UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 20222023

or

For the transition period from to

Commission file number: 001-36393

Paycom Software, Inc.

(Exact name of registrant as specified in its charter)

Registrant’s telephone number, including area code: (405) 722-6900

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officersofficers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of February 7, 2023,8, 2024, 60,321,07757,551,437 shares of the registrant’s common stock, $0.01 par value per share, were outstanding, including 2,449,115994,817 shares of restricted stock. As of June 30, 2022,2023, the aggregate market value of voting stock held by non-affiliates of the registrant was approximately $14.416.6 billion (based on the closing price for shares of the registrant’s common stock as reported by the New York Stock Exchange on that date).

DOCUMENTS INCORPORATED BY REFERENCE

PAYCOM SOFTWARE, INC.

20222023 ANNUAL REPORT ON FORM 10-K

TABLE OF CONTENTS

Unless we state otherwise or the context otherwise requires, the terms “Paycom,” “we,” “us,” “our” and the “Company” refer to Paycom Software, Inc., a Delaware corporation, and its consolidated subsidiaries.

CAUTIONARY STATEMENTS

Special Note Regarding Forward-Looking Statements

This Annual Report on Form 10-K (this “Form 10-K”) contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”) and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Forward-looking statements are any statements that lookrefer to our estimated or anticipated results, other non-historical facts or future events and include, but are not limited to, statements regarding our business strategy; anticipated future operating results and operating expenses, cash flows, capital resources, dividends and liquidity; competition; trends, opportunities and risks affecting our business, industry and financial results; future expansion or growth plans and potential for future growth;growth, including internationally; our ability to attract new clients to purchase our solution; our ability to retain clients and induce them to purchase additional applications; our ability to accurately forecast future revenues and appropriately plan our expenses; market acceptance of our solution and applications; our expectations regarding future revenues generated by certain applications; the return on investment for users of our solution; our ability to attract and retain qualified employees and key personnel; future regulatory, judicial and legislative changes; how certain factors affecting our performance correlate to improvement or deterioration in the labor market; our plan to open additional sales offices and our ability to effectively execute such plan; the sufficiency of our existing cash and cash equivalents to meet our working capital and capital expenditure needs over the next 12 months; our plans regarding our capital expenditures and investment activity as our business grows, including with respect to research and development and the expansion of our corporate headquarters and other facilities; our plans to pay cash dividends; and our plans to repurchase shares of our common stock through a stock repurchase plan. In addition, forward-looking statements also consist of statements involving trend analyses and statements including such words as “anticipate,” “believe,” “could,” “estimate,” “expect,” “will,” “intend,” “may,” “might,” “plan,” “potential,” “should,” “would,” and similar expressions or the negative of such terms or other comparable terminology.

Forward-looking statements are neither historical facts nor assurances of future performance, and are based only on our current beliefs, expectations and assumptions regarding the future of our business, future plans and strategies, projections, anticipated events and trends, the economy and other future conditions. Because forward-looking statements relate to the future, they are subject to inherent uncertainties, risks and changes in circumstances that are difficult to predict and many of which are outside of our control. Therefore, you should not rely on any of these forward-looking statements. Important factors that could cause our actual results and financial condition to differ materially from those indicated in the forward-looking statements include, among others, the following:

4

Forward-looking statements are based only on information currently available to us and speak only as of the date of this Form 10-K and are subject to business and economic risks.10-K. We do not undertake any obligation to update or revise the forward-looking statements to reflect events that occur or circumstances that exist after the date on which such statements were made, except to the extent required by law.

Additional Information

The Vault Visa Payroll Card is issued by The Bancorp Bank, N.A., Member FDIC, pursuant to a license from Visa U.S.A Inc. and may be used everywhere Visa debit cards are accepted.

“Paycom,” the Paycom logo and other trademarks or service marks of Paycom appearing in this Form 10-K are the property of Paycom and are protected under applicable intellectual property laws. Google and Google Pay are registered trademarks of Google, LLC. Apple and Apple Pay are trademarks of Apple, Inc., registered in the United States and other countries. Samsung and Samsung Pay are trademarks owned by Samsung Electronics Co., Ltd. Visa is a registered trademark of Visa International Service Association. All other marks are the property of the respective owners of such marks. Solely for convenience, our trademarks and tradenames referred to in this Form 10-K may appear without the ® or ™ symbols, but such references are not intended to indicate in any way that we will not assert, to the fullest extent under applicable law, our rights to these trademarks and tradenames.

PART I

Item 1. Business

Overview

We are a leading provider of a comprehensive, cloud-based human capital management (“HCM”) solution delivered as Software-as-a-Service (“SaaS”). We provide functionality and data analytics that businesses need to manage the complete employment lifecycle, from recruitment to retirement. Our solution requires virtually no customization and is based on a core system of record maintained in a single database for all HCM functions, including talent acquisition, time and labor management, payroll, talent management and human resources (“HR”) management applications. Our user-friendly software allows for easy adoption of our solution by employees, enabling self-management of their HCM activities in the cloud, which reduces the administrative burden on employers and increases employee productivity.

We were founded in 1998 and became a publicly traded company through our initial public offering in 2014. Since our founding, we have focused on providing an innovative SaaS HCM solution. Organizations need sophisticated, flexible and intuitive applications that can quickly adapt to their evolving HCM requirements, streamline their HR processes and systems and enable them to control costs. We believe the HCM needs of most organizations are currently served by multiple providers in an attempt to replicate a comprehensive SaaS product. This approach often results in challenges with system integration and data integrity, low scalability, high costs and extended delivery times.

Because our solution was developed in-house and is based on a single platform, there is no need for our clients to integrate, update or access multiple databases, which are common issues with competitor offerings that use multiple third-party systems in order to link together their HCM offerings. Additionally, our solution maintains data integrity for accurate, actionable and real-time analytics and business intelligence and helps clients minimize the risks of compliance errors due to inaccurate or missing information. We deliver feature-rich applications while maintaining excellence in information security and quality management standards, as evidenced by our International Organization for Standardization (“ISO”) certifications.

We sell our solution directly through our internally trained, client-focused and highly skilled sales force based in offices across the United States. As a part of our client retention effort, a specialist within a dedicated team is assigned to each client to provide industry-leading, personalized service. We have approximately 36,60036,800 clients, none of which constituted more than one-half of one percent of our revenues for the year ended December 31, 2022.2023. We believe that as a result of our focus on client experience, we enjoy high client satisfaction as evidenced by an annual revenue retention rate of 93%, 94%90% and 93% from existing clients91% for the years ended December 31, 2022, 20212023 and 2020,2022, respectively. We believe our revenue retention rate understates our client loyalty because this rate is decreased by former clients that were acquired or otherwise ceased operations.

We have historically generated the majority of our revenues from our payroll applications. We generally do not separately track our revenues across our other applications because we often sell applications in various groupings and configurations for a single price.

The Paycom Solution

We offer an end-to-end SaaS HCM solution that provides our clients and their employees with immediate access to accurate and secure information and analytics at any time from any location where internet service is available. We believe our solution delivers the following benefits:

Comprehensive HCM Solution

Our solution offers functionality that manages the entire employment lifecycle for employers and employees, from recruitment to retirement. Our user-friendly applications streamline client processes and provide clients and their employees with the ability to directly access and manage administrative processes, including applications that identify candidates, on-board employees, manage time and labor, administer payroll deductions and benefits, manage performance, terminate employees and administer post-termination health benefits such as COBRA. The widespread employee usage of our applications further integrates our solution into the administrative processes of our clients. Our solution also has the advantage of being built in-house by our highly trained and skilled team of software developers, thereby minimizing data integrity issues across applications.

Core System of Record

Our solution is based on a core system of record that contains payroll and HR information in one convenient database, thereby reducing costs and eliminating the need for multiple software products and vendors and the maintenance of employee data in numerous databases. This core system of record enables our clients to input employee data one time and enjoy seamless functionality across our applications. When a revision is made to the file of an employee, all appropriate personnel have access to the change in real time. In addition, our core system of record helps clients minimize the risk of compliance errors due to inaccurate or missing information that results from maintaining multiple databases. Through accurate tracking and management of employee payroll and other HR data, such information can be compiled for comprehensive and consistent reporting for our clients.

Data Analytics and Business Intelligence

Our solution’s core system of record allows clients to strategically analyze comprehensive and accurate employee information to make informed business decisions based upon actionable, real-time analytics provided through our client dashboard. This functionality allows our clients to operate with a more complete and accurate picture of their organization, as our solution’s embedded analytics capture the content and context of everyday business events, facilitating fast and informed decision-making from any location. Our industry firstindustry-first employee usage management analytics tool, Direct Data Exchange® (DDX®Exchange® (DDX®), provides employers insights into efficiencies gained through employee usage of HR technology and generates a real-time estimate of the savings realized from that usage. We help clients reduce administrative and operational costs and better manage talent.

Enhanced Employee Experience

The employees of our clients also benefit from our HCM applications. As workforces transition from technology-savvy to technology-dependent, employees expect mobile technology and the resources necessary to readily access information and control their professional development. Through our employee self-service technology, employees can view real-time HR information, including pay stubs, W-2s and benefits information, as well as manage their schedules and vacation time and update W-4 contact information. Employees can even do their own payroll with our industry-first Beti®Beti® technology. Our mobile app makes it easier for employees to access their self-service information. Our app has fingerprint and facial recognition capabilities, aiding employers in their efforts to engage technology-dependent workers. Our system also allows employers to engage their workforce through learning management courses and training paths, surveys, and performance goals and reviews.

To further enhance the effectiveness of management throughout our clients’ organizations, we also offer easy to use software with Manager on-the-Go®on-the-Go®. Built within our mobile app, this tool allows for 24/7 accessibility to essential manager-side functionality, giving supervisors and managers the ability to perform a variety of tasks such as approving time-off requests and expense reimbursements –— anytime, anywhere.

In addition to our self-service, app-based functionality, we also provide our clients with a strategy to drive usage among their employees. This strategy includes training clients’ employees how to use the Paycom app during implementation and providing additional training from our client relations representatives.representatives (“CRRs”). Allowing employees to make changes directly to our database creates efficiencies for both the employer and employee. Today’s employees have little tolerance for complexity, and with our solution, employees have become accustomed to having a direct relationship with their HR database. This relationship is directly correlated with our single-database that is key to increasing usage. Our strategy to promote employee usage of the Paycom system elevates HR personnel to focus on the human element of their jobs, creating a more positive culture and giving HR personnel more time to engage with their employees.

Personalized Support Provided by Trained Personnel

Our applications are supported by one-on-one personal assistance from trained specialists. Service specialists are assigned to specific clients and are trained across all of our applications, ensuring they provide comprehensive, expert-level service. Our client service is ISO 9001:2015 certified on the basis of its quality and consistency. We strive to provide our clients with high levels of service and support to ensure their continued use of our solution for all of their HCM needs.

Software-as-a-Service Delivery Model

Our SaaS delivery model allows clients with geographically dispersed and mobile workforces to operate more efficiently, and allows these clients to implement, access and use our client-oriented internet solution on demand and remotely through standard web browsers, smart phones, tablets and other web-enabled devices. Our SaaS solution reduces the time, risk, headcount and costs associated with installing and maintaining applications for on-premise products within the information technology (“IT”) infrastructure of our clients.

Secure Cloud-Based Architecture

Our cloud-based architecture allows our solution to be implemented remotely with minimal client interaction. Updates such as software enhancements and newly developed applications can be deployed without client interaction, disruption or involvement, allowing our clients to make a smaller investment in hardware, personnel, implementation time and consulting. Additionally, we own and maintain all of the infrastructure technology to host our solution and to maximize system availability for clients. Our focus on, and investment in, technology and data security has been recognized with ISO/IEC 27001:2013 certified security standards that provide our clients with a “best-in-class” level of data security.standards.

Scalability to Grow with our Clients

Our solution is highly scalable. We serve a diversified client base ranging in size from one employee to many thousands of employees, whileemployees. Historically, our target client size range ishas been organizations with 50 to 10,000 employees, and we recently expanded our target client size range to include organizations with more than 10,000 employees. WeFor this purpose, we calculate the number of clients’ employees based on parent company grouping. Our clients are able to use the same solution while their businesses grow by deploying applications as-neededas needed in real-time. Pricing is determined based on employee headcount and the number of applications utilized, enabling our clients to align HCM spending with their evolving HCM needs as compared to traditional HCM products that require clients to migrate to new software as they grow but retain fixed costs even if the client shrinks in size.client’s employee headcount shrinks.

Efficient and Productive Research and Development

We believe we benefit from a competitive advantage with our research and development investments, people and processes. Early investments in our proprietary, cloud-based architecture enable us to develop and deploy applications in a timely and cost-effective manner. We have also chosen to base our research and development team in Oklahoma and Texas, which we believe provides us with high-quality talent at a lower cost compared to other locations in the United States where there is more competition for technology talent. These strategic decisions have enabled us to have a highly productive research and development function.

Our Strategy for Growth

Our strategy is to continue to establish our solution as the HCM industry standard by increasing our presence in existing markets and expanding into additional markets. We intend to continue to increase our domestic sales capacity as well asand expand intoour offering to additional international markets. We will also execute our strategy for growth by targeting larger clients, expanding our inside sales organizationcapturing small business demand and strengthening and extending our solution.

Increase Our Presence in Existing Markets

We believe a significant market opportunity exists to increase our presence within markets where we currently have a sales office. Each outside sales office is typically staffed with one sales team, with each team comprisedconsisting of a sales manager and approximately six to eight other sales professionals. We plan to further penetrate and more effectively capture existing markets through increased sales productivity as well as by adding sales capacity in such markets. Although we have a sales office in 40 of the 50 largest metropolitan statistical areas (“MSAs”) in the United States based on July 20212022 U.S. Census Bureau estimates, only seven of these MSAs are currently served by multiple Paycom sales teams. We plan to further penetrate and more effectively capture existing markets by adding sales offices and increasing the number of sales teams in such markets.

Expand Into Additional Markets

We plan to continue expanding our sales capability by opening sales offices in certain metropolitan areas where we currently have no sales teams. We have historically selected new locations based on potential client and employee demographics as well as business density. When opening a new sales office, we typically relocate a proven sales manager from an existing territory who then recruits a team of high-performing sales representatives. It typically takes a new sales office 24 months to reach maturity. In addition, as we enhance the global capabilities of our solution, our U.S.-based sales teams are expanding our reach into international markets by targeting global organizations with a U.S. presence.

