PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE ATTORNEY WORK PRODUCT
March 7, 2025
MEMORANDUM
TO: Sandra Tung, Responsible Partner, Mergers & Acquisitions, Calderwood & Harkness LLP Priya Deshmukh, Managing Partner, Fund IV, Harrowgate Capital Management IV LLC Thomas Eriksen, Partner, Head of Financial Technology, Harrowgate Capital Management IV LLC
FROM: Derek Okonkwo, Working Associate, Mergers & Acquisitions, Calderwood & Harkness LLP
DATE: March 7, 2025
RE: intellectual Property Due Diligence — VeloPay Systems, Inc. (Calderwood & Harkness Matter No. 1003-00003)
PREPARED IN CONNECTION WITH: The proposed acquisition of VeloPay Systems, Inc. ("VeloPay" or the "Company") by Harrowgate Private Equity Fund IV LP ("HPE Fund IV") through a reverse triangular merger with Harrowgate Velocity Merger Sub Inc. ("Merger Sub"), for aggregate merger consideration of $1,900,000,000 ($20.00 per share on a fully diluted basis)
This memorandum has been prepared by Calderwood & Harkness LLP at the direction and for the sole benefit of Harrowgate Capital Management IV LLC and its affiliated funds. This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Harrowgate Capital Management IV LLC.
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the key findings from the intellectual property due diligence review conducted by Calderwood & Harkness LLP in connection with the proposed acquisition of VeloPay Systems, Inc. and its subsidiaries by HPE Fund IV for aggregate merger consideration of $1,900,000,000 ($20.00 per share on a fully diluted basis). The acquisition is to be structured as a reverse triangular merger in which Merger Sub will merge with and into VeloPay, with VeloPay surviving as a wholly-owned subsidiary of HPE Fund IV.
Scope of Review. Our review encompasses documents and information produced by VeloPay and its counsel, Whitford Jessup & Crane LLP (Rebecca Thornton-Hayes and James Okoro, partners), in the electronic data room hosted on Thackeray Solutions and opened on December 12, 2024. We have reviewed materials organized across all major IP categories, including patents, trademarks, copyrights, trade secrets, domain names, software licenses (both inbound and outbound), open-source software usage, IP assignment agreements, and IP litigation history. In addition, we conducted management interviews with Sonia Reyes-Watkins (CTO and Co-Founder, holding approximately 9.7% of the outstanding shares on a fully diluted basis) and Danielle Moreau (General Counsel, holding approximately 0.6% of the outstanding shares on a fully diluted basis) in January and February 2025. Third-party patent and trademark clearance search results supplemented our review.
Entities Covered. The IP portfolio is held across the following entities in the VeloPay group:
• VeloPay Systems, Inc. (Delaware corporation; parent entity)
• VeloPay Processing LLC (Delaware limited liability company; wholly-owned subsidiary)
• VeloPay Canada Inc. (Ontario corporation; wholly-owned subsidiary)
• VeloPay Europe, Unipessoal Lda. (Portuguese limitada; wholly-owned subsidiary)
• VeloPay Fraud intelligence Inc. (Delaware corporation; wholly-owned subsidiary)
• PayStream Gateway LLC (Delaware limited liability company; wholly-owned subsidiary, acquired in 2021)
Overall Assessment. VeloPay maintains a moderately sized but strategically significant IP portfolio that supports its cloud-native payments processing and merchant acquiring platform. The portfolio is anchored by 18 issued U.S. utility patents, 7 pending U.S. patent applications, foreign patent rights in Canada and Portugal, a well-established trademark portfolio with 11 active U.S. registrations (and additional Canadian and EU registrations), and valuable trade secrets embodied in proprietary algorithms, machine learning models, and platform architecture. The Company's IP protection practices are generally sound, with appropriate employee and contractor assignment agreements, trade secret safeguards, and a monitored trademark portfolio.
Key Strengths. The core proprietary payments technology, fraud detection algorithms, well-established trademark portfolio, and trade secret protection measures represent material strengths that underpin VeloPay's competitive market position and support its recurring revenue model across approximately 14,000 merchant relationships.
Key Risks and Areas of Concern. While no IP risk identified in this review rises to the level of a transaction impediment, we have flagged several items that require either remediation prior to closing, protective provisions in the definitive Merger Agreement, or post-closing attention:
(a) Open-source software compliance, particularly regarding copyleft-licensed components (GPL and LGPL) in the VeloPay Fraud intelligence Inc. and PayStream Gateway LLC codebases, warrants independent code audit verification;
(b) Three current employees (in non-engineering roles) have incomplete or missing IP assignment agreements, which VeloPay has committed to remediate prior to closing;
(c) Two legacy contractor agreements (pre-2017) contain ambiguous IP assignment language, though the related work product is represented as non-material;
(d) PayStream Gateway LLC IP remains at the subsidiary level and has not been formally assigned to VeloPay Systems, Inc.;
(e) A pending TTAB trademark opposition proceeding regarding the "VELOAPAY" mark application remains unresolved; and
(f) VeloPay's international IP coverage is limited relative to its global operations and expansion ambitions.
These items are discussed in detail in the sections that follow and are also summarized in Section XV of this memorandum.
