litigation-contingent-liabilities-memo.docx

1003-00003 · Harrowgate Private Equity Fund IV LP · Diligence

litigation-contingent-liabilities-memo.docx DOCUMENT M&A / Corporate

36 / 78 ← → ✕

CALDERWOOD & HARKNESS LLP 787 Seventh Avenue, 38th Floor New York, New York 10019 Telephone: (212) 555-7800 Facsimile: (212) 555-7801 www.calderwoodharkness.com

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT This memorandum was prepared by Calderwood & Harkness LLP at the direction of and for the exclusive use of Harrowgate Private Equity Fund IV LP and its authorized representatives in connection with the proposed acquisition of VeloPay Systems, Inc. This memorandum contains confidential attorney-client communications and attorney work product. It is not intended for distribution to, or use by, any person or entity other than the intended recipients. Any unauthorized review, use, disclosure, or distribution is prohibited.

MEMORANDUM

TO: Sandra Tung, Responsible Partner, Mergers & Acquisitions Oliver Mackenzie, Billing Partner, Mergers & Acquisitions

FROM: Megan Chu, Lead Associate, Mergers & Acquisitions

DATE: February 28, 2025

RE: Litigation and Contingent Liabilities Due Diligence Summary — VeloPay Systems, Inc. and Subsidiaries

MATTER: Harrowgate Private Equity Fund IV LP — Acquisition of VeloPay Systems, Inc. (Matter No. 1003-00003)

Right-click to update Table of Contents

I. Executive Summary

This memorandum summarizes the results of our due diligence review of all pending, threatened, and historical litigation, regulatory inquiries, governmental investigations, and other contingent liabilities identified in connection with Harrowgate Private Equity Fund IV LP's ("HPE Fund IV" or the "Buyer") proposed acquisition of VeloPay Systems, Inc. ("VeloPay" or the "Company") and its subsidiaries. The proposed transaction, valued at approximately $1.9 billion, is structured as a reverse triangular merger in which HPE Fund IV's acquisition subsidiary will merge with and into VeloPay, with VeloPay surviving as a wholly owned subsidiary of HPE Fund IV. The Merger Agreement and Plan of Reorganization (the "Merger Agreement") is currently under negotiation, with an anticipated signing date in mid-March 2025 and an expected closing date in the second quarter of 2025, subject to regulatory approvals and satisfaction of customary closing conditions.

The scope of this memorandum encompasses VeloPay Systems, Inc. and each of its direct and indirect subsidiaries, namely: VeloPay Processing LLC, a Texas limited liability company; VeloPay Canada Inc., a corporation organized under the laws of British Columbia, Canada; VeloPay Fraud intelligence Inc., a Delaware corporation; PayStream Gateway LLC, a Delaware limited liability company; and VeloPay Europe, Unipessoal Lda., a Portuguese limited liability company organized under the laws of the Republic of Portugal. Collectively, these entities are referred to herein as the "VeloPay Group" or the "Company and its Subsidiaries."

Our review has been based on the following principal sources: (a) materials made available in VeloPay's electronic due diligence data room, which was opened on December 12, 2024 and has been maintained by Whitford Jessup & Crane LLP, counsel to VeloPay; (b) management interviews conducted with Danielle Moreau, General Counsel of VeloPay, and Marcus Langford, Chief Financial Officer of VeloPay; (c) public court docket searches and administrative tribunal filings obtained via PACER and applicable state court systems; (d) review of VeloPay's audited consolidated financial statements for the fiscal year ended December 31, 2024, prepared in accordance with U.S. Generally Accepted Accounting Principles and audited by Vance Thornbury & Co. LLP (engagement partner Robert Paulsen), including the contingent liability footnotes contained therein; (e) preliminary disclosure schedules delivered by VeloPay's counsel, Whitford Jessup & Crane LLP (Rebecca Thornton-Hayes and James Okoro), together with supplemental responses received through the date of this memorandum; and (f) discussions with VeloPay's outside litigation counsel and regulatory advisors, where available.

Based on our review, we have identified a total of seven (7) pending or active litigation matters, one (1) threatened litigation claim, one (1) active federal regulatory inquiry, one (1) ongoing IRS examination, and several other contingent liability exposures of varying significance. The aggregate estimated exposure across all identified matters ranges from approximately $6.7 million to $35.7 million. VeloPay has recorded accruals totaling approximately $3.15 million in its FY2024 audited financial statements in connection with these matters. These accruals appear to be within a reasonable range based on our independent assessment, though we note certain matters — most notably the patent infringement action brought by Transact Digital Innovations LLC and the Civil Investigative Demand issued by the Consumer Financial Protection Bureau — carry tail-risk exposure that exceeds VeloPay's current accrual posture.

When measured against the $1.9 billion transaction value, the aggregate estimated exposure range of $6.7 million to $35.7 million represents approximately 0.35% to 1.88% of the deal value. Measured against VeloPay's FY2024 financial profile — revenue of $412.3 million, Adjusted EBITDA of $98.1 million, net income of $41.7 million, and total assets of $689.4 million — the aggregate exposure range represents approximately 6.8% to 36.4% of net income and approximately 1.6% to 8.6% of Adjusted EBITDA. While the upper end of the exposure range is noteworthy, particularly in relation to net income, we do not believe that any individual matter or the aggregate of all identified matters, individually or in the aggregate, would reasonably be expected to constitute a "Material Adverse Effect" as that term is anticipated to be defined in the Merger Agreement.

All matters identified herein should be reflected in VeloPay's disclosure schedules to the Merger Agreement. The patent infringement matter and the CFPB Civil Investigative Demand warrant the closest ongoing attention by the HPE Fund IV deal team, including Priya Deshmukh and Thomas Eriksen, both during the pre-closing period and following consummation of the transaction. Specific recommendations regarding transaction documentation, including representations and warranties, indemnification and escrow mechanics, and post-closing monitoring, are set forth in Sections VIII and IX below.

This memorandum should be read in conjunction with the following related due diligence memoranda, each of which addresses matters that intersect with or complement the analysis herein: (i) the IP Due Diligence Memorandum prepared by Derek Okonkwo; (ii) the Tax Due Diligence Memorandum and State and Local Tax Considerations Memorandum prepared by Leonard Cross; (iii) the Regulatory and Licensing Due Diligence Memorandum prepared by the undersigned; (iv) the Material Contracts Summary Memorandum and Change of Control Consent Tracker and Analysis prepared by Derek Okonkwo; and (v) the R&W Insurance Policy Summary and Coverage Memorandum, D&O Tail Policy Memorandum, and Insurance Deliverables Checklist.

II. Methodology and Diligence Scope

A. Document and Data Sources Reviewed

Our litigation and contingent liabilities due diligence comprised a comprehensive review of the following categories of documents, data, and information sources:

Data Room Materials. We reviewed all materials made available in the VeloPay electronic data room hosted on DealVault, which was opened on December 12, 2024. Specific data room categories reviewed include, without limitation: (i) litigation files, including complaints, answers, motions, discovery correspondence, and case management orders for all pending matters; (ii) demand letters, cease-and-desist correspondence, and pre-litigation communications received by VeloPay or any subsidiary within the preceding five years; (iii) regulatory correspondence, including examination reports, consent orders, inquiries, and responses to regulatory information requests from federal, state, and international regulatory authorities; (iv) insurance claims history for the preceding five years, including claims summaries, loss runs, and correspondence with insurance carriers and brokers; (v) auditor communications from Vance Thornbury & Co. LLP, including management representation letters, internal control deficiency letters, and the auditor's analysis of contingent liabilities for the fiscal years ended December 31, 2022, 2023, and 2024; (vi) internal compliance reports, including reports prepared by VeloPay's internal audit function and compliance department; and (vii) minutes of meetings of the Board of Directors and the Audit Committee of VeloPay for the preceding three years, to the extent they reflected discussion of litigation, regulatory, or contingent liability matters.

Management Interviews. We conducted in-person and videoconference interviews with the following individuals:

• Danielle Moreau, General Counsel, VeloPay Systems, Inc. Interviewed on January 8, 2025 and February 4, 2025. Ms. Moreau provided detailed briefings on all pending and threatened litigation matters, regulatory inquiries, and the Company's internal assessment of each matter's risk profile and probable outcomes.

• Marcus Langford, Chief Financial Officer, VeloPay Systems, Inc. Interviewed on January 10, 2025. Mr. Langford discussed VeloPay's accrual methodology for contingent liabilities, the Company's interactions with Vance Thornbury & Co. LLP regarding loss contingency reserves, and VeloPay's financial exposure assessment for each pending matter.

• Rebecca Thornton-Hayes and James Okoro, partners at Whitford Jessup & Crane LLP, outside counsel to VeloPay. Participated in a joint diligence call on January 15, 2025 and provided supplemental responses to our diligence request list on February 7, 2025 and February 19, 2025.

Public Records Searches. We conducted independent public records searches to verify and supplement the litigation information provided by VeloPay. Specific databases and systems searched include: (i) PACER (Public Access to Court Electronic Records) for all federal district courts, bankruptcy courts, and courts of appeals; (ii) state court electronic filing systems for Texas, Delaware, New York, California, Colorado, and all other states where VeloPay maintains an office, employee presence, or registered agent; (iii) administrative tribunal filings, including proceedings before the United States Patent and Trademark Office, the Trademark Trial and Appeal Board, and applicable state regulatory agencies; (iv) state regulatory databases, including the New York Department of Financial Services, the California Department of Financial Protection and Innovation, the Texas Department of Banking, and comparable agencies in each state where VeloPay holds a money transmitter license; and (v) SEC EDGAR filings (to confirm VeloPay does not have any public reporting obligations and to verify the absence of material litigation disclosures by any counterparty that would reference VeloPay).

Financial Statement Review. We reviewed the contingent liability footnotes (Note 18 — Commitments and Contingencies) in VeloPay's audited consolidated financial statements for the fiscal year ended December 31, 2024, as audited by Vance Thornbury & Co. LLP. We also reviewed the comparable footnotes for the fiscal years ended December 31, 2022 and 2023, and traced the year-over-year changes in accruals and disclosures for identified matters. We further reviewed VeloPay's unaudited interim financial statements for the quarter ended September 30, 2024 to confirm that no interim developments had been identified that were not reflected in the year-end financials.

B. Limitations and Qualifications

The analysis contained in this memorandum is subject to the following limitations and qualifications, each of which should be considered in evaluating the conclusions and recommendations herein:

Reliance on Data Room Materials and Management Representations. Our analysis is necessarily based upon, and limited by, the completeness and accuracy of the documents and information provided to us by VeloPay, its management, and its counsel. We have not conducted an independent audit or verification of the underlying facts and have relied upon the representations of Danielle Moreau and Marcus Langford regarding VeloPay's litigation history, pending claims, and accrual methodology. To the extent that VeloPay has failed to disclose material litigation or contingent liabilities, or has provided incomplete or inaccurate information, the conclusions in this memorandum would need to be revised.

Temporal Limitation. This memorandum reflects information available to us as of the date hereof, February 28, 2025. Litigation matters and regulatory proceedings are inherently dynamic, and the status, risk profile, and potential exposure associated with any matter may change materially at any time. We will update this memorandum as part of the bring-down diligence process to be conducted prior to the anticipated closing of the transaction, and we recommend that the HPE Fund IV deal team request updated litigation reports from VeloPay management at regular intervals through closing.

Privileged Materials. Certain litigation strategy memoranda, attorney-client communications, and other privileged materials maintained by VeloPay's outside litigation counsel were not made available for our review. Where such materials were withheld, VeloPay or its counsel provided non-privileged summaries of the matter's status and risk assessment. Our analysis of those matters is limited to the information contained in such non-privileged summaries, the publicly available docket information, and our general assessment of the applicable law and procedural posture. We do not believe that access to the withheld privileged materials would materially change the conclusions set forth herein, but we cannot provide absolute assurance on that point.

