PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP at the direction of and for the sole benefit of Harrowgate Private Equity Fund IV LP and Harrowgate Capital Management IV LLC. This memorandum and its contents may not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Harrowgate Capital Management IV LLC.
MEMORANDUM
TO:
Sandra Tung, Responsible Partner, Mergers & Acquisitions, Calderwood & Harkness LLP
Priya Deshmukh, Managing Partner, Fund IV, Harrowgate Capital Management IV LLC
Thomas Eriksen, Partner, Head of Financial Technology, Harrowgate Capital Management IV LLC
FROM:
Megan Chu, Lead Associate, Mergers & Acquisitions, Calderwood & Harkness LLP
Derek Okonkwo, Working Associate, Mergers & Acquisitions, Calderwood & Harkness LLP
DATE: February 28, 2025
RE: Regulatory and Licensing Due Diligence Summary — VeloPay Systems, Inc. and Subsidiaries
MATTER NO.: 1003-00003
CLIENT: Harrowgate Private Equity Fund IV LP
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
A. Purpose
This memorandum summarizes the findings of our regulatory and licensing due diligence review conducted in connection with Harrowgate Private Equity Fund IV LP's ("HPE Fund IV" or the "Acquiror") proposed acquisition of VeloPay Systems, Inc. ("VeloPay" or the "Company") for aggregate consideration of approximately $1.9 billion. The transaction is structured as a reverse triangular merger in which Harrowgate Velocity Merger Sub Inc. ("Merger Sub"), a newly formed, wholly owned subsidiary of HPE Fund IV, will merge with and into VeloPay, with VeloPay surviving the merger as a wholly owned subsidiary of HPE Fund IV (the "Transaction"). The aggregate merger consideration of $1,900,000,000, representing $20.00 per fully diluted share of VeloPay common stock, is to be paid in cash at closing.
The purpose of this memorandum is to provide the deal team with a comprehensive assessment of VeloPay's regulatory and licensing landscape, to identify all regulatory approvals required for closing, and to flag any material regulatory risks or compliance deficiencies that may affect the Transaction or the ongoing operations of VeloPay and its subsidiaries following the closing.
B. Scope of Review
Our review encompasses VeloPay Systems, Inc., a Delaware corporation with its principal executive offices located at 1455 Innovation Parkway, Suite 800, Austin, Texas 78759, and each of its five subsidiaries:
1. VeloPay Processing LLC — a Delaware limited liability company and the primary operating subsidiary through which VeloPay conducts its payments processing and merchant acquiring activities;
2. VeloPay Canada Inc. — an Ontario corporation that supports VeloPay's Canadian merchant base from offices in Toronto, Ontario;
3. VeloPay Europe, Unipessoal Lda. — a Portuguese sociedade unipessoal limitada (single-member limited liability company) organized under the laws of Portugal, located in Lisbon, Portugal, which functions primarily as an R&D and engineering center;
4. VeloPay Fraud intelligence Inc. — a Delaware corporation that develops and operates VeloPay's proprietary fraud detection and transaction scoring SaaS product; and
5. PayStream Gateway LLC — a Delaware limited liability company acquired by VeloPay in 2021 for approximately $45 million, which operates VeloPay's payment gateway technology.
Each of these entities is wholly owned, directly or indirectly, by VeloPay Systems, Inc.
C. Transaction Structure
The Transaction is structured as a reverse triangular merger under Section 251 of the Delaware General Corporation Law ("DGCL"). In this structure, Merger Sub will merge with and into VeloPay, with VeloPay surviving as the continuing corporation and a wholly owned subsidiary of HPE Fund IV. This structure was selected, among other reasons, to preserve VeloPay's existing contractual relationships, licenses, and regulatory authorizations, which are held by VeloPay and its subsidiaries and would survive the merger by operation of law. The Merger Agreement (the "Merger Agreement") was signed on March 18, 2025, and closing is targeted for Q3 2025, subject to receipt of all required regulatory clearances and satisfaction of other customary closing conditions.
D. Key Findings
Our review has identified the following key findings, each of which is discussed in greater detail in the body of this memorandum:
(i) VeloPay holds money transmitter licenses (or equivalent registrations or authorizations) in 47 states plus Washington, D.C., for a total of 48 jurisdictions. All licenses are currently active and in good standing as of the date of this memorandum. VeloPay has determined that it is exempt from licensing or does not conduct licensable activity in the remaining three states and U.S. territories. The licensing portfolio is well-maintained and reflects a mature regulatory compliance infrastructure.
(ii) Of the 48 jurisdictions where money transmitter licenses are held, 31 states require some form of change of control approval, notification, or filing in connection with the Transaction. This is a significant pre-closing workstream. We have categorized these 31 states into three tiers based on the nature and timing of their respective requirements: Tier 1 (prior approval required before closing, approximately 12–15 states), Tier 2 (pre-closing notification required without affirmative approval, approximately 8–10 states), and Tier 3 (post-closing notification, approximately 6–8 states). The principal timing risk is associated with Tier 1 states, particularly New York and California, where processing times can extend to 90–120 days.
(iii) VeloPay maintains PCI-DSS Level 1 compliance, the highest level of certification required for service providers processing significant transaction volumes. The current certification is valid through October 2025. No material findings or failed assessments were identified in the last three certification cycles. Because the Transaction is structured as a reverse triangular merger with VeloPay as the surviving entity, re-certification should not be required at closing, though the October 2025 recertification cycle will need to be managed under new ownership.