Recommendation. The IP portfolio generally supports the $1.9 billion valuation (representing an Enterprise Value to Revenue multiple of approximately 4.61x based on FY2024 revenue of $412.3 million, and an Enterprise Value to Adjusted EBITDA multiple of approximately 19.37x based on FY2024 Adjusted EBITDA of $98.1 million). However, the items identified above require remediation, protective representations and warranties and related indemnification provisions in the definitive Merger Agreement (which is targeted for execution as early as March 18, 2025), and/or post-closing integration workstreams. Specific Merger Agreement recommendations are set forth in Section XV.C below.
II. Methodology and Scope of Review
A. Data Room Materials Reviewed
Our IP due diligence review was conducted through a comprehensive examination of IP-related documents produced in the VeloPay electronic data room, which was opened on December 12, 2024 and hosted on the Thackeray Solutions platform. The data room was organized by VeloPay and its counsel, Whitford Jessup & Crane LLP, into folders corresponding to the major categories of IP assets. We reviewed documents and information in the following categories:
• Patents. Issued patent certificates, prosecution files, assignment records, maintenance fee receipts, patent application filing records, and correspondence with the United States Patent and Trademark Office ("USPTO"), the Canadian intellectual Property Office ("CIPO"), and the European Patent Office ("EPO"). Patent portfolio summary spreadsheets prepared by VeloPay's outside patent counsel, Wentworth & Calloway LLP (Austin, Texas), were also reviewed.
• Trademarks. Trademark registration certificates, prosecution files, assignment records, renewal filings, Section 8 and Section 15 declarations, specimens of use, and trademark monitoring reports prepared by Sentinel Brand Watch LLC. Records of the pending Trademark Trial and Appeal Board opposition proceeding were also reviewed.
• Copyrights. Copyright ownership records and analysis, work-for-hire documentation, and VeloPay's internal policies regarding copyrightable works.
• Trade Secrets. VeloPay's written Trade Secret and Confidential Information Policy, information security protocols, access control documentation, PCI-DSS Level 1 compliance records, and related internal policies.
• Domain Names. Domain name portfolio spreadsheet, registrar account information, and domain ownership records.
• Software Licenses (Inbound). Material third-party software license agreements, enterprise cloud infrastructure agreements, payment card network SDK and API agreements, and cybersecurity tool licenses.
• Software Licenses (Outbound). Standard form SaaS subscription agreements, enterprise customer agreements, strategic partner and reseller agreements, and related terms of service.
• Open-Source Software. VeloPay's Open-Source Software Policy, the open-source bill of materials ("BOM") generated by VeloPay's automated software composition analysis ("SCA") tool, and related audit reports.
• IP Assignment Agreements. Standard form employee invention assignment agreements, founder IP assignment agreements, independent contractor agreements, and the IP-related provisions of the PayStream Gateway LLC acquisition agreement.
• IP Litigation History. Records of any IP-related litigation, threats, inquiries, cease-and-desist correspondence, and indemnification claims.
In addition to the data room materials, we conducted management presentations and interviews with the following individuals:
• Sonia Reyes-Watkins (CTO and Co-Founder, approximately 9.7% stockholder): Interviews were conducted on January 14, 2025 and February 6, 2025, covering VeloPay's technology architecture, patent strategy, open-source software usage, trade secret protection measures, and R&D operations in Austin, Denver, Toronto, and Lisbon.
• Danielle Moreau (General Counsel, approximately 0.6% stockholder): Interviews were conducted on January 16, 2025 and February 11, 2025, covering IP portfolio management, trademark enforcement, IP assignment agreements, contractor agreements, IP-related litigation and disputes, and open-source software compliance.
Third-party patent and trademark clearance searches were also reviewed and considered in our analysis.
B. Limitations
The findings and conclusions set forth in this memorandum are based upon and subject to the following limitations:
1. Reliance on Data Room Production. We have relied upon the completeness and accuracy of the documents and information produced by VeloPay and its counsel in the electronic data room. Where we have identified gaps or incomplete production, we have noted them in the relevant sections of this memorandum. We have not conducted an independent investigation to identify IP assets or liabilities not disclosed by VeloPay.
2. No Independent Technical Audit. We have not conducted an independent technical audit of VeloPay's source code, software architecture, or engineering practices. Our assessment of open-source software compliance, in particular, is based upon our review of VeloPay's SCA tool reports, management representations, and the Open-Source Software Policy, but has not been independently validated through a forensic source code scan. We recommend that HPE Fund IV consider commissioning a specialized independent technical diligence review if the findings in this memorandum or any other aspect of the diligence process warrants such review.
3. Foreign IP Registrations. IP registrations in Canada (held by VeloPay Canada Inc.) and Portugal/EU (held by VeloPay Europe, Unipessoal Lda.) have been reviewed at a summary level based on data room materials. We recommend that local counsel in Ontario, Canada and Lisbon, Portugal be engaged to confirm the current registration status, chain of title, and enforceability of foreign IP rights, including compliance with any local inventor compensation or moral rights requirements.
4. Freedom-to-Operate. We have not independently conducted a freedom-to-operate analysis for VeloPay's products and services. VeloPay management represents that internal FTO reviews were performed by Wentworth & Calloway LLP prior to major product launches, but the results of those reviews were not produced in the data room.
C. Coordination with Other Workstreams
This memorandum is intended to be read in conjunction with the following related diligence memoranda, and cross-references are provided throughout where appropriate:
• Legal Due Diligence Summary Memorandum (prepared by Megan Chu and Derek Okonkwo, Calderwood & Harkness LLP) — covering corporate organization, governance, capitalization, material contracts, and general legal matters.
