at all, and our ability to develop new solutions and features could be limited. These developments could harm our business, financial condition and results of operations.

Any such new laws, regulations, industry standards, or other legal obligations or any changed interpretation of existing laws, regulations, industry standards, or other obligations may require us to incur additional costs and restrict our business operations. If our privacy or data security measures fail to comply with current or future laws, regulations, policies, legal obligations or industry standards, or any changed interpretations of the foregoing, we may be subject to litigation, regulatory investigations, enforcement actions, inquiries, prosecutions, fines or other liabilities, as well as negative publicity and a potential loss of business. Moreover, if future laws, regulations, industry standards, or other legal obligations, or any changed interpretations of the foregoing, limit the ability of our customers, channel partners or service providers to use and share personally identifiable information or other data or our ability to store, process and share personally identifiable information or other data, demand for our solutions could decrease, our costs could increase and our business, financial condition and operating results could be harmed.

A breach of our IT security, loss of customer data or system disruption could have a material adverse effect on our results of operations, business or financial condition and reputation.  

Our business is dependent on our transaction, financial, accounting and other data processing systems, as well as instances of third-party service provider systems that we use to provide our services. We rely on these systems to process, on a daily basis, a large number of complicated transactions. Any security breach in our business processes and/or systems, or those third-party systems that we use, has the potential to impact our customer information and our financial reporting capabilities which could result in the potential loss of business and our ability to accurately report information. If any of these systems fail to operate properly or become disabled even for a brief period of time, we could potentially lose control of customer data and we could suffer financial loss, a disruption of our businesses, liability to clients, regulatory intervention or damage to our reputation. In addition, any issue of data privacy as it relates to unauthorized access to or loss of employer client and/or employee participant information could result in the potential loss of business, damage to our market reputation, litigation and regulatory investigation and penalties. Our continued investment in the security of our IT systems, continued efforts to improve the controls within our IT systems and those of any service providers that we use to provide our services, business processes improvements, and the enhancements to our culture of information security may not successfully prevent attempts to breach our security or unauthorized access to confidential, sensitive or proprietary information.

In addition, we depend on information technology networks and systems to collect, process, transmit and store electronic information and to communicate among our locations and with our channel partners, service providers, employer clients and employee participants. Security breaches could lead to shutdowns or disruptions of our systems and potential unauthorized disclosure of confidential information. We also are required at times to manage, utilize and store sensitive or confidential employer client and employee participant data, as well as our own employee data in the regular course of business. As a result, we are subject to numerous laws and regulations designed to protect this information, including various U.S. federal and state laws governing the protection of health or other individually identifiable information, all of which are further described in Part I, Item 1, “ Business- Government Regulation ” of this Annual Report on Form 10-K. If any person, including any of our personnel, fails to comply with, disregards or intentionally breaches our established controls with respect to such data or otherwise mismanages or misappropriates that data, we could be subject to monetary damages, fines or criminal prosecution. Unauthorized disclosure of sensitive or confidential data, whether through systems failure, accident, employee negligence, fraud or misappropriation, could damage our reputation and cause us to lose customers. Similarly, unauthorized access to or through our information systems or those we develop or utilize in connection with our provision of services, whether by our personnel or third parties, could result in significant additional expenses (including expenses relating to notification of data security breaches and costs of credit monitoring services), negative publicity, legal liability and damage to our reputation, as well as require substantial resources and effort of management, thereby diverting management’s focus and resources from business operations.

We may be unable to compete effectively against our current and future competitors.

The market for our products and services is highly competitive, rapidly evolving and fragmented. We have numerous competitors, including health insurance carriers, human resources consultants and outsourcers, payroll providers, national CDB specialists, regional third party administrators and commercial banks. Many of our competitors, including health insurance carriers, have longer operating histories and significantly greater financial, technical, marketing and other resources than we have. As a result, some of these competitors may be in a position to devote greater resources to the development, promotion, sale and support of their products and services.