(iv) VeloPay Canada Inc. is registered as a payment service provider and is subject to applicable Canadian federal and Ontario provincial regulatory requirements. The indirect acquisition of VeloPay Canada Inc. by HPE Fund IV triggers a notification requirement under the Investment Canada Act. The transaction is expected to be a "notification-only" filing (as it falls below the applicable net benefit review threshold for non-cultural, non-state-owned-enterprise transactions), and we do not anticipate any material issues with Canadian regulatory clearance.
(v) VeloPay Europe, Unipessoal Lda. operates primarily as an R&D and engineering center in Lisbon, Portugal. Based on our data room review, VeloPay Europe does not appear to directly process payments or hold customer funds, and its activities appear to be limited to software development and technical support. Accordingly, Portuguese financial regulatory considerations are comparatively modest, though we flag the risk that any post-acquisition expansion of VeloPay Europe's activities into regulated payment processing would trigger PSD2 licensing requirements.
(vi) A premerger notification filing under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 (the "HSR Act") will be required for the Transaction. A separate memorandum addressing the HSR filing strategy, competitive analysis, and anticipated timeline is being prepared by Howard Bellamy, Specialist Partner, Antitrust & Competition, Calderwood & Harkness LLP.
(vii) No material regulatory enforcement actions, pending investigations, material compliance deficiencies, or open corrective action orders were identified in connection with VeloPay or any of its subsidiaries.
E. Overall Risk Assessment
We assess the overall regulatory risk associated with the Transaction as moderate. The principal risk is the timing and administrative burden of securing change of control approvals and notifications across 31 state jurisdictions, particularly in Tier 1 states that require prior written approval before the change of control becomes effective. This workstream is manageable with prompt filing and diligent tracking, and we do not believe it presents a risk of material delay beyond the targeted Q3 2025 closing, provided that applications are submitted within two weeks of the signing of the Merger Agreement and that HPE Fund IV principals cooperate promptly with background check and financial disclosure requirements.
F. Data Room Review
The findings in this memorandum are based on our review of documents and materials made available in VeloPay's virtual data room (the "Data Room"), which was opened on December 12, 2024, hosted on the Crestline Solutions platform, and organized into folders corresponding to the categories in Calderwood & Harkness's Due Diligence Request List (the "Request List"). The Request List was delivered to VeloPay and its counsel, Whitford Jessup & Crane LLP (led by Rebecca Thornton-Hayes, Partner), on December 9, 2024. Our review was supplemented by management interviews conducted with VeloPay's executive team, including Danielle Moreau, General Counsel, and members of VeloPay's compliance and regulatory affairs departments, as well as by written responses to follow-up questions submitted through VeloPay's counsel. A complete index of all documents reviewed in connection with this memorandum is set forth in Appendix D.
II. U.S. MONEY TRANSMITTER LICENSING
A. Overview of VeloPay's Licensing Framework
VeloPay operates a cloud-native payments processing and merchant acquiring platform that facilitates the acceptance, processing, and settlement of electronic payments for merchants across a wide range of industries. The Company processes approximately $87 billion in annualized gross payment volume ("GPV") across a merchant base of more than 14,000 active merchants, encompassing card-present, card-not-present, e-commerce, mobile, and in-app payment transactions. VeloPay's revenue model includes interchange-plus processing fees charged to merchants on a per-transaction basis, SaaS subscription fees for access to VeloPay's proprietary analytics dashboard and fraud detection suite (the latter developed and maintained by VeloPay Fraud intelligence Inc.), and gateway transaction fees generated through PayStream Gateway LLC's payment gateway technology.
VeloPay's payment processing activities — and particularly its role in facilitating the movement of money between merchants and their customers, including the holding, receipt, transmission, and settlement of funds — implicate state money transmission laws in virtually all U.S. states and territories. Each state has adopted its own statutory and regulatory framework governing money transmission, money services businesses, and related payment activities, and these frameworks vary significantly in their definitions, exemptions, licensing requirements, and regulatory burdens.
VeloPay holds money transmitter licenses (or equivalent registrations, authorizations, or exemptions) in 47 states plus the District of Columbia, for a total of 48 jurisdictions. These licenses are held primarily by VeloPay Processing LLC, the operating subsidiary that houses VeloPay's payment processing infrastructure and is the entity through which the vast majority of payment processing and money transmission activities are conducted. In certain states, licenses are held directly by VeloPay Systems, Inc. (the parent corporation) based on the particular state's licensing framework and the manner in which VeloPay's operations are structured in that jurisdiction. PayStream Gateway LLC, the payment gateway technology subsidiary acquired in 2021, operates under VeloPay Processing LLC's licenses in most states. In a small number of states, PayStream holds its own gateway-specific registrations or authorizations where the applicable state regulatory framework treats payment gateway services as a separately licensable activity or where such registrations were in place at the time of the 2021 acquisition and have been maintained for operational continuity.
The breadth of VeloPay's licensing portfolio reflects the nationwide scope of its payment processing business and is consistent with the licensing posture maintained by other payment processors of similar scale. As discussed in detail below, all 48 licenses are currently active and in good standing, surety bond and net worth requirements are satisfied across all jurisdictions, and no material enforcement actions, license suspensions, or revocation proceedings were identified.
B. Jurisdictional License Inventory
We have compiled a comprehensive inventory of all money transmitter licenses held by VeloPay and its subsidiaries, which is set forth in full in Appendix A (Schedule of Money Transmitter Licenses by Jurisdiction). The schedule includes, for each license, the following information:
• The state or jurisdiction in which the license is held;
• The license type (e.g., money transmitter license, money services business license, payment instrument seller license, money transfer agent license, or other equivalent authorization);
• The licensing entity (VeloPay Processing LLC, VeloPay Systems, Inc., or PayStream Gateway LLC);
• The license number;
• The original date of issuance;
• The most recent renewal date;
• The next expiration or renewal date; and
• The current status of the license.