International Matters. VeloPay's Canadian subsidiary, VeloPay Canada Inc., and its Portuguese subsidiary, VeloPay Europe, Unipessoal Lda., have been included within the scope of our review. However, our analysis of matters involving those entities has been conducted under U.S. legal principles and with limited local-law analysis. We have not engaged local counsel in Canada or Portugal for purposes of this memorandum. Should any material litigation, regulatory, or contingent liability matter be identified with respect to VeloPay Canada Inc. or VeloPay Europe, Unipessoal Lda., we recommend that local counsel be engaged in the applicable jurisdiction to provide a jurisdiction-specific legal assessment.

No Legal Opinion. This memorandum constitutes our factual summary and risk assessment of litigation and contingent liabilities identified during due diligence. It does not constitute a legal opinion as to the probable outcome of any pending or threatened matter, nor does it constitute a guarantee or prediction regarding the ultimate resolution or financial exposure of any such matter.

III. Pending Litigation

We have identified seven (7) pending litigation matters and one (1) threatened claim involving VeloPay and its subsidiaries. Each matter is described in detail below, organized by subject-matter category.

A. Merchant Disputes — Contract Claims

1. Pinnacle Retail Solutions, Inc. v. VeloPay Systems, Inc.

Forum: 200th Judicial District Court, Travis County, Texas (Cause No. D-1-GN-24-003487)

Date Filed: April 12, 2024

Nature of Claim: Pinnacle Retail Solutions, Inc. ("Pinnacle"), a mid-market e-commerce retailer, filed this action alleging breach of contract arising under a Merchant Processing Agreement dated September 1, 2021 between Pinnacle and VeloPay. Pinnacle alleges that VeloPay improperly withheld merchant reserve funds totaling approximately $1.7 million during a period of elevated chargeback activity in the fourth quarter of 2023 and the first quarter of 2024. Pinnacle further alleges that VeloPay applied excessive chargeback fees and processing penalties in violation of the fee schedule set forth in the Processing Agreement, resulting in an additional approximately $1.5 million in disputed charges. Pinnacle's petition asserts causes of action for breach of contract, breach of the implied covenant of good faith and fair dealing, and conversion. Pinnacle seeks actual damages in an aggregate amount of approximately $3.2 million, plus pre-judgment and post-judgment interest, attorneys' fees, and costs of court.

Status: The matter is currently in the discovery phase. VeloPay filed its answer and counterclaim on June 28, 2024, asserting counterclaims against Pinnacle for unpaid processing fees in the approximate amount of $1.1 million. VeloPay contends that the reserve holdback was contractually authorized under the Processing Agreement's chargeback management provisions and that the disputed fees were properly assessed in accordance with the applicable fee schedule. Written discovery has been exchanged, and depositions are scheduled to begin in March 2025. No trial date has been set. The parties have not yet engaged in formal settlement discussions, though Danielle Moreau indicated that VeloPay would be open to mediation if Pinnacle were to propose it.

VeloPay's Assessment: Danielle Moreau has advised that VeloPay believes Pinnacle's claims lack merit and that VeloPay's reserve practices and fee assessments were fully compliant with the terms of the Processing Agreement. Ms. Moreau estimates the value of VeloPay's counterclaim at approximately $1.1 million and believes VeloPay is likely to recover on its counterclaim regardless of the outcome of Pinnacle's affirmative claims.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low-to-moderate risk. While the contractual provisions governing merchant reserves and chargeback fees under the Processing Agreement appear to support VeloPay's position, merchant reserve disputes in the payments industry frequently result in negotiated settlements, particularly where the merchant can demonstrate cash flow disruption. Based on our review of the Processing Agreement and the relevant discovery exchanged to date, we estimate that a settlement in the range of $500,000 to $1.5 million is the most likely outcome, with VeloPay potentially obtaining an offset for a portion of its counterclaim. This matter is individually immaterial to the transaction.

Accrual Status: VeloPay has accrued $750,000 in its FY2024 audited financial statements in connection with this matter, reflecting management's estimate of a probable settlement amount. We consider this accrual to be within a reasonable range.

2. GreenLeaf Commerce LLC v. VeloPay Processing LLC

Forum: United States District Court, District of Colorado (Case No. 1:23-cv-02891-RPM)

Date Filed: October 17, 2023

Nature of Claim: GreenLeaf Commerce LLC ("GreenLeaf"), an online marketplace operator, filed this action alleging breach of contract and negligence arising from VeloPay Processing LLC's ("VeloPay Processing") alleged failure to properly settle payment transactions processed through GreenLeaf's platform during a three-day period in August 2023. GreenLeaf alleges that a system malfunction in VeloPay Processing's settlement engine caused a delay in the funding of approximately $1.2 million in settled transactions, which in turn caused GreenLeaf to experience cash flow disruption, resulting in consequential damages including lost sales, vendor relationship damage, and reputational harm. GreenLeaf seeks actual damages of approximately $1.8 million plus consequential damages in an unspecified amount.

Status: The case has progressed through fact discovery, and expert discovery has been completed. VeloPay Processing filed a motion for partial summary judgment on November 15, 2024, arguing that: (i) the Processing Agreement between VeloPay Processing and GreenLeaf contains a limitation of liability clause capping VeloPay Processing's aggregate liability at the total fees paid by GreenLeaf during the twelve-month period preceding the claim, which equates to approximately $340,000; (ii) the Processing Agreement expressly excludes consequential, incidental, and punitive damages; and (iii) GreenLeaf's negligence claim is barred by the economic loss doctrine. GreenLeaf's response in opposition was filed on December 20, 2024, and VeloPay Processing's reply was filed on January 17, 2025. The motion is pending before the court, and no oral argument has been scheduled.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. VeloPay Processing has strong contractual defenses, including the limitation of liability clause and the consequential damages exclusion, both of which appear to be enforceable under Colorado law. If the court grants partial summary judgment on the limitation of liability defense, VeloPay Processing's maximum exposure would be limited to approximately $340,000. Even if summary judgment is denied, we believe that VeloPay Processing is likely to prevail at trial on the contractual limitations. The negligence claim faces significant obstacles under Colorado's economic loss doctrine, which generally bars recovery in tort for purely economic losses arising from a contractual relationship. We estimate the realistic exposure in this matter at $0 to $500,000.

Accrual Status: VeloPay has not recorded any accrual in its FY2024 financial statements in connection with this matter, as management considers the loss to be not probable. Based on our assessment of VeloPay Processing's contractual defenses, we consider this determination to be reasonable.

B. Employment Litigation

3. Delgado v. VeloPay Systems, Inc.

Forum: 419th Judicial District Court, Travis County, Texas (Cause No. D-1-GN-24-005102); Texas Workforce Commission Charge of Discrimination No. 22-2024-01847

Date Filed: July 23, 2024 (state court petition); Texas Workforce Commission charge filed April 15, 2024

Nature of Claim: Maria Delgado, a former Senior Compliance Analyst employed by VeloPay from March 2020 to January 2024, filed a charge of discrimination with the Texas Workforce Commission alleging that she was terminated in retaliation for making internal complaints regarding VeloPay's compliance with certain state money transmitter regulations. Following receipt of a right-to-sue notice, Ms. Delgado filed a petition in Travis County District Court asserting causes of action for wrongful termination in violation of public policy, retaliation under the Texas Labor Code, and intentional infliction of emotional distress. Ms. Delgado alleges that she made multiple internal reports to her supervisor and to VeloPay's compliance department beginning in mid-2023, raising concerns about the adequacy of VeloPay's transaction monitoring procedures in certain states. She alleges that following these reports, she was subjected to a hostile work environment, including removal from certain projects and a negative performance review, and was ultimately terminated on January 19, 2024 as part of what VeloPay characterized as a reduction in force.

Damages Sought: Ms. Delgado seeks recovery of back pay, front pay, compensatory damages for emotional distress, and attorneys' fees. Based on Ms. Delgado's salary, tenure, and the claims asserted, Danielle Moreau estimates the Company's total exposure, if liability is established, at approximately $600,000.

Status: The matter is in pre-trial discovery. Written discovery has been exchanged, and depositions of Ms. Delgado and her former supervisor have been completed. A mediation session has been scheduled for April 8, 2025 before a private mediator in Austin, Texas. No trial date has been set.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. Whistleblower and retaliation claims in Texas present meaningful litigation risk, particularly where the plaintiff can demonstrate a temporal nexus between protected activity and adverse employment action. Here, the approximately six-month gap between Ms. Delgado's initial compliance complaints and her termination is within the window that Texas courts have recognized as supporting a retaliation inference. VeloPay's position that Ms. Delgado's termination was part of a legitimate reduction in force will need to be supported by evidence that the RIF was planned and executed on a non-retaliatory basis. We recommend close monitoring of this matter and note that the upcoming mediation may present an opportunity for resolution. Given the risk profile, we believe a settlement in the range of $200,000 to $450,000 would be reasonable.

Accrual Status: VeloPay has accrued $200,000 in its FY2024 audited financial statements in connection with this matter. We note that this accrual is at the lower end of the range we would consider reasonable and suggest that VeloPay may wish to reassess its accrual following the outcome of the mediation session.

4. Consolidated Wage-and-Hour Matter — FLSA Collective Action

Forum: United States District Court, Western District of Texas, Austin Division (Case No. 1:23-cv-01265-DAE)

Date Filed: September 5, 2023

Nature of Claim: This is a collective action brought under the Fair Labor Standards Act ("FLSA"), 29 U.S.C. § 216(b), and the Texas Payday Law, alleging that VeloPay misclassified certain customer support representatives as exempt employees under the FLSA's administrative exemption and, as a result, failed to pay overtime compensation. The named plaintiffs, Karen Whitfield and Jordan Reyes, are former customer support representatives who allege that their job duties were primarily non-exempt in nature and did not involve the exercise of discretion and independent judgment with respect to matters of significance, as required for the administrative exemption to apply. Plaintiffs contend that VeloPay's customer support representatives are entitled to overtime pay at one and one-half times their regular rate of pay for all hours worked in excess of forty per week.

Class Size and Opt-In Status: The court granted conditional certification of the FLSA collective on March 15, 2024, defining the collective as "all current and former customer support representatives employed by VeloPay Systems, Inc. at any time from September 5, 2020 to the present." VeloPay estimates that approximately 85 current and former employees fall within this definition. Opt-in notices were issued on April 22, 2024, and as of the date of this memorandum, approximately 47 individuals have filed consent-to-join forms. VeloPay has not yet moved for decertification but may do so at the conclusion of discovery.

Damages Sought: Plaintiffs seek unpaid overtime compensation for all collective members, liquidated damages in an equal amount (as provided under the FLSA), and attorneys' fees. Based on VeloPay's internal analysis of the hours worked and compensation levels of the putative collective members, VeloPay estimates the aggregate potential exposure at approximately $2.4 million if liability is established on a collective-wide basis, inclusive of liquidated damages.

Status: The matter is in active discovery. The parties have exchanged written discovery, and depositions of the named plaintiffs and VeloPay's human resources personnel have been completed. Expert reports on the question of whether customer support representatives meet the administrative exemption are due on April 30, 2025. A settlement conference has not yet been scheduled, but the parties have exchanged informal settlement proposals.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. FLSA collective actions involving exemption classification questions are inherently difficult to predict, and the outcome will depend heavily on the factual record regarding the day-to-day duties and responsibilities of VeloPay's customer support representatives. The administrative exemption requires, among other things, that the employee's primary duty be the performance of office or non-manual work directly related to the management or general business operations of the employer, and that the employee exercise discretion and independent judgment with respect to matters of significance. Based on our review of the job descriptions and deposition testimony produced to date, VeloPay's classification appears defensible but not without risk, as several of the job descriptions contain language suggesting significant scripted or routine tasks. We estimate the settlement range at $800,000 to $1.6 million, with the lower end reflecting a scenario in which the collective is narrowed through decertification or attrition and the higher end reflecting a negotiated resolution following an adverse ruling on a dispositive motion.

Accrual Status: VeloPay has accrued $1.0 million in its FY2024 audited financial statements in connection with this matter. We consider this accrual to be within a reasonable range, reflecting approximately the midpoint of our estimated settlement range.

