Company: IIIV
Filing Date: 2025-11-21
Form Type: 10-K
Source: 0001728688-25-000122
Chunk: 23

Company: i3 Verticals, Inc.
Filing Date: 2025-11-21
Form: 10-K
Item: Item 1
Chunk 23
---
 such as us, should be supervised by the Board of Governors of the Federal Reserve System because it is systemically important to the U.S. financial system. Any new rules or regulations implemented by the CFPB or the Financial Stability Oversight Council or in connection with the Dodd-Frank Act that are applicable to us, or any changes that are adverse to us resulting from litigation brought by third parties challenging such rules and regulations, could increase our cost of doing business or limit permissible activities. 

Privacy and Information Security Regulations

We provide services that are subject to privacy laws and regulations of a variety of jurisdictions. Relevant federal privacy laws include the Gramm-Leach-Bliley Act of 1999, which applies directly to a broad range of financial institutions and indirectly, or in some instances directly, to companies that provide services to financial institutions. These laws and regulations restrict the collection, processing, storage, use and disclosure of personal information, require notice to individuals of privacy practices and provide individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These laws also impose requirements for safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. Our business also may be subject to the Fair Credit Reporting Act and the Fair and Accurate Credit Transactions Act of 2003, which regulate the use and reporting of consumer credit information and impose disclosure requirements on entities who take adverse action based on information obtained from credit reporting agencies. 

All fifty states, Puerto Rico, and the U.S. Virgin Islands have enacted data breach notification laws requiring businesses that experience a security breach of their computer databases that contain personal information to notify affected individuals, consumer reporting agencies and governmental agencies. Many states have implemented comprehensive data privacy and security laws. Certain of these laws restrict the ability to collect and 

13

utilize certain types of personal information, such as Social Security and driver’s license numbers, impose secure disposal requirements for personal data and contain regulations surrounding data protection and information security. For example, Massachusetts requires any business that processes the personal information of a Massachusetts resident to adopt and implement a written information security program. In addition, states are increasingly legislating data protection requirements for a broader list of personal data and are strengthening protections for students' personal information. Illinois regulates the collection of biometric information under its Biometric Information Privacy Act. Texas and Washington have also passed legislation regulating the collection of biometric information, and additional states have legislation pending regarding the collection of biometric data. Additionally, many states have passed comprehensive consumer privacy laws, that