Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 99

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 99
---
 The NACHA rules permit transactions to be returned under certain circumstances. If too many of our transactions are returned, our ability to access the ACH system could be impaired by our partner financial institutions. Our partner financial institutions could similarly change their interpretation of NACHA requirements, which could require costly remediation efforts and could prevent us from continuing to provide services through such partner financial institutions until we remediate issues to their satisfaction. 

We collect and use a wide variety of information (including personal information) for various purposes in our business, including: (i) to help ensure the integrity of our services, (ii) to meet KYC, transaction monitoring, AML and CFT standards, and (iii) to provide features and functionality to our clients and their customers. This aspect of our business, including the collection, use, disclosure, and protection of personal information we acquire in connection with the use of our services, is subject to numerous laws and regulations in the United States and globally. Regulation and proposed regulation in this area has increased significantly in recent years and is expected to continue to do so. 

In addition to numerous privacy and data protection laws already in place, U.S. states are increasingly adopting laws modeled on the GDPR that impose comprehensive privacy and data protection obligations. For example, the CCPA, which became effective on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used, and it imposes other requirements as well. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. Several other states have joined California in enacting privacy and data protection legislation that impose additional obligations on businesses related to the collection, storage and utilization of third party information, as well as the reporting of data breaches. All 50 states, Puerto Rico, and the U.S. Virgin Islands (similar to many of the other countries where we do business), have passed laws regulating the actions that a business must take if it experiences a data breach, such as prompt disclosure to affected individuals, consumer reporting agencies, or governmental agencies. In addition, we are subject to laws in the U.S. and abroad restricting or placing conditions on our ability to collect and utilize certain specific types of information, such as Social Security and driver’s license numbers. 

Many of the foreign jurisdictions where we or our clients do business, including the European Union (E.U.), have laws and regulations dealing with the