As of the date of this memorandum, all 48 licenses reflected in Appendix A have been confirmed as active and in good standing based on our review of Data Room documents, public license databases, and VeloPay management representations. We note that VeloPay's compliance team maintains an internal license management system that tracks renewal deadlines, filing requirements, and surety bond expirations across all jurisdictions, and we have reviewed this system as part of our diligence.
Jurisdictions Without Licenses
VeloPay does not currently hold money transmitter licenses in three states (Montana, South Carolina, and New Mexico) and does not hold licenses in U.S. territories (Puerto Rico, the U.S. Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands). With respect to these jurisdictions:
• Montana does not have a state money transmitter licensing statute and does not require licensure for money transmission activities. Accordingly, no license is required.
• South Carolina currently exempts payment processors that act as agents of merchants in the settlement of card-based payment transactions from its money transmitter licensing requirements. VeloPay has obtained a written opinion from South Carolina counsel confirming the applicability of this agent-of-payee exemption to VeloPay's business model, a copy of which was provided in the Data Room.
• New Mexico requires a money transmitter license for certain activities, but VeloPay has determined that its transaction volume and the nature of its activities in New Mexico fall within the state's de minimis threshold exemption. VeloPay has represented that it monitors its New Mexico activity levels on a quarterly basis to confirm continued eligibility for this exemption, and we have reviewed documentation supporting this determination.
• With respect to U.S. territories, VeloPay has represented that it does not currently conduct licensable money transmission activities in any U.S. territory and that its merchant base does not include merchants domiciled in these territories in volumes sufficient to trigger licensing requirements. Should VeloPay expand its business into these territories, additional licensing may be required.
We are satisfied that VeloPay's exemption analyses for South Carolina and New Mexico are reasonable based on the information available to us, though we note that exemption determinations inherently involve regulatory interpretation risk and may be subject to challenge by state regulators. We recommend that VeloPay continue to monitor developments in these jurisdictions and reassess its exemption eligibility on a periodic basis.
NMLS Registration. VeloPay Processing LLC maintains an active registration on the Nationwide Multistate Licensing System ("NMLS"), which is the platform through which the majority of state money transmitter license applications, renewals, and regulatory filings are submitted. VeloPay Processing LLC's NMLS Unique Identifier is 1847293. All NMLS filings are current, and VeloPay has designated its Director of Regulatory Affairs, Catherine Hwang, as the primary NMLS contact. We have verified VeloPay Processing LLC's NMLS registration status through the NMLS Consumer Access portal, and all information appears to be accurate and up to date.
C. Surety Bond and Net Worth Requirements
Surety Bonds. The majority of states that require money transmitter licenses also require licensees to maintain surety bonds or other forms of financial security (e.g., irrevocable letters of credit, certificates of deposit, or trust account deposits) as a condition of licensure. The required bond amounts vary by state and are generally calculated based on the licensee's transaction volume, the nature of its activities, and other factors prescribed by state law. Certain states impose a fixed minimum bond amount, while others apply a sliding scale tied to the licensee's actual or projected money transmission volume.
VeloPay Processing LLC and, where applicable, VeloPay Systems, Inc. maintain surety bonds in all jurisdictions where such bonds are required. The aggregate surety bond amount across all licensed jurisdictions is approximately $24.7 million, provided by Federal Surety Underwriters, Inc. under a master surety bond program. All surety bonds are current, and bond renewal dates are tracked in VeloPay's internal license management system. No surety bond claims, draw-downs, or default notifications were identified in connection with any VeloPay entity.
Net Worth and Minimum Capital Requirements
Several states impose minimum net worth or tangible net worth requirements on money transmitter licensees in addition to or in lieu of surety bond requirements. The following states impose particularly noteworthy net worth requirements that we have reviewed in detail:
VeloPay's compliance with all applicable net worth and minimum capital requirements is confirmed based on VeloPay's audited financial statements for fiscal year 2024, which reflect total consolidated assets of $689.4 million and a strong balance sheet position. The FY2024 financial statements were audited by Vance Thornbury & Co. LLP (engagement partner: Robert Paulsen) and received an unqualified opinion. We have reviewed the FY2024 audited financials as part of our financial due diligence and have cross-referenced VeloPay's reported net worth and tangible net worth against the requirements of each applicable jurisdiction. No deficiencies were identified.
D. Examination and Audit History
State Regulatory Examinations
As a licensed money transmitter operating in 48 jurisdictions, VeloPay is subject to periodic examinations by state regulators. We have reviewed VeloPay's examination history for the preceding three years (2022–2024) and identified the following state regulatory examinations:
(i) New York Department of Financial Services ("NYDFS") — 2023 Examination. NYDFS conducted a comprehensive examination of VeloPay Processing LLC's New York money transmitter operations in Q2 2023. The examination covered compliance with the New York Banking Law, BSA/AML compliance, cybersecurity (23 NYCRR Part 500), consumer protection, and financial condition. The final examination report, issued September 2023, identified two minor findings: (a) a recommendation to update certain internal policies to reflect amendments to NYDFS regulations adopted in 2022, and (b) a recommendation to enhance documentation of quarterly AML risk assessments. VeloPay represented that both findings were addressed within 60 days of the report, and we have reviewed correspondence between VeloPay and NYDFS confirming closure of both items. No material deficiencies were identified.