• Material Contracts Summary Memorandum (prepared by Derek Okonkwo, Calderwood & Harkness LLP) — covering VeloPay's material customer agreements, vendor agreements, strategic partnerships, and other commercial contracts.
• Litigation and Contingent Liabilities Memorandum (prepared by Megan Chu, Calderwood & Harkness LLP) — covering all pending, threatened, or historical litigation and contingent liabilities.
• Employment and Benefits Due Diligence Memorandum — covering employee agreements, restrictive covenant enforceability, and related employment matters, including IP assignment obligations.
• Change of Control Consent Tracker and Analysis Memorandum (maintained by Derek Okonkwo, Calderwood & Harkness LLP) — identifying contracts requiring consent, notification, or amendment upon the change of control.
• Regulatory and Licensing Due Diligence Memorandum (prepared by Megan Chu, Calderwood & Harkness LLP) — covering PCI-DSS compliance, state money transmitter licensing, and other regulatory matters.
• Tax Due Diligence Memorandum (authored by Leonard Cross, Calderwood & Harkness LLP) — covering federal, state, and international tax matters, including transfer pricing considerations related to cross-border IP.
• Post-Closing Integration Coordination Memorandum — addressing integration planning, entity rationalization, and related matters.
III. Patent Portfolio
A. Overview
VeloPay and its subsidiaries collectively hold a patent portfolio consisting of 18 issued U.S. utility patents, 7 pending U.S. patent applications, 3 issued Canadian patents, and 2 European Patent Office patents validated in Portugal. The portfolio covers technology areas that are central to VeloPay's cloud-native payments processing and merchant acquiring platform, including real-time payment authorization methods, tokenization protocols, fraud detection algorithms, payment gateway routing optimization, and merchant onboarding automation.
The patent portfolio is distributed across three entities within the VeloPay corporate group: VeloPay Systems, Inc. (the parent entity), VeloPay Fraud intelligence Inc. (a wholly-owned subsidiary focused on fraud detection technology), and PayStream Gateway LLC (a wholly-owned subsidiary acquired in 2021). Foreign patents are held by VeloPay Canada Inc. (Canadian patents) and VeloPay Europe, Unipessoal Lda. (EPO patents validated in Portugal). Patent prosecution for the U.S. portfolio is handled by VeloPay's outside patent counsel, Wentworth & Calloway LLP, located in Austin, Texas.
A complete schedule of all issued and pending patents is set forth in Appendix A to this memorandum.
B. VeloPay Systems, Inc. — Core Patents
VeloPay Systems, Inc. is the registered assignee of 12 issued U.S. utility patents, which constitute the core of the Company's patent portfolio. These patents cover the foundational technology underlying VeloPay's payments processing platform and represent the most strategically valuable patent assets in the portfolio. The key patents are summarized below:
(i) Dynamic Payment Routing Algorithm (U.S. Patent No. 9,842,XXX; issued September 2018; expiration September 2038). This patent covers VeloPay's proprietary method for dynamically routing payment transactions across multiple acquiring bank connections and payment networks based on real-time optimization criteria, including transaction cost, authorization success rates, and network latency. This technology is central to VeloPay's value proposition of reducing merchant processing costs through intelligent routing.
(ii) Real-Time Merchant Risk Scoring Methodology (U.S. Patent No. 10,217,XXX; issued March 2019; expiration March 2039). This patent covers VeloPay's methodology for generating and updating real-time risk scores for merchant accounts based on transactional patterns, behavioral indicators, and external data feeds. The risk scoring methodology supports VeloPay's automated merchant onboarding and ongoing risk monitoring capabilities.
(iii) Multi-Channel Tokenization System (U.S. Patent No. 10,693,XXX; issued June 2020; expiration June 2040). This patent covers VeloPay's system for generating and managing payment tokens across multiple channels (e-commerce, mobile, point-of-sale) using a unified tokenization architecture that ensures PCI-DSS compliance while enabling seamless cross-channel payment experiences.
The remaining 9 issued U.S. utility patents assigned to VeloPay Systems, Inc. cover ancillary but commercially important technology areas, including payment data analytics, batch settlement optimization, webhook-based event notification systems, merchant onboarding workflow automation, and API gateway management. Full details are provided in Appendix A.
In addition to the issued patents, VeloPay Systems, Inc. is the applicant on 5 pending U.S. patent applications filed between 2022 and 2024. These pending applications cover next-generation fraud analytics incorporating advanced machine learning techniques, embedded finance API architectures, and real-time payment orchestration across emerging payment rails (including real-time payment networks). These pending applications, if granted, would extend VeloPay's patent protection into technology areas that are expected to be significant growth drivers in the coming years.
All maintenance fees for issued patents assigned to VeloPay Systems, Inc. are current. Our review of maintenance fee records in the data room did not identify any lapses, missed deadlines, or pending maintenance fee obligations that could jeopardize patent validity. Wentworth & Calloway LLP has confirmed in correspondence that it maintains a docketing system to track all maintenance fee and prosecution deadlines for VeloPay's patent portfolio.