C. Intellectual Property Litigation

5. Transact Digital Innovations LLC v. VeloPay Systems, Inc. and VeloPay Fraud intelligence Inc.

Forum: United States District Court, Eastern District of Texas, marshall Division (Case No. 2:24-cv-00312-JRG)

Date Filed: May 8, 2024

Nature of Claim: Transact Digital Innovations LLC ("Transact Digital"), a non-practicing entity, filed this patent infringement action alleging that VeloPay's fraud detection and risk scoring technology — specifically, the proprietary real-time transaction scoring algorithms developed and maintained by VeloPay Fraud intelligence Inc. — infringes two patents owned by Transact Digital. The patents at issue are U.S. Patent No. 9,847,312 ("Method and System for Real-Time Transaction Risk Scoring Using Machine Learning Models," issued December 19, 2017) and U.S. Patent No. 10,215,688 ("Adaptive Transaction Fraud Detection System with Dynamic Threshold Adjustment," issued February 26, 2019). Transact Digital alleges both literal infringement and infringement under the doctrine of equivalents, and seeks damages in the form of a reasonable royalty.

Potential Exposure: Transact Digital has not yet served its damages expert report, and thus the precise quantum of the claimed royalty is not yet known. However, based on discussions with Danielle Moreau and VeloPay's litigation counsel, VeloPay estimates the potential damages exposure at $5 million to $15 million, calculated as a reasonable royalty on VeloPay's revenues attributable to its fraud detection services during the relevant period. The wide range reflects uncertainty regarding the applicable royalty base and the royalty rate that a damages expert might propose.

Status: The case is in its early stages. Claim construction briefing is underway, and a Markman hearing is scheduled for May 14, 2025. VeloPay has filed petitions for inter partes review ("IPR") with the United States Patent and Trademark Office, challenging the validity of both asserted patents. The IPR petitions were filed on October 4, 2024 (IPR2025-00089, challenging U.S. Patent No. 9,847,312) and October 18, 2024 (IPR2025-00103, challenging U.S. Patent No. 10,215,688). The Patent Trial and Appeal Board has not yet issued institution decisions. If the PTAB institutes review and ultimately finds the claims unpatentable, the district court litigation may be mooted in whole or in part. VeloPay has also filed a motion to stay the district court proceedings pending the outcome of the IPR proceedings, which motion is under advisement.

VeloPay's Assessment: Danielle Moreau and VeloPay's patent litigation counsel have advised that VeloPay believes the asserted patents are invalid as anticipated by prior art and that VeloPay's fraud detection technology does not infringe the asserted claims, properly construed. VeloPay's non-infringement position is based in part on the argument that VeloPay's algorithms employ a fundamentally different technical architecture than the methods claimed in the Transact Digital patents. VeloPay is cautiously optimistic about the prospects of the IPR proceedings, noting that the prior art cited in the IPR petitions includes several references that were not before the examiner during original prosecution.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. Patent litigation in the Eastern District of Texas is notoriously unpredictable, and non-practicing entities have historically achieved favorable outcomes in that forum. However, the inter partes review proceedings at the USPTO represent a meaningful avenue for resolving the patent validity questions outside of the district court. The PTAB institutes review in a substantial majority of petitioned cases, and the invalidation rate for instituted IPRs is significant. If the PTAB institutions are granted and the patents are found unpatentable, the district court action is likely to be resolved without a trial or with a substantially reduced scope. If the IPRs are unsuccessful and the case proceeds to trial, the exposure could be material. We recommend that this matter be included in VeloPay's disclosure schedules to the Merger Agreement and that it be monitored closely by the HPE Fund IV deal team.

Cross-Reference: The IP Due Diligence Memorandum prepared by Derek Okonkwo of this firm contains a detailed patent landscape analysis, including an assessment of VeloPay's freedom-to-operate position and the strength of the Transact Digital patents.

Accrual Status: VeloPay has not recorded any accrual in its FY2024 audited financial statements in connection with this matter, as management considers the loss to be not probable at this stage. Based on the early procedural posture of the case and the pending IPR proceedings, we consider this determination to be reasonable, though we note that the absence of an accrual does not diminish the importance of monitoring this matter.

6. SwiftSettle Technologies, Inc. — Threatened Trade Secret Claim

Nature of Claim: On August 14, 2024, VeloPay received a cease-and-desist letter from Velmoran Brooks LLP, counsel for SwiftSettle Technologies, Inc. ("SwiftSettle"), a competitor in the payment processing technology space. The letter alleges that Dr. Ethan Voss, a former senior engineer at SwiftSettle who was hired by VeloPay Fraud intelligence Inc. in May 2024, misappropriated proprietary algorithms and trade secret information belonging to SwiftSettle and has utilized that information in his work at VeloPay Fraud intelligence. The letter demands that VeloPay immediately terminate Dr. Voss's employment, return all allegedly misappropriated materials, and preserve all relevant documents pending further legal action. The letter references claims under the federal Defend Trade Secrets Act (18 U.S.C. § 1836) and applicable state trade secret statutes.

VeloPay's Response: Upon receipt of the cease-and-desist letter, VeloPay engaged its outside litigation counsel and conducted a thorough internal investigation, including: (i) forensic imaging and review of Dr. Voss's company-issued laptop and email accounts; (ii) review of Dr. Voss's employment agreement with SwiftSettle, including any non-competition, non-solicitation, and confidentiality obligations; (iii) interviews with Dr. Voss and his immediate supervisor; and (iv) a technical comparison of Dr. Voss's work product at VeloPay Fraud intelligence with the algorithms described in SwiftSettle's cease-and-desist letter. Based on the results of this investigation, VeloPay determined that no trade secrets were misappropriated by Dr. Voss and that his work at VeloPay Fraud intelligence was developed independently and does not incorporate any SwiftSettle proprietary information. VeloPay's outside counsel sent a response letter to Velmoran Brooks LLP on September 20, 2024, denying SwiftSettle's allegations and providing a summary of the investigation's findings.

Current Status: No lawsuit has been filed as of the date of this memorandum. SwiftSettle's counsel has not responded to VeloPay's September 2024 response letter. Danielle Moreau has indicated that VeloPay does not believe this matter will result in litigation, but acknowledges that SwiftSettle may choose to file suit at any time.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk based on the available information. VeloPay's internal investigation appears to have been thorough and well-documented, and the absence of any follow-up from SwiftSettle's counsel suggests that the matter may be dormant. However, trade secret claims are fact-intensive and can be difficult to predict, and the absence of litigation to date does not preclude a future filing. We recommend that this matter be disclosed in VeloPay's disclosure schedules as a threatened claim and that it continue to be monitored during the pre-closing period and after closing.

Accrual Status: No accrual has been recorded.

D. PayStream Gateway LLC — Pre-Acquisition Legacy Matters

7. DataRoute Networks Inc. v. PayStream Gateway LLC

Forum: United States District Court, District of Delaware (Case No. 1:20-cv-01547-MN)

Date Filed: November 3, 2020

Nature of Claim: DataRoute Networks Inc. ("DataRoute") filed this action against PayStream Gateway LLC ("PayStream") prior to VeloPay's acquisition of PayStream in 2021. DataRoute alleges that PayStream breached a Technology Licensing Agreement dated January 15, 2018 by improperly sublicensing certain proprietary gateway routing technology developed by DataRoute to third-party merchants and payment facilitators without DataRoute's prior written consent. DataRoute asserts causes of action for breach of contract and misappropriation, seeking damages of approximately $2.5 million.

Background — VeloPay's 2021 Acquisition of PayStream. VeloPay acquired 100% of the membership interests of PayStream Gateway LLC in August 2021 for a purchase price of $45 million. As part of the acquisition, VeloPay assumed PayStream's liabilities, including this pending litigation. The acquisition agreement between VeloPay and PayStream's former members contained indemnification provisions requiring the former members to indemnify VeloPay for losses arising from breaches of representations and warranties, including litigation-related representations. However, the general survival period for those indemnification obligations was eighteen months from closing and has expired. The only remaining indemnification obligations relate to fundamental representations (organization, authority, capitalization) and tax matters, which survive indefinitely and for the applicable statute of limitations, respectively.

Status: This case has been largely dormant since 2022. The last substantive docket activity was the filing of a joint status report on March 15, 2023, in which the parties indicated that they were engaged in settlement discussions. No discovery has been conducted since VeloPay assumed ownership of PayStream. Danielle Moreau has indicated that the parties have exchanged informal settlement proposals, with DataRoute most recently demanding $750,000 and VeloPay offering $200,000, but no agreement has been reached.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. The case's extended dormancy and the relatively modest damages at issue suggest that it is likely to be resolved for nuisance value. We estimate a settlement range of $200,000 to $500,000. We note that because the general indemnification survival period under VeloPay's 2021 acquisition agreement has expired, any settlement amount would be borne entirely by VeloPay (and, post-closing, by HPE Fund IV as the indirect owner of PayStream).

Accrual Status: VeloPay has accrued $300,000 in its FY2024 audited financial statements in connection with this matter. We consider this accrual to be reasonable and consistent with the likely settlement range.

IV. Regulatory Inquiries and Governmental Matters

We have identified several regulatory inquiries, governmental investigations, and related matters affecting VeloPay and its subsidiaries. The most significant of these — the CFPB Civil Investigative Demand — warrants particular attention by the HPE Fund IV deal team.

A. State Regulatory Inquiries — Money Transmitter Compliance

8. New York Department of Financial Services Examination

Nature: The New York Department of Financial Services ("NYDFS") conducted a routine safety and soundness examination of VeloPay's money transmitter operations in the State of New York during the period from April through August 2024. The examination was conducted pursuant to NYDFS's supervisory authority over licensed money transmitters under the New York Banking Law, Article XIII-B, and encompassed a review of VeloPay's transaction processing operations, anti-money laundering and Bank Secrecy Act compliance programs, consumer complaint handling procedures, and financial condition.

Status: The NYDFS issued its examination report on October 22, 2024. The report contained no material findings, criticisms, or enforcement actions. The report did include three minor recommendations regarding VeloPay's transaction monitoring documentation practices, specifically: (i) a recommendation that VeloPay enhance its documentation of the rationale for clearing flagged transactions in certain low-risk categories; (ii) a recommendation that VeloPay increase the frequency of quality assurance reviews of transaction monitoring analyst decisions from quarterly to monthly; and (iii) a recommendation that VeloPay update its transaction monitoring procedures manual to reflect recent NYDFS guidance. VeloPay has advised that all three recommendations have been implemented or are in the process of being implemented as of the date of this memorandum.

Calderwood & Harkness Risk Assessment: This matter presents no material risk to the transaction. The NYDFS examination was routine in nature, and the minor recommendations are typical of regulatory examination findings. We note that VeloPay holds money transmitter licenses in 47 states plus the District of Columbia, and the maintenance of these licenses in good standing is critical to VeloPay's ongoing business operations. Our separate Regulatory and Licensing Due Diligence Memorandum contains a comprehensive analysis of VeloPay's license portfolio and compliance status.

9. California Department of Financial Protection and Innovation Inquiry

Nature: In February 2024, the California Department of Financial Protection and Innovation ("DFPI") initiated an informal inquiry regarding VeloPay's compliance with certain consumer notification requirements under the California Money Transmission Act (Cal. Fin. Code § 2000 et seq.) and related regulations. The inquiry was prompted by a consumer complaint alleging that VeloPay had failed to provide required disclosures regarding transaction fees in connection with a payment processed on behalf of a California-based merchant.

Status: VeloPay provided responsive documentation to the DFPI on March 28, 2024, including copies of its standard consumer-facing disclosures, fee schedules, and the specific transaction records at issue. The DFPI reviewed VeloPay's submissions and closed the matter on May 15, 2024, issuing a letter stating that no further action would be taken. No fine, penalty, or remedial obligation was imposed.

Calderwood & Harkness Risk Assessment: This matter has been fully resolved and presents no ongoing exposure. We include it in this memorandum for completeness and because it is the type of matter that should be considered for inclusion in VeloPay's disclosure schedules.