(ii) California Department of Financial Protection and Innovation ("DFPI") — 2022 Examination. DFPI conducted a routine examination of VeloPay Processing LLC's California money transmitter license in Q4 2022. The examination focused on financial condition, transaction volume reporting, and compliance with the California Money Transmission Act. The final report, issued February 2023, contained no findings or recommendations. VeloPay received a satisfactory examination rating.
(iii) Texas Department of Banking — 2024 Examination. The Texas Department of Banking conducted a limited-scope examination of VeloPay Processing LLC's Texas money transmitter license in Q1 2024, focusing on financial condition and permissible investment requirements. The examination resulted in no adverse findings. VeloPay received a satisfactory examination outcome.
(iv) Multi-State MSB Examination (MSBEG Coordinated Examination) — 2023. VeloPay Processing LLC was the subject of a coordinated multi-state examination conducted under the auspices of the Money Services Business Examination Group ("MSBEG"), a consortium of state regulators. The coordinated examination, which was led by the Texas Department of Banking and participated in by regulators from Florida, Georgia, Washington, and Pennsylvania, covered BSA/AML compliance, consumer protection, and financial condition. The examination was completed in Q3 2023, and the coordinated examination report identified no material deficiencies. One recommendation was made regarding the frequency of independent BSA/AML audits, which VeloPay addressed by engaging an independent third-party auditor to conduct BSA/AML testing on an annual rather than biennial basis.
No other state regulatory examinations were identified during the review period, and no outstanding examination findings, corrective action orders, or consent agreements remain open as of the date of this memorandum.
CFPB Supervisory Status
The Consumer Financial Protection Bureau ("CFPB") has authority to supervise certain "larger participants" in markets for consumer financial products and services. VeloPay's annual payment processing volume and consumer-facing activities may place it within the CFPB's larger-participant jurisdiction for certain product lines, including the processing of consumer-initiated electronic payments and the provision of payment-related technology services. Based on our review, VeloPay has not received a formal CFPB examination notice or supervisory designation letter, and VeloPay's General Counsel, Danielle Moreau, represented during our management interview on January 22, 2025, that the Company has not been the subject of any CFPB examination, investigation, or enforcement action. We note, however, that the CFPB's supervisory authority in this area is evolving, and HPE Fund IV should anticipate the possibility of CFPB supervisory engagement during the post-acquisition period.
Enforcement Actions and Investigations
Based on our review of Data Room materials, public records searches, and representations made by VeloPay management and General Counsel Danielle Moreau, no material enforcement actions, license suspensions, license revocations, civil money penalties, consent orders, or cease-and-desist orders have been issued against VeloPay or any of its subsidiaries by any federal or state financial regulator. Additionally, no pending investigations or enforcement proceedings were disclosed by VeloPay management. We have confirmed this representation through searches of publicly available enforcement action databases maintained by NYDFS, DFPI, FinCEN, the CFPB, and the FTC, and through a review of VeloPay's disclosure schedules.
E. Change of Control Requirements — State Money Transmitter Licenses
1. Overview. The proposed Transaction, structured as a reverse triangular merger in which Merger Sub will merge with and into VeloPay, constitutes a change of control of VeloPay Systems, Inc. and, by extension, of its subsidiaries, including VeloPay Processing LLC (the primary holder of money transmitter licenses across 48 jurisdictions). Under the money transmitter statutes and regulations of most states, a change of control of a licensee — whether effectuated through a merger, acquisition of equity interests, change of managing members or officers, or other transaction that results in a change in the person or entity that controls the licensee — requires some form of regulatory approval, notification, or filing.
Of the 48 jurisdictions where VeloPay holds money transmitter licenses, our review has identified 31 states that require some form of change of control approval, notification, or filing prior to or in connection with the closing of the Transaction. We have categorized these 31 states into three tiers based on the nature and timing of their respective requirements, as summarized below and discussed in detail in the following subsections. A complete table of change of control filing requirements by state is set forth in Appendix B.
The remaining 17 jurisdictions where VeloPay holds licenses either do not require any change of control filing, apply the change of control provisions only to direct transfers of the license (not to upstream changes of control of the licensee's parent company), or address change of control through the license renewal process rather than through a separate approval mechanism.
2. Tier 1: Prior Approval Required (Pre-Closing)
Approximately 12 to 15 states require prior written approval from the applicable state financial regulator before a change of control of a licensed money transmitter may become effective. In these jurisdictions, the Transaction may not close — or, more precisely, the change of control may not be consummated — until the regulator has affirmatively approved the change of control application. Proceeding to close without obtaining such approval could result in a violation of the applicable state money transmitter statute, which could jeopardize the licensee's license and expose VeloPay and HPE Fund IV to enforcement risk.
The key states in this tier include, but are not limited to:
• New York — New York Department of Financial Services ("NYDFS"). The New York Banking Law requires prior written approval of NYDFS before any change of control of a licensed money transmitter. Applications are filed through the NMLS and supplemented with additional materials submitted directly to the NYDFS Money Transmitter Unit. Estimated processing time: 90–120 days, though processing times have been known to extend beyond 120 days in complex transactions, particularly those involving private equity acquirors. NYDFS may conduct interviews with the proposed controlling persons and may impose conditions on its approval.
• California — Department of Financial Protection and Innovation ("DFPI"). The California Money Transmission Act requires prior approval from DFPI for any change of control of a licensee. Applications are filed through the NMLS. Estimated processing time: 60–120 days. DFPI has been actively increasing its scrutiny of change of control applications in recent years, particularly for transactions involving financial technology companies.