Enlarge our Existing Client Relationships

We dedicate our resources to helping our clients facilitate their goals, whether through helping our clients execute better hiring decisions, manage compensation more effectively or simply operate more efficiently. We believe a significant growth opportunity exists in selling additional applications to our current clients. Many clients have subsequently deployed additional applications as they recognize the benefits of our comprehensive solution. Furthermore, with the launch of our Global HCM™ solution and expansion of payroll services into certain international markets, such as Canada, Mexico and the United Kingdom, we have the opportunity to capture additional revenue from existing clients with international employees. As we extend and enhance the functionality of our solution, we will continue to invest in initiatives to increase the adoption of our solution and maintain our high levels of client satisfaction.

Target Larger Clients and Capture Incremental Small Business Demand

The average size of our clients has grown significantly as we have organically grown our operations and increased the number of applications we offer. We expect that our ability to serve organizations with international employees makes our solution more attractive to larger companies, many of which have a global presence. We believe larger employers represent a substantial opportunity to increase our revenues per client, with limited incremental cost to us. To further capitalize on this opportunity, we intend to continue targeting larger businesses opportunistically where our current sales model is effective.

businesses. We also receive inbound leads from businesses below our target client size range, who can be onboarded through our inside sales organization. We intend to expand our inside sales capabilities as needed to opportunistically capture inbound demand for our solution.emerging markets group, which focuses on businesses with fewer than 50 employees.

Maintain Our Leadership in Innovation by Strengthening and Extending our Solution

Our ability to develop and deploy new applications and updates rapidly and cost-effectively has been integral to the results that we have achieved to date. We intend to continue extending the functionality and range of our solution in the future. Our development efforts are performed exclusively in-house and are heavily based upon proactive research and client input. We are focusing our investments on the development of new applications, enhancements and learning courses that are responsive to the needs of our clients, which are garnered through ongoing client interaction and collaboration.

8

Our Applications and Tools

Our HCM solution offers a full suite of applications and tools that generally fall within the following categories: talent acquisition, time and labor management, payroll, talent management and HR management. With Global HCM, a number of our HCM applications and tools are available in 15 languages and dialects and are accessible to users in more than 180 countries. We also offer native payroll in Canada, Mexico and the United Kingdom, and intend to add native payroll in other countries.

Talent Acquisition

Time and Labor Management

9

Payroll

10

Everyday™. Our daily payroll service, Everyday, allows employees to receive daily wages on a Vault Visa Payroll Card at no cost to the employees. This service provides employees greater financial flexibility and transparency to better meet life’s demands. It also provides employers a competitive edge in hiring and retaining employees with a benefit today’s employees want. Everyday is fully automated, calculating and withholding taxes, benefits and deductions first to protect against overpayment and help ensure compliance.

Talent Management

11

HR Management

12

Our Clients

We serve a diverse client base in terms of size and industry. We have approximately 36,60036,800 clients, or nearly 19,10019,500 clients based on parent company grouping, none of which constituted more than one-half of one percent of our revenues for the year ended December 31, 2022.2023. We stored data for over 6.56.8 million persons employed by our clients during the year ended December 31, 2022.2023.

Many small to mid-sized companies can typically make the decision to adopt our solution more quickly than larger companies, which we believe results in a shorter sales cycle and more closely corresponds to our target sales cycle of 30 to 90 days. As a result of the nature and size of our clientele, we maintain a diversified client base and very low revenue concentration among our clients. We believe, however, that larger employers represent a substantial opportunity to increase our revenues per client with limited incremental cost. As we pursue and attract larger clients, at the higher end of our target client size range, we may face longer sales cycles and less predictability in completing some of our sales.

Competition

The market for HCM solutions is rapidly evolving, highly competitive and subject to changing technology, shifting client needs and frequent introduction of new products and services. Our competitors range from small, regional firms to large, well-established international firms with multiple product offerings.

13

We compete with firms that provide HCM solutions by various means. Many providers continue to deliver legacy enterprise software, but as demand for greater flexibility and access to information grows, we believe there will be increased competition in the delivery of HCM cloud-based solutions by other SaaS providers, including those offering white label and embedded payroll solutions. Our competitors offer HCM solutions that may overlap with one, several or all categories of the applications and includewe offer. We compete with companies such as Automatic Data Processing, Inc., Ceridian HCM Holding,Cornerstone OnDemand, Inc., Cornerstone OnDemand,Dayforce, Inc., Gusto, Inc., Intuit, Inc., Insperity, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, Paycor HCM, Inc., People Center, Inc. d/b/a Rippling, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers. Our competitors provide HCM solutions by various means. Although certain providers continue to deliver legacy enterprise software, many now offer cloud-based solutions, resulting in increased competition for clients seeking the greater flexibility and regional providers.access to information provided by cloud-based offerings. Furthermore, the HCM industry has experienced an emergence of white label and embedded payroll offerings.

Competition in the HCM solutions market is primarily based on service responsiveness, product quality and reputation, breadth of service, application offering and price. The importance of these factors depends on the size of the business. Price tends to be the most important factor of competition for smaller businesses with fewer employees, while the scope of features and customization is more important to larger businesses. Regardless of a company’s size, another important factor is the implementation experience, as all organizations are seeking a streamlined and simplified process.

Sales and Marketing

We generate client leads and demo requests, accelerate sales opportunities and build brand awareness through our marketing programs that target senior finance and HR executives, technology professionals and senior business leaders of companies that perform HCM functions in-house or outsource these functions to one of our competitors. Our marketing programs include:

We sell our solution exclusively through our captive sales force, substantially all of whom have a four-year college degree. We typically recruit sales candidates who have sales experience in non-HCM industries or, with respect to candidates recruited directly from colleges and universities, who have demonstrated an aptitude for sales. Our sales force is comprised of inside sales and field sales personnel, who are organized geographically, and client relations representatives (“CRRs”),CRRs, who sell additional applications to existing clients.clients, and our emerging markets representatives, who focus on businesses with fewer than 50 employees. As of the filing of this Form 10-K, we have 55 sales teams (including one team consisting of CRRs and inside salesemerging markets representatives) located in 28 states and plan to open additional sales offices to further expand our market presence.

When a new client processes payroll with us for an entire month, our sales representative receives a one-time commission based upon an estimate of future annual revenues from such client. Executive sales representatives receive a higher commission rate and base salary based upon both current year and career-to-date realized sales.

In addition to managing client relationships, our CRRs are focused on expanding the number of applications our clients purchase from us by introducing them to additional applications. When an existing client purchases and then utilizes a new application, for one payroll cycle, a CRR receives a one-time commission based upon an estimate of future annual revenues from such client.

Technology, Operations and Security

Technology

Our multi-tenant architecture enables us to deliver our solution across our client base from a single platform, while securely partitioning access to our clients’ respective application data. Because a single version of our solution is developed, supported and deployed across all of our clients, the Paycom solution is seamlessly scalable.

Operations

We physically host our solution for our clients in three secure data center facilities located in Oklahoma and Texas. Each of these data centers is owned and managed by Paycom, and Paycom is the only tenant occupying the data centers. All of our critical systems are fully redundant and backed up at regular intervals to these facilities, and backups are monitored for success and failure status daily. Client data is backed up in real-time among the three data centers. We maintain redundant load-balanced internet lines serviced by multiple service providers to each data center, to ensure optimized client access to our solution and the clients’ stored data. Our server and database clusters are fully redundant to ensure continuous service in the event of a disk failure.

Physical security includes biometric and dedicated ID-oriented access control, redundant alarm systems and continuous camera monitoring by our security guards. The data centers also have environmental monitoring and extensive environmental controls such as heat and fire protection, moisture, temperature, and humidity sensors, backup power supply and exterior reinforced concrete walls.

14

Security

We maintain a formal and comprehensive security program designed to ensure the confidentiality, integrity and availability of our clients’ data. During the regular courseFor a discussion of business, we receive client data through our online system that we in turn process, record, store, and secure following ISO/IEC 27001:2013 certified controls and procedures. All communications with our servers must be encrypted and our servers are configured to only utilize high-grade encryption algorithms.

We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ network and endpoint intrusion detection and prevention sensors throughout our infrastructure, systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, a system for managing and installing patches for third-party applications, and highly restricted access to the internet for anyone who has access to client data. Our information security department regularly performs penetration testing and we retain a third-party penetration testing company to conduct penetration tests and periodic audits to identify and remediate any issues.

Our IT infrastructure is secured and monitored using a number of best practices and tools across physical and logical security. This security is also continually monitored by our information security department.program, see “Item 1C. Cybersecurity.”

Software Development

Our application development team works closely with our clients to enhance our existing application offerings and develop new applications. This process is led by experienced product managers, who oversee the evolution of their respective applications within a focused timeframe of innovation and cultivation in order to deliver the well-developed applications and enhancements desired by our clients. Our product managers are proactive in their approach to assigning development requests based on research, trends and user feedback. A key element of our development process is the one-on-one personal interaction between clients and our CRRs,service team, through whom our clients personally suggest new applications and features.

We develop our solution from the “ground up” with our internal development and engineering teams. Our development and engineering teams, along with our employees, conceive new applications and enhancements, review requests, schedule development in order of priority and subsequently develop the applications or enhancements. Our new applications and enhancements are independently reviewed by the quality assurance team, in accordance with our software development process, before being fully implemented. Any enhancementsEnhancements to our applications are typically released on a monthly scheduled release date to coordinate the communication and release to our clients.

Client Service

We are committed to providing industry-leading, client-centered service. For this reason, we assign each client a specialist within a dedicated team. This one-on-one service is a key part of our client service model and helps to ensure we are delivering an industry-leading solution and maintaining high client satisfaction. The primary elements of our client service model include the following:

Streamlined Setup and Onboarding

After electing to deploy our solution, a new client begins our onboarding process with assistance from a team of new client setup specialists and the sales representative responsible for obtaining the client’s business. In addition, we also have a team of transition specialists whose job it is to ensure that the process is performed smoothly, data is collected properly and all relevant employees are fully trained on the system. This team works closely with the client until the client is capable of managing our solution independently, at which time responsibility for the client relationship is transferred to our dedicated CRRs and service specialists. Unlike certain of our competitors, we do not outsource any of our onboarding efforts.

Dedicated Service Specialists

After completing the onboarding process, each client is assigned to a service specialist within a dedicated team. Clients can then contact their dedicated service specialist or a team member if any issues or questions arise. These specialists provide personalized service with a historical knowledge of the clients’ communicated business needs. When appropriate, client questions can be elevated to the specialists with the appropriate application expertise. In addition, our CRRs proactively contact our clients to ensure satisfaction with our solution and introduce additional applications.

Expert Level Service

Our service specialists are trained across all of our applications to ensure that they can provide comprehensive, expert-level service. Our client service is ISO 9001:2015 certified and helps support our high client retention rate.

15

Regulatory and CertificationsGovernment Regulation

We are subject to varying degrees of regulations in each of the jurisdictions in which we provide services. Local laws and regulations, and their interpretation and enforcement, differ significantly among those jurisdictions. We are also subject to certain federal, state, local and localforeign regulations based on the products we offer. For example, as a result of our background screening application, Enhanced Background Checks, we are subject to the Fair Credit Reporting Act and other federal and state background reporting laws. Further, our status as a government contractor subjects us to federal government contracting regulations including the adherence to heightened equal employment opportunity requirements, maintaining an affirmative action plan and other federal regulations.

Data privacy has become a significant issue in the United States and in other countries. The regulatory framework for privacy issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations affecting or regarding the collection, use and disclosure of personal information. In the United States, these include, for example, rules and regulations promulgated under the authority of the Federal Trade Commission, the Health Insurance Portability and Accountability Act of 1996, the Family Medical Leave Act of 1993, the ACA, the Financial Services Modernization Act of 1999, the Gramm-Leach-Bliley Act, state biometric privacy laws, including the Illinois Biometric Information Privacy Act (“IBIPA”), state breach notification laws and state consumer privacy laws, such asincluding the California Consumer Privacy Act of 2018 (the “CCPA”(“CCPA”), as amended by the California Privacy Rights Act (the “CPRA”) and the Illinois Biometric Information Privacy Act (the “IBIPA”(“CPRA”). Further, because some of our clients have establishments internationally, the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”), Mexico’s Federal Law on the Protection of Personal Data held by Private Parties, and the European Union’s General Data Protection Regulation (“GDPR”) and other foreign data privacy laws may impact our processing of certain client and employee information. In addition, regulatory and legislative authorities in the United States and the European Union have enacted or proposed legislation that imposes or would impose restrictions on the development of emerging technologies such as generative artificial intelligence (“generative AI”) and machine learning. The regulatory landscape related to generative AI and machine learning is rapidly evolving and is likely to remain uncertain for the foreseeable future. As we develop products that incorporate technologies such as generative AI and machine learning, we must comply with applicable laws and regulations.

Certifications

We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with System and Organization Controls Report, I (“SOC 1”). Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with System and Organization Controls Report, II (“SOC 2”). Our SOC 2 examination is conducted every year by one of the four largest independent international auditing firms, and addresses, among other areas, internal controls around security, availability, processing integrity, confidentiality and privacy. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.

In April 2020,2023, we renewed a certification based on ISO 9001:2015 criteria, a standard for the implementation of quality management processes published by ISO, covering our activities required to create and deliver our solution. This independent assessment of our conformity to the ISO 9001:2015 standard includes assessing the design and implementation of quality objectives to meet delivery standards on an ongoing basis. The certification is valid until April 2023,2026, with continuing assessments taking place annually.

In October 2022, we renewed a certification based on ISO 22301:2019 criteria, a standard for implementing and managing an effective Business Continuity Management System (BCMS) published by ISO. This international standard for continuity management specifies requirements to plan, implement, operate and continually improve a documented management system to protect against, prepare for, respond to and recover from disruptive incidents when they arise. The certification is valid until January 2026, with continuing assessments taking place annually.

In November 2022, we renewed a certification based on ISO/IEC 27001:2013 criteria, a security standard for Information Security Management Systems published by ISO covering our production, quality assurance and implementation environments. This independent assessment of our conformity to the ISO 27001 standard includes assessing security risks, designing and implementing comprehensive security controls and adopting an information security management process to meet security needs on an ongoing basis. The certification is valid until October 2025, with continuing assessments taking place annually.

In November 2022, we renewed a certification based on ISO 27701:2019 criteria, a standard for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) published by ISO. This international standard for PIMS specifies PIMS-related requirements and provides guidance for Personally Identifiable Information (PII) controllers and PII processors holding responsibility and accountability for PII processing. The certification is valid until February 2026, with continuing assessments taking place annually.