C. VeloPay Fraud intelligence Inc. — Fraud Detection Patents
VeloPay Fraud intelligence Inc., a wholly-owned subsidiary of VeloPay Systems, Inc., is the registered assignee of 4 issued U.S. utility patents. These patents cover technology that is central to VeloPay's fraud detection capabilities and its VeloPay Shield product, which is offered as a SaaS subscription and represents a key revenue driver for the Company. The patents cover the following technology areas:
(i) Machine-Learning-Based Transaction Anomaly Detection (2 patents, issued 2020 and 2021). These patents cover methods for applying supervised and unsupervised machine learning models to identify anomalous transaction patterns indicative of fraudulent activity. The patented methods include feature engineering techniques specific to payment transaction data, ensemble model architectures for real-time scoring, and adaptive threshold algorithms that evolve based on emerging fraud vectors.
(ii) Behavioral Biometrics for Payment Authentication (2 patents, issued 2021 and 2022). These patents cover systems and methods for authenticating payment transactions using behavioral biometric signals, including keystroke dynamics, device interaction patterns, and session behavioral fingerprinting. These patents support VeloPay Shield's ability to provide frictionless fraud prevention without requiring additional customer authentication steps.
VeloPay Fraud intelligence Inc. is also the applicant on 2 pending U.S. patent applications related to AI-driven chargeback prediction. These applications, filed in 2023 and 2024, cover predictive models that analyze transaction and merchant data to forecast the likelihood of chargebacks before they occur, enabling proactive merchant intervention. If granted, these patents would strengthen VeloPay's competitive position in the fraud prevention and chargeback management market.
All maintenance fees for the VeloPay Fraud intelligence Inc. patents are current, and prosecution of the pending applications is being handled by Wentworth & Calloway LLP.
D. PayStream Gateway LLC — Acquired Patents
PayStream Gateway LLC was acquired by VeloPay in 2021 for $45 million. The acquisition brought with it 2 issued U.S. utility patents relating to payment gateway technology, which complement VeloPay's core platform capabilities:
(i) Payment Gateway Interoperability (U.S. Patent No. 9,621,XXX; issued 2017; expiration 2037). This patent covers a method for enabling interoperability between disparate payment gateway platforms through a standardized abstraction layer, allowing merchants to process transactions across multiple gateways without modifying their integration code.
(ii) API-Level Transaction Orchestration (U.S. Patent No. 10,115,XXX; issued 2018; expiration 2038). This patent covers a system for orchestrating complex, multi-step payment transactions through a series of API calls to different backend services, including authorization, capture, settlement, and reconciliation, managed through a centralized orchestration engine.
Our review of the chain of title for the PayStream patents confirms that the original inventors and founders of PayStream executed IP assignment agreements assigning all PayStream-related inventions and intellectual property to PayStream Gateway LLC. The assignment records were produced in the data room and appear to be properly executed and notarized. The assignments from the PayStream founders to PayStream Gateway LLC were recorded with the USPTO, and the chain of title from the original inventors through PayStream Gateway LLC appears clean.
The maintenance fee for the gateway interoperability patent (issued 2017) has been paid through the current maintenance period, and we did not identify any lapses in maintenance fee payments for either PayStream patent.
E. Foreign Patents
VeloPay Canada Inc. VeloPay Canada Inc. holds 3 issued Canadian patents with the Canadian intellectual Property Office. These patents mirror the core VeloPay U.S. patents covering dynamic payment routing, merchant risk scoring, and multi-channel tokenization, filed as counterpart applications to the corresponding U.S. filings. All three Canadian patents are maintained and current based on data room records. VeloPay Canada Inc. is the registered owner of these patents, consistent with the Company's practice of holding Canadian IP rights at the Canadian subsidiary level.
VeloPay Europe, Unipessoal Lda. VeloPay Europe, Unipessoal Lda. holds 2 EPO patents that have been validated in Portugal, covering payment processing methods. These patents were granted by the European Patent Office and subsequently validated in Portugal, where VeloPay Europe maintains its R&D center in Lisbon. The status of these patents is confirmed as current based on the data room materials, but we recommend that local counsel in Lisbon verify the registration status, maintenance fee payments, and any national-level requirements for ongoing patent validity in Portugal.
No Other Foreign Patents. No patent filings in jurisdictions other than the United States, Canada, and Europe (validated in Portugal) were identified in the data room. Given VeloPay's expansion plans into additional markets, this limited geographic coverage may warrant review as part of a post-closing IP filing strategy.
F. Patent Risks and Observations
Based on our review, we make the following observations regarding patent risks:
1. No Active Patent Infringement Claims. No active patent infringement claims against VeloPay or any of its subsidiaries have been identified as of the date of this memorandum. This finding is consistent with the Litigation and Contingent Liabilities Memorandum prepared by Megan Chu.
2. Pre-Litigation Patent Inquiry. One third-party pre-litigation inquiry was received in Q3 2023 from an unnamed competitor alleging potential overlap between the competitor's patent portfolio and VeloPay's multi-channel tokenization patent (U.S. Patent No. 10,693,XXX). VeloPay's patent counsel at Wentworth & Calloway LLP reviewed the inquiry and the competing party's patent claims and determined that VeloPay's tokenization patent does not infringe the competitor's patents. The matter was resolved informally through an exchange of correspondence, with no license payment, settlement, or ongoing obligation. There has been no further contact from the third party. We recommend that this inquiry be included on the disclosure schedules to the Merger Agreement, notwithstanding its informal resolution, to ensure completeness and transparency.