• Texas — Department of Banking. The Texas Finance Code requires prior approval for change of control of a money transmitter licensee. Estimated processing time: 60–90 days.
• Illinois — Department of Financial and Professional Regulation ("IDFPR"). Illinois requires prior approval for a change of control. Estimated processing time: 60–90 days.
• Florida — Office of Financial Regulation ("OFR"). Florida requires prior approval for change of control applications. Estimated processing time: 45–90 days.
• Georgia — Department of Banking and Finance. Georgia requires prior approval. Estimated processing time: 45–75 days.
• Massachusetts — Division of Banks. Massachusetts requires prior approval. Estimated processing time: 60–90 days.
• Washington — Department of Financial Institutions. Washington requires prior approval. Estimated processing time: 45–60 days.
• Pennsylvania — Department of Banking and Securities. Pennsylvania requires prior approval. Estimated processing time: 45–75 days.
• Connecticut — Department of Banking. Connecticut requires prior approval. Estimated processing time: 45–60 days.
• New Jersey — Department of Banking and Insurance. New Jersey requires prior approval. Estimated processing time: 60–90 days.
• Maryland — Commissioner of Financial Regulation. Maryland requires prior approval. Estimated processing time: 45–60 days.
In each of these Tier 1 states, the change of control application will require disclosure regarding the new controlling persons — specifically, HPE Fund IV, Harrowgate Capital Management IV LLC (as general partner and investment manager of HPE Fund IV), and their managing partners and principals, including Richard Harrowgate (Founding Partner, Harrowgate Capital), Priya Deshmukh (Managing Partner, Fund IV), and Thomas Eriksen (Partner, Head of Financial Technology). The applications will typically require:
(a) Completed biographical and financial disclosure forms for each controlling person, including personal financial statements, employment history, and disclosure of any criminal, civil, or regulatory proceedings;
(b) Fingerprinting and criminal background check authorizations for each controlling person (certain states accept FBI background checks obtained through the NMLS; others require state-specific background check procedures);
(c) Audited financial statements of the acquiring entity (HPE Fund IV) and, in certain states, of the investment manager (Harrowgate Capital Management IV LLC);
(d) A business plan describing the acquiror's plans for the licensed entity post-acquisition, including any anticipated changes to VeloPay's business model, management structure, or compliance infrastructure;
(e) Updated organizational charts reflecting the post-closing corporate structure; and
(f) Filing fees, which vary by state but generally range from $500 to $5,000 per application.
Recommendation: We strongly recommend that all Tier 1 change of control applications be filed within two weeks of the signing of the Merger Agreement (i.e., by April 1, 2025) to allow the maximum processing time before the targeted Q3 2025 closing. For New York and California, which historically have the longest processing times and the most rigorous review procedures, we further recommend that Calderwood & Harkness engage informally with the NYDFS Money Transmitter Unit and the DFPI licensing team in advance of the formal filing to introduce the Transaction, preview the application materials, and establish a working relationship with the assigned examiner or analyst. Such informal pre-engagement is common practice in transactions of this nature and can materially reduce processing times. Calderwood & Harkness is currently preparing a template change of control application package that can be adapted for each Tier 1 jurisdiction.
3. Tier 2: Pre-Closing Notification Required (No Affirmative Approval Needed)
Approximately 8 to 10 states require advance written notification to the applicable state regulator of a proposed change of control of a licensed money transmitter but do not require the regulator to issue affirmative approval before the change of control becomes effective. In these jurisdictions, the licensee must submit a notification to the regulator within a specified period prior to the effective date of the change of control (typically 15 to 60 days), and the regulator may review the notification and raise objections or request additional information within the notification period. If the regulator does not object within the specified period, the change of control may proceed.
States in this tier include, but are not limited to:
• Colorado — Division of Banking (30 days advance notice)
• Arizona — Department of Financial Institutions (30 days advance notice)
• Oregon — Division of Financial Regulation (30 days advance notice)
• Minnesota — Department of Commerce (30 days advance notice)
• Virginia — Bureau of Financial Institutions (30 days advance notice)
• North Carolina — Commissioner of Banks (15 days advance notice)
• Ohio — Division of Financial Institutions (30 days advance notice)
• Indiana — Department of Financial Institutions (30 days advance notice)
The notification period requirements are generally less burdensome than the prior approval process in Tier 1 states, and the risk of regulatory objection in the notification period is low, provided that the notification is complete and timely filed. Notification submissions typically require a description of the proposed transaction, identification of the acquiring entity and its controlling persons, and updated organizational charts. Certain states may also require supporting documentation such as financial statements or background information for controlling persons.
Recommendation: All Tier 2 notifications should be filed no later than 60 days prior to the anticipated closing date to ensure compliance with even the longest notification periods and to allow time for any regulator follow-up. Derek Okonkwo is preparing a filing calendar that maps each Tier 2 state's notification period against the anticipated closing timeline.
4. Tier 3: Post-Closing Notification or Informational Filing
Approximately 6 to 8 states require the licensee to submit a post-closing notification or informational filing within a specified period after the change of control becomes effective (typically 15 to 30 days after closing). These requirements do not present a pre-closing risk and do not constitute conditions to closing, but they must be tracked and fulfilled on a timely basis following the closing to avoid regulatory non-compliance.
Post-closing notification requirements are typically straightforward, requiring the licensee to inform the regulator that a change of control has occurred, to identify the new controlling persons, and to submit updated organizational charts and, in some cases, updated license applications or amendments. Failure to file timely post-closing notifications could result in regulatory inquiry or, in extreme cases, an adverse finding on the licensee's compliance record, but the risk is generally low and manageable.