Intellectual Property

We rely on a combination of copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and protect our intellectual property rights. We also have a number of registered and unregistered trademarks and will continue to evaluate the registration of additional trademarks as appropriate. We do not have any patents or patent applications pending.

Seasonality

Our revenues are seasonal in nature and generally we expect our first and fourth quarter revenues to be higher than other quarters during the year. Our first quarter recurring revenues are positively impacted by the annual processing of payroll tax filing

16

forms and ACA form filing requirements, such as Form W-2, Form 1099 and Form 1095.requirements. We anticipate that our revenues will continue to exhibit this seasonal pattern related to ACA form filings for so long as the ACA (or replacement legislation) includes employer reporting requirements. Additionally, our fourth quarter recurring revenues are positively impacted by processing unscheduled payroll runs (such as bonuses) for our clients. Nonetheless, we expect the magnitude of these seasonal fluctuations in our revenues to decrease to the extent clients utilize more of our non-payroll applications.

Human Capital

As of December 31, 2022,2023, we employed 6,3497,308 people, substantially all of whom are full-time employees. Our human capital objectives include attracting, developing and retaining the best talent in the industry. We have been recognized both locally and nationally for providing our employees with an excellent work environment. We strive to provide a workplace that is free from harassment or discrimination, including harassment or discrimination involving race, color, sex, religion, gender, age, national origin, disability, gender identity or expression, sexual orientation, veteran or marital status. We believe that creating this kind of work environment is fundamental to fostering diversity.

Culture and Values

Paycom’s purpose is to create technology that simplifies life for employees. Our purpose guides every aspect of our business and creates a culture that aligns our employees with the core values of our company:

These values further define us and drive our success. They steer how we work with our clients and each other. Paycom would not be the company it is today without a deep desire to win and innovate new ideas. Our focus on people –— including our team members, our clients and their employees –— and caring about their experience, health and success, is at the heart of our culture. Our can-do attitude helps us embrace uncertainty with optimism and believe we can achieve what others consider impossible.

Diversity and Inclusion

Our commitment to diversity, inclusion and belonging starts with our goal to attract, retain and develop a workforce that is diverse in background, knowledge, skill and experience. We recognize Paycom plays an important part in the lives of our employees and strive to create an inclusive workplace where employees feel heard, valued and appreciated for who they are. We continue to work toward a diverse workforce at all employee levels, from entry level to executive. The table below summarizes our workforce demographics as of December 31, 2022.2023. The demographic workforce data within the table below, including race and ethnicity, gender

and job categories, aligns with the EEO-1 Component 1 data collection reporting requirements outlined by the U.S. Equal Employment Opportunity Commission.Commission, where applicable.

17

Training and Development

Through the use of our Paycom learning tool, we empower our employees by providing tailored learning paths in areas such as leadership, diversity and inclusion, technical skills and compliance. During 2022,2023, our employees completed thousands of courses utilizing our Paycom learning tool.

We provide our sales force with an intensive ten-week training course.courses. Our unique training program includes instruction in accounting, business metrics, application features and tax matters relevant to our target market and we believe it fosters loyalty and helps maintain our corporate culture. Our training continues for our sales force through weekly strategy sessions and leadership development training. Executive sales representatives are also required to attend quarterly conferences to share bestleading practices and receive legal and business updates.

Health, Safety and Wellness

We believe that our employees are the summation of our successes, which is why we offer an excellent health and benefits program to our employees and their families. We offer our employees comprehensive health insurance as well as optional dental and vision coverage. Additionally, we provide our employees several opportunities to focus on physical, mental and financial wellness by maintaining a fully equipped on-site gym, 401(k) matching, an employee stock purchase plan, and paid vacation, holiday, family leave and sick leave, with numerous other benefits offered to our employees.

Segment Information

We operate in a single operating segment and a single reporting segment. Operating segments are defined as components of an enterprise about which separate financial information is regularly evaluated by the chief operating decision maker function (which is fulfilled by our chief executive officer)Co-Chief Executive Officers) in deciding how to allocate resources and in assessing performance. Our chief executive officer allocatesCo-Chief Executive Officers allocate resources and assessesassess performance based upon financial information at the consolidated level. Because we operate in one operating segment, all required financial segment information is presented in the consolidated financial statements.

Available Information

Our internet address is www.paycom.com and our investor relations website is located at investors.paycom.com. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports can be found on our investor relations website, free of charge, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Information contained on our website is not incorporated by reference into this Form 10-K. The SEC maintains a public website, www.sec.gov, which includes information about and the filings of issuers that file electronically with the SEC.

Item 1A. Risk Factors

The risk factors noted in this section and other factors noted throughout this Form 10-K, including those risks identified in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” describe examples of risks, uncertainties and events that may cause our actual results to differ materially from those contained in any forward-looking statement. If one or more of these risks or uncertainties materialize, or if underlying assumptions prove incorrect, actual outcomes may vary materially from those included in this Form 10-K.

Risks Related to Our Business

If our security measures are breached, or unauthorized access to our clients’ or their employees’ or potential employees’ sensitive data is otherwise obtained, our solution may not be perceived as being secure, clients may reduce the use of or stop using our solution, our ability to attract new clients may be harmed and we may incur significant liabilities.

Our solution involves the collection, storage and transmission of clients’ and their employees’ and potential employees’ confidential and proprietary information, including personal identifying information, as well as financial and payroll data. HCM software is often targeted in cyber attacks,cyber-attacks, including computer viruses, worms, phishing attacks, malicious software programs and other information security breaches, which could result in the unauthorized access to or release, gathering, monitoring, misuse, loss or destruction of our or our clients’ sensitive data or otherwise disrupt our clients’ or other third parties’our clients’ business operations. If cybercriminalsthreat actors are able to circumvent our security measures or ifand we are unable to detect anor contain such intrusion into our systems and contain such intrusion in a reasonable amount of time,system, our or our clients’ sensitive data (including client employees’ personal data) may be compromised.

Certain Further, in order to provide our services, certain of our employees have access to sensitive information about our clients’ employees. While we conduct background checks of our employees and limit access to systems and data, it is possible that one or more of these individuals may circumvent these controls, resulting in a security breach.

In certain limited circumstances, we utilize relationships with third parties to aid in data management and transaction processing. Certain third parties with which we do business have been subject to cyber-attacks, one of which resulted in unauthorized access to data of certain Company clients and their employees as well as Company data and employee records. These third parties may be sources of cybersecurity or other technological risks in the future, including operational errors, system interruptions or breaches, unauthorized disclosure of confidential information and misuse of intellectual property. Even without a direct breach of our systems, cyber-attacks on such third-party vendors or on our clients could adversely impact our business and reputation.

Although we have security measures in place to protect client information and prevent data loss and other security breaches, these measures couldhave been in the past and in the future may be breached as a result of third-party action, employee error, third-party or employee malfeasance or otherwise. Globally, cybersecurity attacks are increasing in number and the attackersthreat actors are increasingly organized and well financed, or at times

18

supported by state actors. In addition, geopolitical tensions or conflicts, such as Russia’s invasion of Ukraine, the ongoing conflict between Israel and Hamas, or increasing tension with China, may create a heightened risk of cybersecurity attacks. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently, we may not be able to anticipate these techniques and implement adequate preventative or protective measures. While we currently maintain a cyber liability insurance policy, cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance policy may cover only a portion of losses incurred in investigating or remediating an incident, if at all, and may not cover all claims made against us, andus. Undergoing a government investigation or defending a suit,lawsuit, regardless of its merit, could be costly and divert management’s attention from our business and operations.

Any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition.

Any damage, failure or disruption of our SaaS network infrastructure or data centers could impair our ability to effectively provide our solution, harm our reputation and adversely affect our business.

Our SaaS network infrastructure is a critical part of our business operations. Our clients access our solution through standard web browsers, smart phones, tablets and other web-enabled devices and depend on us for fast and reliable access to our solution. We serve all of our clients from our three fully redundant data centers located in Oklahoma and Texas. Our SaaS network infrastructure and data centers are vulnerable to damage, failure and disruption.

In the future, we may experience issues with our computing and communications infrastructure or data centers caused by the following factors:

If our SaaS network infrastructure or our clients’ ability to access our solution is interrupted, client and employee data from recent transactions may be permanently lost, and we could be exposed to significant claims by clients, particularly if the access interruption is associated with problems in the timely delivery of funds payable to employees or tax authorities. Further, any adverse changes in service levels at our data centers resulting from damage to or failure of our data centers could result in disruptions in our services. Any significant instances of system downtime or performance problems at our data centers could negatively affect our reputation and ability to attract new clients, prevent us from gaining new or additional business from our current clients, or cause our current clients to terminate their use of our solution, any of which would adversely impact our revenues. In addition, if our network infrastructure and data centers fail to support increased capacity due to growth in our business, our clients may experience interruptions in the availability of our solution. Such interruptions may reduce our revenues, cause us to issue refunds to clients or adversely affect our retention of existing clients, any of which could have a negative impact on our business, operating results or financial condition.

If we are not able to develop enhancements and new applications, keep pace with technological developments or respond to future disruptive technologies, we might not remain competitive and our business could be adversely affected.

Our continued success will depend on our ability to adapt and innovate. In order to attract new clients and increase revenues from existing clients, we need to enhance, add new features to and improve our existing applications and introduce new applications. The success of any enhancements or new features and applications depends on several factors, including timely completion and introduction and market acceptance. We may expend significant time and resources developing and pursuing sales of a particular enhancement or application that may not result in revenues in the anticipated time frame or at all, or may not result in revenue growth sufficient to offset increased expenses. Further, changing legal and regulatory requirements may delay the development or introduction of enhancements or new applications or render certain of our applications obsolete. If we are unable to successfully develop enhancements, new features or new applications to meet client needs, our business and operating results could be adversely affected.

19

In addition, because our applications are designed to operate on a variety of network, hardware and software platforms using internet tools and protocols, we must continuously modify and enhance our applications to keep pace with changes in internet-related hardware, software, communication, browser and database technologies. If we are unable to respond in a timely and cost-effective manner to these rapid technological developments, our current and future applications may become less marketable and less competitive or even obsolete.

Our success is also subject to the risk of future disruptive technologies, such as artificial intelligence (“AI”)AI and machine learning. The failure to develop enhancements to our applications for, or that incorporate, technologies such as natural language processing, AI, machine learning, and blockchain may impact our ability to increase the efficiency of and reduce costs associated with our clients’ operations. If new technologies including but not limited to those that may involve AI or machine learning or be created using AI or machine learning, emerge that are able to deliver HCM solutions at lower prices, more efficiently or more conveniently, including but not limited to those that incorporate AI or machine learning or are created using AI or machine learning, such technologies could adversely impact our ability to compete. Furthermore, as we continue to use such new technologies in our own solution, developing, testing, and deploying resource-intensive AI systems will require additional investment and may increase our costs. There also may be real or perceived social harm, unfairness, or other outcomes that undermine public confidence in the use and deployment of AI. Any of the foregoing may result in decreased demand for our solution or harm to our business, results of operations or reputation.

The market in which we participate is highly competitive, and if we do not compete effectively, our business, operating results or financial condition could be adversely affected.

The market for HCM software is highly competitive, rapidly evolving and fragmented. If we are unable to compete effectively, our business, operating results or financial condition could be adversely affected. We expect competition to continue to intensify in the future with the introduction ofas new technologies and new market entrants. Manyentrants emerge and increasingly aggressive pricing strategies persist. Competition in the HCM solutions market is primarily based on service responsiveness, application quality and reputation, breadth of our currentservice and potentialproduct offering, and price. Certain competitors arehave access to larger clients and have greater brand name recognition, longer operating histories,major distribution agreements with consultants, software vendors and distributors and a more established relationships in the industry and significantly greater financial, technical and marketing resourcesglobal presence than we do. As a result, someCertain of theseour competitors have in the past or may be able to:in the future:

SomeOur competitors offer HCM solutions that may overlap with one, several or all categories of the applications we offer. We compete with companies such as Automatic Data Processing, Inc., Dayforce, Inc., Cornerstone OnDemand, Inc., Gusto, Inc., Intuit, Inc., Insperity, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, Paycor HCM, Inc., People Center, Inc. d/b/a Rippling, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other international, national, regional, and local providers. Our competitors provide HCM solutions by various means. Although certain providers continue to deliver legacy enterprise software, many now offer cloud-based solutions, resulting in increased competition for clients seeking the greater flexibility and access to information provided by cloud-based offerings. Furthermore, the HCM industry has experienced an emergence of white label and embedded payroll offerings. The proliferation of white label offerings and products and technologies utilizing embedded payroll systems may adversely affect our competitive position.

In addition, some of our principal competitors offer their products or services at a lower price, which has resulted in pricing pressures. Similarly, some competitors offer different billing terms, which has resulted in pressures on our billing terms. If we are unable to maintain our pricing levels and our billing terms, our operating results would be negatively impacted. In addition, pricing pressures and increased competition generally could hinder our ability to attract and retain clients and could result in reduced sales, reduced margins, losses or the failure of our solution to maintain widespread market acceptance, any of which could adversely affect our business, operating results or financial condition.

We compete with firms that provide HCM solutions by various means. Many providers continueOur business depends on our clients’ continued use of our applications, their purchases of additional applications from us and our ability to deliver legacy enterprise software, but as demand for greater flexibility and access to information grows, we believe there will be increased competitionadd new clients. Any decline in the deliveryour clients’ continued use of HCM cloud-based solutions by other SaaS providers, including those offering white label and embedded payroll solutions. Our competitors offer HCM solutions that may overlap with one, severalour applications or all categoriespurchases of additional applications and include companies such as Automatic Data Processing, Inc., Ceridian HCM Holding, Inc., Cornerstone OnDemand, Inc., Gusto, Inc., Intuit, Inc., Insperity, Inc., Oracle Corporation, Paychex, Inc., Paylocity Holding Corporation, Paycor HCM, Inc., People Center, Inc. d/b/a Rippling, SAP SE, ServiceNow, Inc., Ultimate Kronos Group, Workday, Inc., and other local and regional providers.

Furthermore, the HCM industry has begun to experience an emergence of embedded payroll offerings. Products and technologies utilizing embedded payroll systems and developed by others within the HCM industry maycould adversely affect our competitive position.business, operating results or financial condition.