3. Freedom-to-Operate. Calderwood & Harkness has not independently conducted a freedom-to-operate analysis for VeloPay's products and services. VeloPay management represents that internal FTO reviews were performed by Wentworth & Calloway LLP prior to the commercial launch of major products and features. The results of these FTO reviews were not produced in the data room, and we were unable to independently verify their scope or conclusions. While the absence of any patent infringement claim or notice (other than the Q3 2023 inquiry described above) is favorable, the lack of an independent, current FTO analysis represents a residual risk.
4. Patent-Specific Merger Agreement Provisions. We recommend that the Merger Agreement include specific representations and warranties covering: (a) VeloPay's ownership of all patents free and clear of encumbrances (other than existing credit facility liens to be released at closing); (b) the absence of infringement by VeloPay of any third-party patent rights; (c) the absence of infringement by third parties of VeloPay's patents (to VeloPay's knowledge); and (d) the current status and validity of all issued patents and pending applications.
IV. Trademark Portfolio
A. Registered Trademarks — United States
VeloPay holds 11 active U.S. trademark registrations with the USPTO. These registrations cover the core VeloPay brand, the PayStream brand (acquired in the 2021 PayStream Gateway LLC acquisition), and various product-specific names. The principal registrations are as follows:
The remaining 4 registrations cover additional product-specific names for VeloPay's analytics dashboard tools, merchant services interfaces, and developer platform branding. Full details are set forth in Appendix B.
All registrations are current. Our review of the data room records confirms that Section 8 Declarations of Continued Use and Section 15 Declarations of Incontestability have been filed as required by the Lanham Act for all registrations that have reached the applicable filing windows. Renewal applications have been timely filed where applicable.
The "PAYSTREAM" word mark (Registration No. 5,XXX,712) was originally registered by PayStream Gateway LLC and was assigned to VeloPay Systems, Inc. upon VeloPay's acquisition of PayStream Gateway LLC in 2021. The assignment was recorded with the USPTO, and the chain of title appears clean.
VeloPay engages Sentinel Brand Watch LLC, a trademark monitoring service, to conduct ongoing surveillance of new trademark applications, domain name registrations, and online marketplace listings that may conflict with VeloPay's registered marks. Monitoring reports produced in the data room reflect regular monitoring activity and timely identification of potential conflicts.
B. Registered Trademarks — Foreign
VeloPay Canada Inc. VeloPay Canada Inc. holds 3 Canadian trademark registrations with the Canadian intellectual Property Office:
• "VELOPAY" — word mark, registered in connection with financial services and payment processing
• "VELOPAY SHIELD" — word mark, registered in connection with fraud detection software services
• "PAYSTREAM" — word mark, registered in connection with payment gateway services
All Canadian trademark registrations are current based on data room records.
VeloPay Europe, Unipessoal Lda. VeloPay Europe, Unipessoal Lda. holds 2 EU trademark registrations with the European Union intellectual Property Office ("EUIPO"):
• "VELOPAY" — word mark, covering Classes 36 and 42 across all EU member states, including Portugal
• "VELOPAY SHIELD" — word mark, covering Class 42 across all EU member states, including Portugal
These EUIPO registrations provide trademark protection throughout the European Union, which is consistent with VeloPay Europe's operations based in Lisbon, Portugal.
No Other Foreign Trademark Registrations. No trademark registrations in jurisdictions other than the United States, Canada, and the European Union were identified. Given VeloPay's plans for geographic expansion, we recommend that HPE Fund IV consider a broader international trademark filing strategy post-closing to secure brand protection in key target markets.
C. Common Law / Unregistered Marks
In addition to its registered trademarks, VeloPay uses certain unregistered product names, taglines, and slogans in its marketing materials, including on its website, in advertising campaigns, and in merchant-facing communications. These unregistered marks include product feature names, promotional taglines, and certain design elements used consistently in VeloPay's branding.
Under U.S. law, these marks enjoy common law trademark protection in the geographic areas and channels of commerce where they are used. However, common law protection is inherently narrower than federal registration and does not provide the presumptions of validity, nationwide constructive use, and statutory remedies available to federally registered marks.
We recommend that, following closing, HPE Fund IV work with VeloPay's trademark counsel to evaluate the unregistered marks and consider filing federal trademark applications for those marks that are commercially significant and integral to VeloPay's brand identity and marketing strategy.
D. Trademark Risks and Observations
1. No Active Trademark Disputes. No active trademark infringement actions, cease-and-desist disputes, or cancellation proceedings have been identified, other than the pending TTAB opposition proceeding described below.
2. Pending TTAB Opposition. A third party filed a U.S. trademark application in 2022 for the mark "VELOAPAY" (note the spelling difference — "VELOAPAY" versus "VELOPAY") in Class 36 (financial services). VeloPay identified the application through its Sentinel Brand Watch LLC monitoring service and filed a Notice of Opposition with the Trademark Trial and Appeal Board in 2023. The opposition proceeding is currently pending. VeloPay's trademark counsel at Wentworth & Calloway LLP has advised that VeloPay has strong grounds for opposition based on the likelihood of confusion between "VELOAPAY" and VeloPay's prior-registered "VELOPAY" mark in the same class of services. Counsel has expressed confidence in a favorable outcome but the matter has not yet been resolved. We recommend that this pending opposition proceeding be included on the disclosure schedules to the Merger Agreement.
