Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 139

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 139
---
 numbers, credit or debit card numbers and expiration dates, driver’s license numbers and bank account numbers. We have ultimate liability to the payment networks and to our clients for our failure or the failure of third parties with whom we contract to protect this data in accordance with PCI DSS and network requirements. The loss, destruction or unauthorized modification or disclosure of merchant or cardholder data by us or our contracted third parties could result in significant fines, sanctions, claims, litigation and proceedings or actions against us by the payment networks, governmental entities, clients, client customers or others and damage our reputation.

Similarly, there are existing regulatory regimes designed to protect the privacy of categories of personal or otherwise sensitive data. Relevant U.S. federal privacy laws include the FERPA, the Gramm-Leach-Bliley Act (GLBA), and HIPAA. We also are subject to stringent contractual obligations relating to the handling of such data, including obligations that are more restrictive than legally required. For example, under HIPAA, the information we collect during the payment experience may include protected health Information (PHI), and as such, we are considered a “business associate” of the U.S. healthcare clients we serve, and we are required to enter into a business associate agreement (BAA) with these clients. The BAAs largely mirror some of the statutory obligations contained in HIPAA, but many contain additional contractual undertakings that give these clients additional remedies in the event of a breach of our obligations to protect the confidentiality of the client’s PHI or otherwise meet our contractual obligations. Privacy laws impose a variety of compliance burdens on us and our clients, such as requiring notice to individuals of privacy practices, providing individuals with certain rights to prevent the use and disclosure of protected information, and also imposing requirements for safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. Privacy laws grant audit rights to our regulators and those of our clients. Any unauthorized disclosure of PHI or other data we are obligated to protect by regulation or contract could result in significant fines, sanctions, or requirements to take corrective action and could materially adversely affect our reputation and business. 

Threats may derive from human error, fraud, or malice on the part of employees or third parties, or from accidental technological failure. For example, certain of our FlyMates have access to personal and sensitive data that could be used to commit identity theft or fraud. Concerns about security increase when we transmit information electronically because such transmissions can be subject to attack, interception, or loss. Also