B. Consumer Financial Protection Bureau (CFPB) — Civil Investigative Demand

10. CFPB Civil Investigative Demand

Date Received: January 18, 2024

Nature: The Consumer Financial Protection Bureau ("CFPB") issued a Civil Investigative Demand ("CID") to VeloPay Systems, Inc. pursuant to Section 1052 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. § 5562). The CID relates to the CFPB's investigation of VeloPay's disclosure practices regarding processing fees charged to small and mid-market merchants. Based on the CID's notification of purpose, the investigation appears to be part of a broader CFPB inquiry into payment processing fee transparency across the payments industry, and VeloPay may not be the only company subject to such an inquiry.

Scope: The CID requests the production of documents and written responses to interrogatories covering the following subject areas for the period from January 1, 2019 to the present: (i) VeloPay's standard and non-standard merchant processing fee schedules; (ii) VeloPay's standard form merchant processing agreements and any amendments thereto; (iii) VeloPay's policies and procedures for disclosing processing fees, interchange fees, assessments, and other charges to merchants at the time of onboarding and on an ongoing basis; (iv) internal communications regarding changes to VeloPay's fee structures or disclosure practices; (v) consumer and merchant complaint logs relating to fee disputes, unexpected charges, or inadequate fee disclosures; (vi) VeloPay's marketing materials and sales presentations directed at small and mid-market merchants; and (vii) samples of merchant statements showing fee breakdowns.

Status: VeloPay has substantially complied with the CID's document production requirements. VeloPay's initial document production was made on April 30, 2024, and supplemental productions were made on July 15, 2024 and September 30, 2024. VeloPay's responses to the interrogatories were submitted on May 31, 2024. VeloPay has cooperated with the CFPB's investigation throughout and has made its personnel available for informal interviews requested by the CFPB. As of the date of this memorandum, the CFPB has not issued a Notice and Opportunity to Respond and Advise ("NORA") letter, has not initiated any enforcement action, and has not indicated whether further proceedings will follow. Danielle Moreau and Rebecca Thornton-Hayes of Whitford Jessup & Crane LLP have advised that the CFPB's staff has not communicated any preliminary findings or concerns.

VeloPay's Outside Counsel Assessment: Rebecca Thornton-Hayes of Whitford Jessup & Crane LLP has advised that, based on her review of VeloPay's fee disclosure practices and the materials produced to the CFPB, she believes VeloPay's disclosures are compliant with applicable law and industry standards. Ms. Thornton-Hayes further indicated that it is possible that the CFPB investigation may close without any enforcement action, but cautioned that the CFPB's enforcement posture in the payments space has been aggressive in recent years, and the outcome of the investigation remains uncertain.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. The CFPB's authority to pursue enforcement actions against payment processors for unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act (12 U.S.C. § 5536) is broad, and CFPB enforcement actions in the payments industry have resulted in significant monetary penalties, consumer restitution orders, and injunctive relief requiring changes to business practices. While VeloPay's fee disclosure practices appear to be generally compliant based on our review, the CFPB's interpretation of what constitutes adequate disclosure can be expansive and may not align with industry practice. We estimate the potential exposure associated with this matter at $0 to $10 million, with the range reflecting scenarios from closure with no action (at the low end) to a contested enforcement action resulting in civil money penalties and remedial obligations (at the high end). We note that the uncertainty inherent in this type of regulatory inquiry makes it difficult to narrow the range further at this time.

Accrual Status: VeloPay has not recorded any accrual in its FY2024 audited financial statements in connection with the CFPB CID, as management considers a loss to be not probable. Given the absence of a NORA letter or any indication from the CFPB of intent to pursue enforcement, we consider this determination to be within the range of reasonable positions, though we note that the matter should be actively monitored.

Relevance to Transaction: This matter should be prominently disclosed in VeloPay's disclosure schedules to the Merger Agreement, specifically in connection with the representations regarding compliance with laws, absence of governmental proceedings, and absence of enforcement actions. The pendency of the CFPB CID may also be relevant to the representations regarding the absence of events, circumstances, or conditions that would reasonably be expected to have a Material Adverse Effect, although we do not believe the CID, in its current posture, rises to that level. We recommend that the bring-down certificate to be delivered by VeloPay at closing specifically address the status of the CFPB CID.

C. Tax Audits / Inquiries

11. IRS Examination — VeloPay Systems, Inc.

Tax Years Under Examination: Fiscal years ended December 31, 2021 and December 31, 2022

Nature: The Internal Revenue Service initiated an examination of VeloPay's federal income tax returns for the 2021 and 2022 tax years. The examination was assigned to IRS Large Business and International Division and is being conducted by Revenue Agent Patricia Woo. Based on information provided by VeloPay's tax advisors, the examination has focused primarily on two areas: (i) VeloPay's claims for research and development tax credits under Section 41 of the Internal Revenue Code, totaling approximately $2.8 million across the two examined years; and (ii) VeloPay's intercompany transfer pricing arrangements between VeloPay Systems, Inc. and VeloPay Canada Inc., specifically the pricing of software development services provided by VeloPay Canada Inc. to the U.S. parent under an intercompany services agreement.

Status: The examination is ongoing. VeloPay's tax advisors at Whitford Jessup & Crane LLP (Ellen Fairchild, Tax Partner) have been responding to Information Document Requests ("IDRs") issued by the examining agent. As of the date of this memorandum, the IRS has issued six IDRs, all of which have been timely responded to. The examining agent has not issued a preliminary notice of proposed adjustment or a Revenue Agent's Report. Ellen Fairchild has indicated that the examination may take an additional six to twelve months to complete.

Potential Exposure: VeloPay's tax advisors estimate that the worst-case adjustment, if the IRS were to fully disallow VeloPay's R&D tax credits and propose an adjustment to the intercompany transfer pricing, would result in approximately $1.8 million in additional federal income tax liability, plus interest and potential penalties. VeloPay has informed us that its R&D credit claims were prepared by a third-party R&D tax credit specialist and are supported by contemporaneous documentation, including qualified research expense analyses and employee activity studies. With respect to the transfer pricing issue, VeloPay has a transfer pricing study prepared by an independent economics firm supporting the arm's-length nature of the intercompany services pricing.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low-to-moderate risk. IRS examinations of R&D tax credits and intercompany transfer pricing are common for technology companies with cross-border operations, and the existence of an ongoing examination is not, in itself, unusual. VeloPay's positions appear to be supportable based on the review conducted by Leonard Cross of this firm's Tax practice, who has concluded that VeloPay's R&D credit documentation is consistent with industry standards and that the transfer pricing study methodology is defensible. That said, R&D credit examinations frequently result in some adjustment, and the IRS may challenge the sufficiency of VeloPay's documentation for certain activities. We estimate the realistic exposure at $0 to $1.2 million, representing a partial adjustment scenario.

Cross-Reference: The Tax Due Diligence Memorandum prepared by Leonard Cross of this firm contains a detailed analysis of VeloPay's federal and state tax positions, including the R&D credit claims and intercompany transfer pricing arrangements.

Accrual Status: VeloPay has recorded a tax reserve of $900,000 in its FY2024 audited financial statements in connection with this examination. We consider this reserve to be reasonable and consistent with our assessment of the probable outcome.

D. Data Privacy and Cybersecurity Incidents

12. Data Security Incident — 2023

Nature: In June 2023, VeloPay's information security team detected unauthorized access to a non-production database environment within VeloPay's cloud infrastructure. The affected database contained certain merchant contact information, including merchant representative names, business email addresses, business phone numbers, and business mailing addresses. Critically, the compromised database did not contain any payment card data, Social Security numbers, bank account information, financial account credentials, or other sensitive financial information. VeloPay determined that the unauthorized access was the result of a misconfigured access control setting that permitted external access to the database through an unprotected API endpoint.

Response: VeloPay engaged CyberShield Forensics LLC, an independent forensic cybersecurity firm, to investigate the scope and impact of the incident. CyberShield's investigation concluded that: (i) the unauthorized access was limited to the single non-production database environment; (ii) the data potentially exposed was limited to merchant contact information as described above; (iii) there was no evidence that the accessed data was exfiltrated, published, or used for any malicious purpose; and (iv) the vulnerability was promptly remediated upon discovery. VeloPay contained the incident within 48 hours of detection by disabling the affected API endpoint and implementing enhanced access controls.

VeloPay notified all affected merchants (approximately 4,200 merchants) in writing, in accordance with applicable breach notification laws. VeloPay also made notifications to the attorneys general and/or data protection regulators in all states where affected merchants were located, as required by applicable state breach notification statutes.

Regulatory Status: No state attorney general or regulatory authority has initiated an enforcement action, investigation, or inquiry in connection with this incident. All required breach notifications were made within the timeframes prescribed by applicable law.

Litigation Status: No lawsuits have been filed in connection with this incident as of the date of this memorandum.

Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. The incident was limited in scope, involved only merchant contact information (not financial or payment data), was promptly detected and remediated, and was the subject of timely breach notifications. VeloPay's PCI-DSS compliance status was not affected by the incident, as the compromised database was a non-production environment that did not process, store, or transmit cardholder data. The absence of any regulatory enforcement action, litigation, or consumer complaint in the approximately twenty months since the incident further supports a low risk assessment.

Relevance to Transaction: This incident should be disclosed in VeloPay's disclosure schedules to the Merger Agreement, specifically in connection with the representations regarding data privacy and cybersecurity, absence of material security incidents, and compliance with applicable data protection laws. While we do not consider this incident to be material, disclosure is prudent to ensure the accuracy of VeloPay's representations and to provide full transparency to HPE Fund IV.

V. Contingent Liabilities (Non-Litigation)

In addition to the pending litigation and regulatory matters described in Sections III and IV above, we have identified the following categories of contingent liabilities affecting VeloPay and its subsidiaries.

A. Indemnification Obligations

VeloPay has standard indemnification obligations in favor of its directors and officers pursuant to Article VIII of its Amended and Restated Certificate of Incorporation (as amended), Section 6.01 of its Amended and Restated Bylaws, and individual indemnification agreements entered into with each director and executive officer. These provisions obligate VeloPay to indemnify and hold harmless its directors and officers against liabilities, losses, and expenses (including attorneys' fees) arising from their service as directors or officers, to the fullest extent permitted by the General Corporation Law of the State of Delaware. The indemnification obligations are consistent with customary market practice for Delaware corporations of comparable size.

VeloPay also has outstanding indemnification obligations under the Membership Interest Purchase Agreement dated August 16, 2021 by and among VeloPay Systems, Inc. and the former members of PayStream Gateway LLC in connection with VeloPay's acquisition of PayStream. As noted in Section III.D above, the general survival period for the seller representations and warranties under that agreement was eighteen months from closing and has expired. The remaining indemnification obligations relate to the fundamental representations (organization, authority, and capitalization), which survive indefinitely, and the tax representations, which survive for the applicable statute of limitations. No claims have been made under the PayStream acquisition agreement's indemnification provisions, and VeloPay does not anticipate that any such claims will be made.

In the ordinary course of its business, VeloPay provides standard contractual indemnities in its merchant processing agreements, pursuant to which VeloPay indemnifies merchants and their affiliates against losses, damages, and liabilities arising from VeloPay's breach of the processing agreement, VeloPay's negligence or willful misconduct, and VeloPay's violation of applicable law. The aggregate potential exposure under these contractual indemnities is inherently difficult to quantify, as it depends on the nature and scope of any future breach or negligent act, but such indemnification obligations are standard in the payments processing industry and are not unique to VeloPay. VeloPay's professional liability (errors and omissions) insurance policy provides coverage for certain claims that may arise under these contractual indemnities.

B. Guarantees and Letters of Credit

VeloPay has posted surety bonds or standby letters of credit in connection with its money transmitter licenses in certain states that require such instruments as a condition of licensure. The aggregate face amount of these surety bonds and letters of credit is approximately $12.5 million as of the date of this memorandum. The bonds and letters of credit are issued by a combination of Tralvendo National Bank and Prairie State Bank, N.A., and are secured by a pledge of cash collateral or by VeloPay's general credit. The specific surety bond and letter of credit requirements vary by state and are detailed in our separate Regulatory and Licensing Due Diligence Memorandum.