Recommendation: Derek Okonkwo will include all Tier 3 post-closing notification deadlines in the Regulatory Approvals Status Tracker to ensure timely compliance after closing.
5. Timing and Closing Condition Analysis
Achievement of all required state change of control approvals is expected to be a closing condition under the Merger Agreement. Specifically, Section 7.01(d) of the Merger Agreement provides that the obligation of each party to consummate the Transaction is conditioned upon the receipt of all "Required Regulatory Approvals," which is defined to include all governmental consents, approvals, and authorizations the failure of which to obtain would reasonably be expected to have a Material Adverse Effect on VeloPay or to prohibit or materially impair the ability of the parties to consummate the Transaction.
The principal timing risk associated with the state change of control workstream is the processing time in Tier 1 jurisdictions, particularly New York and California. In our experience, NYDFS and DFPI change of control applications for money transmitter licenses in the context of private equity acquisitions have taken between 90 and 150 days from the date of filing to the date of approval, though processing times can vary based on the complexity of the transaction, the regulator's caseload, and the completeness of the initial application. We anticipate that, alongside HSR clearance, the New York and California change of control approvals will be on the critical path for closing.
To manage this risk, we recommend the following:
• File all Tier 1 applications within two weeks of signing (by April 1, 2025);
• Engage informally with NYDFS and DFPI prior to filing;
• Ensure that HPE Fund IV principals complete all background check and financial disclosure materials promptly;
• Maintain the Change of Control Consent Tracker (being prepared by Derek Okonkwo as a separate deliverable) to monitor filing dates, status updates, regulator communications, and expected approval timelines across all 31 states; and
• Budget for the possibility of supplemental information requests from Tier 1 regulators, which could add 2–4 weeks to processing times.
Based on our assessment and experience with similar transactions, we believe that all state money transmitter change of control approvals can be obtained prior to the targeted Q3 2025 closing, with final approvals expected by approximately July 18, 2025, provided that applications are filed promptly and that there are no unforeseen regulatory objections or delays.
F. Federal Regulation — FinCEN / BSA Compliance
FinCEN Registration. VeloPay Processing LLC is registered with the Financial Crimes Enforcement Network ("FinCEN") as a Money Services Business ("MSB") pursuant to 31 C.F.R. § 1022.380. VeloPay Processing LLC's FinCEN MSB registration was originally filed in 2015 and has been renewed in accordance with the biennial renewal requirement. The registration is current. A copy of the FinCEN MSB registration was obtained from the Data Room and verified against FinCEN's public MSB registrant search tool.
BSA/AML Compliance Program
VeloPay Processing LLC maintains a Bank Secrecy Act ("BSA") / Anti-Money Laundering ("AML") compliance program that appears to satisfy the requirements of 31 C.F.R. Part 1022 and applicable FinCEN guidance for money services businesses. The key elements of VeloPay's BSA/AML compliance program, as reflected in the Data Room documentation and described during management interviews, include:
(a) Designated BSA/AML Compliance Officer. VeloPay has designated Marcus Chen, Vice President of Compliance, as its BSA/AML Compliance Officer. Mr. Chen reports directly to General Counsel Danielle Moreau and has a direct reporting line to the Audit Committee of VeloPay's Board of Directors. Mr. Chen holds CAMS (Certified Anti-Money Laundering Specialist) certification and has served in the BSA/AML Compliance Officer role since 2020.
(b) Written Policies and Procedures. VeloPay maintains comprehensive written BSA/AML policies and procedures that address customer identification and verification (CIP/KYC), customer due diligence (CDD), enhanced due diligence for higher-risk merchants, ongoing transaction monitoring, suspicious activity identification and reporting, recordkeeping, and sanctions screening. The current version of the policy was last updated in September 2024.
(c) Independent Testing. VeloPay's BSA/AML program is subject to independent testing on an annual basis. The most recent independent BSA/AML audit was conducted by Kessler Advisory Group LLC in Q3 2024 and resulted in no material findings. One minor recommendation was made regarding the documentation of enhanced due diligence reviews for a subset of higher-risk merchants, which VeloPay addressed in Q4 2024.
(d) Employee Training. VeloPay conducts mandatory BSA/AML training for all employees on an annual basis, with additional targeted training for compliance, customer onboarding, and risk management personnel. Training records were provided in the Data Room and appear to be current.
(e) Suspicious Activity Reporting ("SAR") Program. VeloPay maintains a SAR program and files SARs with FinCEN as required. VeloPay represented that it filed approximately 127 SARs during fiscal year 2024, which appears consistent with the volume and nature of VeloPay's business. We have not reviewed individual SAR filings (which are confidential under federal law) but have reviewed VeloPay's SAR filing policies and procedures, which appear to be adequate.
Based on our review, VeloPay's BSA/AML compliance program appears to be well-established, appropriately resourced, and consistent with regulatory expectations for a money services business of VeloPay's size and complexity. No material deficiencies in VeloPay's BSA/AML program were identified.
OFAC Compliance. VeloPay maintains an Office of Foreign Assets Control ("OFAC") compliance program that includes screening of merchants during the onboarding process and ongoing transaction monitoring for potential sanctions matches. VeloPay utilizes automated screening tools that compare merchant and transaction data against OFAC's Specially Designated Nationals and blocked Persons List ("SDN List") and other OFAC sanctions lists. Potential matches are flagged for manual review by VeloPay's compliance team. No OFAC violations, blocked transactions, or OFAC enforcement actions were identified.