In addition, if one or more of our competitors were to merge or partner with another of our competitors, the change in the competitive landscape could materially adversely affect our ability to compete effectively. Our competitors may also establish or strengthen cooperative relationships with our current or future strategic brokers, insurance carriers, payroll services companies, private exchanges, third-party advisors or other parties with which we have relationships, thereby limiting our ability to promote our CDB programs with these parties and limiting the number of brokers available to sell or market our programs. If we are unable to compete effectively with our competitors for any of the foregoing reasons, our results of operations, financial condition, business and prospects could be materially adversely affected.

Changes in healthcare, security and privacy laws and other regulations applicable to our business may constrain our ability to offer our products and services.

Changes in healthcare or other laws and regulations applicable to our business may occur that could increase our compliance and other costs of doing business, require significant systems enhancement, or render our products or services less profitable or obsolete, any of which could have a material adverse effect on our results of operations.

The PPACA signed into law   on March 23, 2010 and related regulations or regulatory actions could adversely affect our ability to offer certain of our CDBs in the manner that we do today or may make CDBs less attractive to some employers. For example, any new laws that increase reporting and compliance burdens on employers may make them less likely to offer CDBs to their employees and instead offer employees benefit coverage through public exchanges. In addition, it is unclear whether the “Cadillac Tax”, now delayed until 2020, will be modified so that employee contributions to FSAs and HSAs are excluded from the calculation or if the entire tax will be repealed. If employers are less incentivized to offer our CDB programs to employees because of the Cadillac Tax increased regulatory burdens, costs or otherwise, our results of operations and financial condition could be materially adversely affected.

In addition, the numerous federal and state laws and regulations related to the privacy and security of personal health information, in particular those promulgated pursuant to HIPAA require the implementation of administrative, physical and technological safeguards to ensure the confidentiality and integrity of individually identifiable health information in electronic form. We are required to enter into written agreements with all of our employer clients known as Business Associate Agreements. Pursuant to these agreements, and as our employer client’s “Business Associate” thereunder, we are required to safeguard all individually identifiable health information of their participating employees and are restricted in how we use and disclose such information. These agreements also contain data security breach notification requirements which, in some circumstances, may be more stringent than HIPAA requirements. As we are unable to predict what changes to HIPAA or other privacy and security laws or regulations might be made in the future, we can’t be certain how those changes could affect our business or the costs of compliance.

We plan to extend and expand our products and services and introduce new products and services, and we may not accurately estimate the impact of developing and introducing these products and services on our business.

We intend to continue to invest in technology and development to create new and enhanced products and services to offer our employer clients and their participating employees. Scalability of our platform remains an on-going focus as our platform volume increases. We continue to make investments in technology upgrades to ensure stability and performance of our applications for our clients and participants.  Despite quality testing of technology prior to use, it may contain errors that impact its function and performance and this may result in negative consequences. We have limited experience in these areas and so we may not be able to anticipate or manage new risks and obligations or legal, compliance or other requirements that may arise. The anticipated benefits of such new and improved products and services may not outweigh the costs and resources associated with their development.

Our ability to attract and retain new employer clients and increase revenue from existing employer clients will depend in large part on our ability to enhance and improve our existing products and services and to introduce new products and services. The success of any enhancement or new product or service depends on several factors, including the timely completion, introduction and market acceptance of the enhancement or new product or service. Any new product or service we develop or acquire may not be introduced in a timely or cost-effective manner and may not achieve the broad market acceptance necessary to generate significant revenue. If we are unable to successfully develop or acquire new products or services or enhance our existing products or services to meet client requirements, our results of operations, financial condition, business or prospects may be materially adversely affected.

If we fail to manage future growth effectively, we may not be able to market and sell our products and services successfully.