These surety bonds and letters of credit will need to be maintained or replaced in connection with the closing of the transaction. We recommend that the HPE Fund IV deal team coordinate with Tralvendo National Bank and Prairie State Bank, N.A. regar

CALDERWOOD & HARKNESS LLP 787 Seventh Avenue, 38th Floor New York, New York 10019 Telephone: (212) 555-7800 Facsimile: (212) 555-7801 www.calderwoodharkness.com
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED — ATTORNEY WORK PRODUCT This memorandum was prepared by Calderwood & Harkness LLP at the direction of and for the exclusive use of Harrowgate Private Equity Fund IV LP and its authorized representatives in connection with the proposed acquisition of VeloPay Systems, Inc. This memorandum contains confidential attorney-client communications and attorney work product. It is not intended for distribution to, or use by, any person or entity other than the intended recipients. Any unauthorized review, use, disclosure, or distribution is prohibited.
MEMORANDUM
TO: Sandra Tung, Responsible Partner, Mergers & Acquisitions Oliver Mackenzie, Billing Partner, Mergers & Acquisitions
FROM: Megan Chu, Lead Associate, Mergers & Acquisitions
DATE: February 28, 2025
RE: Litigation and Contingent Liabilities Due Diligence Summary — VeloPay Systems, Inc. and Subsidiaries
MATTER: Harrowgate Private Equity Fund IV LP — Acquisition of VeloPay Systems, Inc. (Matter No. 1003-00003)
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the results of our due diligence review of all pending, threatened, and historical litigation, regulatory inquiries, governmental investigations, and other contingent liabilities identified in connection with Harrowgate Private Equity Fund IV LP's ("HPE Fund IV" or the "Buyer") proposed acquisition of VeloPay Systems, Inc. ("VeloPay" or the "Company") and its subsidiaries. The proposed transaction, valued at approximately $1.9 billion, is structured as a reverse triangular merger in which HPE Fund IV's acquisition subsidiary will merge with and into VeloPay, with VeloPay surviving as a wholly owned subsidiary of HPE Fund IV. The Merger Agreement and Plan of Reorganization (the "Merger Agreement") is currently under negotiation, with an anticipated signing date in mid-March 2025 and an expected closing date in the second quarter of 2025, subject to regulatory approvals and satisfaction of customary closing conditions.
The scope of this memorandum encompasses VeloPay Systems, Inc. and each of its direct and indirect subsidiaries, namely: VeloPay Processing LLC, a Texas limited liability company; VeloPay Canada Inc., a corporation organized under the laws of British Columbia, Canada; VeloPay Fraud intelligence Inc., a Delaware corporation; PayStream Gateway LLC, a Delaware limited liability company; and VeloPay Europe, Unipessoal Lda., a Portuguese limited liability company organized under the laws of the Republic of Portugal. Collectively, these entities are referred to herein as the "VeloPay Group" or the "Company and its Subsidiaries."
Our review has been based on the following principal sources: (a) materials made available in VeloPay's electronic due diligence data room, which was opened on December 12, 2024 and has been maintained by Whitford Jessup & Crane LLP, counsel to VeloPay; (b) management interviews conducted with Danielle Moreau, General Counsel of VeloPay, and Marcus Langford, Chief Financial Officer of VeloPay; (c) public court docket searches and administrative tribunal filings obtained via PACER and applicable state court systems; (d) review of VeloPay's audited consolidated financial statements for the fiscal year ended December 31, 2024, prepared in accordance with U.S. Generally Accepted Accounting Principles and audited by Vance Thornbury & Co. LLP (engagement partner Robert Paulsen), including the contingent liability footnotes contained therein; (e) preliminary disclosure schedules delivered by VeloPay's counsel, Whitford Jessup & Crane LLP (Rebecca Thornton-Hayes and James Okoro), together with supplemental responses received through the date of this memorandum; and (f) discussions with VeloPay's outside litigation counsel and regulatory advisors, where available.
Based on our review, we have identified a total of seven (7) pending or active litigation matters, one (1) threatened litigation claim, one (1) active federal regulatory inquiry, one (1) ongoing IRS examination, and several other contingent liability exposures of varying significance. The aggregate estimated exposure across all identified matters ranges from approximately $6.7 million to $35.7 million. VeloPay has recorded accruals totaling approximately $3.15 million in its FY2024 audited financial statements in connection with these matters. These accruals appear to be within a reasonable range based on our independent assessment, though we note certain matters — most notably the patent infringement action brought by Transact Digital Innovations LLC and the Civil Investigative Demand issued by the Consumer Financial Protection Bureau — carry tail-risk exposure that exceeds VeloPay's current accrual posture.
When measured against the $1.9 billion transaction value, the aggregate estimated exposure range of $6.7 million to $35.7 million represents approximately 0.35% to 1.88% of the deal value. Measured against VeloPay's FY2024 financial profile — revenue of $412.3 million, Adjusted EBITDA of $98.1 million, net income of $41.7 million, and total assets of $689.4 million — the aggregate exposure range represents approximately 6.8% to 36.4% of net income and approximately 1.6% to 8.6% of Adjusted EBITDA. While the upper end of the exposure range is noteworthy, particularly in relation to net income, we do not believe that any individual matter or the aggregate of all identified matters, individually or in the aggregate, would reasonably be expected to constitute a "Material Adverse Effect" as that term is anticipated to be defined in the Merger Agreement.
All matters identified herein should be reflected in VeloPay's disclosure schedules to the Merger Agreement. The patent infringement matter and the CFPB Civil Investigative Demand warrant the closest ongoing attention by the HPE Fund IV deal team, including Priya Deshmukh and Thomas Eriksen, both during the pre-closing period and following consummation of the transaction. Specific recommendations regarding transaction documentation, including representations and warranties, indemnification and escrow mechanics, and post-closing monitoring, are set forth in Sections VIII and IX below.
This memorandum should be read in conjunction with the following related due diligence memoranda, each of which addresses matters that intersect with or complement the analysis herein: (i) the IP Due Diligence Memorandum prepared by Derek Okonkwo; (ii) the Tax Due Diligence Memorandum and State and Local Tax Considerations Memorandum prepared by Leonard Cross; (iii) the Regulatory and Licensing Due Diligence Memorandum prepared by the undersigned; (iv) the Material Contracts Summary Memorandum and Change of Control Consent Tracker and Analysis prepared by Derek Okonkwo; and (v) the R&W Insurance Policy Summary and Coverage Memorandum, D&O Tail Policy Memorandum, and Insurance Deliverables Checklist.
II. Methodology and Diligence Scope
A. Document and Data Sources Reviewed
Our litigation and contingent liabilities due diligence comprised a comprehensive review of the following categories of documents, data, and information sources:
Data Room Materials. We reviewed all materials made available in the VeloPay electronic data room hosted on DealVault, which was opened on December 12, 2024. Specific data room categories reviewed include, without limitation: (i) litigation files, including complaints, answers, motions, discovery correspondence, and case management orders for all pending matters; (ii) demand letters, cease-and-desist correspondence, and pre-litigation communications received by VeloPay or any subsidiary within the preceding five years; (iii) regulatory correspondence, including examination reports, consent orders, inquiries, and responses to regulatory information requests from federal, state, and international regulatory authorities; (iv) insurance claims history for the preceding five years, including claims summaries, loss runs, and correspondence with insurance carriers and brokers; (v) auditor communications from Vance Thornbury & Co. LLP, including management representation letters, internal control deficiency letters, and the auditor's analysis of contingent liabilities for the fiscal years ended December 31, 2022, 2023, and 2024; (vi) internal compliance reports, including reports prepared by VeloPay's internal audit function and compliance department; and (vii) minutes of meetings of the Board of Directors and the Audit Committee of VeloPay for the preceding three years, to the extent they reflected discussion of litigation, regulatory, or contingent liability matters.
Management Interviews. We conducted in-person and videoconference interviews with the following individuals:
• Danielle Moreau, General Counsel, VeloPay Systems, Inc. Interviewed on January 8, 2025 and February 4, 2025. Ms. Moreau provided detailed briefings on all pending and threatened litigation matters, regulatory inquiries, and the Company's internal assessment of each matter's risk profile and probable outcomes.
• Marcus Langford, Chief Financial Officer, VeloPay Systems, Inc. Interviewed on January 10, 2025. Mr. Langford discussed VeloPay's accrual methodology for contingent liabilities, the Company's interactions with Vance Thornbury & Co. LLP regarding loss contingency reserves, and VeloPay's financial exposure assessment for each pending matter.
• Rebecca Thornton-Hayes and James Okoro, partners at Whitford Jessup & Crane LLP, outside counsel to VeloPay. Participated in a joint diligence call on January 15, 2025 and provided supplemental responses to our diligence request list on February 7, 2025 and February 19, 2025.
Public Records Searches. We conducted independent public records searches to verify and supplement the litigation information provided by VeloPay. Specific databases and systems searched include: (i) PACER (Public Access to Court Electronic Records) for all federal district courts, bankruptcy courts, and courts of appeals; (ii) state court electronic filing systems for Texas, Delaware, New York, California, Colorado, and all other states where VeloPay maintains an office, employee presence, or registered agent; (iii) administrative tribunal filings, including proceedings before the United States Patent and Trademark Office, the Trademark Trial and Appeal Board, and applicable state regulatory agencies; (iv) state regulatory databases, including the New York Department of Financial Services, the California Department of Financial Protection and Innovation, the Texas Department of Banking, and comparable agencies in each state where VeloPay holds a money transmitter license; and (v) SEC EDGAR filings (to confirm VeloPay does not have any public reporting obligations and to verify the absence of material litigation disclosures by any counterparty that would reference VeloPay).
Financial Statement Review. We reviewed the contingent liability footnotes (Note 18 — Commitments and Contingencies) in VeloPay's audited consolidated financial statements for the fiscal year ended December 31, 2024, as audited by Vance Thornbury & Co. LLP. We also reviewed the comparable footnotes for the fiscal years ended December 31, 2022 and 2023, and traced the year-over-year changes in accruals and disclosures for identified matters. We further reviewed VeloPay's unaudited interim financial statements for the quarter ended September 30, 2024 to confirm that no interim developments had been identified that were not reflected in the year-end financials.
B. Limitations and Qualifications
The analysis contained in this memorandum is subject to the following limitations and qualifications, each of which should be considered in evaluating the conclusions and recommendations herein:
Reliance on Data Room Materials and Management Representations. Our analysis is necessarily based upon, and limited by, the completeness and accuracy of the documents and information provided to us by VeloPay, its management, and its counsel. We have not conducted an independent audit or verification of the underlying facts and have relied upon the representations of Danielle Moreau and Marcus Langford regarding VeloPay's litigation history, pending claims, and accrual methodology. To the extent that VeloPay has failed to disclose material litigation or contingent liabilities, or has provided incomplete or inaccurate information, the conclusions in this memorandum would need to be revised.
Temporal Limitation. This memorandum reflects information available to us as of the date hereof, February 28, 2025. Litigation matters and regulatory proceedings are inherently dynamic, and the status, risk profile, and potential exposure associated with any matter may change materially at any time. We will update this memorandum as part of the bring-down diligence process to be conducted prior to the anticipated closing of the transaction, and we recommend that the HPE Fund IV deal team request updated litigation reports from VeloPay management at regular intervals through closing.
Privileged Materials. Certain litigation strategy memoranda, attorney-client communications, and other privileged materials maintained by VeloPay's outside litigation counsel were not made available for our review. Where such materials were withheld, VeloPay or its counsel provided non-privileged summaries of the matter's status and risk assessment. Our analysis of those matters is limited to the information contained in such non-privileged summaries, the publicly available docket information, and our general assessment of the applicable law and procedural posture. We do not believe that access to the withheld privileged materials would materially change the conclusions set forth herein, but we cannot provide absolute assurance on that point.
International Matters. VeloPay's Canadian subsidiary, VeloPay Canada Inc., and its Portuguese subsidiary, VeloPay Europe, Unipessoal Lda., have been included within the scope of our review. However, our analysis of matters involving those entities has been conducted under U.S. legal principles and with limited local-law analysis. We have not engaged local counsel in Canada or Portugal for purposes of this memorandum. Should any material litigation, regulatory, or contingent liability matter be identified with respect to VeloPay Canada Inc. or VeloPay Europe, Unipessoal Lda., we recommend that local counsel be engaged in the applicable jurisdiction to provide a jurisdiction-specific legal assessment.
