Paycom Software (PAYC): what its 10-K says it depends on

Customers

U.S. Government contracting

earns fromnamed as a risk

Finally, a negative audit or other investigations by the U.S. Government could adversely affect our ability to receive U.S. Government contracts and could result in financial or reputational harm.Risk factors (Item 1A)

Also named by URI

Partners and platforms

Visa

depends onnamed as a risk

We rely on third-party couriers to deliver payroll checks and tax forms and on financial and accounting processing systems and various financial institutions to perform financial services in connection with our applications, such as providing automated clearing house (“ACH”) and wire transfers as part of our payroll and payroll tax payment services and facilitating our Vault Visa® Payroll Card.Risk factors (Item 1A)

Also named by AFRM, AXP, CASH, COF, EEFT, FIS, FISV, GPN and 6 more

Federal Reserve ACH processing

depends onnamed as a risk

Furthermore, due to our dependence on financial institutions for certain services, a systemic shutdown of the banking industry or a disruption of the Federal Reserve Bank’s services, including ACH processing, would impede our ability to provide our payroll and expense reimbursement services by delaying direct deposits and other financial transactions across the United States and could have an adverse impact on our financial results and liquidity.Risk factors (Item 1A)

Other companies

Funds held for clients interest income

exposed to its price · approximately $22.1 millionnamed as a risk

As of December 31, 2025, a hypothetical increase or decrease in interest rates of 100 basis points would result in an approximately $22.1 million increase or decrease, respectively, in interest earned on funds held for clients over the ensuing 12-month period.Market risk (Item 7A)

Competitors

Automatic Data Processing, Inc. (ADP)

competes withnamed as a risk

We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Intuit, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers.Risk factors (Item 1A)

Also named by BBSI, WDAY

Workday, Inc.

competes withnamed as a risk

We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Intuit, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers.Risk factors (Item 1A)

Also named by SSD, TYL

Paychex, Inc.

competes withnamed as a risk

We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Intuit, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers.Risk factors (Item 1A)

Also named by BBSI

Paylocity Holding Corporation

competes withnamed as a risk

We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Intuit, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers.Risk factors (Item 1A)

Dayforce, Inc.

competes withnamed as a risk

We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Intuit, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers.Risk factors (Item 1A)

Places

Texas

operates innamed as a risk

We serve all of our clients from our fully redundant data centers located in Oklahoma, Texas and Arizona.Risk factors (Item 1A)

Also named by ABR, AFRM, ALLY, AN, ASO, ASTS, ATO, AXP and 70 more

Mexico

earns fromnamed as a risk

Because some of our clients are located in Mexico and other clients have establishments internationally, Canada’s PIPEDA, Mexico’s Federal Law on the Protection of Personal Data, and other foreign data privacy laws, such as the EU GDPR, may impact our processing of certain client and employee information.Risk factors (Item 1A)

Also named by AAP, AME, AMRC, ANET, AOS, ARES, AYI, AZO and 83 more

Arizona

operates innamed as a risk

We serve all of our clients from our fully redundant data centers located in Oklahoma, Texas and Arizona.Risk factors (Item 1A)

Also named by ABR, AMKR, AXON, BBSI, BRK/B, DJCO, ELS, ENSG and 5 more

Oklahoma

operates innamed as a risk

We serve all of our clients from our fully redundant data centers located in Oklahoma, Texas and Arizona.Risk factors (Item 1A)

Also named by DCI, KEX, OGE

Hazards

Tornadoes

operates innamed as a risk

•tornadoes, fires, earthquakes, hurricanes, floods and other natural disasters;Risk factors (Item 1A)

Also named by AAON, DLTR, PNFP, RF

Regulators

Office of the Comptroller of the Currency (OCC)

subject to

The Paycom National Trust Bank and all its fiduciary activities, including the U.S. money movement it oversees and manages via Paycom Client Trust, are subject to comprehensive ongoing oversight and regulation by the OCC.Business (Item 1)

Also named by ADP, AMP, AXP, BAC, BLK, C, CASH, CFG and 22 more

Financial Transactions and Reports Analysis Centre of Canada

subject to

We are registered with the U.S. Treasury Department Financial Crimes Enforcement Network, and Paycom Canada, Inc. is a registered Money Service Business with the Financial Transactions and Reports Analysis Centre of Canada.Business (Item 1)

Also named by ADP

Laws and programs

EU Artificial Intelligence Act

subject tonamed as a risk

The EU AI Act, and developing interpretation and application of the EU GDPR in respect of automated decision making, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to provide, improve or commercialize our business, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.Risk factors (Item 1A)

Also named by ABNB, ADP, AIOT, AKAM, ALAB, AMG, APP, AVAV and 24 more

Bank Secrecy Act

subject tonamed as a risk

Any violation of applicable AML laws or regulations could limit certain of our business activities until they are satisfactorily remediated and could result in civil and criminal penalties, including fines, which could damage our reputation and have a materially adverse effect on our results of operations and financial condition.Risk factors (Item 1A)

Also named by AUB, BAC, CASH, CPAY, CUBI, EFSC, EWBC, EZPW and 10 more

Affordable Care Act (ACA)

earns fromnamed as a risk

We anticipate that our revenues will continue to exhibit this seasonal pattern related to ACA form filings for so long as the ACA (or replacement legislation) includes employer reporting requirements.Business (Item 1)

Also named by ABBV, ABT, ADP, AFL, BBSI, BRO, BWIN, COR and 8 more

Gramm-Leach-Bliley Act

subject tonamed as a risk

Notably, the GLBA is enforced under the authority of the Federal Trade Commission and requires our payment card services to adhere to a privacy notice and take certain measures to protect related personal information from unauthorized use and threats to data security.Risk factors (Item 1A)

Also named by BR, CINF, EFX, FICO, FIS, FITB, OMF, ORI and 4 more

Fair Credit Reporting Act

subject tonamed as a risk

Consequently, we are subject to extensive, evolving and often complex laws and governmental regulations, such as the FCRA, the Drivers’ Privacy Protection Act, state consumer reporting agency laws, state licensing and registration requirements, and various other foreign, federal, state and local laws and regulations.Risk factors (Item 1A)

Also named by ADP, EFX, FICO, FIS, FISV, TRU, VRSK

Illinois Biometric Information Privacy Act

subject tonamed as a risk

In the United States, these include numerous state-level consumer privacy laws, such as California’s CCPA, Texas’ Data Privacy and Security Act, Illinois’ IBIPA, rules and regulations promulgated under the authority of the Federal Trade Commission, the Health Insurance Portability and Accountability Act of 1996, the Family Medical Leave Act of 1993, the ACA, the Financial Services Modernization Act of 1999 (the “GLBA”), the Fair Credit Reporting Act (“FCRA”), federal and state labor and employment laws, state data breach notification laws, and state cybersecurity laws such as the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act.Risk factors (Item 1A)

Also named by CART, IOT, MSI, PAR

Technology

Third-party large language model (LLM)

depends onnamed as a risk

We have licensed and deployed a third-party large language model (“LLM”) on our own internal network and AI-powered tools.Risk factors (Item 1A)