We have expanded our operations significantly in recent years and anticipate that further expansion will be required in order for us to grow our business. If we do not effectively manage our growth, the quality of our services could suffer, which could materially adversely affect our results of operations, financial condition, business and prospects, and damage our brand and reputation among existing and prospective clients. In order to manage our future growth, we will need to hire, integrate and retain highly skilled and motivated employees. We will also be required to continue to improve our existing systems for operational and financial information management, including our reporting systems, procedures and controls and regulatory compliance processes. These improvements may require significant capital expenditures and will place increasing demands on our management. We may not be successful in managing or expanding our operations, or in maintaining adequate operating and financial information systems and controls. If we are not successful in implementing improvements in these areas, our results of operations, financial condition, business and prospects would be materially adversely affected.

General economic and other conditions may adversely affect trends in employment and hiring patterns, which could result in lower employee participation in CDB programs, which would materially adversely affect our results of operations, financial condition, business and prospects.

Our revenue is attributable to the number of employee participants at each of our employer clients, which in turn is influenced by the employment and hiring patterns of our employer clients. To the extent our employer clients freeze or reduce their headcount or wages paid because of general economic or other conditions, demand for our programs may decrease, which could materially adversely affect our results of operations, financial condition, business and prospects.

Failure to effectively develop and expand our direct and indirect sales channels may materially adversely affect our results of operations, financial condition, business and prospects and reduce our growth.

We will need to continue to expand our sales and marketing infrastructure in order to grow our employer client base and our business. We rely on our enterprise sales force to target new Fortune 1000 client accounts and sell into the private exchanges, as well as to cross-sell additional products and services to our existing enterprise clients. Effectively training our sales personnel requires significant time, expense and attention. In addition, we utilize various channel brokers, including insurance agents, benefits consultants, regional and national insurance carriers, health plans, payroll companies, banks and regional third party administrators, to sell and market our programs to employers. If we are unable to develop and expand our direct sales team, our indirect sales channels, or become a partner to more private exchanges, our ability to attract new employer clients may be negatively impacted and our growth opportunities will be reduced, each of which would materially adversely affect our results of operations, financial condition, business and prospects.

If our efforts to develop and expand our direct and indirect sales channels do not generate a corresponding increase in revenue, our business may be materially adversely affected. In particular, if we are unable to effectively train our sales personnel or if our direct sales personnel are unable to achieve expected productivity levels in a reasonable period of time, we may not be able to increase our revenue and grow our business.

Long sales cycles make the timing of our long-term revenues difficult to predict.

Our average sales cycle ranges from approximately two months for small opportunities to over a year for large and significant new indirect business. Factors that may influence the length of our sales cycle include:

If we are unable to close an expected significant transaction with one or more of these potential clients in the anticipated period, our operating results for that period, and for any future periods in which revenue from such transaction would otherwise have been recognized, would be harmed.

Our business and operational results are subject to seasonality as a result of open enrollment for CDB programs and decreased use of commuter program offerings during typical vacation months.

The number of accounts that generate revenue is typically greatest during our first calendar quarter. This is primarily due to two factors. First, new employer clients and their employee participants typically begin service on January 1. Second, during the first calendar quarter, we are also servicing the end of plan year activity for existing clients, including assisting our clients with initiating the deduction of healthcare premiums on a tax deferred basis, and employee participants who do not continue participation into the next plan year.

Generally, in comparison to other quarters, our revenue is highest in the first quarter and lowest in the second and third quarters. Thereafter, our revenue generally grows gradually in the fourth quarter as our employer clients hire new employees who then elect to participate in our programs, thereby increasing our monthly minimum billing amount. The minimum billing amount is not, however, generally subject to downward revision when employees leave their employers because we continue to administer those former employee participants’ accounts for the remainder of the plan year. Revenue from commuter programs may vary from month-to-month because employees may elect to participate in our commuter programs at any time during the year and may change their election to participate or the amount of their contribution on a monthly basis; however, participation rates in our commuter business typically slow during the summer as people take vacations and do not purchase transit passes or parking passes during that time.