Competition inIn order for us to maintain or improve our operating results, it is important that our current clients continue to use our applications and purchase additional applications from us, and that we add new clients. Generally, our clients have no obligation to continue to use our applications and have the HCM solutions market is primarily based on service responsiveness, application quality and reputation, breadthright to cancel their agreements with us for any or no reason by providing 30 days’ prior written notice. Moreover, from time to time, clients choose not to continue to use our applications at the same or higher level of service, if at all. Our annual revenue retention rate fluctuates as a result of a number of factors, including but not limited to the level of client satisfaction with our applications, pricing, the prices of competing products or services, mergers and product offering and price. Many ofacquisitions affecting our competitors have established marketing relationships, access to larger client bases and major distribution agreements with consultants, software vendors and distributors.base, reduced hiring by our clients or reductions in our clients’ spending levels. In addition, some competitorsbecause our Beti technology is designed to eliminate payroll errors that lead to billable corrections and unscheduled payroll runs, we have experienced and expect to continue to experience a reduction in these activities that would otherwise generate additional revenue for us. If our clients do not continue to use our applications, renew on less favorable terms or fail to purchase additional applications, or if we fail to add new clients, our annual revenue retention rate may offer software that addresses one or a limited number of HCM functions at a lower price point or with greater depth than our solution.

20

Further, some potential clients, particularly large enterprises, may elect to develop their own internal solutions. If we are unable to compete effectively,decline and our business, operating results or financial condition could be adversely affected.

Our business, operating results or financial condition could be adversely affected if our clients are not satisfied with our deployment or technical support services, or if our solution fails to perform properly.

Our business depends on our ability to satisfy our clients, both with respect to our applications and the technical support provided to help our clients use the applications that address the needs of their businesses. We use our in-house deployment personnel to implement and configure our solution and provide support to our clients. If a client is not satisfied with the quality of our solution, the applications delivered or the support provided, we could incur additional costs to address the situation, our profitability might be negatively affected, and the client’s dissatisfaction with our deployment or support service could harm our ability to sell additional applications to that client. In addition, our sales process is highly dependent on the reputation of our solution and applications and on positive recommendations from our existing clients. Our clients have no obligation to continue to use our applications, and may choose not to continue to use our applications at the same or higher level of service, if at all. Moreover, our clients generally have the right to cancel their agreements with us for any or no reason by providing 30 days’ prior written notice. In the past, some of our clients have elected not to continue to use our applications. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality technical support, could adversely affect client retention, our reputation, our ability to sell our applications to existing and prospective clients, and, as a result, our business, operating results or financial condition.

Further, our solution is inherently complex and may in the future contain, or develop, undetected defects or errors. Any defects in our applications could adversely affect our reputation, impair our ability to sell our applications in the future and result in significant costs to us. The costs incurred in correcting any application defects may be substantial and could adversely affect our business, operating results or financial condition. Any defects in functionality or defects that cause interruptions in the availability of our applications could result in:

Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our applications could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our clients regard as significant. Our clients might assert claims against us in the future alleging that they suffered damages due to a defect, error, or other failure of our solution. Our errors and omissions insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management’s attention. Any failures in the performance of our solution could harm our reputation and our ability to retain existing clients and attract new clients, which would have an adverse impact on our business, operating results or financial condition.

The marketWe face challenges related to attracting and retaining larger clients, including demand for our solution among large companies may be limited if these companies demand customized features, longer sales cycles and functions that we do not offer.less predictability in completing sales.

ProspectiveIn some cases, prospective clients, especially larger companies, may requireexpect customized features and functions unique to their business processes, thator are seeking to integrate our solutions with other products. If we do not offer. In order to ensure we meet these requirements, we may devote a significant amountthe demands of support and service resources to largersuch prospective clients, increasing the cost and time required to complete sales with no guarantee that these prospective clients will adopt our solution. Further, we may not be successful in implementing any customized features or functions. If prospective clients require customized features or functions that we do not offer, or that would be difficult for them to deploy themselves, the market for our solution will be more limited and our business could be adversely affected. Furthermore, pursing larger clients may result in a longer sales cycle and, in some cases, we may devote a significant amount of support and service resources to attract and acquire larger prospective clients with no guarantee that these prospective clients will adopt our solution.

We are dependent on the continued service of our key executives and, if we fail to retain such key executives, our business could be adversely affected.

We believe that our success depends in part on the continued services of our key executives, consisting of Chad Richison, Chris Thomas, Craig E. Boelte, Bradley S.Jason Clark, Brad Smith and Holly Faurot, and Justin Long.Faurot. Our business could be adversely affected if we fail to retain these key executives. Although the employment arrangements of certain of our key executives contain restrictive covenants, our business could

21

nonetheless be adversely affected if a key executive leaves Paycom and interferes with Paycom’s client, employee and/or other business relationships. In addition, we have not purchased key person life insurance on any of our key executives.

If we are unable to attract and retain qualified personnel, including software developers, product managers and skilled IT, sales, marketing and operational personnel, our ability to develop and market new and existing products and, in turn, increase our revenue and profitability could be adversely affected.

Our future success is dependent on our ability to continue to enhance and introduce new applications. As a result, we are heavily dependent on our ability to attract and retain qualified software developers, product managers and IT personnel with the requisite education, background and industry experience. In addition, to continue to execute our growth strategy, we must also attract and retain qualified sales, marketing and operational personnel capable of supporting a larger and more diverse client base. The softwaretechnology industry is characterized by a high level of employee mobility and aggressive recruiting among competitors. Thecompetitors, and competition is particularly intense for qualified software developers, product managers and IT personnel. In addition, the nature of the office environment is changing as employers continue to offer various remote or hybrid work arrangements, which can be an important factor in a candidate’s decision on employment. We maintain an office-centric operational model. Certain companies with which we compete for talent may offer work arrangements more flexible than ours, which may impact our ability to attract and retain qualified personnel if potential or current employees prefer such policies.

The competition for qualified personnel also may be amplified by new immigration laws or policies that could limit software companies’ ability to recruit internationally. Although we would not expect such changes in immigration laws or policies would notto have a significant direct impact on our workforce, the ensuing increase in demand for software developers and IT personnel could impair our ability to attract or retain skilled employees and/or significantly increase our costs to do so. Furthermore, identifying and recruiting qualified personnel and training them in the use of our applications requires significant time, expense and attention, and it can take a

substantial amount of time before our employees are fully trained and productive. The loss of the services of a significant number of employees could be disruptive to our development efforts, which may adversely affect our business by causing us to lose clients, increase operating expenses or divert management’s attention to recruit replacements for the departed employees.

Our business and operations are experiencing rapid growth and organizational change. If we fail to manage such growth and change effectively, we may be unable to execute our business plan, maintain high levels of service or adequately address competitive challenges.

We have experienced, and may continue to experience, rapid growth in our headcount and operations, which has placed, and may continue to place, significant demands on our management, operational and financial resources. We have also experienced significant growth in the number of clients and transactions and the amount of client and employee data that our infrastructure supports. As a result, our organizational structure and recording systems and procedures are becoming more complex as we improve our operational, financial and management controls. Our success depends, in part, on our ability to manage this growth and organizational change effectively. Moreover, our international expansion efforts are exacerbating many of these challenges. To manage the expected growth of our headcount and operations, we must continue to improve our operational, financial and management controls and our reporting systems and procedures. The failure to effectively manage growth could result in (i) declines in the quality of, or client satisfaction with, our applications or service delivery, (ii) increases in costs, (iii) difficulties or delays in introducing new applications or (iv) other operational difficulties, any of which could adversely affect our business by impairing our ability to retain and attract clients or sell additional applications to our existing clients.

Further, we need to continue to expand our inside and outside sales force and support team members in order to grow our client base and increase our revenues. Our ability to add additional officesexpand our sales force may be constrained by the COVID-19 pandemic, the willingness and availability of qualified personnel to staff and manage any new offices and our success in recruiting and training sales personnel in those new offices.personnel. If our expansion efforts are unsuccessful, our business, operating results or financial condition could be adversely affected.

The failure to develop and maintain our brand cost-effectively could have an adverse effect on our business.

We believe that developing and maintaining widespread awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our solution and is an important element in attracting new clients and retaining existing clients. Successful promotion of our brand depends largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful applications at competitive prices. Brand promotion activities, including increased spending on our national media campaigns, may not yield increased revenues, and even if they do, any increased revenues may not offset the expenses incurred in building our brand. If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract enough new clients or retain our existing clients to the extent necessary to realize a sufficient return on our brand-building efforts, which could have an adverse effect on our business.

As we continue to enhance our solution to serve clients located outside of the United States, our business is subject to risks associated with international operations.

An element of our growth strategy is to expand our operations and client base and we have recently begun to expand our operations into markets outside of the United States. Launching into international markets and doing business internationally involves a number of risks, including but not limited to:

Our expansion into international markets requires significant resources and management attention and subjects us to regulatory, economic and political risks that differ from those in the United States. Because of our inexperience with international operations, we

cannot ensure that our expansion into international markets will be successful, and the impact of such expansion may adversely affect our business, operating results or financial condition.

Our business depends in part on the success of our relationships with third parties.

We rely on third-party couriers to deliver payroll checks and tax forms and on financial and accounting processing systems and various financial institutions to perform financial services in connection with our applications, such as providing automated clearing house (“ACH”) and wire transfers as part of our payroll and tax payment services and facilitating our Vault Visa Payroll Card. We also rely on third parties to provide technology and content support, manufacture time clocks and process background checks. We anticipate that we will continue to depend on various third-party relationships in order to provide these and other services. Identifying, negotiating and documenting relationships with these third parties and integrating third-party content and technology requires significant time and resources. Our agreements with third parties typically are non-exclusive and do not prohibit them from working with our competitors. In addition, these third parties may not perform as expected under our agreements, which could hinder our ability to deliver certain services to our clients and negatively affect our brand and reputation. A global economic slowdown could also adversely affect the businesses of our third-party providers, hindering their ability to provide the services on which we rely. If we are unsuccessful in establishing or maintaining our relationships with these third parties, our ability to compete in the marketplace or to grow our revenues could be impaired and our business, operating results or financial condition could be adversely affected. Furthermore, due to our dependence on financial institutions for certain services, a systemic shutdown of the banking industry or a disruption of the Federal Reserve Bank’s services, including ACH processing, would impede our ability to provide our payroll and expense reimbursement services by delaying direct deposits and other financial transactions across the United States and could have an adverse impact on our financial results and liquidity.

We employ third-party licensed software for use in our applications and the inability to maintain these licenses or errors in the software we license could result in increased costs or reduced service levels, which could adversely affect our business.

Our applications incorporate certain third-party software obtained under licenses from other companies. For example, we rely on third-party software to support our background checks application. We anticipate that we will continue to rely on third-party software and development tools from third parties in the future. If the third-party software we currently license becomes unavailable, we may be unable to identify commercially reasonable alternatives without significant cost or difficulty, or available alternatives may not meet our internal cybersecurity requirements. In addition, incorporating the software used in our applications with new third-party software may require significant work and substantial investment of our time and resources. Also, to the extent that our applications depend upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications and harm our reputation.

If we fail to adequately protect our proprietary rights, our competitive advantage could be impaired and we may lose valuable assets, generate reduced revenues or incur costly litigation to protect our rights.

Our success is dependent in part upon our intellectual property. We rely on a combination of copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and to protect our intellectual property rights in the United States and in foreign jurisdictions. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual

22

property. Despite our precautions, it may be possible for unauthorized third parties to copy our applications and use information that we regard as proprietary to create products or services that compete with ours.

We may be required to spend significant resources to monitor and protect our intellectual property. We have been involved in litigation in the past and litigation may be necessary in the future to protect and enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time-consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. We may not be able to secure, protect and enforce our intellectual property rights or control access to, and the distribution of, our solution and proprietary information, which could adversely affect our business.

We may be sued by third parties for alleged infringement of their proprietary rights.

Considerable intellectual property development activity exists in our industry, and we expect that software developerscompanies will increasingly be subject to infringement claims as the number of applications and competitors grows and the functionality of applications in different industry segments overlaps. Our competitors, as well as a number of other entities and individuals, may own or claim to own intellectual property in technology areas relating to our solution or applications. In addition, we may increasingly be subject to trademark infringement claims as our presence grows in the marketplace. From time to time, third parties have asserted and may in the future assert that we are infringing on their intellectual property rights, and we may be found to be infringing upon such rights. A claim of infringement may also be made relating to technology that we acquire or license from third parties. However, we may be

unaware of the intellectual property rights of others that may cover, or may be alleged to cover, some or all of our solution, applications or brands.

The outcome of litigation is inherently unpredictable and, as a result, any future litigation or claim of infringement could (i) cause us to enter into an unfavorable royalty or license agreement, pay ongoing royalties or require that we comply with other unfavorable terms, (ii) require us to discontinue the sale of our solution or applications, (iii) require us to indemnify our clients or third-party service providers or (iv) require us to expend additional development resources to redesign our solution or applications. Any of these outcomes could harm our business. Even if we were to prevail, any litigation regarding our intellectual property could be costly and time consuming and divert the attention of our management and key personnel from our business and operations.

The use of open source software in our applications may expose us to additional risks and harm our intellectual property rights.

Some of our applications use software covered by open source licenses. From time to time, there have been claims challenging the ownership or use of certain types of open source software against companies that incorporate such software into their products or applications. As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition or require us to devote additional development resources to change our applications. In addition, if we were to combine our applications with open source software in a certain manner, we could, under certain types of the open source licenses, be required to release the source code of our applications. If we inappropriately use open source software, we may be required to redesign our applications, discontinue the sale of our applications or take other remedial actions, which could adversely impact our business, operating results or financial condition.

We employ third-party licensed software for use in our applications and the inability to maintain these licenses or errors in the software we license could result in increased costs or reduced service levels, which could adversely affect our business.

Our applications incorporate certain third-party software obtained under licenses from other companies. We anticipate that we will continue to rely on such third-party software and development tools from third parties in the future. Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace. In addition, incorporating the software used in our applications with new third-party software may require significant work and substantial investment of our time and resources. Also, to the extent that our applications depend upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications and harm our reputation.

We may acquire other businesses, applications or technologies, which could divert our management’s attention, result in additional dilution to our stockholders and otherwise disrupt our operations and harm our operating results.

In the future, we may seek to acquire or invest in businesses, applications or technologies that we believe complement or expand our applications, enhance our technical capabilities or otherwise offer growth opportunities. The pursuit of potential acquisitions may divert the attention of management and cause us to incur expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are ultimately consummated.