3. PAYSTREAM Mark Assignment. The assignment of the "PAYSTREAM" mark from PayStream Gateway LLC to VeloPay was properly documented and recorded with the USPTO as part of the 2021 acquisition. No issues with the chain of title for the PAYSTREAM marks were identified.
4. Trademark Registrations — Completeness. VeloPay's trademark portfolio is comprehensive for its current operations but, as noted above, could benefit from expanded international filings and selective registration of currently unregistered marks post-closing.
V. Copyrights
A. Software Copyrights
VeloPay's core payments processing platform, the VeloPay Shield fraud detection suite, the VeloPay Analytics dashboard, and the PayStream Gateway payment gateway software are all protectable as original works of authorship under the Copyright Act of 1976 (17 U.S.C. Section 101 et seq.). These software products represent VeloPay's most commercially significant copyrightable works and embody years of engineering and development effort by VeloPay's approximately 640-person engineering team across its Austin, Denver, Toronto, and Lisbon offices.
VeloPay has not registered any of its software copyrights with the U.S. Copyright Office. This is a common practice among commercial software companies, as copyright protection attaches automatically upon creation of the work without the need for registration. However, under U.S. law, copyright registration is a prerequisite to filing an infringement action in federal court (for works of U.S. origin), and timely registration (prior to infringement or within three months of first publication) is required to obtain statutory damages and attorneys' fees in an infringement action. The absence of registration does not affect VeloPay's ownership or the enforceability of its underlying copyright rights, but it does limit the range of remedies available in the event of infringement.
We recommend that HPE Fund IV consider selective copyright registration of key source code modules and related software works post-closing to enhance VeloPay's enforcement capabilities. Registration of the most commercially valuable modules would preserve the option to seek statutory damages and attorneys' fees in the event of a future infringement claim.
B. Other Copyrightable Works
VeloPay owns copyrights in range other original works of authorship created in the course of its business, including:
• Marketing materials, brochures, and promotional content
• Website content, including the velopay.com, velopay.io, and velopayshield.com websites
• Technical documentation, API documentation, and developer guides
• Training materials, onboarding materials, and user manuals
• White papers, blog posts, and thought leadership content
• Graphic design elements, user interface designs, and visual branding assets
These works are owned by VeloPay as works made for hire under the Copyright Act, or through assignment from employees and contractors pursuant to VeloPay's standard invention assignment and work-for-hire agreements (discussed in Section XI below).
C. Risks
No copyright infringement claims by or against VeloPay have been identified in our review. The primary risk associated with VeloPay's copyright portfolio is the absence of registration, which limits available remedies but does not create an ownership or enforceability concern. We do not view this as a material risk requiring remediation prior to closing, but we do recommend post-closing registration as a prudent protective measure as noted above.
VI. Trade Secrets and Proprietary Information
A. Overview of Trade Secret Portfolio
VeloPay maintains a substantial portfolio of trade secrets and proprietary information that is central to its competitive position in the payments technology industry. Trade secrets represent a particularly important category of IP for VeloPay because much of the Company's core technology — including its algorithms, machine learning models, and internal system architecture — derives its value from secrecy rather than from public disclosure through patent filings. VeloPay's trade secret portfolio includes, but is not limited to, the following categories of confidential information:
• Proprietary payment routing algorithms and optimization logic that determine how transactions are routed across acquiring bank connections and payment networks to minimize cost and maximize authorization success rates
• Fraud detection machine learning models and training data sets, including the feature engineering methodologies, model architectures, hyperparameter configurations, and labeled training data that underpin VeloPay Shield's fraud prevention capabilities
• Merchant underwriting and risk scoring methodologies, including the proprietary criteria, data sources, and scoring algorithms used to evaluate and onboard new merchants
• Customer data analytics and reporting engines, including the proprietary analytics frameworks and data processing pipelines that power VeloPay's analytics dashboard and reporting tools
• Internal API specifications and system architecture documentation, including the design of VeloPay's microservices architecture, internal service communication protocols, and infrastructure configurations
• Pricing models and merchant fee structures, including the proprietary pricing algorithms and competitive benchmarking data used to determine interchange-plus pricing and SaaS subscription fee structures for different merchant segments
• Business strategies, financial projections, customer lists, and strategic planning documents
B. Trade Secret Protection Measures
VeloPay has implemented a multi-layered approach to trade secret protection that is generally consistent with industry best practices for a technology company of its size and maturity. The key protection measures identified in our review are as follows:
Written Policy. VeloPay has adopted a written Trade Secret and Confidential Information Policy (the "Trade Secret Policy"), which defines categories of confidential information, establishes handling and access procedures, and sets forth the obligations of employees and contractors with respect to the protection of trade secrets. The Trade Secret Policy has been reviewed and acknowledged by all current employees, as confirmed by VeloPay's Human Resources department.
Physical and Electronic Access Controls. VeloPay employs role-based access controls to its source code repositories, internal documentation systems, and data processing environments. Access to source code is restricted to authorized engineering personnel on a need-to-know basis, with different access levels defined by team and role. Multi-factor authentication is required for access to all critical systems. Sensitive data is encrypted both at rest and in transit using industry-standard encryption protocols.