No Legal Opinion. This memorandum constitutes our factual summary and risk assessment of litigation and contingent liabilities identified during due diligence. It does not constitute a legal opinion as to the probable outcome of any pending or threatened matter, nor does it constitute a guarantee or prediction regarding the ultimate resolution or financial exposure of any such matter.
III. Pending Litigation
We have identified seven (7) pending litigation matters and one (1) threatened claim involving VeloPay and its subsidiaries. Each matter is described in detail below, organized by subject-matter category.
A. Merchant Disputes — Contract Claims
1. Pinnacle Retail Solutions, Inc. v. VeloPay Systems, Inc.
Forum: 200th Judicial District Court, Travis County, Texas (Cause No. D-1-GN-24-003487)
Date Filed: April 12, 2024
Nature of Claim: Pinnacle Retail Solutions, Inc. ("Pinnacle"), a mid-market e-commerce retailer, filed this action alleging breach of contract arising under a Merchant Processing Agreement dated September 1, 2021 between Pinnacle and VeloPay. Pinnacle alleges that VeloPay improperly withheld merchant reserve funds totaling approximately $1.7 million during a period of elevated chargeback activity in the fourth quarter of 2023 and the first quarter of 2024. Pinnacle further alleges that VeloPay applied excessive chargeback fees and processing penalties in violation of the fee schedule set forth in the Processing Agreement, resulting in an additional approximately $1.5 million in disputed charges. Pinnacle's petition asserts causes of action for breach of contract, breach of the implied covenant of good faith and fair dealing, and conversion. Pinnacle seeks actual damages in an aggregate amount of approximately $3.2 million, plus pre-judgment and post-judgment interest, attorneys' fees, and costs of court.
Status: The matter is currently in the discovery phase. VeloPay filed its answer and counterclaim on June 28, 2024, asserting counterclaims against Pinnacle for unpaid processing fees in the approximate amount of $1.1 million. VeloPay contends that the reserve holdback was contractually authorized under the Processing Agreement's chargeback management provisions and that the disputed fees were properly assessed in accordance with the applicable fee schedule. Written discovery has been exchanged, and depositions are scheduled to begin in March 2025. No trial date has been set. The parties have not yet engaged in formal settlement discussions, though Danielle Moreau indicated that VeloPay would be open to mediation if Pinnacle were to propose it.
VeloPay's Assessment: Danielle Moreau has advised that VeloPay believes Pinnacle's claims lack merit and that VeloPay's reserve practices and fee assessments were fully compliant with the terms of the Processing Agreement. Ms. Moreau estimates the value of VeloPay's counterclaim at approximately $1.1 million and believes VeloPay is likely to recover on its counterclaim regardless of the outcome of Pinnacle's affirmative claims.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low-to-moderate risk. While the contractual provisions governing merchant reserves and chargeback fees under the Processing Agreement appear to support VeloPay's position, merchant reserve disputes in the payments industry frequently result in negotiated settlements, particularly where the merchant can demonstrate cash flow disruption. Based on our review of the Processing Agreement and the relevant discovery exchanged to date, we estimate that a settlement in the range of $500,000 to $1.5 million is the most likely outcome, with VeloPay potentially obtaining an offset for a portion of its counterclaim. This matter is individually immaterial to the transaction.
Accrual Status: VeloPay has accrued $750,000 in its FY2024 audited financial statements in connection with this matter, reflecting management's estimate of a probable settlement amount. We consider this accrual to be within a reasonable range.
2. GreenLeaf Commerce LLC v. VeloPay Processing LLC
Forum: United States District Court, District of Colorado (Case No. 1:23-cv-02891-RPM)
Date Filed: October 17, 2023
Nature of Claim: GreenLeaf Commerce LLC ("GreenLeaf"), an online marketplace operator, filed this action alleging breach of contract and negligence arising from VeloPay Processing LLC's ("VeloPay Processing") alleged failure to properly settle payment transactions processed through GreenLeaf's platform during a three-day period in August 2023. GreenLeaf alleges that a system malfunction in VeloPay Processing's settlement engine caused a delay in the funding of approximately $1.2 million in settled transactions, which in turn caused GreenLeaf to experience cash flow disruption, resulting in consequential damages including lost sales, vendor relationship damage, and reputational harm. GreenLeaf seeks actual damages of approximately $1.8 million plus consequential damages in an unspecified amount.
Status: The case has progressed through fact discovery, and expert discovery has been completed. VeloPay Processing filed a motion for partial summary judgment on November 15, 2024, arguing that: (i) the Processing Agreement between VeloPay Processing and GreenLeaf contains a limitation of liability clause capping VeloPay Processing's aggregate liability at the total fees paid by GreenLeaf during the twelve-month period preceding the claim, which equates to approximately $340,000; (ii) the Processing Agreement expressly excludes consequential, incidental, and punitive damages; and (iii) GreenLeaf's negligence claim is barred by the economic loss doctrine. GreenLeaf's response in opposition was filed on December 20, 2024, and VeloPay Processing's reply was filed on January 17, 2025. The motion is pending before the court, and no oral argument has been scheduled.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. VeloPay Processing has strong contractual defenses, including the limitation of liability clause and the consequential damages exclusion, both of which appear to be enforceable under Colorado law. If the court grants partial summary judgment on the limitation of liability defense, VeloPay Processing's maximum exposure would be limited to approximately $340,000. Even if summary judgment is denied, we believe that VeloPay Processing is likely to prevail at trial on the contractual limitations. The negligence claim faces significant obstacles under Colorado's economic loss doctrine, which generally bars recovery in tort for purely economic losses arising from a contractual relationship. We estimate the realistic exposure in this matter at $0 to $500,000.
Accrual Status: VeloPay has not recorded any accrual in its FY2024 financial statements in connection with this matter, as management considers the loss to be not probable. Based on our assessment of VeloPay Processing's contractual defenses, we consider this determination to be reasonable.
B. Employment Litigation
3. Delgado v. VeloPay Systems, Inc.
Forum: 419th Judicial District Court, Travis County, Texas (Cause No. D-1-GN-24-005102); Texas Workforce Commission Charge of Discrimination No. 22-2024-01847
Date Filed: July 23, 2024 (state court petition); Texas Workforce Commission charge filed April 15, 2024
Nature of Claim: Maria Delgado, a former Senior Compliance Analyst employed by VeloPay from March 2020 to January 2024, filed a charge of discrimination with the Texas Workforce Commission alleging that she was terminated in retaliation for making internal complaints regarding VeloPay's compliance with certain state money transmitter regulations. Following receipt of a right-to-sue notice, Ms. Delgado filed a petition in Travis County District Court asserting causes of action for wrongful termination in violation of public policy, retaliation under the Texas Labor Code, and intentional infliction of emotional distress. Ms. Delgado alleges that she made multiple internal reports to her supervisor and to VeloPay's compliance department beginning in mid-2023, raising concerns about the adequacy of VeloPay's transaction monitoring procedures in certain states. She alleges that following these reports, she was subjected to a hostile work environment, including removal from certain projects and a negative performance review, and was ultimately terminated on January 19, 2024 as part of what VeloPay characterized as a reduction in force.
Damages Sought: Ms. Delgado seeks recovery of back pay, front pay, compensatory damages for emotional distress, and attorneys' fees. Based on Ms. Delgado's salary, tenure, and the claims asserted, Danielle Moreau estimates the Company's total exposure, if liability is established, at approximately $600,000.
Status: The matter is in pre-trial discovery. Written discovery has been exchanged, and depositions of Ms. Delgado and her former supervisor have been completed. A mediation session has been scheduled for April 8, 2025 before a private mediator in Austin, Texas. No trial date has been set.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. Whistleblower and retaliation claims in Texas present meaningful litigation risk, particularly where the plaintiff can demonstrate a temporal nexus between protected activity and adverse employment action. Here, the approximately six-month gap between Ms. Delgado's initial compliance complaints and her termination is within the window that Texas courts have recognized as supporting a retaliation inference. VeloPay's position that Ms. Delgado's termination was part of a legitimate reduction in force will need to be supported by evidence that the RIF was planned and executed on a non-retaliatory basis. We recommend close monitoring of this matter and note that the upcoming mediation may present an opportunity for resolution. Given the risk profile, we believe a settlement in the range of $200,000 to $450,000 would be reasonable.
Accrual Status: VeloPay has accrued $200,000 in its FY2024 audited financial statements in connection with this matter. We note that this accrual is at the lower end of the range we would consider reasonable and suggest that VeloPay may wish to reassess its accrual following the outcome of the mediation session.
4. Consolidated Wage-and-Hour Matter — FLSA Collective Action
Forum: United States District Court, Western District of Texas, Austin Division (Case No. 1:23-cv-01265-DAE)
Date Filed: September 5, 2023
Nature of Claim: This is a collective action brought under the Fair Labor Standards Act ("FLSA"), 29 U.S.C. § 216(b), and the Texas Payday Law, alleging that VeloPay misclassified certain customer support representatives as exempt employees under the FLSA's administrative exemption and, as a result, failed to pay overtime compensation. The named plaintiffs, Karen Whitfield and Jordan Reyes, are former customer support representatives who allege that their job duties were primarily non-exempt in nature and did not involve the exercise of discretion and independent judgment with respect to matters of significance, as required for the administrative exemption to apply. Plaintiffs contend that VeloPay's customer support representatives are entitled to overtime pay at one and one-half times their regular rate of pay for all hours worked in excess of forty per week.
Class Size and Opt-In Status: The court granted conditional certification of the FLSA collective on March 15, 2024, defining the collective as "all current and former customer support representatives employed by VeloPay Systems, Inc. at any time from September 5, 2020 to the present." VeloPay estimates that approximately 85 current and former employees fall within this definition. Opt-in notices were issued on April 22, 2024, and as of the date of this memorandum, approximately 47 individuals have filed consent-to-join forms. VeloPay has not yet moved for decertification but may do so at the conclusion of discovery.
Damages Sought: Plaintiffs seek unpaid overtime compensation for all collective members, liquidated damages in an equal amount (as provided under the FLSA), and attorneys' fees. Based on VeloPay's internal analysis of the hours worked and compensation levels of the putative collective members, VeloPay estimates the aggregate potential exposure at approximately $2.4 million if liability is established on a collective-wide basis, inclusive of liquidated damages.
Status: The matter is in active discovery. The parties have exchanged written discovery, and depositions of the named plaintiffs and VeloPay's human resources personnel have been completed. Expert reports on the question of whether customer support representatives meet the administrative exemption are due on April 30, 2025. A settlement conference has not yet been scheduled, but the parties have exchanged informal settlement proposals.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. FLSA collective actions involving exemption classification questions are inherently difficult to predict, and the outcome will depend heavily on the factual record regarding the day-to-day duties and responsibilities of VeloPay's customer support representatives. The administrative exemption requires, among other things, that the employee's primary duty be the performance of office or non-manual work directly related to the management or general business operations of the employer, and that the employee exercise discretion and independent judgment with respect to matters of significance. Based on our review of the job descriptions and deposition testimony produced to date, VeloPay's classification appears defensible but not without risk, as several of the job descriptions contain language suggesting significant scripted or routine tasks. We estimate the settlement range at $800,000 to $1.6 million, with the lower end reflecting a scenario in which the collective is narrowed through decertification or attrition and the higher end reflecting a negotiated resolution following an adverse ruling on a dispositive motion.
Accrual Status: VeloPay has accrued $1.0 million in its FY2024 audited financial statements in connection with this matter. We consider this accrual to be within a reasonable range, reflecting approximately the midpoint of our estimated settlement range.
C. Intellectual Property Litigation
5. Transact Digital Innovations LLC v. VeloPay Systems, Inc. and VeloPay Fraud intelligence Inc.
Forum: United States District Court, Eastern District of Texas, marshall Division (Case No. 2:24-cv-00312-JRG)
Date Filed: May 8, 2024
Nature of Claim: Transact Digital Innovations LLC ("Transact Digital"), a non-practicing entity, filed this patent infringement action alleging that VeloPay's fraud detection and risk scoring technology — specifically, the proprietary real-time transaction scoring algorithms developed and maintained by VeloPay Fraud intelligence Inc. — infringes two patents owned by Transact Digital. The patents at issue are U.S. Patent No. 9,847,312 ("Method and System for Real-Time Transaction Risk Scoring Using Machine Learning Models," issued December 19, 2017) and U.S. Patent No. 10,215,688 ("Adaptive Transaction Fraud Detection System with Dynamic Threshold Adjustment," issued February 26, 2019). Transact Digital alleges both literal infringement and infringement under the doctrine of equivalents, and seeks damages in the form of a reasonable royalty.