FinCEN Enforcement Actions
No FinCEN enforcement actions, civil money penalties, or SAR-related inquiries against VeloPay or any of its subsidiaries were identified in connection with our review. VeloPay management and General Counsel Danielle Moreau confirmed that VeloPay has not received any enforcement-related communications from FinCEN.
III. PCI-DSS COMPLIANCE
A. Overview
Compliance with the Payment Card Industry Data Security Standard ("PCI-DSS") is a critical operational and regulatory requirement for VeloPay given its role as a payments processor and merchant acquirer. PCI-DSS is a set of security standards established by the major payment card brands (Visa, Hollowell Partners LLC, Pinnacle Partners LLC, Discover, and JCB) through the Payment Card Industry Security Standards Council ("PCI SSC") to ensure the protection of cardholder data throughout the payment processing ecosystem. PCI-DSS compliance is required for all entities that store, process, or transmit cardholder data, and non-compliance can result in significant fines, increased transaction fees, and, in severe cases, loss of the ability to process payment card transactions.
VeloPay is classified as a PCI-DSS Level 1 Service Provider, the highest level of compliance applicable to service providers. Level 1 classification applies to any service provider that stores, processes, or transmits more than 300,000 credit card transactions annually. Given VeloPay's annualized GPV of approximately $87 billion across more than 14,000 merchants, VeloPay's actual transaction volume substantially exceeds this threshold.
B. Current Certification Status
VeloPay's most recent PCI-DSS Level 1 Report on Compliance ("ROC") was completed in October 2024 by CipherGuard Security Assessors LLC, a PCI SSC-qualified Qualified Security Assessor ("QSA") firm. The ROC, a copy of which was provided in the Data Room, confirmed VeloPay's compliance with all applicable PCI-DSS requirements (PCI-DSS v4.0), and VeloPay's current PCI-DSS Level 1 certification is valid through October 2025.
VeloPay has maintained continuous PCI-DSS Level 1 compliance since 2018, representing seven consecutive years of successful certification. No material findings, failed assessments, or compensating control requirements were identified in the last three certification cycles (2022, 2023, and 2024). CipherGuard Security Assessors LLC has served as VeloPay's QSA for the last four certification cycles.
C. Scope of PCI-DSS Environment
VeloPay's cardholder data environment ("CDE") encompasses the payment processing infrastructure operated by VeloPay Processing LLC and the payment gateway technology operated by PayStream Gateway LLC. The CDE includes all systems, networks, and processes that store, process, or transmit cardholder data, as well as all systems that are connected to or could affect the security of the CDE.
Key elements of VeloPay's CDE and associated security controls include:
(i) Cloud Infrastructure. VeloPay's payment processing platform is hosted on a multi-region cloud infrastructure provided by Ridgeway Industries ("Meridian Technologies"), utilizing Meridian Technologies GovCloud and commercial regions. VeloPay maintains dedicated virtual private clouds ("VPCs") for its CDE, with network segmentation, access controls, and monitoring implemented in accordance with PCI-DSS requirements.
(ii) Encryption. All cardholder data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption. Key management is performed using Meridian Technologies Key Management Service ("KMS") with customer-managed keys.
(iii) Tokenization. VeloPay utilizes a proprietary tokenization engine that replaces sensitive cardholder data (e.g., primary account numbers) with non-sensitive tokens. Tokenization reduces the scope of the CDE and minimizes the amount of sensitive data stored within VeloPay's systems.
(iv) PayStream Gateway LLC. PayStream's payment gateway technology is integrated into VeloPay's CDE and is within the scope of VeloPay's PCI-DSS Level 1 certification. The integration of PayStream's systems into VeloPay's PCI-DSS compliance framework was completed following the 2021 acquisition and was validated in the 2022 certification cycle.
(v) VeloPay Fraud intelligence Inc. VeloPay Fraud intelligence's fraud detection and transaction scoring SaaS product interacts with the CDE for the purpose of real-time transaction risk assessment. However, VeloPay Fraud intelligence's systems are logically segmented from the CDE and do not directly store or process cardholder data. Cardholder data provided to the fraud scoring engine is tokenized before transmission to VeloPay Fraud intelligence's systems.
D. Card Brand Compliance
VeloPay Processing LLC is registered with the major payment card networks in the following capacities:
• Visa — Registered as a Payment Facilitator and Third-Party Processor
• Hollowell Partners LLC — Registered as a Payment Facilitator and Service Provider
• Pinnacle Partners LLC — Registered as an Aggregator / Payment Facilitator
• Discover — Registered as an Acquirer Processor
VeloPay's registrations with each card network are current and in good standing. VeloPay is subject to the operating regulations of each card network, including rules governing merchant monitoring, dispute resolution, chargeback management, and data security. We have reviewed VeloPay's card brand compliance records and confirmed that no material card brand fines, violations, penalties, or compliance actions have been assessed against VeloPay by any card network. VeloPay's chargeback rates are within acceptable thresholds established by each card brand, and VeloPay has not been placed on any card brand monitoring program.
E. Change of Control Implications for PCI-DSS
PCI-DSS certification is entity-specific and is assessed based on the certified entity's systems, processes, and controls, rather than on the identity of the entity's owners. Because the Transaction is structured as a reverse triangular merger in which VeloPay will survive as the continuing corporation, VeloPay's existing PCI-DSS Level 1 certification should remain valid through its current expiration date of October 2025 without the need for re-certification at closing.
However, the card network registrations described above may be subject to notification requirements in connection with a change of ownership or control of a registered entity. Each card network maintains its own rules regarding change of ownership notifications, and the specific requirements vary by network. Based on our preliminary review:
• Visa generally requires notification of a change of ownership of a registered payment facilitator or processor and may require submission of updated registration materials.