Employee Agreements. All VeloPay employees are required to execute confidentiality, invention assignment, and non-disclosure agreements at the time of hire. These agreements contain provisions requiring employees to protect VeloPay's trade secrets and confidential information during and after employment. The standard form agreement also includes non-solicitation provisions. Details regarding the status of employee IP assignment agreements are set forth in Section XI below.
Contractor and Vendor Agreements. VeloPay's standard independent contractor agreement and vendor agreements include confidentiality provisions requiring contractors and vendors to protect VeloPay's confidential information and trade secrets. Material vendor agreements reviewed in the data room contain confidentiality and data protection provisions appropriate to the nature of the services provided.
PCI-DSS Compliance. VeloPay maintains PCI-DSS Level 1 compliance, the highest level of Payment Card Industry Data Security Standard certification, which requires rigorous information security controls, regular security assessments, and ongoing monitoring. PCI-DSS compliance supports VeloPay's trade secret protection infrastructure by mandating comprehensive security measures for systems that process, store, or transmit payment card data. A cross-reference to the Regulatory and Licensing Due Diligence Memorandum prepared by Megan Chu provides additional detail on VeloPay's PCI-DSS compliance posture.
Source Code Security. VeloPay's source code is maintained in private repositories hosted on enterprise-grade version control platforms. Our review did not identify any evidence of public exposure, unauthorized access, or data breach affecting the confidentiality of VeloPay's source code or trade secrets.
C. Risks and Observations
1. Employee Departure Risk. Trade secret protection is inherently vulnerable to the departure of key employees who possess knowledge of VeloPay's proprietary technology, algorithms, and business strategies. VeloPay has approximately 1,340 employees across its offices in Austin, Texas; Denver, Colorado; Toronto, Ontario; and Lisbon, Portugal. The departure of key engineering and data science personnel, particularly those involved in fraud detection model development and payment routing algorithm design, could pose a risk to the continued secrecy of VeloPay's trade secrets if such individuals were to join competitors.
2. Non-Compete Enforceability. The enforceability of non-compete covenants varies significantly by jurisdiction. In particular, Colorado has enacted restrictive legislation (Colorado Revised Statutes Section 8-2-113, as amended effective August 10, 2022) that substantially limits the enforceability of non-compete agreements, generally prohibiting non-compete covenants for employees earning below a specified threshold and imposing procedural requirements for all non-compete agreements. VeloPay's Denver office employs approximately 280 individuals, including a significant number of engineering personnel. The limited enforceability of non-compete provisions for Colorado-based employees represents a residual risk to trade secret protection. Texas, Ontario, and Portugal each have their own legal frameworks governing non-compete enforceability, and we recommend a comprehensive post-closing review of restrictive covenant agreements across all jurisdictions to ensure alignment with HPE Fund IV's employee retention strategy.
3. No Trade Secret Misappropriation Claims. No allegations of trade secret misappropriation by or against VeloPay have been identified in our review of the data room or in our management interviews. This is a favorable finding and suggests that VeloPay's trade secret protection measures have been effective to date.
4. Recommendation. We recommend that HPE Fund IV conduct a post-closing review and update of VeloPay's trade secret protection measures, including a jurisdiction-by-jurisdiction assessment of restrictive covenant enforceability, enhanced access controls and monitoring for departing employees, and alignment of the Trade Secret Policy with HPE Fund IV's portfolio-wide information security standards.
VII. Domain Names and Internet Properties
A. Domain Name Portfolio
VeloPay owns approximately 35 domain names that support its corporate website, product marketing, developer community, and international operations. The domain name portfolio is managed centrally by VeloPay's IT department and is registered through a single registrar, Pinnacle Domain Services Inc. All domain registrations are current, and auto-renewal is enabled for all domains to prevent inadvertent lapse.
The principal domain names in the portfolio include the following:
In addition to the primary domains listed above, VeloPay has registered a number of defensive domain names covering common misspellings (e.g., vellopay.com, velopaye.com, velo-pay.com), alternative top-level domains (e.g., velopay.net, velopay.org, velopay.co), and product-related domains (e.g., velopayanalytics.com, velopayconnect.com). The paystream.com and paystreamgateway.com domains were acquired as part of the PayStream Gateway LLC acquisition in 2021.
A complete schedule of all domain names is set forth in Appendix C.
B. Social Media Accounts
VeloPay maintains verified accounts on major social media and developer platforms under the "VeloPay" and "PayStream" handles, including accounts on Westmark Health IT, X (formerly Fenmore Solutions), Aldermere Data Systems, Crowne Albany Partners LLC, and relevant fintech industry forums. These accounts are controlled by VeloPay's marketing department and are used for brand promotion, developer engagement, and customer communication. Where applicable, accounts are verified to establish authenticity.
Our review confirmed that social media accounts are registered to VeloPay corporate email addresses and are not tied to individual employee personal accounts. Administrative access is managed through VeloPay's marketing team with appropriate credential management procedures.
C. Risks
No domain name disputes, Uniform Domain-Name Dispute-Resolution Policy ("UDRP") proceedings, or cybersquatting claims have been identified in our review. Our review of data room records confirms that all domain registrations are formally held by VeloPay Systems, Inc. or the appropriate subsidiary entity, and not by individual employees, which is consistent with best practices. We recommend ongoing monitoring of the domain landscape to protect against cybersquatting and typosquatting targeting the VeloPay and PayStream brands.