Our operating expenses increase during the fourth quarter because of increased debit card production and because we increase our customer support center capacity to answer questions from employee participants during the open enrollment periods related to their CDB participation decisions. The cost of providing services peaks in the first quarter as new employee participants contact us for information about their CDBs, and as terminating employee participants submit their final claims for reimbursement.

Our operating results can fluctuate from period to period, which could cause our share price to fluctuate.

Fluctuations in our quarterly operating results could cause our stock price to decline rapidly, may lead analysts to change their long-term models for valuing our common stock, could cause short-term liquidity issues, may impact our ability to retain or attract key personnel or cause other unanticipated issues. If our quarterly operating results or guidance fall below the expectations of research analysts or investors, the price of our common stock could decline substantially. Our quarterly operating expenses and operating results may vary significantly in the future and period-to-period comparisons of our operating results may not be meaningful. You should not rely on the results of one quarter as an indication of future performance.

If employee participants do not continue to utilize our prepaid debit cards or choose to use PIN rather than signature enabled prepaid debit cards, our results of operations, business and prospects could be materially adversely affected.

We derive a portion of our revenue from interchange fees that are paid to us when employee participants utilize our prepaid debit cards to pay for certain healthcare and commuter expenses under our CDB programs. These fees represent a percentage of the expenses transacted on each debit card. If our employer clients do not adopt these prepaid debit cards as part of the benefits programs they offer, if the employee participants do not use them at the rate we expect, if employee participants choose to process their transactions over PIN networks rather than signature networks or if other alternatives to prepaid tax-advantaged benefit cards develop, our results of operations, business and prospects could be materially adversely affected.

If we are unable to maintain and enhance our brand and reputation, our ability to sustain and grow our business may be materially adversely affected.

Maintaining and strengthening our brand is critical to attracting new clients and growing our business. Our ability to maintain and strengthen our brand and reputation will depend heavily on our capacity to continue to provide high levels of customer service to our employer clients and their employee participants at cost effective and competitive prices, which we may not do successfully. In addition, our continued success depends, in part, on our reputation as an industry leader in promoting awareness and understanding of the positive impact of CDBs among employers and employees. If we fail to successfully maintain and strengthen our brand, our results of operations, financial condition, business and prospects will be materially adversely affected.

Some plan providers with which we have relationships also provide, or may provide, competing services.

We face competitive risks in situations where some of our strategic partners are also current or potential competitors. For example, certain of the banks we utilize as custodians of the funds for our HSA employee participants also offer their own HSA products. To the extent that these partners choose to offer competing products and services that they have developed or in which they have an interest to our current or potential clients, our results of operations, business and prospects could be materially adversely affected.

We are subject to complex regulation, and any compliance failures or regulatory action could materially adversely affect our business.

The plans we administer and, as a result, our business are subject to extensive, complex and continually changing federal and state laws and regulations, including IRS regulations; ERISA, HIPAA , HITECH and other privacy and data security regulations; and the PPACA, all of which are further described in Part I, Item 1, “ Business — Government Regulation ” of this Annual Report on Form 10-K. If we fail to comply with any applicable law, rule or regulation, we could be subject to fines and penalties, indemnification claims by our clients, or become the subject of a regulatory enforcement action, each of which would materially adversely affect our business and reputation.  

We may also become subject to additional regulatory and compliance requirements as a result of changes in laws or regulations, or as a result of any expansion or enhancement of our existing products and services or the development of any new products or services in the future. For example, if we expand our product and service offerings into the health insurance market in the future, we would become subject to state Department of Insurance regulations. Compliance with any new regulatory requirements may divert internal resources and take significant time and effort.

Any claims of noncompliance brought against us, regardless of merit or ultimate outcome, could subject us to investigation by the DOL, the IRS, the Centers for Medicare and Medicaid Services, the U.S. Department of the Treasury or other federal and state regulatory authorities, which could result in substantial costs to us and divert management’s attention and other resources away from our operations.  In addition, investor perceptions of us may suffer and could cause a decline in the market price of our common stock.  Our compliance processes may not be sufficient to prevent assertions that we failed to comply with any applicable law, rule or regulation.