23

We do not have any experience in acquiring other businesses. If we acquire additional businesses, we may not be able to integrate the acquired personnel, operations and technologies successfully or to effectively manage the combined business following the acquisition. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

In addition, a significant portion of the purchase price of any companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could harm our results of operations. Acquisitions could also result in the incurrence of debt or issuances of equity securities, or the incurrence of debt, which would result in dilution to our stockholders.

Our business depends in part on the success of our relationships with third parties.

We rely on third-party couriers, financial and accounting processing systems, and various financial institutions, to deliver payroll checks and tax forms, perform financial services in connection with our applications, such as providing automated clearing house (“ACH”) and wire transfers as part of our payroll and tax payment services and to provide technology and content support, manufacture time clocks and process background checks. We anticipate that we will continue to depend on various third-party relationships in order to grow our business, provide technology and content support, manufacture time clocks, process background checks and deliver payroll checks and tax forms. Identifying, negotiating and documenting relationships with these third parties and integrating third-party content and technology requires significant time and resources. Our agreements with third parties typically are non-exclusive and do not prohibit them from working with our competitors. In addition, these third parties may not perform as expected under our agreements, and we may have disagreements or disputes with such third parties, which could negatively affect our brand and reputation. A global economic slowdown could also adversely affect the businesses of our third-party providers, hindering their ability to provide the services on which we rely. Further, a disruption of the Federal Reserve Bank’s services, including ACH processing, could negatively affect our payroll and expense reimbursement services by delaying direct deposits and other financial transactions across the United States. If we are unsuccessful in establishing or maintaining our relationships with these third parties, our ability to compete in the marketplace or to grow our revenues could be impaired and our business, operating results or financial condition could be adversely affected. Even if we are successful, these relationships may not result in improved operating results.

Because our long-term success may depend, in part, on our ability to expand the sales of our solution to clients located outside of the United States, our business could be subject to risks associated with international operations.

An element of our growth strategy is to expand our operations and client base. If we decide to expand our operations into international markets, it will require significant resources and management attention and will subject us to regulatory, economic and political risks that are different from those in the United States. Because of our lack of experience with international operations, we cannot ensure that our international expansion efforts will be successful, and the impact of such expansion efforts may adversely affect our business, operating results or financial condition.

24

Legal and Regulatory Risks

Changes in laws, government regulations and policies could have a material adverse effect on our business and results of operations.

Many of our applications are designed to assist our clients in complying with government regulations that continually change. The introduction of new regulatory requirements, or new interpretations of existing laws or regulations, could increase our cost of doing business. For example, there have beenbusiness, decrease our revenues and may continuenet income or require us to be a significant number of new laws and regulations promulgated by federal, state and local governments following the outbreak of the COVID-19 pandemic. We have expended additional resources and incurred additional costs in addressing the regulatory requirements applicablemake changes to us and our clients. More generally,applications. Moreover, changing regulatory requirements may make the introduction of new applications and enhancements more costly or more time-consuming than we currently anticipate or could prevent the introduction of new applications and enhancements by us altogether.

For example, a change in tax laws and regulations resulting in a decrease in the amount of taxes required to be withheld or accelerating the deadline to remit taxes to appropriate tax agencies would adversely impact our average balance of funds held for clients and, as a result, adversely impact the interest income we earn on such funds during the period between receipt and disbursement. Changes in laws, regulations or policies could also affect the extent and type of benefits employers are required, or may choose, to provide employees or the amount and type of taxes employers and employees are required to pay. Such changes could reduce or eliminate the need for certain of our existing applications or services, which would result in decreased revenues. For example, we generate ACA-related revenues (i) on an annual basis in connection with processing and filing Forms 1094 and 1095 on behalf of clients and (ii) from clients who have purchased our Enhanced ACA application as part of the fixed, bundled price charged per billing period. If the ACA is modified to eliminate the employer reporting requirements, or if the ACA is repealed and replaced with new legislation that does not include similar employer reporting requirements, we will no longer generate revenues in connection with processing and filing Forms 1094 and 1095 on behalf of clients. While we generally do not track our revenues on an application-by-application basis (because applications are often sold in various groupings and configurations for a single price), we estimate that, if the ACA is not modified or repealed, revenues from our Enhanced ACA application and ACA forms filings business will represent approximately 2% of total projected revenues for the year ending December 31, 2023.2024.

Further, we may spend time and money developing new applications and enhancements that, due to regulatory changes, become unnecessary prior to being released. In addition, any failure to educate and assist our clients with respect to new or revised legislation that impacts them could have an adverse effect on our reputation, and any failure to modify our applications or develop new applications in a timely fashion in response to regulatory changes could have an adverse effect on our business and results of operations. Additionally, new regulations or changes to existing regulations could be unclear, difficult to interpret or conflict with other applicable regulations. Our or our clients’ failure to comply with new or modified laws or regulations could result in financial penalties, legal proceedings or reputational harm. Finally, a negative audit or other investigations by the U.S. Government could adversely affect our ability to receive U.S. Government contracts and our future operating performance, and could result in financial or reputational harm.

In addition, federal, state and foreign government bodies or agencies have in the past adopted, and may in the future adopt, laws or regulations affecting the use of the internet as a commercial medium. Changes in these laws or regulations could require us to modify our applications. Further, government agencies or private organizations may impose taxes, fees or other charges for accessing the internet or commerce conducted via the internet. These laws or charges could limit the growth of internet-related commerce or communications generally or could result in reductions in the demand for internet-based applications such as ours.

Failure to comply with privacy, data protection and cyber securitycybersecurity laws and regulations could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences.

Our applications and services are subject to various complex laws and regulations on the federal, state, local, and localforeign levels, including those governing data security and privacy, which have become significant issues globally. The regulatory framework for privacy issues is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use and disclosure of personal information. In the United States, these include numerous state-level consumer privacy laws, beginning with California’s CCPA, the IBIPA, rules and regulations promulgated under the authority of the Federal Trade Commission, the Health Insurance Portability and Accountability Act of 1996, the Family Medical Leave Act of 1993, the ACA, the Financial Services Modernization Act of 1999 (the “GLBA”), federal and state labor and employment laws, and state data breach notification laws, and state privacycybersecurity laws, such as the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act,Act. As we expand our operations outside the IBIPAUnited States, our applications and services are or will be subject to additional laws governing data security and privacy in relevant jurisdictions, such as Canada’s PIPEDA and Mexico’s Federal Law on the Protection of Personal Data held by Private Parties, as well as the GDPR, which is applicable in the European Economic Area and the CCPA, which was passed in California in 2020.United Kingdom.

The CCPA provides California consumers with a private right of action if covered companies suffer a data breach related to their failure to implement reasonable security measures. The CCPA and other state-level consumer privacy laws give consumers located in those states certain rights to be informed of, opt-out of, and request deletion of the personal information that we hold, similar to those rights provided by the European Union’s GDPR. The IBIPA includes a private right of action for persons who are aggrieved by violations of the IBIPA. The GLBA is enforced under the authority of the Federal Trade Commission and requires our payment card services to adhere to a privacy notice and take certain measures to protect related personal information from unauthorized use and threats to data security. The CCPA provides California consumers with a private right of action if covered companies suffer a data breach related to their failure to implement reasonable security measures. The CCPA also gives California consumers certain rights to be informed of, opt-out of, and request deletion of the personal information that we hold, similar to those provided by the European Union’s GDPR. Further, becauseBecause some of our clients are located in Mexico and other clients have establishments internationally, Canada’s PIPEDA, Mexico’s Federal Law on the GDPRProtection of Personal Data, and other foreign data privacy laws, such as the GDPR, may impact our processing of certain client and employee information. Failure to comply with data protection and privacy laws and regulations could result in regulatory

25

scrutiny and increased exposure to the risk of litigation or the imposition of consent orders or civil and criminal penalties, including fines, which could have an adverse effect on our results of operations or financial condition. Moreover, allegations of non-compliance, whether or not true, could be costly, time consuming, distracting to management, and cause reputational harm.

The landscape of privacy laws applicable to our various products and services is evolving quickly. The California Privacy Rights Act (“CPRA”), which expands upon the CCPA, went into effect on January 1,in 2023. Virginia, Colorado, Connecticut and Utah recently passed itsenacted their own consumer data privacy statutestatutes, many of which are modeled on the CCPA, which also went into effect on January 1, 2023.CCPA. New data privacy statutes are slated to go into effect later this year in Colorado, ConnecticutDelaware, Indiana, Iowa, Montana, Oregon, Tennessee, and Utah.Texas. In addition, there are a number of other legislative proposals worldwide, including in the United States at both the federal and state level, that could impose additional and potentially conflicting obligations in areas affecting our business. Newly-passed legislative and regulatory initiatives may adversely affect the ability of our clients to process, handle, store, use and transmit demographic and personal information from their employees, which could reduce demand for our solution.

In addition to government regulation, privacy advocates and industry groups may propose and adopt new and different self-regulatory standards. Because the interpretation and application of many privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our solution. Any failure to comply with government regulations that apply to our applications, including privacy and data protection laws, could subject us to liability. In addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our solution, which could have an adverse effect on our business, operating results or financial condition. Any inability to adequately address privacy concerns and claims, even if unfounded, or inability to comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage to our reputation, reductions in our sales and other adverse effects on our business, operating results or financial condition.

Furthermore, privacy concerns may cause our clients’ employees to resist providing the personal data necessary to allow our clients and their employees to use our applications and services effectively. Even the perception of privacy concerns, whether or not valid, may inhibit market adoption of our applications and services in certain industries.

Certain of our products and services use data-driven insights to help our clients manage their businesses more efficiently. We believe that providing insights from aggregated data, including those insights derived from advancedgenerative AI and machine learning, maywill become increasingly important to the value that our solutions and services deliver to our customers. TheKnown risks of generative AI currently include accuracy, bias, privacy, security and data provenance. Regulatory and legislative authorities in the United States and the European Union have enacted or proposed legislation that imposes or would impose restrictions on the development of generative AI and machine learning. Our ability to provide data-driven insights using generative AI or machine learning may be constrained by current or future regulatory requirements, statutes or ethical considerations that could restrict or impose burdensome and costly requirements on our ability to leverage data in innovative ways. As we continue to pursue such new technologies, our failure to adequately address legal risks relating to the use of generative AI and machine learning in our applications could result in litigation regarding, among other things, intellectual property, privacy, employment, civil rights and other claims that could result in liability for the Company. The use of generative AI and machine learning may also result in new or increased governmental or regulatory scrutiny. Any actual or alleged noncompliance with applicable laws and regulations, or failure to meet client expectations with respect to the use of generative AI and machine learning, could result in negative publicity or harm to our reputation and subject us to investigations, claims or other remedies, and expose us to significant fines, penalties and other damages.

The adoption of new, or adverse interpretations of existing U.S. state, andU.S. federal, or foreign money transmitter, or money services business, or payment services statutes or regulations could subject us to additional regulation and related expenses and require changes to our business.

The adoption of new money transmitter, or money services business, or payment services statutes or regulations in jurisdictions, changes in regulators’ interpretation of existing U.S. state, andU.S. federal, or foreign money transmitter, or money services business, or payments services statutes or regulations, or disagreements by regulatory authorities with our interpretation of such statutes or regulations, could subjecthave subjected us to registration or licensing orand could limit business activities until we are appropriately licensed. These occurrences could also require changes to the manner in which we conduct certain aspects of our business or invest client funds, which could adversely impact the amount of interest income we receive from investing client funds before such funds are remitted to the appropriate taxing authorities and accounts designated by our clients.

While we maintain that we are not a money services business or money transmitter wein the United States and other jurisdictions, our operations in certain states and countries are or may be subject to anti-money laundering (“AML”) laws and regulations that require money services business or payment service business to, among other things, develop and implement risk-based anti-money laundering programs, report suspicious activity, and maintain transaction records. We have adopted an anti-money laundering (“AML”) compliance program to mitigate the risk of our application being used for illegal or illicit activity and to help detect and prevent fraud. Our AML compliance program is designed to foster trust in our application and services. Any violation of applicable AML laws or regulations could limit certain of our business activities until they are satisfactorily remediated and could result in civil and criminal penalties, including fines, which could damage our reputation and have a materially adverse effect on our results of operations and financial condition.

We are registered as a “money services business” in one jurisdictionmultiple jurisdictions and intend to apply for money services business or payment services licenses in others.other jurisdictions as applicable. Should other U.S. state, U.S. federal, or federalforeign regulators make a determination that we have operated as an unlicensed money services business, or money transmitter, or payment services provider, we could be subject to civil and criminal fines, penalties, costs of registration, legal fees, reputational damage or other negative consequences, all of which may have an adverse effect on our business operating results or financial condition.

Further, bank regulators continue to impose additional and stricter requirements on banks to ensure they are meeting their Bank Secrecy Act/USA PATRIOT Act obligations, and banks are increasingly viewing money services businesses and third-party senders to be higher risk customers for money laundering. Thus, our banking partners that assist in processing our money movement transactions may limit the scope of services they provide to us or may impose additional material requirements on us. These regulatory restrictions on banks and changes to banks’ internal risk-based policies and procedures may result in a decrease in the number of banks willing to do business with us, may require us to materially change the manner in which we conduct some aspects of our business, may decrease our revenues and earnings and could have a material adverse effect on our results of operations or financial condition.

Adverse tax laws or regulations could be enacted or existing laws could be applied to us or our clients, which could increase the costs of our solution and applications and could adversely affect our business, operating results or financial condition.

As a vendor of services, we are ordinarily held responsible by taxing authorities for collecting and paying any applicable sales or other similar taxes. Additionally, the application of federal, state and local tax laws to services provided electronically like ours is evolving. New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time (possibly with retroactive effect), and could be applied solely or disproportionately to services and applications provided over the internet. These enactments could adversely affect our sales activity, due to the inherent cost increase the taxes would represent, and ultimately could adversely affect our business, operating results or financial condition.

26

Each state has different rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that change over time. We review these rules and regulations periodically and, when we believe we are subject to sales and use taxes in a particular state, we may voluntarily engage state tax authorities in order to determine how to comply with that state’s rules and regulations. We cannot ensure that we will not be subject to sales and use taxes or related penalties for past sales in states where we currently believe no such taxes are required.