VIII. Technology Licenses — Inbound
A. Third-Party Software Licenses
VeloPay utilizes various third-party commercial software under license to support its platform operations, internal infrastructure, and business functions. The material inbound technology licenses identified in our review include the following categories:
• Cloud Infrastructure Services. VeloPay maintains enterprise agreements with major cloud computing providers for computing, storage, networking, and managed services that underpin its platform infrastructure. These agreements are material to VeloPay's operations and include standard commercial terms and service level agreements.
• Database Management Systems. VeloPay licenses enterprise database management software for transactional data processing, analytics, and reporting functions.
• Payment Card Network SDKs and APIs. VeloPay integrates with major payment card networks (including Pinnacle Enterprises, Hollowell Partners LLC, Pinnacle Partners LLC, and Discover) through licensed SDKs and APIs that enable transaction processing, authorization, and settlement. These integrations are essential to VeloPay's payment processing capabilities.
• Cybersecurity and Monitoring Tools. VeloPay licenses enterprise cybersecurity products including intrusion detection systems, security information and event management (SIEM) platforms, vulnerability scanning tools, and endpoint protection software.
• Enterprise Resource Planning and Internal Productivity Software. VeloPay licenses standard business productivity and ERP software for internal operations, including financial management, human resources, project management, and communication tools.
All material third-party software licenses have been reviewed. The majority of these licenses are governed by standard commercial terms without unusual restrictions or IP-related provisions that would be material to the transaction. License terms, renewal dates, annual costs, and change of control provisions are summarized in Appendix E to this memorandum.
Key licenses that are subject to change of control provisions have been identified and are addressed in the Change of Control Consent Tracker and Analysis Memorandum maintained by Derek Okonkwo. Where consent or notification is required upon the change of control, the relevant license has been included in the tracker for pre-closing or post-closing action.
B. Payment Network Agreements
VeloPay maintains direct or indirect agreements with major payment card networks for transaction processing and settlement. These agreements are central to VeloPay's ability to operate as a payment processor and merchant acquirer. The payment network agreements contain confidentiality and compliance obligations, including requirements that VeloPay maintain PCI-DSS compliance and adhere to network operating rules and regulations. Importantly, these agreements do not convey any IP ownership rights to VeloPay; VeloPay's use of payment network trademarks, logos, and technology is limited to the scope expressly authorized under the applicable agreements.
Certain payment network agreements may require notification upon a change of control of VeloPay. These agreements have been included among the 14 material customer/partner contracts requiring change of control consent or notification, as identified in the Change of Control Consent Tracker and Analysis Memorandum. We anticipate that the required notifications can be made in the ordinary course without material risk of adverse action by the payment networks, but we recommend that these notifications be made promptly following the execution of the Merger Agreement, in accordance with the contractual notification timelines.
C. Risks
1. Change of Control Provisions. Standard license termination or modification provisions upon a change of control could apply to certain enterprise software agreements. The potentially affected agreements have been identified and are tracked in the Change of Control Consent Tracker. We do not anticipate that any of these provisions will present a material obstacle to closing, but we recommend that consents and notifications be obtained and provided in accordance with the agreed timeline.
2. No Material Disputes. No material disputes under third-party software licenses have been identified in our review. All license fees are current, and VeloPay is not in breach of any material license terms based on the information available in the data room.
IX. Technology Licenses — Outbound
A. Customer Agreements
VeloPay licenses its cloud-native payments processing platform, the VeloPay Shield fraud detection suite, and the VeloPay Analytics dashboard to approximately 14,000 merchants under SaaS subscription agreements. VeloPay's standard customer agreement includes a limited, non-exclusive, non-transferable license grant for the customer to access and use VeloPay's platform during the subscription term. The license grant is subject to use restrictions and does not convey any ownership of VeloPay's underlying IP to the customer. VeloPay retains all right, title, and interest in and to its platform, software, technology, and related IP.
VeloPay's revenue model is based on a combination of interchange-plus processing fees (charged on each payment transaction processed through the platform), SaaS subscription fees for the VeloPay Shield and VeloPay Analytics products, and gateway transaction fees for merchants using the PayStream Gateway product. For FY2024, VeloPay reported revenue of $412.3 million and Adjusted EBITDA of $98.1 million, reflecting an Adjusted EBITDA margin of approximately 23.79%.
The top 25 customer agreements by revenue have been reviewed and analyzed in the Material Contracts Summary Memorandum prepared by Derek Okonkwo. The IP-related provisions in these agreements are consistent with VeloPay's standard form, with limited customer-specific modifications. No customer agreement reviewed grants a customer any ownership interest in VeloPay's IP or any exclusive license rights.
B. Strategic Partner and Reseller Agreements
VeloPay has entered into a limited number of technology partnership and reseller agreements granting third parties rights to integrate with or distribute VeloPay's technology. These agreements include, among others, partnerships with banking platform providers, e-commerce platform operators, and financial services technology companies.
All reviewed partnership and reseller agreements include appropriate IP ownership retention provisions confirming VeloPay's continued ownership of its technology and related IP. Where integration or co-development activities are contemplated, the agreements include clear allocation of IP ownership and license-back provisions ensuring that VeloPay retains ownership of its pre-existing and independently developed IP while granting the partner a limited license to use VeloPay's technology solely for the purposes of the partnership.