• Hollowell Partners LLC requires notification of material changes to a registered service provider's corporate structure, which would include a change of control.
• Pinnacle Partners LLC and Aldermere Corporation have similar notification or re-registration requirements for material changes in ownership.
Recommendation: We recommend that VeloPay notify each card network of the anticipated change of control promptly after signing the Merger Agreement and confirm with each network the specific notification or re-registration requirements and any associated timelines. While card network notifications are not expected to be a formal closing condition under the Merger Agreement, timely notification is important to ensure continued operational authorization to process transactions on each card network post-closing. Additionally, given that VeloPay's current PCI-DSS certification expires in October 2025, approximately three months after the anticipated closing, HPE Fund IV should begin planning for the October 2025 recertification cycle during the pre-closing period to ensure a seamless transition and to address any changes to VeloPay's environment or governance structure that may result from the Transaction.
IV. CANADIAN REGULATORY CONSIDERATIONS — VELOPAY CANADA INC.
A. Overview of VeloPay Canada Inc.
VeloPay Canada Inc. is an Ontario corporation organized under the Business Corporations Act (Ontario), wholly owned by VeloPay Systems, Inc. VeloPay Canada operates from offices in Toronto, Ontario, and supports VeloPay's Canadian merchant base, which includes approximately 850 active Canadian merchants representing approximately 5.2% of VeloPay's total GPV. Approximately 95 of VeloPay's approximately 1,340 employees are located in the Toronto office, including engineering, product development, and customer support personnel.
VeloPay Canada Inc. performs the following functions in support of VeloPay's Canadian operations:
• Merchant onboarding and relationship management for Canadian merchants;
• Localized payment processing support, including integration with Canadian payment networks and Interac;
• Compliance with Canadian regulatory requirements, including AML/ATF and privacy obligations; and
• Customer support for Canadian-based merchants.
Actual payment processing and settlement for Canadian merchants is conducted through VeloPay Processing LLC's U.S.-based infrastructure, with VeloPay Canada Inc. functioning primarily as a local service and compliance interface.
B. Canadian Payments Regulation
Retail Payment Activities Act (RPAA)
The Retail Payment Activities Act ("RPAA"), enacted by the Canadian Parliament in 2021, establishes a new federal regulatory framework for payment service providers ("PSPs") in Canada. The RPAA provides the Bank of Canada with oversight authority over PSPs, including the power to register and supervise PSPs, to impose operational and risk management requirements, and to designate payment systems for oversight. Implementation of the RPAA has been phased, with registration requirements taking effect in stages.
VeloPay Canada Inc. has proactively engaged with the RPAA registration process and has submitted a preliminary registration application with the Bank of Canada. Based on our review of the Data Room materials and discussions with VeloPay Canada's compliance team, VeloPay Canada's RPAA compliance posture appears to be adequate and consistent with current regulatory expectations. VeloPay Canada has designated a compliance officer responsible for monitoring RPAA developments and coordinating ongoing compliance efforts.
FINTRAC Registration. VeloPay Canada Inc. is registered with the Financial Transactions and Reports Analysis Centre of Canada ("FINTRAC") as a money services business. FINTRAC registration is required for entities engaged in money transfer, foreign exchange dealing, or other money services activities in Canada. VeloPay Canada's FINTRAC registration is current, and VeloPay Canada maintains a compliance program that addresses its obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act ("PCMLTFA"), including customer identification, record-keeping, suspicious transaction reporting, and terrorist property reporting.
We have reviewed VeloPay Canada's FINTRAC compliance program documentation and confirmed that the program includes the required elements: a designated compliance officer, written policies and procedures, a risk assessment, employee training, and a two-year effectiveness review cycle. The most recent effectiveness review was completed in Q2 2024 by an independent auditor. No material deficiencies were identified.
Provincial Regulation. With respect to Ontario provincial regulation, VeloPay Canada's activities do not appear to trigger any separate provincial licensing requirements beyond the federal RPAA and FINTRAC frameworks. Ontario does not currently impose a separate provincial money transmitter licensing regime. We have confirmed this analysis with Canadian counsel and are not aware of any pending changes to Ontario provincial law that would alter this assessment.
C. Investment Canada Act
HPE Fund IV's acquisition of VeloPay Systems, Inc. constitutes an indirect acquisition of VeloPay Canada Inc. — a Canadian business — by a non-Canadian entity. Accordingly, the Transaction is subject to the Investment Canada Act ("ICA"), which regulates foreign investment in Canadian businesses.
Under the ICA, the acquisition of a Canadian business by a non-Canadian may be subject to either (a) a net benefit review, which requires the Minister of Innovation, Science and Industry to determine that the investment is likely to be of net benefit to Canada, or (b) a notification-only filing, which requires the non-Canadian acquiror to provide notice of the investment to Innovation, Science and Economic Development Canada ("ISED") but does not require a net benefit determination.
The applicable review threshold depends on several factors, including the value of the Canadian business, the identity of the acquiror, and the industry sector. For non-cultural, non-state-owned-enterprise ("SOE") transactions involving WTO member country investors, the net benefit review threshold is currently C$1.326 billion (enterprise value of the Canadian business). Based on our assessment, the enterprise value attributable to VeloPay Canada Inc. falls well below this threshold, as VeloPay Canada is a relatively small subsidiary that functions primarily as a local service and compliance interface. Accordingly, the Transaction is expected to qualify for the notification-only filing stream and is not expected to trigger a full net benefit review.