In addition, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us (possibly with retroactive effect), which could require us or our clients to pay additional tax amounts, as well as require us or our clients to pay fines or penalties and substantial interest for past amounts. If we are unsuccessful in collecting such taxes from our clients, we could be held liable for such costs, thereby adversely affecting our business, operating results or financial condition. Additionally, the imposition of such taxes on us would effectively increase the cost of our software and services we provide to clients and would likely have a negative impact on our ability to retain existing clients or to gain new clients in the jurisdictions in which such taxes are imposed.

Federal, state and localCompliance with employment-related laws and regulations could increase our cost of doing business and violations of such laws and regulations could subject us to fines and lawsuits.

Our operations are subject to a variety of federal, state, local and localinternational employment-related laws and regulations, including, but not limited to, the U.S. Fair Labor Standards Act, which governs such matters as minimum wages, the Family Medical Leave Act, overtime pay, compensable time, recordkeeping and other working conditions, Title VII of the Civil Rights Act, the Employee Retirement Income Security Act, the Americans with Disabilities Act, the National Labor Relations Act, regulations of the Equal Employment Opportunity Commission, regulations of the Office of Civil Rights, regulations of the Department of Labor, regulations of state attorneys general, federal and state wage and hour laws, and a variety of similar laws enacted by the federal and state governments that govern these and other employment-related matters. As our employees are located in a number of states and we are beginning to hire internationally, compliance with these evolving federal, state and local laws and regulations could substantially increase our cost of doing business. In recent years, companies have been subject to lawsuits, including class action lawsuits, alleging violations of federal and state law regarding workplace and employment matters, overtime wage policies, discrimination and similar matters, some of which have resulted in the payment of meaningful damages by the defendants. Similar lawsuits may be threatened or instituted against us from time to time, and we may incur damages and expenses resulting from lawsuits of this type, which could have a material adverse effect on our business, financial condition or results of operations. We are currently subject to employee-related legal proceedings in the ordinary course of business. While we believe that we have adequate reserves for those losses that we believe are probable and can be reasonably estimated, the ultimate results of legal proceedings and claims cannot be predicted with certainty.

While none of our employees are currently represented by a union, our employees have the right under the National Labor Relations Act to form or affiliate with a union. If a significant portion of our employees were to become unionized, our labor costs could increase and our business could be negatively affected by other requirements and expectations that could increase our costs, change our employee culture, impact corporate flexibility and disrupt our business. Additionally, our responses to any union

organizing efforts could negatively impact perception of our brand and have adverse effects on our business, including on our financial results. These responses could also expose us to legal risk, causing us to incur costs related to defending legal and regulatory actions, potential penalties and restrictions or reputational harm.

Our background check business is subject to significant governmental regulation, and changes in law or regulation, or a failure to correctly identify, interpret, comply with and reconcile the laws and regulations to which it is subject, could materially adversely affect our revenue or profitability.

We offer a background screening application called Enhanced Background Checks. In the course of providing background checks, we search and report public and non-public consumer information and records, including criminal records, employment and education history, credit history, driving records and drug screening results. Consequently, we are subject to extensive, evolving and often complex laws and governmental regulations, such as the Fair Credit Reporting Act (the “FCRA”), the Drivers’ Privacy Protection Act, state consumer reporting agency laws, state licensing and registration requirements, and various other foreign, federal, state and local laws and regulations. These laws and regulations set forth restrictions and process requirements concerning what may be reported about an individual, when, to whom, and for what purposes, and how the subjects of background checks are to be treated. Compliance with these laws and regulations requires significant expense and resources, which could increase significantly as these laws and regulations evolve. Such increase in restrictions and compliance costs could negatively affect our ability to provide other services expected by our clients and adversely affect our offerings and revenue.

Changes in law, regulation, or administrative enforcement and interpretations or other limitations and prohibitions related to the provision of consumer information and records could materially adversely affect our revenue and profitability. For example, numerous state and local authorities have implemented “ban the box” and “fair chance” hiring laws that limit or prohibit employers from inquiring or using a candidate’s criminal history to make employment decisions and many of these authorities have in recent years amended these laws to increase the restrictions on the use of such information. In addition, redaction of personal identifying information in criminal records (such as date of birth), and court rules or lawsuits that limit or restrict access to identifiers in criminal records, may negatively impact our ability to perform complete criminal background checks. The enactment of new restrictive legislation and the requirements, restrictions, and limitations imposed by changing interpretations and court decisions on such laws and regulations could prevent our customers from using the full functionality of our background screening application, which may reduce demand for such solution.

We could face liability from our background check services and the information we report or fail to report in our background checks, which may not be covered, in whole or in part, by insurance.

We face potential liability from individuals, classes of individuals, clients or regulatory bodies for claims based on the nature, content or accuracy of our background check services and the information we use and report. Our potential exposure to lawsuits or government investigations may increase depending in part on our clients’ compliance with these laws and regulations and applicable employment laws in their procurement and use of our background checks as part of their hiring process, which is generally outside of our control. Our potential liability includes claims of non-compliance with the FCRA, U.S. state consumer reporting agency laws or regulations, foreign regulations or applicable employment laws, as well as other claims of defamation, invasion of privacy, negligence, copyright, patent or trademark infringement. In some cases we may be subject to strict liability.

We also face potential liability from our clients, and possibly third parties, in the event we fail to report information, particularly criminal records or other potentially negative information, or wrongly report such information. From time to time, we have been subject to claims and lawsuits by current and potential employees of our clients, alleging that we provided to our clients inaccurate or improper information that negatively affected the clients’ hiring decisions. Although the resolutions of these lawsuits have not had a material adverse effect on us to date, the costs of such claims, including settlement amounts or punitive damages, could be material in the future, could cause adverse publicity and reputational damage, could divert the attention of our management, could subject us to equitable remedies relating to the operation of our business and provision of services and result in significant legal expenses, all of which could have a material adverse effect on our business, financial condition and results of operations and adverse publicity, and could result in the loss of existing clients and make it difficult to attract new clients. Insurance may not be adequate to cover us for all risks to which we are exposed or may not be available to cover these claims at all. Any imposition of liability, particularly liability that is not covered by insurance or is in excess of our insurance coverage, could have a material adverse effect on our business, financial condition or results of operations. Additionally, we cannot be certain that our insurance coverage, including any applicable deductibles, copays and other policy limits, will continue to be available to us at a reasonable cost or will be adequate to cover any claims or lawsuits we may face in the future or that we will be able to renew our insurance policies on favorable terms, or at all.

Industry and Financial Risks

Our financial results may fluctuate due to many factors, some of which may be beyond our control.

Our results of operations, including our revenues, costs of revenues, administrative expenses, operating income, cash flow and deferred revenue, may vary significantly in the future, and the results of any one period should not be relied upon as an indication of

future performance. Fluctuations in our financial results may negatively impact the value of our common stock. Our financial results may fluctuate as a result of a variety of factors, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business. Factors that may cause our financial results to fluctuate from period to period include, without limitation:

27

Certain of our operating results and financial metrics may be difficult to predict as a result of seasonality.

We have historically experienced seasonality in our revenues. A significant portion of our recurring revenues relate to the annual processing of payroll tax filing forms such as Form W-2 and Form 1099 and the annual processing and filing of ACA-related forms. These forms are typically processed in the first quarter of the year and, as a result, positively impact first quarter recurring revenues. In addition, unscheduled payroll runs at the end of the year (such as bonuses) have a positive impact on our recurring revenues in the fourth quarter. Although we expect the magnitude of seasonal fluctuations in our revenues to decrease in the future to the extent clients utilize more of our non-payroll applications, seasonal fluctuations in certain of our operating results and financial metrics may make such results and metrics difficult to predict.

Our outstanding indebtedness isWe are subject to certain operating and financial covenants that may restrict our business and financing activities and may adversely affect our cash flow and our ability to operate our business.

We maintain a senior secured revolving credit facility (the “Revolving Credit Facility”), which can be accessed as needed to supplement our operating cash flow and cash balances. Although we do not currently have incurredany outstanding indebtedness, to be used for ongoing working capital and general corporate purposes. Pursuantpursuant to the terms of our outstanding indebtedness,Credit Agreement (as defined herein) that governs the Revolving Credit Facility, we may not, subject to certain exceptions:

In addition, we are required to maintain as of the end of each fiscal quarter a consolidated interest coverage ratio of earnings before interest, taxes, depreciation and amortization (“EBITDA”) to interest charges of not less than 3.0 to 1.0 and a consolidated leverage

28

ratio of funded indebtedness to EBITDA of not greater than 3.753.5 to 1.0, stepping down to 3.25 to 1.0 as of December 31, 2024 and 3.0 to 1.0 at intervalsas of December 31, 2025, and thereafter. The operating and financial covenants in the loan agreements relating to our outstanding indebtedness,Credit Agreement, as well as any future financing agreements that we may enter into, may restrict our ability to finance our operations, engage in business activities or expand or fully pursue our business strategies. WeIf we borrow in the future, we may also be required to use a substantial portion of our cash flows to pay principal and interest on our debt, which would reduce the amount of money available for operations, working capital, expansion, or other general corporate purposes.

Our ability to meet our expenses and debt obligations and comply with the operating and financial covenants may be affected by financial, business, economic, regulatory and other factors beyond our control. We may be unable to control many of these factors and comply with these covenants. A breach of any of the covenants under our loan agreementsCredit Agreement could result in an event of default, which could cause allresult in the acceleration of ourany outstanding indebtedness or foreclosure on our assets pledged to become immediately due and payable.secure the indebtedness.

If our goodwill or other intangible assets become impaired, we may be required to record a significant charge to earnings.

We are required to test goodwill for impairment at least annually or earlier if events or changes in circumstances indicate the carrying value may not be recoverable. As of December 31, 2022,2023, we had recorded a total of $51.9 million of goodwill and $54.0$50.1 million of other intangible assets, net. An adverse change in domestic or global market conditions, particularly if such change has the effect of changing one of our critical assumptions or estimates made in connection with the impairment testing of goodwill or intangible assets, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or other intangible assets. Any such material charges may have a negative impact on our operating results or financial condition.

We may pay employees and taxing authorities amounts due for a payroll period before a client’s electronic funds transfers are finally settled to our account. If client payments are rejected by banking institutions or otherwise fail to clear into our accounts, we may require additional sources of short-term liquidity and our operating results could be adversely affected.

Our payroll processing application moves significant funds from the account of a client to employees and relevant taxing authorities. For larger funding amounts, we require clients to transfer the funds to us via fed wire. For smaller funding amounts, we debit a client’s account prior to any disbursement on its behalf, and due to ACH banking regulations, funds previously credited could be reversed under certain circumstances and time frames after our payment of amounts due to employees and taxing and other regulatory authorities. There is therefore a risk that the employer’s funds will be insufficient to cover the amounts we have already paid on its behalf. While such shortage and accompanying financial exposure has only occurred in very limited circumstances in the past, should clients default on their payment obligations in the future, we might be required to advance substantial funds to cover such obligations. In such an event, we may be required to seek additional sources of short-term liquidity, which may not be available on reasonable terms, if at all, and our operating results and our liquidity could be adversely affected and our banking relationships could be harmed.

If we are unable to maintain effective internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our common stock may be negatively affected.

As a public company, we are required to maintain internal control over financial reporting to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements. Management must evaluate and furnish a report on the effectiveness of our internal control over financial reporting as of the end of each fiscal year, and our auditors must attest to the effectiveness of our internal control over financial reporting.

If we have a material weakness in our internal control over financial reporting, we may not detect errors on a timely basis and our financial statements may be materially misstated. If we identify material weaknesses in our internal control over financial reporting or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and/or we could become subject to investigations by the New York Stock Exchange (the “NYSE”), the SEC, or other regulatory authorities and the market price of our common stock could be negatively affected.

Our actual operating results may differ significantly from our guidance.

We have released, and may continue to release, guidance in our earnings conference calls, earnings releases, or otherwise, regarding our future performance, which represents our estimates as of the date of release. This guidance, which includes forward-looking statements, has been and will be based on projections prepared by our management. These projections are not prepared with a view toward compliance with published guidelines of the American Institute of Certified Public Accountants, and neither our registered public accountants nor any other independent expert or outside party compiles or examines the projections. Accordingly, no such person expresses any opinion or any other form of assurance with respect to the projections.

Projections are based upon a number of assumptions and estimates that, while presented with numerical specificity, are inherently subject to significant business, economic, and competitive uncertainties and contingencies, many of which are beyond our control. Projections are also based upon specific assumptions with respect to future business decisions, some of which will change.

29

The principal reason that we release guidance is to provide a basis for our management to discuss our business outlook with analysts and investors. We do not accept any responsibility for any projections or reports published by any third parties.

Guidance is necessarily speculative in nature, and it can be expected that some or all of the assumptions underlying the guidance furnished by us will vary significantly from actual results. Accordingly, our guidance is only an estimate of what management believes is realizable as of the date of release. Actual results have in the past, and may in the future, vary from our guidance and the variations may be material. In light of the foregoing, investors are urged not to rely upon our guidance in making an investment decision regarding our common stock.

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this “Risk Factors” section in this Form 10-K could result in the actual operating results being different from our guidance, and the differences may be adverse and material.

Our reported financial results may be adversely affected by changes in accounting principles generally accepted in the United States.

Generally accepted accounting principles in the United States are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported financial results and could affect the reporting of transactions completed before the announcement of a change.

Risks Related to Ownership of Our Securities

The issuance of additional stock in connection with acquisitions, our stock incentive plans, warrants or otherwise will dilute all other stockholders.

Our certificate of incorporation authorizes us to issue up to one hundred million shares of common stock and up to ten million shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue all of these shares that are not already outstanding without any action or approval by our stockholders. We intend to continue to evaluate strategic acquisitions in the future. We may pay for such acquisitions, in part or in full, through the issuance of additional equity securities.

Any issuance of shares in connection with an acquisition, the exercise of stock options or warrants, the award of shares of restricted stock or otherwise would dilute the percentage ownership held by our existing stockholders.

Anti-takeover provisions in our charter documents and Delaware law may delay or prevent an acquisition of our company.

Our certificate of incorporation, bylaws and Delaware law contain provisions that may have the effect of delaying or preventing a change in control of us or changes in our management. These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management.

Any provision of our certificate of incorporation, bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could affect the price that some investors are willing to pay for our common stock.

Our certificate of incorporation contains an exclusive forum provision that may discourage lawsuits against us and our directors and officers.