Our inability to successfully recover should we experience a disaster or other business continuity problem could cause material financial loss, loss of human capital, breach of confidential information, regulatory actions, reputational harm or legal liability.

Should we experience a disaster or other business continuity problem, either natural or man-made, our ability to protect our infrastructure, including customer data, and maintain ongoing operations will depend, in part, on the availability of our personnel, our office facilities, and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience near-term operational challenges with regard to particular areas of our operations.

In particular, our ability to recover from any disaster or other business continuity problem will depend on our ability to protect our technology infrastructure against damage from business continuity events that could have a significant disruptive effect on our operations. Our business continuity plan may not be successful in mitigating the effects of a disaster or other business continuity problem. We could potentially lose client data, experience a breach of security or confidential information, or experience material adverse interruptions to our operations or delivery of services to our clients in a disaster.

We will continue to regularly assess and take steps to improve upon our business continuity plans. However, a disaster on a significant scale or affecting certain of our key operating areas within or across regions, or our inability to successfully recover should we experience a disaster or other business continuity problem, could materially interrupt our business operations and cause material financial loss, loss of human capital, breach of confidential information, regulatory actions, reputational harm, damaged client relationships and legal liability.

If we fail to effectively upgrade our information technology systems, our business and operations could be disrupted.

As part of our efforts to continue the improvement of our enterprise resource planning, we plan to upgrade our existing information technology systems in order to automate several controls that are currently performed manually. We may experience difficulties in transitioning to these upgraded systems, including loss of data and decreases in productivity as personnel work to become familiar with these new systems. In addition, our management information systems will require modification and refinement as we grow and as our business needs change, which could prolong difficulties we experience with systems transitions, and we may not always employ the most effective systems for our purposes. If we experience difficulties in implementing new or upgraded information systems or experience significant system failures, or if we are unable to successfully modify our management information systems or respond to changes in our business needs, we may not be able to effectively manage our business and we may fail to meet our reporting obligations.

Our future success depends on our ability to recruit and retain qualified employees, including our executive officers and directors.

Our success is substantially dependent upon the performance of our senior management, such as our chief executive officer. Our management and employees may terminate their employment at any time, and the loss of the services of any of our executive officers could materially adversely affect our business. Our success is also substantially dependent upon our ability to attract additional personnel for all areas of our organization. Competition for qualified personnel is intense, and we may not be successful in attracting and retaining such personnel on a timely basis, on competitive terms or at all. Additionally, it may be more difficult for us to attract and retain qualified individuals to serve on our board of directors or as our executive officers due to potential liability concerns related to serving on a public company. If we are unable to attract and retain the necessary personnel, our results of operations, financial condition, business and prospects would be materially adversely affected.

Changes in credit card association or other network rules or standards set by Visa or MasterCard, or changes in card association and debit network fees or products or interchange rates, could materially adversely affect our results of operations, business and financial position.

We, and the banks that issue our prepaid debit cards, are subject to Visa and MasterCard association rules that could subject us to a variety of fines or penalties that may be levied by the card associations or networks for acts or omissions by us or businesses that work with us, including card processors, such as Alegeus. The termination of the card association registrations held by us or any of the banks that issue our cards, or any changes in card association or other debit network rules or standards, including interpretation and implementation of existing rules, participants deciding to use PIN networks, standards or guidance that increase the cost of doing business or limit our ability to provide our products and services, or limit our ability to receive interchange, could have a material adverse effect on our results of operations, financial condition, business and prospects. In addition, from time-to-time, card associations increase the organization or processing fees that they charge, which could increase our operating expenses, reduce our profit margin and materially adversely affect our results of operations, financial condition, business and prospects.

We have entered into outsourcing and other agreements with third parties related to certain of our business operations, and any difficulties experienced in these arrangements could result in additional expense, loss of revenue or an interruption of our services.

We have entered into outsourcing agreements with third parties to provide certain customer service and related support functions to our employer clients and their employee participants. As a result, we rely on third parties over which we have limited control. If these third parties are unable to perform to our requirements or to provide the level of service required or expected by our employer clients, including ensuring the privacy and integrity of individually identifiable health information that they may be privy to as a result of the services they perform for our employer clients and their employee participants, our operating results, financial condition, business, prospects and reputation may be materially harmed. In addition, we may be forced to pursue alternative strategies to provide these services, which could result in delays, interruptions, additional expenses and loss of clients and related revenues.

If our intellectual property and technology are not adequately protected to prevent use or appropriation by our competitors, our business and competitive position could be materially adversely affected.

We rely on a combination of copyright, trademark and trade secret laws, as well as confidentiality procedures and contractual provisions, to establish and protect our intellectual property rights in the United States.

The efforts we have taken to protect our intellectual property may not be sufficient or effective, and our trademarks and copyrights may be held invalid or unenforceable. We may not be effective in policing unauthorized use of our intellectual property, and even if we do detect violations, litigation may be necessary to enforce our intellectual property rights. Any enforcement efforts we undertake, including litigation, could be time consuming and expensive, could divert our management’s attention and may result in a court determining that our intellectual property rights are unenforceable. If we are not successful in cost-effectively protecting our intellectual property rights, our results of operations, financial condition, business and prospects could be materially adversely affected.

Our ability to use net operating loss carryforwards to offset future taxable income may be limited.

As of December 31, 2015, we had $ 10.9 million of federal and $30.9 million of state net operating loss carryforwards available to offset future regular and alternative minimum taxable income. The state net operating loss carryforward has been prepared on a post-apportionment basis. These net operating loss carryforwards will expire in the year 2033 for U.S. federal income tax purposes and in years 2016 through 2033 for state income tax purposes, if not fully utilized. In addition, we have federal and state research and development credit carryforwards of approximately $5. 5 million and $3.1 million, respectively. The federal research credit carryforwards expire beginning in 2022 through 203 5 , if not fully utilized. The state research credit carries forward indefinitely for the state of California and twenty years for the state of Texas. Our ability to utilize net operating loss and tax credit carryforwards are subject to restrictions, including limitations in the event of past or future ownership changes as defined in Section 382 of the Internal Revenue Code, or IRC, of 1986, as amended, and similar state tax laws. In general, an ownership change occurs if the aggregate stock ownership of certain stockholders increases by more than 50 percentage points over such stockholders’ lowest percentage ownership during the testing period (generally three years). We have considered Section 382 of the IRC and concluded that any ownership change would not diminish our utilization of our net operating loss carryforwards or our research and development credits during the carryover periods .

If one or more jurisdictions successfully assert that we should have collected or in the future should collect additional sales and use taxes on our fees, we could be subject to additional liability with respect to past or future sales and the results of our operations could be adversely affected.

Sales and use tax laws and rates vary by jurisdiction and such laws are subject to interpretation. In those jurisdictions where we believe sales taxes are applicable, we collect and file timely sales tax returns. Currently, such taxes are minimal. Jurisdictions in which we do not collect sales and use taxes may assert that such taxes are applicable, which could result in the assessment of such taxes, interest and penalties, and we could be required to collect such taxes in the future. This additional sales and use tax liability could adversely affect our results of operations.

Third parties may assert intellectual property infringement claims against us, or our services may infringe the intellectual property rights of third parties, which may subject us to legal liability and materially adversely affect our reputation.

Assertion of intellectual property infringement claims against us could result in litigation. We might not prevail in any such litigation or be able to obtain a license for the use of any infringed intellectual property from a third party on commercially reasonable terms, or at all. Even if obtained, we may be unable to protect such licenses from infringement or misuse, or prevent infringement claims against us in connection with our licensing efforts. Any such claims, regardless of their merit or ultimate outcome, could result in substantial cost to us, divert management’s attention and our resources away from our operations and otherwise adversely affect our reputation. Our process for controlling our own employees’ use of third-party proprietary information may not be sufficient to prevent assertions of intellectual property infringement claims against us.

