Contract analysis

I. EXECUTIVE SUMMARY A. Purpose This memorandum summarizes the findings of our regulatory and licensing due diligence review conducted in connection with Harrowgate Private Equity Fund IV LP's ("HPE Fund IV" or the "Acquiror") proposed acquisition of VeloPay Systems, Inc. ("VeloPay" or the "Company") for aggregate consideration of approximately $1.9 billion. The transaction is structured as a reverse triangular merge

1. VeloPay Processing LLC — a Delaware limited liability company and the primary operating subsidiary through which VeloPay conducts its payments processing and merchant acquiring activities;

2. VeloPay Canada Inc. — an Ontario corporation that supports VeloPay's Canadian merchant base from offices in Toronto, Ontario;

3. VeloPay Europe, Unipessoal Lda. — a Portuguese sociedade unipessoal limitada (single-member limited liability company) organized under the laws of Portugal, located in Lisbon, Portugal, which functions primarily as an R&D and engineering center;

4. VeloPay Fraud intelligence Inc. — a Delaware corporation that develops and operates VeloPay's proprietary fraud detection and transaction scoring SaaS product; and

5. PayStream Gateway LLC — a Delaware limited liability company acquired by VeloPay in 2021 for approximately $45 million, which operates VeloPay's payment gateway technology. Each of these entities is wholly owned, directly or indirectly, by VeloPay Systems, Inc. C. Transaction Structure The Transaction is structured as a reverse triangular merger under Section 251 of the Delaware General Corporation Law ("DGCL"). I

II. U.S. MONEY TRANSMITTER LICENSING A. Overview of VeloPay's Licensing Framework VeloPay operates a cloud-native payments processing and merchant acquiring platform that facilitates the acceptance, processing, and settlement of electronic payments for merchants across a wide range of industries. The Company processes approximately $87 billion in annualized gross payment volume ("GPV") across a merchant base of more

1. Overview. The proposed Transaction, structured as a reverse triangular merger in which Merger Sub will merge with and into VeloPay, constitutes a change of control of VeloPay Systems, Inc. and, by extension, of its subsidiaries, including VeloPay Processing LLC (the primary holder of money transmitter licenses across 48 jurisdictions). Under the money transmitter statutes and regulations of most states, a change o

2. Tier 1: Prior Approval Required (Pre-Closing) Approximately 12 to 15 states require prior written approval from the applicable state financial regulator before a change of control of a licensed money transmitter may become effective. In these jurisdictions, the Transaction may not close — or, more precisely, the change of control may not be consummated — until the regulator has affirmatively approved the change of

3. Tier 2: Pre-Closing Notification Required (No Affirmative Approval Needed) Approximately 8 to 10 states require advance written notification to the applicable state regulator of a proposed change of control of a licensed money transmitter but do not require the regulator to issue affirmative approval before the change of control becomes effective. In these jurisdictions, the licensee must submit a notification to

4. Tier 3: Post-Closing Notification or Informational Filing Approximately 6 to 8 states require the licensee to submit a post-closing notification or informational filing within a specified period after the change of control becomes effective (typically 15 to 30 days after closing). These requirements do not present a pre-closing risk and do not constitute conditions to closing, but they must be tracked and fulfille

5. Timing and Closing Condition Analysis Achievement of all required state change of control approvals is expected to be a closing condition under the Merger Agreement. Specifically, Section 7.01(d) of the Merger Agreement provides that the obligation of each party to consummate the Transaction is conditioned upon the receipt of all "Required Regulatory Approvals," which is defined to include all governmental consent

III. PCI-DSS COMPLIANCE A. Overview Compliance with the Payment Card Industry Data Security Standard ("PCI-DSS") is a critical operational and regulatory requirement for VeloPay given its role as a payments processor and merchant acquirer. PCI-DSS is a set of security standards established by the major payment card brands (Visa, Hollowell Partners LLC, Pinnacle Partners LLC, Discover, and JCB) through the Payment Car

IV. CANADIAN REGULATORY CONSIDERATIONS — VELOPAY CANADA INC. A. Overview of VeloPay Canada Inc. VeloPay Canada Inc. is an Ontario corporation organized under the Business Corporations Act (Ontario), wholly owned by VeloPay Systems, Inc. VeloPay Canada operates from offices in Toronto, Ontario, and supports VeloPay's Canadian merchant base, which includes approximately 850 active Canadian merchants representing approx

V. PORTUGUESE / EU REGULATORY CONSIDERATIONS — VELOPAY EUROPE, UNIPESSOAL LDA. A. Overview of VeloPay Europe VeloPay Europe, Unipessoal Lda. is a Portuguese sociedade unipessoal por quotas de responsabilidade limitada (single-member limited liability company) organized under the laws of Portugal, wholly owned by VeloPay Systems, Inc. VeloPay Europe is located in Lisbon, Portugal, at Avenida da Liberdade 110, 3.° anda