Our certificate of incorporation provides that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware (or if no Court of Chancery located within the State of Delaware has jurisdiction, the Federal District Court for the District of Delaware) will be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim of breach of fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, any action asserting a claim against us or any of our directors, officers or other employees arising pursuant to any provision of Delaware law or our certificate of incorporation or our bylaws (as either may be amended from time to time) or any action asserting a claim against us or any of our directors, officers or other employees governed by the internal affairs doctrine. This exclusive forum provision applies to state and federal law claims, although our stockholders will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder. In addition, this exclusive forum selection provision will not apply to claims under the Exchange Act. Moreover, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. Accordingly, there is uncertainty as to whether a court would enforce our forum selection provision as written in connection with claims arising under the Securities Act. This forum selection provision may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us. It is also possible that, notwithstanding the forum selection clause included in our certificate of incorporation, a court could rule that such a provision is inapplicable or unenforceable.

30

We may not continue to pay dividends or to pay dividends at the same rate as announced in May 2023.

Our payment of dividends, as well as the rate at which we pay dividends, are solely at the discretion of our Board of Directors. Further, dividend payments, if any, are subject to our financial results and the availability of statutory surplus. These factors could result in a change to our recently adopted dividend policy.

General Risks

Adverse economic and market conditions could affect our business, operating results or financial condition.

Our business depends on the overall demand for HCM applications and on the economic health of our current and prospective clients. If economic conditions in the United States or in global markets deteriorate, clients may cease their operations, eliminate or reduce unscheduled payroll runs (such as bonuses), reduce headcount, delay or reduce their spending on HCM and other outsourcing services or attempt to renegotiate their contracts with us. In addition, global and regional macroeconomic developments, such as

increased unemployment, decreased income, uncertainty related to future economic activity, reduced access to credit, increased interest rates, inflation, volatility in capital markets, and decreased liquidity, among other possible factors, could negatively affect our ability to conduct business. Furthermore, the impact of such macroeconomic developments may be exacerbated by the COVID-19 pandemic or geopolitical events such as the ongoing military conflict in Ukraine.Ukraine and the ongoing conflict between Israel and Hamas. An economic decline could result in reductions in sales of our applications, decreased revenue from unscheduled payroll runs and fees charged on a per-employee basis, longer sales cycles, slower adoption of new technologies and increased price competition, any of which could adversely affect our business, operating results or financial condition. In addition, HCM spending levels may not increase following any recovery.

Further, as part of our payroll and tax filing application, we collect and then remit client funds to taxing authorities and accounts designated by our clients. During the interval between receipt and disbursement, we typically invest such funds in money market funds, demand deposit accounts, certificates of deposit, U.S. treasury securities and commercial paper. These investments are subject to general market, interest rate, credit and liquidity risks, and such risks may be exacerbated during periods of unusual financial market volatility. Any loss of or inability to access such funds could have an adverse impact on our cash position and results of operations and could require us to obtain additional sources of liquidity, which may not be available on terms that are acceptable to us, if at all. Furthermore, although increased interest rates may have a negative impact on certain clients, increased interest rates have resulted in increased interest earned on funds held for clients and additional income earned on our corporate funds. Changes in interest rates will impact potential earnings of future investments. A stable or rising interest rate environment would sustain the additional interest earned on funds held for clients and interest earned on our corporate funds, whereas a decreasing interest rate environment would compress the additional interest earnings and potentially adversely affect our operating results.

In recent years, there have been several instances when there has been uncertainty regarding the ability of Congress and the President collectively to reach agreement on federal budgetary and spending matters. A period of failure to reach agreement on these matters, particularly if accompanied by an actual or threatened government shutdown, may have an adverse impact on the U.S. economy. Additionally, because certain of our clients rely on government resources to fund their operations, a prolonged government shutdown may affect such clients’ ability to make timely payments to us, which could adversely affect our operations results or financial condition.

Further, as part of our payroll and tax filing application, we collect and then remit client funds to taxing authorities and accounts designated by our clients. During the interval between receipt and disbursement, we may invest such funds in money market funds, demand deposit accounts, certificates of deposit, U.S. treasury securities and commercial paper. These investments are subject to general market, interest rate, credit and liquidity risks, and such risks may be exacerbated during periods of unusual financial market volatility. Any loss of or inability to access such funds could have an adverse impact on our cash position and results of operations and could require us to obtain additional sources of liquidity, which may not be available on terms that are acceptable to us, if at all.

Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

Risk Management and Strategy

Overview

We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

Prevention, Identification, Detection and Mitigation Activities

We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following:

We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.

Infrastructure; Network and Physical Security

Our IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.

Incident Response

We maintain plans to address any cybersecurity incidents, including but not limited to Crisis Management Policies and Procedures, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency/Continuity Management Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team’s ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee on a quarterly basis.

Certifications and Audits

We maintain the following ISO certifications related to our information systems:

We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, processing integrity, confidentiality and privacy. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.

Impact of Risks from Cybersecurity Threats

We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, cause existing clients to discontinue the use of our solution, prevent us from attracting new clients, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition.

Governance

Both management and the Board of Directors are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board of Directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.

Role of the Board of Directors

The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Executive Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company’s information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.

Role of Management

The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Executive Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Executive Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 25 years. The Executive Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.

The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT

Security, Executive Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Executive Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.

In addition, we have established a working group composed of senior leaders from various departments, including operations, finance, IT, information security, audit, and legal. This working group’s responsibilities include (i) ensuring that information security goals and objectives are identified, meet organizational and business requirements, and are integrated into relevant processes, (ii) reviewing the effectiveness of the information security program, (iii) providing clear direction and highly visible management support for security initiatives, (iv) providing resources required for information security projects and initiatives, (v) overseeing programs to maintain information security awareness, including training and team-specific guidance, and (vi) coordinating the information security aspects of supplier relationships.

Item 2. Properties

Our corporate headquarters is an approximately 500,000-square-foot campus located on over 150 acres of Company-owned property in Oklahoma City, Oklahoma. In 2022, we commenced construction ofWe are currently constructing a new 315,000-square-foot building at our Oklahoma City headquarters. We also have an operations facility on approximately 14 acres of Company-owned property in Grapevine, Texas. In addition to housing two fully redundant data centers at our corporate headquarters in Oklahoma City, we operate another fully redundant data center at our Grapevine facility.

As of December 31, 2022,2023, we lease offices in 28 states.states and in certain international locations. We believe that these facilities are suitable for our current operations and, upon the expiration of the terms of the leases, we believe we could renew these leases or find suitable space elsewhere on acceptable terms.

Item 3. Legal Proceedings

From time to time, we are involved in various disputes, claims, suits, investigations and legal proceedings arising in the ordinary course of business. business, including commercial, intellectual property and employment-related matters, as well as stockholder derivative actions, class action lawsuits and other matters. The litigation matters described below involve issues or claims that may be of particular interest to our stockholders, regardless of whether any of these matters are material to our business or financial condition based upon the standard set forth in the SEC’s rules. We believe we have substantial defenses in each matter and we intend to vigorously defend against the claims brought by plaintiffs in these lawsuits.

On August 22, 2023, an individual on behalf of herself and her two minor children filed a class action lawsuit against our wholly owned subsidiary, Paycom Payroll, LLC, in the District Court of Oklahoma County. See Carmen Johnson et al. v. Paycom, No. CJ-2023-4763. The complaint relates to the previously disclosed cybersecurity incident involving a third-party vendor, MOVEit, and alleges claims and damages resulting from that matter, including claims for negligence, breach of implied contract, invasion of privacy, unjust enrichment and a request for declaratory and injunctive relief.

On November 10, 2023, a stockholder filed a securities class action lawsuit against the Company, Chad Richison (in his capacity as Chief Executive Officer) and Craig Boelte (in his capacity as Chief Financial Officer), in the U.S. District Court, Western District of Oklahoma, on behalf of a class of acquirers of Company securities between May 3, 2023 and November 1, 2023. See Angelo Ventrillo Jr. v. Paycom Software, Inc., et al., Case Number CIV-23-1019-F. Similar securities class action lawsuits, involving substantially similar allegations, have also been filed. See Minarik v. Paycom Software, Inc., et al., Case Number 5:24-CV-00014-J in the United States District Court for the Western District of Oklahoma; Schoenrock v. Paycom Software, Inc., et al., Case Number 5:24-CV-00012-F in the United States District Court for the Western District of Oklahoma; and Caloto v. Paycom Software, Inc., et al., Case Number 5:24-cv-00019-R in the United States District Court for the Southern District of New York (transferred to the Western District of Oklahoma on January 9, 2024). The plaintiffs are currently seeking consolidation, designation as lead plaintiff and certification as class representative under Rule 23 of the Federal Rules of Civil Procedure. The plaintiffs have brought multiple claims, including for violations of the federal securities laws under the Exchange Act, on behalf of persons or entities who purchased or otherwise acquired publicly traded Paycom securities during a disputed class period. Plaintiffs claim they incurred losses based on materially false and misleading statements made by the defendants during the class period, which led plaintiffs to invest in Paycom securities. The plaintiffs are seeking remedies including, but not limited to, compensatory damages, reimbursement of out-of-pocket costs, and injunctive relief.

On January 12, 2024, a stockholder filed a stockholder derivative complaint in the U.S. District Court, District of Delaware, against the Company and the members of the Board of Directors, invoking the allegations set forth in the Ventrillo, Caloto, Schoenrock and Minarik lawsuits described above. The complaint alleges breaches of fiduciary duties and violations of federal law. The plaintiffs seek to recover unspecified monetary damages on behalf of the Company. See Chelsey Moon, Derivatively on Behalf of Nominal Defendant Paycom Software, Inc., v. Chad Richison, et al., Case No. 1:24-cv-00046-UNA.

We believe that the resolution of current pending legal matters will not have a material adverse effect on our business, financial condition, results of operations or cash flows. Nonetheless, we cannot predict the outcome of these proceedings, as legal matters are subject to inherent uncertainties, and there exists the possibility that the ultimate resolution of these matters could have a material adverse effect on our business, financial condition, results of operations or cash flows. For additional information, see “Note 13. Commitments and Contingencies” in this Form 10-K.

Item 4. Mine Safety Disclosures

None.

PART II

Item 5. Market for RegistrantsRegistrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Our common stock is traded on the NYSE under the symbol “PAYC.” As of February 7, 2023,8, 2024, there were approximately 2,7983,209 holders of record of our common stock. This number is based on the actual number of holders registered at such date and does not include holders whose shares are held in “street name” by brokers and other nominees.

Dividends

We have not paid anyIn May 2023, our Board of Directors adopted a dividend policy under which we intend to pay quarterly cash dividends on our common stock asstock.

The following table summarizes dividend activity during 2023.

On February 5, 2024, our Board of any future dividends on sharesDirectors declared a quarterly cash dividend of $0.375 per share of common stock will bepayable on March 18, 2024 to stockholders of record at the soleclose of business on March 4, 2024.

The declaration, timing and amount of each quarterly cash dividend are subject to the discretion and approval of the Board of Directors, including a determination that the dividend policy and the declaration of dividends thereunder are in the best interests of our boardstockholders and are in compliance with applicable law. The Board of directorsDirectors retains the power to modify, suspend, or cancel the dividend policy in any manner and we may reduce or discontinue entirely the payment of such dividends at any time. Our board of directors may take into account general and economic conditions, our financial condition and operating results, our available cash and current and anticipated cash needs, capital requirements, contractual, legal, tax and regulatory restrictions and implications of the payment of dividends by us to our stockholders or by our subsidiaries to us, and such other factors as our board of directorstime that it may deem relevant.necessary or appropriate.

Performance Graph

Notwithstanding any statement to the contrary in any of our filings with the SEC, the following performance graph shall not be deemed “filed” with the SEC for purposes of Section 18 of the Exchange Act or “soliciting material” under the Exchange Act and shall not be incorporated by reference into any such filings irrespective of any general incorporation language contained in such filing.

The following graph compares the cumulative total stockholder return on our common stock with the cumulative total return of the S&P 500 Index and the S&P 500 Software & Services Index, and the S&P 1500 Application Software Index during the five-year period commencing on December 31, 20172018 and ending on December 31, 2022.2023. The graph assumes that $100 was invested in our common stock and in each of the comparative indices at the beginning of the period, and assumes the reinvestment of any dividends. Historical stock price performance should not be relied upon as an indication of future stock price performance.

We have selected the S&P 500 Software & Services Index as our published industry or line-of-business index, replacing the S&P 1500 Application Software Index used in prior years, as we believe the S&P 500 Software & Services Index represents a more appropriate peer group. The cumulative total return of the S&P 1500 Application Software Index is presented in the graph above as required by Item 201(e)(4) of Regulation S-K.

32

Purchases of Equity Securities

The number of shares of common stock repurchased by us during the three months ended December 31, 20222023 is set forth below:

Item 6. Reserved

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations

This Management’s Discussion and Analysis of Financial Condition and Results of Operations is intended to provide a reader of our financial statements with management’s perspective on our financial condition, results of operations, liquidity, and certain other factors that may affect our future results. The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the audited and unaudited consolidated financial statements (prepared in accordance with accounting principles generally accepted in the United States (“U.S. GAAP”) and related notes included elsewhere in this Annual Report on Form 10-K (this “Form 10-K”). The following discussion contains forward-looking statements that are subject to risks and uncertainties. See “Cautionary Statements” for a discussion of the uncertainties, risks, and assumptions associated with those statements. Actual results could differ materially from those discussed in or implied by forward-looking statements as a result of various factors, including those discussed below and elsewhere in this Form 10-K, particularly in the section entitled “Risk Factors.” Unless we state otherwise or the context otherwise requires, the terms “we,” “us,” “our” and the “Company” refer to Paycom Software, Inc. and its consolidated subsidiaries. All amounts presented in tables, other than per share amounts, are in thousands unless otherwise noted.

Overview

We are a leading provider of a comprehensive, cloud-based human capital management (“HCM”) solution delivered as Software-as-a-Service. We provide functionality and data analytics that businesses need to manage the complete employment lifecycle, from recruitment to retirement. Our solution requires virtually no customization and is based on a core system of record maintained in a single database for all HCM functions, including talent acquisition, time and labor management, payroll, talent management and human resources management applications. Our user-friendly software allows for easy adoption of our solution by employees, enabling self-management of their HCM activities in the cloud, which reduces the administrative burden on employers and increases employee productivity.

We generate revenues from (i) fixed amounts charged per billing period plus a fee per employee or transaction processed and (ii) fixed amounts charged per billing period. We do not require clients to enter into long-term contractual commitments with us. Our billing period varies by client based on when each client pays its employees, which may be weekly, bi-weekly, semi-monthly or monthly. We serve a diverse client base in terms of size and industry. None of our clients constituted more than one-half of one percent of our revenues for the year ended December 31, 2022.2023. Our revenues are primarily generated through our sales force that solicits new clients and our client relations representatives (“CRRs”) who sell new applications to existing clients.

Our continued growth depends on attracting new clients through further penetration of our existing markets and geographic expansion into new markets, targeting a high degree of client employee usage across our solution, and introducing new applications to our existing client base. We believe our ability to continue to develop new applications and to improve existing applications will enable us to increase revenues in the future, and the number of our new applications adopted by our clients has been a significant factor in our revenue growth. In January 2022, we added new sales teams in Las Vegas, Jacksonville, New England and South Jersey, bringing our total to 55 sales teams (including one team consisting of CRRs and inside sales representatives) located in 28 states. We plan to open additional sales offices in the future to further expand our market presence.

Our principal marketing efforts include national and local advertising campaigns, email campaigns, social and digital media campaigns, search engine marketing methods, sponsorships, tradeshows, print advertising and outbound marketing including personalized direct mail campaigns. In addition, we generate leads and build recognition of our brand and thought leadership with relevant and informative content, such as white papers, blogs, podcast episodes and webinars.

Throughout our history, we have built strong relationships with our clients. As the HCM needs of our clients evolve, we believe that we are well-positioned to expand the HCM spending of our clients and we believe this opportunity is significant. To be successful, we must continue to demonstrate the operational and economic benefits of our solution, as well as effectively hire, train, motivate and retain qualified personnel.

Growth Outlook, Opportunities and Challenges

As a result of our significant revenue growth and geographic expansion, we are presented with a variety of opportunities and challenges. Our payroll application is the foundation of our solution and all of our clients are required to utilize this application in order to access our other applications. Consequently, we have historically generated the majority of our revenues from our payroll applications, although our revenue mix has evolved and will continue to evolve as we develop and add new non-payroll applications to our solution. We believe our strategy of focusing on increased employee usage is an important differentiator for attracting new clients and is also key to long-term client satisfaction and client retention. Client adoption of new applications and client employee usage of both new and existing applications have been significant factors in our revenue growth, and we expect the continuation of this trajectory will depend, in part, on the introduction of applications to our existing client base that encourage and promote more employee usage. For example, in 2021, we launched our industry-first Beti technology, which further automates and streamlines the payroll process by empowering employees to do their own payroll. Moreover,Client adoption of new applications and, historically, client employee usage of both new and existing applications have been significant factors in our revenue growth. Nonetheless, because Beti is designed to eliminate payroll errors that lead to billable corrections and

unscheduled payroll runs, we have experienced and expect to continue to experience a reduction in these activities that would otherwise generate additional revenue for us.

In order to increase revenues and continue to improve our operating results, we must also attract new clients. We intend to

34

obtain new clients by (i) continuing to leverage our sales force productivity within markets where we currently have existing sales offices, (ii) expanding our presence in metropolitan areasmarkets where we currently have an existing sales office through adding sales teams or offices, thereby increasing the number of sales professionals within such markets, and (iii) opening sales offices in new metropolitan areas.markets.

OurThe market for HCM software is highly competitive, rapidly evolving and fragmented, and we expect competition to continue to intensify as new market entrants and disruptive technologies emerge and increasingly aggressive pricing and client retention strategies persist.

Historically, our target client range has been organizations with 50 to 10,000 employees. In 2023, we expanded our target client size range is 50 to include organizations with more than 10,000 employees. While we continue to serve a diversified client base ranging in size from one employee to many thousands of employees, the average size of our clients has grown significantly as we have organically grown our operations and increased the number of applications we offeroffer. Furthermore, with the launch of our Global HCM solution and gained tractionexpansion of payroll services into certain international markets, such as Canada and Mexico, we expect that our ability to serve organizations with international employees makes our solution more attractive to larger companies.companies, many of which have a global presence. We believe larger employers represent a substantial opportunity to increase our revenues per client, with limited incremental cost to us. Because we charge our clients on a per employee basis for certain services we provide, any increase or decrease in the number of employees of our clients will have a positive or negative impact, respectively, on our results of operations. A multitude of macroeconomic pressures, such as inflation and rising interest rates, impact our clients’ hiring practices to varying degrees and, in turn, impact our revenues. Generally, we expect that changes in certain factors affecting our performance will correlate with improvement or deterioration in the labor market. For example, the performance of our pre-employment services offerings is sensitive to changes in hiring trends and we believe it will reflect the current slowdown in hiring among U.S. employers.

Based on our total revenues, we have grown at a 25%23% compound annual growth rate from January 1, 20192020 through December 31, 2022.2023. Growing our business has resulted in, and will continue to result in, substantial investments in sales professionals, operating expenses, system development and programming costs and general and administrative expenses, which have increased and will continue to increase our expenses. Specifically, our revenue growth and geographic expansion drive increases in our employee headcount, which in turn precipitates increases in (i) salaries and benefits, (ii) stock-based compensation expense and (iii) facility costs related to the expansion of our corporate headquarters and operations facilities and additional sales office leases.

We believe the challenges of managing the ever-changing complexity of payroll and human resources will continue to drive companies to turn to outsourced providers for help with their HCM needs. The HCM industry historically has been driven, in part, by legislation and regulatory action, including COBRA, changes to the minimum wage laws or overtime rules, and legislation from federal, state, or municipal taxation authorities. The implementation of the Affordable Care Act (the “ACA”) is an example of legislation that has created demand in the HCM industry. We generate ACA-related revenues (i) on an annual basis in connection with processing and filing Forms 1094 and 1095 on behalf of clients and (ii) from clients who have purchased our Enhanced ACA application as part of the fixed, bundled price charged per billing period. While we generally do not track our revenues on an application-by-application basis (because applications are often sold in various groupings and configurations for a single price), we estimate that, if the ACA is not modified or repealed, revenues from our Enhanced ACA application and ACA forms filings business will represent approximately 2% of total projected revenues for the year ending December 31, 2023.2024.

For each of the years ended December 31, 2023, 2022 2021 and 2020,2021, our gross margin wasmargins were approximately 84%, 85%. and 85%, respectively. Although our gross margin may fluctuate from quarter to quarter due to seasonality and hiring trends, we expect that our gross margin will remain relatively consistent in future periods.

Key Metrics

In addition to the U.S. GAAP and non-GAAP metrics discussed elsewhere in this Form 10-K, we also monitor the following metrics to evaluate our business, measure our performance and identify trends affecting our business:

35

During the year ended December 31, 2023, we modified the method by which we calculate annual revenue retention rate. Prior period amounts have been recast to reflect the new methodology. We now calculate annual revenue retention rate for any 12-month period (a “Measurement Period”) as follows:

The trailing 12-month value of revenue from clients lost during the Measurement Period (“TTM Revenue Attrition”) is equal to the actual recurring fees paid by such lost clients during the 12 months preceding the respective dates on which they last processed payroll with us.

The point at which a client is deemed “lost” is determined based on the terms of our standard services agreement with clients. Beginning in July 2023, commensurate with operational changes related to how we mobilize our services department to manage relationships with clients that have missed a payroll, we amended our standard services agreement and, as a result, the point at which a client was deemed “lost” accelerated. Due to this change in methodology, the TTM Revenue Attrition for the year ended December 31, 2023 (i) includes revenue from certain former clients deemed lost in December 2023 that, under the historical methodology, may have been deemed lost in early 2024, and (ii) excludes revenue from certain former clients that, under the historical methodology, may have been deemed lost in early 2023 but was instead included in the TTM Revenue Attrition for the year ended December 31, 2022. In addition, due to rising interest rates and higher average balances of funds held for clients, we determined that interest earned on funds held for clients should be excluded from the annual revenue retention rate calculation beginning in 2023. In prior years, we did not believe that the interest earned on funds held for clients was material for purposes of this calculation.

Components of Results of Operations

Sources of Revenues

Revenues are comprisedconsist of recurring revenues, and implementation and other revenues. We expect our revenues to increase as we introduce new applications, expand our client base and renew and expand relationships with existing clients. As a percentage of total revenues, we expect our mix of recurring revenues, and implementation and other revenues to remain relatively constant.

Recurring Revenues

Recurring revenues include fees forare derived primarily from our talent acquisition, time and labor management, payroll, talent management and HR management applications as well as fees charged for form filings and delivery of client payroll checks and reports. TheseWe generate revenues are derived from (i) fixed amounts charged per billing period plus a fee per employee or transaction processed orand (ii) fixed amounts charged per billing period. We do not require clients to enter into long-term contractual commitments with us. Our billing period varies by client based on when each client pays its employees, which may be weekly, bi-weekly, semi-monthly or monthly. Because recurring revenues are based, in part, on fees for use of our applications and the delivery of checks and reports that are levied on a per-employee basis, our recurring revenues increase as our clients hire more employees. Recurring revenues are recognized in the period services are rendered.

Recurring revenues include revenues relating to the annual processing of payroll tax filing forms such as Form W-2 and Form 1099,ACA form filing requirements and revenues from processing unscheduled payroll runs (such as bonuses) for our clients. These payroll forms are typically processed in the first quarter of the year and many of our clients are subject to ACA form filing requirements in the first quarter, which positively impacts first quarter revenues and margins. We anticipate our revenues will continue to exhibit this seasonal pattern related to ACA form filings for so long as the ACA (or replacement legislation) includes employer reporting requirements. In addition, our recurring revenues during the fourth quarter are positively impacted by unscheduled payroll runs for our clients that occur before the end of the year. Nonetheless, we expect the magnitude of these seasonal fluctuations in our revenues to decrease to the extent clients utilize more of our non-payroll applications.

Recurring revenues also include interest earned on funds held for clients. We collect funds from clients in advance of either the applicable due date for payroll tax submissions or the applicable disbursement date for employee payment services. These collections from clients are typically disbursed from one to 30 days after receipt, with some funds being held for up to 120 days. We typically invest funds held for clients in money market funds, demand deposit accounts, commercial paper and certificates of deposit and commercial paper until they are paid to the applicable tax or regulatory agencies or to client employees. We expect interest earned on funds held for clients will increase asAs we introduce new applications, expand our client base and renew and expand relationships with existing clients. Theclients, we expect our average funds held for clients balance and, accordingly, interest earned on funds held for clients, will increase; however, the amount of interest we earn from the investment of client funds is alsocan be positively or negatively impacted by changes in interest rates.

Implementation and Other Revenues

Implementation and other revenues are comprisedconsist of implementation fees for the deployment of our solution and other revenues from sales of time clocks as part of our time and attendance services. Non-refundable implementation fees are charged to new clients at inception and upon the addition of certain incremental applications for existing clients. These fees generally range from 10% to 30% of the annualized value of the transaction. Implementation revenues are recognized as deferred revenue and amortized into income over the life of the client, which is estimated to be ten years, and other revenues are recognized upon shipment of time clocks. Implementation and other revenues comprised approximately 1.7% and 1.8% of our total revenues for each of the years ended December 31, 20222023 and 2021, respectively.2022.

Cost of Revenues

Cost of revenues consists of expenses related to hosting and supporting our applications, hardware costs, systems support and technology and depreciation and amortization. These costs include employee-related expenses (including non-cash stock-based compensation expenses) and other expenses related to client support, bank charges for processing ACH transactions, certain implementation expenses, delivery charges and paper costs. They also include our cost for time clocks sold and ongoing technology and support costs related to our systems. The amount of depreciation and amortization of property and equipment allocated to cost of revenues is determined based upon an estimate of assets used to support our operations.

36

Administrative Expenses

Administrative expenses consist of sales and marketing expenses, research and development expenses, general and administrative expenses and depreciation and amortization.amortization expenses. Sales and marketing expenses consist primarily of employee-related expenses for our direct sales and marketing staff (such as the amortization of commissions and bonuses and non-cash stock-based compensation expenses), marketing expenses and other related costs. Based on positive results from our advertising campaigns, we plan to continue to invest in our marketing program and may adjust spending levels in future periods as we see opportunities for favorable returns on our investments. Research and development expenses consist primarily of employee-related expenses (including

non-cash stock-based compensation expenses) for our development staff, net of capitalized software costs for internally developed software. We expect to grow our research and development efforts as we continue to broaden our payroll and HR solution offerings and extend our technological solutions by investing in the development of new applications and enhancements for existing applications. General and administrative expenses consist of employee-related expenses for finance and accounting, legal, human resources and management information systems personnel (including non-cash stock-based compensation expenses), legal costs, professional fees and other corporate expenses. Depreciation and amortization expenses consist of (i) the amount of depreciation and amortization of property and equipment allocated to administrative expenses (based upon an estimate of assets used to support our selling, general and administrative functions) and (ii) amortization of intangible assets.

Interest Expense

Interest expense includes interest on our long-term debt and settlements related to an interest rate swap prior to the termination of the interest rate swap agreement on August 24, 2022. We capitalizePrior to the repayment of our long-term debt in November 2023, we capitalized interest costs incurred for indebtedness related to construction in progress. See “Note 6. Long-Term Debt” for discussion of the repayment of our debt.

Other Income (Expense), net

Other income (expense), net includes interest earned on our own funds, any gain or loss on the sale or disposal of fixed assets, costs associated with the early repayment of debt, loss on the extinguishment of debt, and the realized gain whichthat resulted from the settlement of our interest rate swap agreement.

Provision for Income Taxes

Our consolidated financial statements include a provision for income taxes incurred for the anticipated tax consequences of the reported results of operations using the asset and liability method. Under this method, we recognize deferred tax assets and liabilities for the expected future tax consequences of temporary differences between the financial reporting and tax basis of assets and liabilities, as well as for any operating loss and tax credit carryforwards. Deferred tax assets and liabilities are measured using the tax rates expected to apply to taxable income for the years in which those tax assets and liabilities are expected to be realized or settled. We recognize a valuation allowance to reduce deferred tax assets to the net amount we believe is more likely than not to be realized.

Results of Operations

The following table sets forth selected consolidated statements of income data and such data as a percentage of total revenues for each of the periods indicated, as well as year-over-year changes with respect to each line item. Refer to “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” in the Annual Report on Form 10-K for the year ended December 31, 2021,2022, filed with the SEC on February 17, 202216, 2023,for a discussion of results for the year ended December 31, 2020,2021, including a discussion of the changes in our results of operations for the year ended December 31, 20212022 compared to the year ended December 31, 2020.2021.