We rely on insurance to mitigate some risks of our business and, to the extent the cost of insurance increases or we maintain insufficient coverage, our results of operations, business and financial condition may be materially adversely affected.

We contract for insurance to cover a portion of our potential business risks and liabilities. In the current environment, insurance companies are increasingly specific about what they will and will not insure. It is possible that we may not be able to obtain sufficient insurance to meet our needs, may have to pay very high prices for the coverage we do obtain or may not acquire any insurance for certain types of business risk. This could leave us exposed, and to the extent we incur liabilities and expenses for which we are not adequately insured, our results of operations, business and financial condition could be materially adversely affected. Also, to the extent the cost of maintaining insurance increases, our operating expenses will rise, which could materially adversely affect our results of operations, financial condition, business and prospects.

In the past significant deficiencies in our internal control over financial reporting have been identified. If our internal controls are not effective, there may be errors in our financial information that could require a restatement or delay our SEC filings, and investors may lose confidence in our reported financial information, which could lead to a decline in our stock price.

We have, in the past, experienced issues with our internal control over financial reporting and it is possible that we may discover significant deficiencies or material weaknesses in our internal control over financial reporting in the future. Any failure to maintain or implement required new or improved controls, or any difficulties we encounter in their implementation, could cause us to fail to meet our periodic reporting obligations, or result in material misstatements in our financial information. Any such delays or restatements could cause investors to lose confidence in our reported financial information and lead to a decline in our stock price.

Substantial sales of our common stock by our stockholders could depress the market price of our common stock regardless of our operating results.

Sales of substantial amounts of our common stock in the public market, or the perception that these sales could occur, could adversely affect the market price of our common stock and impair our ability to raise capital through offerings of our common stock. As of December 31, 2015, we had 3 6,054,771 shares of our common stock outstanding. In addition, as of December 31, 2015, there were outstanding options to purchase 3,037 ,602 shares of our common stock and 763,028 restricted stock units. Substantially all of our outstanding common stock is eligible for sale, subject to Rule 144 volume limitations for holders affected by such limitations, as are common stock issuable under vested and exercisable options. Rule 144 allows public resale of restricted and control securities if certain conditions are met. If our existing stockholders sell a large number of common stock or the public market perceives that existing stockholders might sell our common stock, the market price of our common stock could decline significantly. These sales might also make it more difficult for us to sell equity securities at a time and price that we deem appropriate.

Our stock price has fluctuated and may continue to do so and may even decline regardless of our financial performance.

The market price of our common stock has fluctuated and may continue to fluctuate significantly in response to numerous factors, many of which are beyond our control, including:

In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against such a company. If securities class action litigation is instituted against us, it could result in substantial costs and a diversion of our management’s attention and resources and could materially adversely affect our operating results.

Anti-takeover provisions contained in our amended and restated certificate of incorporation and amended and restated bylaws, as well as provisions of Delaware law, could impair a takeover attempt.

Our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law contain provisions that could have the effect of delaying, preventing or rendering more difficult an acquisition of us if such acquisition is deemed undesirable by our board of directors. Our corporate governance documents include provisions that:

These provisions, alone or together, could delay or prevent unsolicited takeovers and changes in control or changes in our management.

As a Delaware corporation, we are also subject to provisions of Delaware law, including Section 203 of the Delaware General Corporation Law, which prevents some stockholders holding more than 15% of our outstanding common stock from engaging in certain business combinations without approval of the holders of substantially all of our outstanding common stock.

Any provision of our amended and restated certificate of incorporation or amended and restated bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

We do not expect to declare any dividends in the foreseeable future.

We do not anticipate declaring any cash dividends to holders of our common stock in the foreseeable future. A ny future financing agreements may prohibit us from paying any type of dividends. Consequently, investors may need to rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Investors seeking cash dividends should not purchase our common stock.