Potential Exposure: Transact Digital has not yet served its damages expert report, and thus the precise quantum of the claimed royalty is not yet known. However, based on discussions with Danielle Moreau and VeloPay's litigation counsel, VeloPay estimates the potential damages exposure at $5 million to $15 million, calculated as a reasonable royalty on VeloPay's revenues attributable to its fraud detection services during the relevant period. The wide range reflects uncertainty regarding the applicable royalty base and the royalty rate that a damages expert might propose.
Status: The case is in its early stages. Claim construction briefing is underway, and a Markman hearing is scheduled for May 14, 2025. VeloPay has filed petitions for inter partes review ("IPR") with the United States Patent and Trademark Office, challenging the validity of both asserted patents. The IPR petitions were filed on October 4, 2024 (IPR2025-00089, challenging U.S. Patent No. 9,847,312) and October 18, 2024 (IPR2025-00103, challenging U.S. Patent No. 10,215,688). The Patent Trial and Appeal Board has not yet issued institution decisions. If the PTAB institutes review and ultimately finds the claims unpatentable, the district court litigation may be mooted in whole or in part. VeloPay has also filed a motion to stay the district court proceedings pending the outcome of the IPR proceedings, which motion is under advisement.
VeloPay's Assessment: Danielle Moreau and VeloPay's patent litigation counsel have advised that VeloPay believes the asserted patents are invalid as anticipated by prior art and that VeloPay's fraud detection technology does not infringe the asserted claims, properly construed. VeloPay's non-infringement position is based in part on the argument that VeloPay's algorithms employ a fundamentally different technical architecture than the methods claimed in the Transact Digital patents. VeloPay is cautiously optimistic about the prospects of the IPR proceedings, noting that the prior art cited in the IPR petitions includes several references that were not before the examiner during original prosecution.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. Patent litigation in the Eastern District of Texas is notoriously unpredictable, and non-practicing entities have historically achieved favorable outcomes in that forum. However, the inter partes review proceedings at the USPTO represent a meaningful avenue for resolving the patent validity questions outside of the district court. The PTAB institutes review in a substantial majority of petitioned cases, and the invalidation rate for instituted IPRs is significant. If the PTAB institutions are granted and the patents are found unpatentable, the district court action is likely to be resolved without a trial or with a substantially reduced scope. If the IPRs are unsuccessful and the case proceeds to trial, the exposure could be material. We recommend that this matter be included in VeloPay's disclosure schedules to the Merger Agreement and that it be monitored closely by the HPE Fund IV deal team.
Cross-Reference: The IP Due Diligence Memorandum prepared by Derek Okonkwo of this firm contains a detailed patent landscape analysis, including an assessment of VeloPay's freedom-to-operate position and the strength of the Transact Digital patents.
Accrual Status: VeloPay has not recorded any accrual in its FY2024 audited financial statements in connection with this matter, as management considers the loss to be not probable at this stage. Based on the early procedural posture of the case and the pending IPR proceedings, we consider this determination to be reasonable, though we note that the absence of an accrual does not diminish the importance of monitoring this matter.
6. SwiftSettle Technologies, Inc. — Threatened Trade Secret Claim
Nature of Claim: On August 14, 2024, VeloPay received a cease-and-desist letter from Velmoran Brooks LLP, counsel for SwiftSettle Technologies, Inc. ("SwiftSettle"), a competitor in the payment processing technology space. The letter alleges that Dr. Ethan Voss, a former senior engineer at SwiftSettle who was hired by VeloPay Fraud intelligence Inc. in May 2024, misappropriated proprietary algorithms and trade secret information belonging to SwiftSettle and has utilized that information in his work at VeloPay Fraud intelligence. The letter demands that VeloPay immediately terminate Dr. Voss's employment, return all allegedly misappropriated materials, and preserve all relevant documents pending further legal action. The letter references claims under the federal Defend Trade Secrets Act (18 U.S.C. § 1836) and applicable state trade secret statutes.
VeloPay's Response: Upon receipt of the cease-and-desist letter, VeloPay engaged its outside litigation counsel and conducted a thorough internal investigation, including: (i) forensic imaging and review of Dr. Voss's company-issued laptop and email accounts; (ii) review of Dr. Voss's employment agreement with SwiftSettle, including any non-competition, non-solicitation, and confidentiality obligations; (iii) interviews with Dr. Voss and his immediate supervisor; and (iv) a technical comparison of Dr. Voss's work product at VeloPay Fraud intelligence with the algorithms described in SwiftSettle's cease-and-desist letter. Based on the results of this investigation, VeloPay determined that no trade secrets were misappropriated by Dr. Voss and that his work at VeloPay Fraud intelligence was developed independently and does not incorporate any SwiftSettle proprietary information. VeloPay's outside counsel sent a response letter to Velmoran Brooks LLP on September 20, 2024, denying SwiftSettle's allegations and providing a summary of the investigation's findings.
Current Status: No lawsuit has been filed as of the date of this memorandum. SwiftSettle's counsel has not responded to VeloPay's September 2024 response letter. Danielle Moreau has indicated that VeloPay does not believe this matter will result in litigation, but acknowledges that SwiftSettle may choose to file suit at any time.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk based on the available information. VeloPay's internal investigation appears to have been thorough and well-documented, and the absence of any follow-up from SwiftSettle's counsel suggests that the matter may be dormant. However, trade secret claims are fact-intensive and can be difficult to predict, and the absence of litigation to date does not preclude a future filing. We recommend that this matter be disclosed in VeloPay's disclosure schedules as a threatened claim and that it continue to be monitored during the pre-closing period and after closing.
Accrual Status: No accrual has been recorded.
D. PayStream Gateway LLC — Pre-Acquisition Legacy Matters
7. DataRoute Networks Inc. v. PayStream Gateway LLC
Forum: United States District Court, District of Delaware (Case No. 1:20-cv-01547-MN)
Date Filed: November 3, 2020
Nature of Claim: DataRoute Networks Inc. ("DataRoute") filed this action against PayStream Gateway LLC ("PayStream") prior to VeloPay's acquisition of PayStream in 2021. DataRoute alleges that PayStream breached a Technology Licensing Agreement dated January 15, 2018 by improperly sublicensing certain proprietary gateway routing technology developed by DataRoute to third-party merchants and payment facilitators without DataRoute's prior written consent. DataRoute asserts causes of action for breach of contract and misappropriation, seeking damages of approximately $2.5 million.
Background — VeloPay's 2021 Acquisition of PayStream. VeloPay acquired 100% of the membership interests of PayStream Gateway LLC in August 2021 for a purchase price of $45 million. As part of the acquisition, VeloPay assumed PayStream's liabilities, including this pending litigation. The acquisition agreement between VeloPay and PayStream's former members contained indemnification provisions requiring the former members to indemnify VeloPay for losses arising from breaches of representations and warranties, including litigation-related representations. However, the general survival period for those indemnification obligations was eighteen months from closing and has expired. The only remaining indemnification obligations relate to fundamental representations (organization, authority, capitalization) and tax matters, which survive indefinitely and for the applicable statute of limitations, respectively.
Status: This case has been largely dormant since 2022. The last substantive docket activity was the filing of a joint status report on March 15, 2023, in which the parties indicated that they were engaged in settlement discussions. No discovery has been conducted since VeloPay assumed ownership of PayStream. Danielle Moreau has indicated that the parties have exchanged informal settlement proposals, with DataRoute most recently demanding $750,000 and VeloPay offering $200,000, but no agreement has been reached.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. The case's extended dormancy and the relatively modest damages at issue suggest that it is likely to be resolved for nuisance value. We estimate a settlement range of $200,000 to $500,000. We note that because the general indemnification survival period under VeloPay's 2021 acquisition agreement has expired, any settlement amount would be borne entirely by VeloPay (and, post-closing, by HPE Fund IV as the indirect owner of PayStream).
Accrual Status: VeloPay has accrued $300,000 in its FY2024 audited financial statements in connection with this matter. We consider this accrual to be reasonable and consistent with the likely settlement range.
IV. Regulatory Inquiries and Governmental Matters
We have identified several regulatory inquiries, governmental investigations, and related matters affecting VeloPay and its subsidiaries. The most significant of these — the CFPB Civil Investigative Demand — warrants particular attention by the HPE Fund IV deal team.
A. State Regulatory Inquiries — Money Transmitter Compliance
8. New York Department of Financial Services Examination
Nature: The New York Department of Financial Services ("NYDFS") conducted a routine safety and soundness examination of VeloPay's money transmitter operations in the State of New York during the period from April through August 2024. The examination was conducted pursuant to NYDFS's supervisory authority over licensed money transmitters under the New York Banking Law, Article XIII-B, and encompassed a review of VeloPay's transaction processing operations, anti-money laundering and Bank Secrecy Act compliance programs, consumer complaint handling procedures, and financial condition.
Status: The NYDFS issued its examination report on October 22, 2024. The report contained no material findings, criticisms, or enforcement actions. The report did include three minor recommendations regarding VeloPay's transaction monitoring documentation practices, specifically: (i) a recommendation that VeloPay enhance its documentation of the rationale for clearing flagged transactions in certain low-risk categories; (ii) a recommendation that VeloPay increase the frequency of quality assurance reviews of transaction monitoring analyst decisions from quarterly to monthly; and (iii) a recommendation that VeloPay update its transaction monitoring procedures manual to reflect recent NYDFS guidance. VeloPay has advised that all three recommendations have been implemented or are in the process of being implemented as of the date of this memorandum.
Calderwood & Harkness Risk Assessment: This matter presents no material risk to the transaction. The NYDFS examination was routine in nature, and the minor recommendations are typical of regulatory examination findings. We note that VeloPay holds money transmitter licenses in 47 states plus the District of Columbia, and the maintenance of these licenses in good standing is critical to VeloPay's ongoing business operations. Our separate Regulatory and Licensing Due Diligence Memorandum contains a comprehensive analysis of VeloPay's license portfolio and compliance status.
9. California Department of Financial Protection and Innovation Inquiry
Nature: In February 2024, the California Department of Financial Protection and Innovation ("DFPI") initiated an informal inquiry regarding VeloPay's compliance with certain consumer notification requirements under the California Money Transmission Act (Cal. Fin. Code § 2000 et seq.) and related regulations. The inquiry was prompted by a consumer complaint alleging that VeloPay had failed to provide required disclosures regarding transaction fees in connection with a payment processed on behalf of a California-based merchant.
Status: VeloPay provided responsive documentation to the DFPI on March 28, 2024, including copies of its standard consumer-facing disclosures, fee schedules, and the specific transaction records at issue. The DFPI reviewed VeloPay's submissions and closed the matter on May 15, 2024, issuing a letter stating that no further action would be taken. No fine, penalty, or remedial obligation was imposed.
Calderwood & Harkness Risk Assessment: This matter has been fully resolved and presents no ongoing exposure. We include it in this memorandum for completeness and because it is the type of matter that should be considered for inclusion in VeloPay's disclosure schedules.
B. Consumer Financial Protection Bureau (CFPB) — Civil Investigative Demand
10. CFPB Civil Investigative Demand
Date Received: January 18, 2024
Nature: The Consumer Financial Protection Bureau ("CFPB") issued a Civil Investigative Demand ("CID") to VeloPay Systems, Inc. pursuant to Section 1052 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. § 5562). The CID relates to the CFPB's investigation of VeloPay's disclosure practices regarding processing fees charged to small and mid-market merchants. Based on the CID's notification of purpose, the investigation appears to be part of a broader CFPB inquiry into payment processing fee transparency across the payments industry, and VeloPay may not be the only company subject to such an inquiry.
Scope: The CID requests the production of documents and written responses to interrogatories covering the following subject areas for the period from January 1, 2019 to the present: (i) VeloPay's standard and non-standard merchant processing fee schedules; (ii) VeloPay's standard form merchant processing agreements and any amendments thereto; (iii) VeloPay's policies and procedures for disclosing processing fees, interchange fees, assessments, and other charges to merchants at the time of onboarding and on an ongoing basis; (iv) internal communications regarding changes to VeloPay's fee structures or disclosure practices; (v) consumer and merchant complaint logs relating to fee disputes, unexpected charges, or inadequate fee disclosures; (vi) VeloPay's marketing materials and sales presentations directed at small and mid-market merchants; and (vii) samples of merchant statements showing fee breakdowns.
Status: VeloPay has substantially complied with the CID's document production requirements. VeloPay's initial document production was made on April 30, 2024, and supplemental productions were made on July 15, 2024 and September 30, 2024. VeloPay's responses to the interrogatories were submitted on May 31, 2024. VeloPay has cooperated with the CFPB's investigation throughout and has made its personnel available for informal interviews requested by the CFPB. As of the date of this memorandum, the CFPB has not issued a Notice and Opportunity to Respond and Advise ("NORA") letter, has not initiated any enforcement action, and has not indicated whether further proceedings will follow. Danielle Moreau and Rebecca Thornton-Hayes of Whitford Jessup & Crane LLP have advised that the CFPB's staff has not communicated any preliminary findings or concerns.
VeloPay's Outside Counsel Assessment: Rebecca Thornton-Hayes of Whitford Jessup & Crane LLP has advised that, based on her review of VeloPay's fee disclosure practices and the materials produced to the CFPB, she believes VeloPay's disclosures are compliant with applicable law and industry standards. Ms. Thornton-Hayes further indicated that it is possible that the CFPB investigation may close without any enforcement action, but cautioned that the CFPB's enforcement posture in the payments space has been aggressive in recent years, and the outcome of the investigation remains uncertain.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a moderate risk. The CFPB's authority to pursue enforcement actions against payment processors for unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act (12 U.S.C. § 5536) is broad, and CFPB enforcement actions in the payments industry have resulted in significant monetary penalties, consumer restitution orders, and injunctive relief requiring changes to business practices. While VeloPay's fee disclosure practices appear to be generally compliant based on our review, the CFPB's interpretation of what constitutes adequate disclosure can be expansive and may not align with industry practice. We estimate the potential exposure associated with this matter at $0 to $10 million, with the range reflecting scenarios from closure with no action (at the low end) to a contested enforcement action resulting in civil money penalties and remedial obligations (at the high end). We note that the uncertainty inherent in this type of regulatory inquiry makes it difficult to narrow the range further at this time.
Accrual Status: VeloPay has not recorded any accrual in its FY2024 audited financial statements in connection with the CFPB CID, as management considers a loss to be not probable. Given the absence of a NORA letter or any indication from the CFPB of intent to pursue enforcement, we consider this determination to be within the range of reasonable positions, though we note that the matter should be actively monitored.
Relevance to Transaction: This matter should be prominently disclosed in VeloPay's disclosure schedules to the Merger Agreement, specifically in connection with the representations regarding compliance with laws, absence of governmental proceedings, and absence of enforcement actions. The pendency of the CFPB CID may also be relevant to the representations regarding the absence of events, circumstances, or conditions that would reasonably be expected to have a Material Adverse Effect, although we do not believe the CID, in its current posture, rises to that level. We recommend that the bring-down certificate to be delivered by VeloPay at closing specifically address the status of the CFPB CID.
C. Tax Audits / Inquiries
11. IRS Examination — VeloPay Systems, Inc.
Tax Years Under Examination: Fiscal years ended December 31, 2021 and December 31, 2022
Nature: The Internal Revenue Service initiated an examination of VeloPay's federal income tax returns for the 2021 and 2022 tax years. The examination was assigned to IRS Large Business and International Division and is being conducted by Revenue Agent Patricia Woo. Based on information provided by VeloPay's tax advisors, the examination has focused primarily on two areas: (i) VeloPay's claims for research and development tax credits under Section 41 of the Internal Revenue Code, totaling approximately $2.8 million across the two examined years; and (ii) VeloPay's intercompany transfer pricing arrangements between VeloPay Systems, Inc. and VeloPay Canada Inc., specifically the pricing of software development services provided by VeloPay Canada Inc. to the U.S. parent under an intercompany services agreement.
Status: The examination is ongoing. VeloPay's tax advisors at Whitford Jessup & Crane LLP (Ellen Fairchild, Tax Partner) have been responding to Information Document Requests ("IDRs") issued by the examining agent. As of the date of this memorandum, the IRS has issued six IDRs, all of which have been timely responded to. The examining agent has not issued a preliminary notice of proposed adjustment or a Revenue Agent's Report. Ellen Fairchild has indicated that the examination may take an additional six to twelve months to complete.
Potential Exposure: VeloPay's tax advisors estimate that the worst-case adjustment, if the IRS were to fully disallow VeloPay's R&D tax credits and propose an adjustment to the intercompany transfer pricing, would result in approximately $1.8 million in additional federal income tax liability, plus interest and potential penalties. VeloPay has informed us that its R&D credit claims were prepared by a third-party R&D tax credit specialist and are supported by contemporaneous documentation, including qualified research expense analyses and employee activity studies. With respect to the transfer pricing issue, VeloPay has a transfer pricing study prepared by an independent economics firm supporting the arm's-length nature of the intercompany services pricing.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low-to-moderate risk. IRS examinations of R&D tax credits and intercompany transfer pricing are common for technology companies with cross-border operations, and the existence of an ongoing examination is not, in itself, unusual. VeloPay's positions appear to be supportable based on the review conducted by Leonard Cross of this firm's Tax practice, who has concluded that VeloPay's R&D credit documentation is consistent with industry standards and that the transfer pricing study methodology is defensible. That said, R&D credit examinations frequently result in some adjustment, and the IRS may challenge the sufficiency of VeloPay's documentation for certain activities. We estimate the realistic exposure at $0 to $1.2 million, representing a partial adjustment scenario.
Cross-Reference: The Tax Due Diligence Memorandum prepared by Leonard Cross of this firm contains a detailed analysis of VeloPay's federal and state tax positions, including the R&D credit claims and intercompany transfer pricing arrangements.
Accrual Status: VeloPay has recorded a tax reserve of $900,000 in its FY2024 audited financial statements in connection with this examination. We consider this reserve to be reasonable and consistent with our assessment of the probable outcome.
D. Data Privacy and Cybersecurity Incidents
12. Data Security Incident — 2023
Nature: In June 2023, VeloPay's information security team detected unauthorized access to a non-production database environment within VeloPay's cloud infrastructure. The affected database contained certain merchant contact information, including merchant representative names, business email addresses, business phone numbers, and business mailing addresses. Critically, the compromised database did not contain any payment card data, Social Security numbers, bank account information, financial account credentials, or other sensitive financial information. VeloPay determined that the unauthorized access was the result of a misconfigured access control setting that permitted external access to the database through an unprotected API endpoint.
Response: VeloPay engaged CyberShield Forensics LLC, an independent forensic cybersecurity firm, to investigate the scope and impact of the incident. CyberShield's investigation concluded that: (i) the unauthorized access was limited to the single non-production database environment; (ii) the data potentially exposed was limited to merchant contact information as described above; (iii) there was no evidence that the accessed data was exfiltrated, published, or used for any malicious purpose; and (iv) the vulnerability was promptly remediated upon discovery. VeloPay contained the incident within 48 hours of detection by disabling the affected API endpoint and implementing enhanced access controls.
VeloPay notified all affected merchants (approximately 4,200 merchants) in writing, in accordance with applicable breach notification laws. VeloPay also made notifications to the attorneys general and/or data protection regulators in all states where affected merchants were located, as required by applicable state breach notification statutes.
Regulatory Status: No state attorney general or regulatory authority has initiated an enforcement action, investigation, or inquiry in connection with this incident. All required breach notifications were made within the timeframes prescribed by applicable law.
Litigation Status: No lawsuits have been filed in connection with this incident as of the date of this memorandum.
Calderwood & Harkness Risk Assessment: We assess this matter as presenting a low risk. The incident was limited in scope, involved only merchant contact information (not financial or payment data), was promptly detected and remediated, and was the subject of timely breach notifications. VeloPay's PCI-DSS compliance status was not affected by the incident, as the compromised database was a non-production environment that did not process, store, or transmit cardholder data. The absence of any regulatory enforcement action, litigation, or consumer complaint in the approximately twenty months since the incident further supports a low risk assessment.
Relevance to Transaction: This incident should be disclosed in VeloPay's disclosure schedules to the Merger Agreement, specifically in connection with the representations regarding data privacy and cybersecurity, absence of material security incidents, and compliance with applicable data protection laws. While we do not consider this incident to be material, disclosure is prudent to ensure the accuracy of VeloPay's representations and to provide full transparency to HPE Fund IV.
V. Contingent Liabilities (Non-Litigation)
In addition to the pending litigation and regulatory matters described in Sections III and IV above, we have identified the following categories of contingent liabilities affecting VeloPay and its subsidiaries.
A. Indemnification Obligations
VeloPay has standard indemnification obligations in favor of its directors and officers pursuant to Article VIII of its Amended and Restated Certificate of Incorporation (as amended), Section 6.01 of its Amended and Restated Bylaws, and individual indemnification agreements entered into with each director and executive officer. These provisions obligate VeloPay to indemnify and hold harmless its directors and officers against liabilities, losses, and expenses (including attorneys' fees) arising from their service as directors or officers, to the fullest extent permitted by the General Corporation Law of the State of Delaware. The indemnification obligations are consistent with customary market practice for Delaware corporations of comparable size.
VeloPay also has outstanding indemnification obligations under the Membership Interest Purchase Agreement dated August 16, 2021 by and among VeloPay Systems, Inc. and the former members of PayStream Gateway LLC in connection with VeloPay's acquisition of PayStream. As noted in Section III.D above, the general survival period for the seller representations and warranties under that agreement was eighteen months from closing and has expired. The remaining indemnification obligations relate to the fundamental representations (organization, authority, and capitalization), which survive indefinitely, and the tax representations, which survive for the applicable statute of limitations. No claims have been made under the PayStream acquisition agreement's indemnification provisions, and VeloPay does not anticipate that any such claims will be made.
In the ordinary course of its business, VeloPay provides standard contractual indemnities in its merchant processing agreements, pursuant to which VeloPay indemnifies merchants and their affiliates against losses, damages, and liabilities arising from VeloPay's breach of the processing agreement, VeloPay's negligence or willful misconduct, and VeloPay's violation of applicable law. The aggregate potential exposure under these contractual indemnities is inherently difficult to quantify, as it depends on the nature and scope of any future breach or negligent act, but such indemnification obligations are standard in the payments processing industry and are not unique to VeloPay. VeloPay's professional liability (errors and omissions) insurance policy provides coverage for certain claims that may arise under these contractual indemnities.
B. Guarantees and Letters of Credit
VeloPay has posted surety bonds or standby letters of credit in connection with its money transmitter licenses in certain states that require such instruments as a condition of licensure. The aggregate face amount of these surety bonds and letters of credit is approximately $12.5 million as of the date of this memorandum. The bonds and letters of credit are issued by a combination of Tralvendo National Bank and Prairie State Bank, N.A., and are secured by a pledge of cash collateral or by VeloPay's general credit. The specific surety bond and letter of credit requirements vary by state and are detailed in our separate Regulatory and Licensing Due Diligence Memorandum.
These surety bonds and letters of credit will need to be maintained or replaced in connection with the closing of the transaction. We recommend that the HPE Fund IV deal team coordinate with Tralvendo National Bank and Prairie State Bank, N.A. regar

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts