There are no family relationships among any of the officers named above. Each officer of Enova holds office from the date of appointment until removal or termination of employment with Enova. Set forth below is additional information regarding the executive officers identified above.

David Fisher has served as our Chief Executive Officer since January 29, 2013 when he joined Enova. Mr. Fisher has also served as oura Director since February 11, 2013. Prior to joining Enova, Mr. Fisher was Chief Executive Officer of optionsXpress Holdings, Inc., or optionsXpress, from October 2007 until The Charles Schwab Corporation (“Schwab”), acquired the business in September 2011. Following the acquisition, Mr. Fisher served as President of optionsXpress until March 2012. Mr. Fisher also served as the President of optionsXpress from March 2007 to October 2007 and as the Chief Financial Officer of optionsXpress from August 2004 to March 2007. Prior to joining optionsXpress, Mr. Fisher served as Chief Financial Officer of Potbelly Sandwich Works from February 2001 to July 2004, and before that in the roles of Chief Financial Officer and General Counsel for Prism Financial Corporation. In addition, Mr. Fisher has served on the Board of Directors of InnerWorkings, Inc. since November 2011 and has served on the Board of Directors of GrubHub,GoHealth, Inc. since May 2012.2022 and Fathom Digital Manufacturing Corporation since December 2021. Mr. Fisher alsopreviously served on the Boards of Directors of optionsXpress, from October 2007 until September 2011 and CBOE Holdings, Inc. from January 2007 until October 2011., InnerWorkings, Inc., GrubHub, Inc. and Just Eat Takeaway.com N.V. Mr. Fisher received a Bachelor of Science degree in Finance from the University of Illinois and a law degree from Northwestern University School of Law.

Greg Zeeman has servedKirk Chartier currently serves as our Chief Operating Officer since October 2015. From September 2014 to October 2015,Strategy Officer. Mr. Zeeman served as Chief Executive Officer of Main Street Renewal, a firm specializing in the acquisition and leasing of single-family properties. From March 2012 to July 2014, Mr. Zeeman served as Chief Operating Officer and Senior Executive Vice President of HSBC USA. From March 2011 to March 2012, Mr. Zeeman served as Executive Vice President and Head, Change Delivery, HSBC Americas, and from January 2009 to March 2011, Mr. Zeeman served as Deputy Chief Executive Officer, HSBC Singapore. From 1999 to 2010, Mr. Zeeman held various roles with Household Credit Card Services and HSBC Consumer & Mortgage Lending. From 1995 to 1999, Mr. Zeeman was a consultant with Boston Consulting Group. Mr. Zeeman holds a Master of Business Administration degree from Harvard University and a Bachelor of Arts degree in Economics and Political Science from the University of North Carolina – Chapel Hill.

Kirk Chartier has served as our Chief Marketing Officer since he joined Enova in April 2013.2013 as Chief Marketing Officer. Prior to joining Enova, Mr. Chartier was the Executive Vice President & Chief Marketing Officer of optionsXpress Holdings from January 2010 until Schwab acquired the business in September 2011. Following the acquisition, Mr. Chartier served as Vice President of Schwab through May 2012. From 2004 to 2010, Mr. Chartier was the Senior Managing Principal and Business Strategy Practice Leader for the Zyman Group, a marketing and strategy consultancy owned by MDC Partners, where he also served in interim senior marketing executive roles for Fortune 500 companies, including Safeco Insurance. Mr. Chartier has held executive roles at technology companies including as Senior Vice President of Business Services & eCommerce for CommerceQuest, as Vice President of Online Marketing & Strategy for THINK New Ideas and as a Corporate Auditor for the General Electric Company. He started his career as a combat pilot with the U.S. Marine Corps and is a veteran of Desert Storm. Mr. Chartier received a Master of Business Administration from Syracuse University, a Bachelor of Arts in Economics from the College of the Holy Cross, and a Bachelor of Science in Engineering from Worcester Polytechnic Institute.

11

Steven Cunningham has served as our Chief Financial Officer since he joined Enova in June 2016. Mr. Cunningham joined Enova from Discover Financial Services, where he most recently served as Executive Vice President and Chief Risk Officer for Discover’s $8.7 billion direct banking and payment services business. He joined Discover as its Corporate Treasurer in 2010. Prior to Discover, Mr. Cunningham was the CFO of Harley-Davidson Financial Services, a $7 billion receivables business, and spent eight years at Capital One Financial in various corporate and line of business finance leadership positions, including CFO for the Auto Finance segment, a $20 billion receivables business, and CFO for the company’s banking segment. Mr. Cunningham also has experience as a bank regulator with the FDIC. Mr. Cunningham has served on the Board of Directors of AgriBank, a Farm Credit Bank, since January 2022. Mr. Cunningham received a bachelor’s degree in Corporate Finance and Investment Management from the University of Alabama and a Master of Business Administration from George Washington University. He also holds the professional designation of Chartered Financial Analyst.

Lisa M. YoungSean Rahilly has served as our General Counsel and SecretaryChief Compliance Officer since September 2011. Ms. YoungJune 2018. Mr. Rahilly joined Enova (then knownin October 2013 as CashNetUSA) in June 2009Chief Compliance Officer. Mr. Rahilly previously served as Assistant General Counsel and becameCompliance Officer of First American Bank from September 2006 to September 2013. He also served as First American Bank’s Vice President—General Counsel in August 2011. Ms. Young previously served asCommunity Reinvestment Act and Compliance Officer from January 2006 to September 2006, Vice President—Assistant General Counsel of JPMorgan Chase following the merger of Bank One and JPMorgan Chase in July 2004, and she served in this position until she joined us in 2009. From MayCompliance Manager from November 2003 to June 2004, she served as Senior Counsel with Bank One.January 2006 and Assistant Vice President—Compliance and Community Reinvestment Act from July 2002 to November 2003. Prior to joining First American Bank, One, Ms. YoungMr. Rahilly served as an attorney with the Law Offices of Victor J. Cacciatore, a project assistant with Schiff Hardin & Waite and in the Consumer Financial Services Litigation practice groups of McGuireWoods LLPvarious roles with Pullman Bank and Lovells LLP (currently known as Hogan Lovells US LLP) and as a litigation attorney at Goldberg Kohn Ltd. SheTrust Company. He received a Bachelor of Science degree in Electrical EngineeringAccountancy from theDePaul University College of Notre DameCommerce and a Juris Doctor from Northwestern University.DePaul University College of Law.

PersonnelHuman Capital

Our Workforce. Our employees are primarily located in the United States, with a portion of our workforce in Mexico and Brazil. As of December 31, 2017,2023, we had 1,1091,675 employees, with 1,634 of our employees located in the United States. None of our employees are currently covered by a collective bargaining agreement or represented by an employee union. We believe we have one of the most skilled and talented teams of professionals in the industry. Our employees have exceptional educational backgrounds, with numerous post-graduate and undergraduate degrees in science, technology, engineering, and mathematics fields. We hire and develop a diverse range of top talent from graduate and undergraduate programs at premier institutions as well as from coding bootcamps such as Code Platoon. The extensive education of our team is complemented by the experience our leadership team obtained at leading financial services companies and technology firms such as optionsXpress, Discover Financial Services, First American Bank, JPMorgan Chase and Groupon.

Diversity, Equity, & Inclusion. Diversity, equity, and inclusion (“DEI”) are highly valued at Enova. We are committed to fostering a culture where everyone is treated equitably and fairly, with a sense of belonging, community, and value. We believe that DEI is important to all aspects of our business, including our goal to attract, develop, and retain talent from underrepresented groups. Our business is better when we have a team of people from diverse backgrounds, experiences, talents, skills, and perspectives contributing to our success. To further our commitment, in 2021, we created a new position, Diversity, Equity, & Inclusion Lead, focused exclusively on fostering and driving our DEI initiatives and values. A key part of this role is partnering with Enova’s DEI Council, DEI groups, and business teams to ensure that our initiatives have an impactful role in our culture and day-to-day work.

In The Community.We are dedicated to having a positive impact on our community. We encourage our employees to volunteer in their communities and on behalf of causes that are important to them through our Enova Gives program. Corporate employees are granted one paid volunteer day per calendar year to volunteer with or on behalf of a qualified 501(c)(3) non-profit organization of their choice during work hours. In addition, Enova matches charitable donations from employees to qualifying 501(c)(3) non-profit organizations—up to $500 per employee each calendar year. At a company level, Enova invests financially in organizations that are dedicated to strengthening and broadening access to quality education; improving the lives of children and young adults in need; and providing access to high quality financial literacy programs.

Learning & Development.We offer a combination of required and optional learning and development opportunities to every Enova employee. Our learning and development program is facilitated and guided primarily by our Talent Development team, Operations Learning and Development team, company leaders, subject matter experts and our People team. We utilize an enterprise learning management system (“LMS”) to deliver and manage all online learning. Enova employees can utilize tuition reimbursement or department training budgets for external learning and development. Required compliance training is administered and tracked through our LMS, and every Enova employee is assigned required compliance e-Learning modules. We also invest in our talent through a variety of leadership and mentor programs, as well as other events focused on professional development.

Rewards & Benefits. The primary objectives of our compensation program are to: support Enova’s core values; attract, motivate, and retain the best talent; encourage and reward high performance and results, while aligning short- and long-term interests with those of our stockholders; and reinforce our strategy to grow our business as we continue to innovate. We offer employees competitive and comprehensive total rewards packages. For U.S.-based employees, this includes competitive base bay; annual bonus consideration; long-term incentive grants; employer-subsidized health, dental, and vision insurance; an employer match for 401(k) savings; paid and unpaid time off; group term life and disability insurance; paid volunteer day; paid holidays; paid parental leave; and a summer hours program. Enova offers additional corporate perks to its U.S. employees, including a discount savings program, tuition reimbursement, last-minute childcare reimbursement, and meal ordering. Enova also offers a paid four-week sabbatical program for eligible employees. Legal, financial, and work-life solutions and support are available through our Employee Assistance Program.

Market and Industry Data

The market and industry data contained in this Annual Report on Form 10-K, including trends in our markets and our position within such markets, are based on a variety of sources, including our good faith estimates, which are derived from our review of internal surveys, information obtained from customers and publicly available information, as well as from independent industry publications, reports by market research firms and other published independent sources. Although we believe these sources are reliable, we have not independently verified the information. None of the independent industry publications used in this report were prepared on our behalf.

REGULATION

Our operations are subject to extensive regulation, supervision and licensing under various federal, state, local and international statutes, ordinances and regulations.

U.S. Federal Regulation

Consumer Lending Laws.Our consumer loan business is subject to the federal Truth in Lending Act (“TILA”), and its underlying regulations, known as Regulation Z, and the Fair Credit Reporting Act (“FCRA”). These laws require us to provide certain disclosures to prospective borrowers and protect against unfair credit practices. The principal disclosures required under TILA are intended to promote the informed use of consumer credit. Under TILA, when acting as a lender, we are required to disclose certain material terms related to a credit transaction, including, but not limited to, the annual percentage rate, finance charge, amount financed, total of payments, the number and amount of payments and payment due dates to repay the indebtedness. The FCRA regulates the collection, dissemination and use of consumer information, including consumer credit information. The federal Equal Credit Opportunity Act (“ECOA”), prohibits us from discriminating against any credit applicant on the basis of any protected category, such as race, color, religion, national origin, sex, marital status or age, and requires us to notify credit applicants of any action taken on the individual’s credit application.

Consumer Reports and Information.The use of consumer reports and other personal data used in credit underwriting is governed by the FCRA and similar state laws governing the use of consumer credit information. The FCRA establishes requirements that apply to the use of “consumer reports” and similar data, including certain notifications to consumers where their loan application has been denied because of information contained in their consumer report. The FCRA requires us to promptly update any credit information reported to a credit reporting agency about a consumer and to allow a process by which consumers may inquire about credit information furnished by us to a consumer reporting agency.

Information-Sharing Laws.We are also subject to the federal Fair and Accurate Credit Transactions Act, which limits the sharing of information with affiliates for marketing purposes and requires us to adopt written guidance and procedures for detecting, preventing and responding appropriately to mitigate identity theft and to adopt various policies and procedures and provide training and materials that address the importance of protecting non-public personal information and aid us in detecting and responding to suspicious activity, including suspicious activity that may suggest a possible identity theft red flag, as appropriate.

12

Marketing Laws.Our advertising and marketing activities are subject to several federal laws and regulations including the Federal Trade Commission Act (the “FTC Act”), which prohibits unfair or deceptive acts or practices and false or misleading advertisements in all aspects of our business. As a financial services company, any advertisements related to our products must also comply with the advertising requirements set forth in TILA. Also, any of our telephone marketing activities must comply with the Telephone Consumer Protection Act (the “TCPA”) and the TelephoneTelemarketing Sales Rule (the “TSR”). The TCPA prohibits the use of automatic telephone dialing systems for communications with wireless phone numbers without express consent of the consumer, and the TSR established the Do Not Call Registry and sets forth standards of conduct for all telemarketing. Our advertising and marketing activities are also subject to the CAN-SPAM Act of 2003, which establishes certain requirements for commercial email messages and specifies penalties for the transmission of commercial email messages that are intended to deceive the recipient as to the source of content.

Protection of Military Members and Dependents.The Military Lending Act (“MLA”) is a federal law that limits the annual percentage rate to 36% on certain consumer loans made to active duty members of the U.S. military, reservists and members of the National Guard and their immediate families. The MLA’s implementing regulation also contains various disclosure requirements, limitations on renewals and refinancing, as well as restrictions on the use of prepayment penalties, arbitration provisions and certain waivers of rights. The 36% annual percentage rate cap applies to a variety of consumer loan products, including short-term consumer loans.products. Therefore, due to these rate restrictions, we are unable to offer certain short-term consumer loans to active duty military personnel, active reservists and members of the National Guard and their immediate dependents. Federal law also limits the annual percentage rate on existing loans when the borrower, or spouse of the borrower, becomes an active-duty member of the military during the life of a loan. Pursuant to federal law, the interest rate must be reduced to 6% per year on amounts outstanding during the time in which the servicememberservice member is on active duty.

Funds Transfer and Signature Authentication Laws.The consumer loan business is also subject to the federal Electronic Funds Transfer Act (“EFTA”), and various other laws, rules and guidelines relating to the procedures and disclosures required in debiting or crediting a debtor’s bank account relating to a consumer loan (i.e., Automated Clearing House (“ACH”) funds transfer). Furthermore, we are subject to various state and federal e-signature rules mandating that certain disclosures be made and certain steps be followed in order to obtain and authenticate e-signatures.

Debt Collection Practices. Additionally, our collection activities related to our CSO programs and our Bank Program are required to comply withWe use the federal Fair Debt Collection Practices Act (“FDCPA”), and we also use the FDCPA as a guide in connection with operating our other collection activities. We are also required to comply with all applicable state collection practices laws.

Privacy and Security of Non-Public Customer Information. We are also subject to various federal and state laws and regulations relating to privacy and data security. Under these laws, including the federal Gramm-Leach-Bliley Act (“GLBA”), we must disclose to consumersindividuals our privacy policy and practices, including those policies relating to the sharing of consumers’individuals’ nonpublic personal information with third parties. This disclosure must be made to consumers when the customer relationship is established and, in some cases, at least annually thereafter. These regulationsThe GLBA also requirerequires us to ensure that our systems are designed to protect the confidentiality of consumers’individuals’ nonpublic personal information. These regulations also dictateinformation and dictates certain actions that we must take to notify consumersindividuals if their personal information is disclosed in an unauthorized manner.

Anti-Money Laundering and Economic Sanctions.We are also subject to certain provisions of the USA PATRIOT Act and the Bank Secrecy Act under which we must maintain an anti-money laundering compliance program covering certain of our business activities. In addition, the Office of Foreign Assets Control (“OFAC”), prohibits us from engaging in financial transactions with specially designated nationals. Certain of our subsidiaries are also registered as money services businesses with the U.S. Department of the Treasury (“Treasury Department”) and must re-register with the Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) at least every two years if conducting money services business.

Anticorruption.We are also subject to the U.S. Foreign Corrupt Practices Act (the “FCPA”), which generally prohibits companies and their agents or intermediaries from making improper payments to foreign officials for the purpose of obtaining or keeping business and/or other benefits.

CFPB

CFPB

In July 2010, the U.S. Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) and Title X of the Dodd-Frank Act created the Consumer Financial Protection Bureau (the “CFPB”), which regulates consumer financial products and services, including consumer loans and remittance transfers that we offer. The CFPB has regulatory, supervisory and enforcement powers over providers of consumer financial products and services, including explicit supervisory authority to examine and require registration of suchcertain providers. Pursuant to these powers, the CFPB has examined our lending products, services and practices, and we expect to continue to be examined on a regular basis by the CFPB.

On October 6, 2017, the CFPB issued its final rule entitled “Payday, Vehicle Title, and Certain High-Cost Installment Loans” (the “Small Dollar Rule”), which covers certain consumer loans that we offer. The Small Dollar Rule requires that lenders who make short-term loans and longer-term loans with balloon payments reasonably determine consumers’ ability to repay the loans according to their terms before issuing the loans. The Small Dollar Rule also introduces new limitations on repayment processes for those lenders as well as lenders of other longer-term loans with an annual percentage rate greater than 36 percent that include an ACH authorization or similar payment provision. If a consumer has two consecutive failed payment attempts, the lender must obtain the consumer’s new and specific authorization to make further withdrawals from the consumer’s bank account. For loans covered by the Small Dollar Rule, lenders must provide certain notices to consumers before attempting a first payment withdrawal or an unusual withdrawal and after two consecutive failed withdrawal attempts. On June 7, 2019, the CFPB issued a final rule to set the compliance date for the mandatory underwriting provisions of the Small Dollar Rule to November 19, 2020. On July 7, 2020, the CFPB issued a final rule rescinding the ability to repay (“ATR”) provisions of the Small Dollar Rule along with related provisions, such as the establishment of registered information systems for checking ATR and reporting loan activity. The payment provisions of the Small Dollar Rule remained in place. In April 2018, an action was filed against the CFPB making a constitutional challenge to the Small Dollar Rule. On October 19, 2022, a three-judge panel of the Fifth Circuit U.S. Circuit Court of Appeals ruled that the funding structure of the CFPB is unconstitutional and vacated the Small Dollar Rule. On November 20, 2013, Cash America International, Inc. (“Cash America”),14, 2022, the CFPB filed a Petition for Writ of Certiorari with the U.S. Supreme Court to review the Fifth Circuit ruling, and on October 3, 2023, the Supreme Court held oral arguments. The Supreme Court is expected to rule on the matter in spring of 2024. If the Small Dollar Rule becomes effective in its current proposed form, we will need to make certain changes to our parent company atpayment processes and customer notifications in our U.S. consumer lending business. If we are not able to execute these changes effectively because of unexpected complexities, costs or otherwise, we cannot guarantee that the time,Small Dollar Rule will not have a material adverse impact on our business, prospects, results of operations, financial condition and cash flows.

On January 25, 2019, we consented to the issuance of a Consent Order by the CFPB pursuant to which itwe agreed, without admitting or denying any of the facts or conclusions,

13

made by the CFPB from its 2012 examination of Cash America and us, to pay a civil money penalty of $5$3.2 million. The Consent Order relates in partrelated to issues self-disclosed to the CFPB by us,in 2014, including failure to provide loan extensions to 308 consumers and debiting approximately 5,500 consumers from the makingwrong bank account.

On November 15, 2023, we consented to the issuance of a limited numberConsent Order by the CFPB that supersedes the January 25, 2019 Consent Order and pursuant to which we agreed, without admitting or denying any of loansthe facts or conclusions, to pay a civil money penalty of $15 million. The Consent Order relates to issues such as payment processing and debiting errors, the majority of which were self-disclosed. The Consent Order requires that we honor loan extensions granted to consumers who may have been active-duty membersand debit a loan extension fee to such consumers instead of debiting the full payment, and that we not debit or attempt to debit, on an individual or recurring basis, any consumer’s bank account without obtaining the consumer’s express informed consent and providing the consumer a copy of the military at the time of the loan at rates in excess of the annual percentage rate permitted by the federal Military Lending Act, and for which made refunds of approximately $33,500, and for certain failuresauthorization. The Consent Order also restricts our ability to timely provide and preserve records andoriginate or service payday loans or use payday consumer information in connection with the CFPB’s examination of us. In addition, asto market consumer financial products. The Consent Order will terminate seven years from November 15, 2023.

As a result of the CFPB’s review,issues giving rise to the Consent Order that we self-identified, we implemented enhanced policies and procedures designed to prevent the prohibited actions. We continue to enhance our compliance management system and implemented additional policies and proceduresinternal controls as well as our technology platform to address the issues identified by the CFPB. These policies, proceduresnoted above.

Enova continues to monitor and other initiatives are in many cases subjectoptimize its compliance program with respect to review and potential objection by the CFPB. We remain subject to the restrictions and obligations of the Consent Order including the CFPB’s order thatrequirements, leveraging monitoring, testing and audit of its compliance program and payment processes. The aforementioned changes have not had a material impact on our financial results, nor do we ensure compliance with federal consumer financial laws and develop more robust compliance policies and procedures.

On May 5, 2016, the CFPB issued proposed rules prohibiting the use of mandatory arbitration clauses and class action waiver provisions in consumer financial services contracts. On July 10, 2017, the CFPB issued a final rule consistent with its proposed rule. On November 1, 2017, President Trump signed a joint resolution passed by the House and Senate pursuantexpect them to the Congressional Review Act disapproving the CFPB arbitration rule and blocking it from taking effect. The joint resolution also precludes an agency from reissuing a rule in substantially the same form unless the reissued rule is specifically authorized by a law enacted subsequent to the President signing the joint resolution of disapproval.

On October 6, 2017, the CFPB issued its Final Rule (the “Final Rule”) on Payday, Vehicle Title, and Certain High-Cost Installment Loans. The Final Rule would impose significant limitations on all short-term loans and longer-term loans with balloon payments. Among other provisions, the Final Rule requires lenders to conduct a specific assessment regarding a borrower’s ability to repay, including a requirement to verify borrowers’ income and major financial obligations. The Final Rule also includes limitations on the number of loans that certain borrowers can have within a specified time frame and requires additional disclosures in loan documents and notices and limitations regarding payments. The Final Rule was published in the Federal Register on November 17, 2017 and will apply to loan contracts entered into beginning August 19, 2019. However, under the Congressional Review Act, Congress has 60 legislative days after publication of the rule in the Federal Register to overturn it by a majority vote in both Houses of Congress. On January 16, 2018, the CFPB issued a statement that it intends to engage in a rulemaking process to reconsider the Final Rule. We do not currently know which portions of the Final Rule will be subject to reconsideration or the nature and extent of the final rule that the CFPB will adopt. It is also likely that there will be legal challenges to the final rule if it does not change before it goes into effect.

On July 28, 2016, the CFPB, pursuant to the authority provided in the Dodd-Frank Act, issued an outline of proposals pertaining to third-party debt collectors and others covered by the FDCPA that is intended to increase consumer protection during debt collection (“Debt Collection Outline”). In the Debt Collection Outline, the CFPB is considering substantive rules under the FDCPA that would, among other proposals: (i) require collectors to substantiate the debt and confirm that they have sufficient consumer information before starting collection; (ii) limit communication attempts to six per week through any point of contact; (iii) make it easier for consumers to stop specific ways collectors are contacting them; (iv) prohibit collectors from communicating with certain parties for 30 days after a consumer’s death; (v) make it easier for consumers to dispute debts by, among other proposals, requiring collectors to include more specific information about the debt in the initial collection notices sent to consumers as well as a “tear-off” portion of the notice that consumers could send back to the collector; (vi) require collectors to verify a debt through a written report if the debt is disputed in writing by a consumer; (vii) prohibit collectors from continuing collection efforts or suing for the debt until the necessary documentation is checked if a consumer disputes the debt; and (viii) require a subsequent holder of a debt to resolve any outstanding dispute about the debt before attempting to collect.

The proposals in the Debt Collection Outline would apply to our collection of debt originated by other lenders, including under our CSO programs and our Bank Program. The proposals in the Debt Collection Outline would not apply to our collection of debt that we originate; however, the CFPB has announced that it plans to address consumer protection issues involving first-party debt collectors and creditors separately. The CFPB published its Debt Collection Outline in preparation for convening a Small Business Review Panel to determine whether its proposal could have a significant economicmaterial impact on small businesses. The Debt Collection Outline does not include proposed or final rules, and any future rules could be significantly different from those in the Debt Collection Outline. The CFPB has not yet defined a date for any proposed rules related to debt collection nor has it defined the effective date for the implementation of final rules.financial results.

For further discussion of the CFPB and its regulatory, supervisory and enforcement powers, see “Risk Factors—Risks Related to Our Business and Industry—The Consumer Financial Protection Bureau has examination authority over our U.S. consumer lending business that could have a significant impact on our U.S. business” in Part I, Item 1A of this report.

U.S. State Regulation

Our consumer lending business is regulated under a variety of enabling state statutes, all of which are subject to change and which may impose significant costs or limitations on the way we conduct or expand our business. As of the date of this report, we offer or arrange consumer loans in 3337 states that have specific statutes and regulations that enable us to offer economically viable products. We currently do not offer consumer loans in the remaining states or in the District of Columbia because we do not believe it is

14

economically feasible to operate in those jurisdictions due to specific statutory or regulatory restrictions, such as interest rate ceilings, caps on the fees that may be charged, or costly operational

requirements. However, we may later offer our consumer products or services in any of these states or the District of Columbia if we believe doing so may become economically viable because of changes in applicable statutes or regulations or if we determine we can broaden our product offerings to operate under existing laws and regulations.

The scope of state regulation of consumer loans, including the fees and terms of our products and services, varies from state to state. The terms of our products and services vary from state to state in order to comply with the laws and regulations of the states in which we operate. In addition, our advertising and marketing activities and disclosures are subject to review under various state consumer protection laws and other applicable laws and regulations. The states with laws that specifically regulate our consumer products and services may limit the principal amount of a consumer loan, and set maximum fees or interest rates customers may be charged. Some states also limit a customer’s ability to renew a short-term consumer loancharged and require various disclosures to consumers. State statutes often specify minimum and maximum maturity dates for short-term consumer loans such as ours and, in some cases, specify mandatory cooling-off periods between transactions.dates. Our collection activities regarding past due amounts aremay be subject to consumer protection laws and state regulations relating to debt collection practices. In addition, some states require certain disclosures or content to accompany our advertising or marketing materials. Also, some states require us to report short-term consumer loan activity to state-wide databases and restrict the number and/or principal amount of loans a consumer may have outstanding at any particular time or over the course of a particular period of time, typically twelve months.time.

In Texas, and Ohio, where we offer our CSO programs,program, we comply with the applicable jurisdiction’s Credit Services Organization Act or a similar statute.and related regulations. These laws generally define the services that we can provide to consumers and require us to provide a contract to the customer outlining our services and the cost of those services to the customer. In addition, these laws may require additional disclosures to consumers and may require us to be registered with the jurisdiction and/or be bonded.

We must also comply with state restrictions on the use of lead providers. Over the past few years, several states have taken actions that have caused us to discontinue the use of lead providers in those states. Other states may propose or enact similar restrictions on lead providers in the future.

A variety of states have recently enacted legislation related to consumer data privacy. The laws have varying consumer protections, including the right to access and delete personal information and to opt-out of the sale of personal information. Other states may propose or enacted similar laws in the future.

Over the last few years, legislation that prohibits or severely restricts our consumer loan products and services has been introduced or adopted in a number of states. As a result, we have altered or ceased making consumer loans in severalcertain states, where we formerly made such loans, and we have also modified our business operations in other states where restrictive legislation has been enacted. For example, Maryland passed a law in 2017 that limitscompliance with the total fees, charges and interest that can be assessed on unsecured revolving credit plans with Maryland consumers to an effective rate of 33% per year. The law went into effect on July 1, 2017 with regard to new revolving credit plans. Additional legislation or regulations targeting or otherwise directly affecting our products and services have also been recently passed in several states.statutes. We regularly monitor proposed legislation or regulations that could affect our business.

Licensing Requirements – Small Business Loans

In states and jurisdictions that do not require a license to make commercial loans, OnDeck, and certain other of our subsidiaries, typically make commercial installment loans and extend lines of credit directly to customers pursuant to Utah or Virginia law. There are other states and jurisdictions that require a license or have other requirements or restrictions applicable to commercial loans, including both installment loans and line of credit accounts, and may not honor a Utah or Virginia choice of law. In these other states, historically we have originated some installment loans and lines of credit directly but purchased other installment loans and lines of credit from issuing bank partners, the foregoing depending on the requirements or restrictions of these other states. Certain line of credit accounts are extended by an issuing bank partner and we may purchase extensions under those line of credit accounts.

The issuing bank partner establishes its underwriting criteria for the issuing bank partner program in consultation with us. We recommend commercial loans to the issuing bank partner that meet the bank partner's underwriting criteria, at which point the issuing bank partner may elect to fund the installment finance loan or extend the line of credit. The issuing bank partner earns origination fees from the customers who borrow from it and retains the interest paid during the period that the issuing bank partner owns the loan. In exchange for recommending loans to an issuing bank partner, we earn a marketing referral fee based on the loans recommended to, and originated by, that issuing bank partner. Historically, OnDeck has been the purchaser of the loans that it referred to issuing bank partners.

Local Regulation—United States

In addition to state and federal laws and regulations, the short-term loanconsumer lending industry is subject to various local rules and regulations. These local rules and regulations are subject to change and vary widely from city to city. Local jurisdictions’ efforts to restrict short-term lending have been increasing. Typically, these local ordinances apply to storefront operations, however, local jurisdictions could attempt to enforce certain business conduct and registration requirements on online lenders lending to residents of that jurisdiction. Actions taken in the future by local governing bodies to impose other restrictions on short-term lenders such as us could impact our business.

In the United Kingdom, we are subject to regulation by the Financial Conduct Authority, (“FCA”), and must comply with the FCA’s rules and regulations set forth in the FCA Handbook, the Financial Services and Markets Act 2000 (“FSMA”), the Consumer Credit Act 1974, as amended (the “CCA”), and secondary legislation passed under the CCA, among other rules and regulations. We must also follow the Irresponsible Lending Guidance, or the Guidance, of the Office of Fair Trading (the “OFT”), which provides greater clarity for lenders as to business practices that the OFT (and the FCA) believes constitute irresponsible lending under the CCA. In January 2016, we received full authorization from the FCA to provide consumer credit and to perform related activities. We will be required to continue to satisfy certain minimum standards set out in the FSMA, which will result in additional costs to us.

The FCA regulates consumer credit and related activities in accordance with the guidance of the FSMA and the FCA Handbook, which includes prescriptive regulations and carries across many of the standards set out in the CCA and its secondary legislation as well as the Guidance. The FSMA gives the FCA the power to authorize, supervise, examine and bring enforcement actions against providers of consumer credit such as us, as well as to make rules for the regulation of consumer credit. On February 28, 2014, the FCA issued the Consumer Credit Sourcebook (“CONC”), which incorporates prescriptive regulations for lenders such as us, including

15

mandatory affordability checks on borrowers, limiting the number of rollovers on short-term loans to two, restricting how lenders can advertise, banning advertisements that the FCA deems misleading, and introducing a limit of two unsuccessful attempts on the use of continuous payment authority (which provides a creditor the ability to directly debit a customer’s account for payment when authorized by the customer to do so) to pay off a loan. Certain provisions of the CONC took effect on April 1, 2014, and other provisions for high cost short-term credit providers such as us, such as the limits on rollovers, continuous payment authority and advertising, took effect on July 1, 2014.

On January 2, 2015, the FCA implemented a cap on the total cost of high-cost short-term credit, which includes a maximum rate of 0.8% of principal per day, and limits the total fees, interest (including post-default interest) and charges (including late fees which are capped at £15) to an aggregate amount not to exceed 100% of the principal amount loaned. The final rule required us to make changes to all of our high-cost short-term products in the United Kingdom. As a result of the final rule, we discontinued offering line of credit accounts to new customers in the United Kingdom in late 2014 and effective January 1, 2015, we discontinued draws on existing line of credit accounts in the United Kingdom.

Due to the concerns expressed about our business by the FCA and the implementation of the rate cap, we made significant modifications to many of our business practices to address the FCA’s expectations. These modifications included adjustments to our affordability assessment practices and underwriting standards that govern who will qualify for a loan from us, reductions in certain maximum loan amounts, alterations to our advertising practices and adjustments to our collections processes (including our practices relating to continuous payment authority) and debt forbearance processes (or our practices regarding customers who have indicated that they are experiencing financial difficulties), all of which resulted in a significant year-over-year decrease in our U.K. consumer loan volume, U.K. loan balances and U.K. revenue for the second half of 2014 and the first half of 2015 as a result of our adapting our U.K. business practices in response to the expectations of the FCA. The implementation of stricter affordability assessments and underwriting standards resulted in a decrease in the number of consumer loans written, the average consumer loan amount and the total amount of consumer loans written to new and returning customers. Additionally, the changes we made to our collections and debt forbearance practices in the United Kingdom resulted in lower collection rates on delinquent loans, and we have experienced and will continue to experience an increase in compliance- and administrative-related costs for our U.K. operations.

The FCA conducted a consultation in 2015 and published its response on September 28, 2015, allowing firms to use continuous payment authority to collect repayments where a customer is in arrears or default and the lender is exercising forbearance. The FCA also imposed a number of regulatory changes on credit brokers and lenders operating in the high-cost-short-term credit market in the United Kingdom. The FCA also implemented a provision that requires providers of high-cost short-term credit include a risk warning in all financial promotions, including previously exempted size-limited ads like SMS text messages and pay-per-click ads. The majority of these changes came into force on November 2, 2015.

In June 2013, the OFT referred the payday lending industry in the United Kingdom to the Competition Commission, which is now the Competition & Markets Authority (“CMA”), for a market investigation. The CMA gathered data from industry participants, including us, in connection with its review of the U.K. payday lending industry to determine whether certain features of the payday lending industry prevent, restrict or distort competition (which is also referred to as having an adverse effect on competition) and, if so, what remedial action should be taken. On August 13, 2015, the CMA published its final order which required online lenders to provide details of their products on at least one price comparison website which is authorized by the FCA once the FCA published rules concerning price comparison websites. The CMA also required online and storefront lenders to provide existing customers with a summary of their cost of borrowing as of August 13, 2016.

On November 29, 2016, the FCA issued a Call for Input, seeking evidence and feedback to further inform its previous reviews of the high-cost credit market, including a review of the payday loan price cap. The Call for Input covered all high-cost products, including payday loans, rent-to-own, pawnbroking loans, guarantor loans, credit cards and installment loans, as well as overdrafts. The CMA previously identified a number of competition issues with overdrafts, including poor price transparency and the nature and level of charges, especially for unarranged overdrafts.  The FCA looked in more detail at overdrafts from a consumer protection and a competition perspective. The FCA also reviewed the price cap that was implemented on January 2, 2015 to assess whether there is evidence that suggests the price cap should be changed and to determine whether there is any evidence of consumers turning to illegal money lenders as a result of being excluded from the high-cost credit market because of the price cap.  The FCA will also continue to monitor the impact that repeat and multiple borrowing has on the market and consumers. The FCA issued its findings to the Call for Input on July 31, 2017 deciding to maintain the high cost short-term credit price cap at its current level and committing to review it within three years to ensure that it remains effective. The FCA found that regulation of high-cost short-term credit, including the price cap, has led to substantial benefits to consumers.  The FCA also highlighted its priorities for the next stage of the review, which will focus on overdrafts, rent-to-own, home-collected credit and catalog credit.

In 2014, the FCA published a policy statement which set out its concerns about the practices of some credit brokers which charge upfront fees to consumers.  It also introduced new rules targeted at ensuring that key features of brokers’ relationships with consumers are transparent, which came into effect in 2015. In addition, in its report regarding the payday industry, the CMA recommended that the FCA take steps to ensure that lead generators explain how they operate much more clearly to customers, including that lead

16

generators be required to state that application details are referred to the lender that offers the lead generator the best commercial deal rather than to the lender that offers the most suitable loan for the customer’s needs. In September 2015, the FCA published its policy statement confirming its retention of the credit broking rules previously introduced as well as imposing minor changes to CONC rules on credit brokers, which became effective in 2016.

The FCA previously stated that measures taken by it with respect to the payday loan industry would likely force about a quarter of the firms out of the industry in the United Kingdom. For recent developments related to the FCA, including serious concerns that were previously expressed by the FCA regarding our compliance with U.K. legal and regulatory requirements, such as the requirement that our business be capable of being effectively supervised by the FCA and compliance with FCA rules and principles and our affordability assessment and debt forbearance practices, see “Risk Factors—Risks Related to Our Business and Industry— Our primary regulators in the United Kingdom previously expressed serious concerns about our compliance with applicable U.K. regulations, which caused us to make significant changes to our U.K. business that negatively impacted our operations and results, and future changes to our operations as a result of regulator concerns could have a material adverse effect on our U.K. business.,” “— The United Kingdom has imposed, and continues to impose, increased regulation of the short-term high-cost credit industry and previously stated its expectation that some firms will exit the market,” and “— Competition regulators in the United Kingdom have reviewed and may in the future again review our industry and, together with the FCA, could require lenders to implement changes to their operations, which could have a negative effect on our operations in the United Kingdom. in Part I, Item 1A of this report.

Furthermore, we are subject to the Bribery Act, which prohibits the giving or receiving of a bribe to any person, including but not limited to public officials, and makes failing to prevent bribery by relevant commercial organizations a criminal offense. This offense applies when any person associated with the organization offers or accepts bribes anywhere in the world intending to obtain or retain a business advantage for the organization or in the conduct of business. The Bribery Act is applicable to businesses that operate in the United Kingdom such as us. The Bribery Act is broader in scope than the FCPA in the United States in that it directly addresses commercial bribery in addition to bribery of government officials and it does not recognize certain exceptions, notably facilitation payments that are permitted by the U.S. FCPA.

In the United Kingdom, we are also subject to the requirements of the Data Protection Act 1988 (“DPA”) and are required to be fully registered as a data-controller under the DPA. The DPA controls how organizations, businesses and/or the government use personal data and how they should process it. The current Data Protection regime will be strengthened by changes from the EU General Data Protection Regulation (“GDPR”), a regulation by which the European Parliament, the European Council and the European Commission intend to strengthen and unify data protection for individuals within the European Union (“EU”). It also addresses export of personal data outside the EU. The primary objectives of the GDPR are to give citizens back the control of their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. When the GDPR takes effect, it will replace the previous data protection directive. The GDPR contains a number of new protections for EU data subjects and threatens significant fines and penalties for non-compliant data controllers and processors once it comes into effect. The regulation was adopted on April 27, 2016. It is effective May 25, 2018 after a two-year transition period and, unlike a directive, it does not require any enabling legislation to be passed by national governments.

On October 6, 2015, the European Court of Justice invalidated the so-called “Safe Harbor” framework, which previously evidenced compliance with the U.K. Data Protection Act and the European Union Data Protection Directive and allowed companies to pass European Union data to non-European Union countries if certain certification requirements were met by the company. Although many companies, including us, had Safe Harbor certification, the European Union and the United Kingdom provide other guidance regarding compliance with data protection laws and regulations for companies who pass data outside the European Union. In addition, there are circumstances under which a company is exempt from complying with those laws and regulations. Despite the invalidation of the Safe Harbor framework, we believe we are exempt from and/or in compliance with all E.U. and U.K. privacy laws and regulations.

On February 2, 2016, the European Commission and the United States agreed on a new framework for transatlantic data flows, the “EU-US Privacy Shield”, which will replace the invalidated Safe Harbor framework. The EU-US Privacy Shield is a framework designed by the U.S. Department of Commerce (the “Commerce Department”) and European Commission to provide companies on both sides of the Atlantic with a mechanism to comply with EU personal data from the European Union to the United States in support of transatlantic commerce. On July 12, 2016, the European Commission adopted the EU-US Privacy Shield, which consists of four components: (i) the privacy shield principles, which is a code of conduct outlining protections for the handling of personal data; (ii) oversight and enforcement; (iii) ombudsperson mechanism; and (iv) safeguards and limitations. The Commerce Department began accepting certifications to the EU-US Privacy Shield on August 1, 2016. We do not expect to apply for certification to the EU-US Privacy Shield, as we believe we are exempt from and/or are in compliance with all E.U. and U.K. privacy laws and regulations and will continue to be so under the GDPR.

In the United Kingdom, we are also subject to specific anti-money laundering and counter terrorist financing requirements that require us to develop and maintain anti-money laundering and counter terrorist financing policies and procedures including reporting suspicious activity, pursuant to the Proceeds of Crime Act 2002 and the Terrorism Act 2000. The National Crime Agency (“NCA”) is

17

a law enforcement agency created in 2013 to reduce the harm caused to people and communities in the UK by serious and organized crime. The NCA replaced the Serious Organised Crime Agency (“SOCA”) and is charged with strengthening the UK’s borders, fighting fraud and cyber-crime and protecting children and young people from sexual abuse and exploitation. The NCA has the mandate and powers to work in partnership with other law enforcement organizations and has an international role of liaising with overseas law enforcement agencies. It has a “four pillars” approach to fighting crime: pursue, prevent, protect and prepare. On June 26, 2017, the European Union’s Fourth Anti-Money Laundering Directive came into force, with an emphasis on employing a risk-based approach to money laundering.

Our U.K. operations are also overseen by the Financial Ombudsman Service (“FOS”), a public body established by the U.K. Parliament to carry out statutory functions on a non-commercial, not-for-profit basis. The FOS is the statutory dispute-resolution scheme set up under the FSMA. The FOS works closely with other U.K. regulators governing the financial services market.

On June 23, 2016, the United Kingdom voted to exit the European Union. On March 29, 2017, UK Prime Minister Theresa May invoked Article 50 of the Lisbon Treaty, thereby setting March 29, 2019 as the date the United Kingdom will leave the European Union. This date can be extended if all European Union members agree to such extension. No further details of the exit have been finalized. When the United Kingdom exits the European Union, it is expected that the United Kingdom will establish a new framework for data flow between the United Kingdom and the United States or will agree to continue the protections of the GDPR for the transfer of personal data into and out of the United Kingdom. We expect to comply with any framework established by the United Kingdom for the transfer of personal data into and out of the United Kingdom.

In international jurisdictions where we operate, our advertising and marketing activities and disclosures are subject to regulation under various consumer protection laws and other applicable laws and regulations.

Company and Website Information

Our principal executive offices are located at 175 West Jackson Blvd., Chicago, Illinois 60604, and our telephone number is (312) 568-4200.

Our website is located at www.enova.com.www.enova.com. Through our website, we provide free access to our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934 as soon as reasonably practicable after such reports are electronically filed with or furnished to the SEC. These reportsThe information posted on our website is not incorporated by reference into this Annual Report on Form 10-K.

ITEM 1A. RISK FACTORS

Risk Factors Summary

The summary of risks below provides an overview of the principal risks we are exposed to in the normal course of our business activities:

Risks Related to Our Business and Industry

Risk Related to Our Indebtedness

Risk Related to Our Common Stock and the Securities Market

Risk Factors

Our business and future results may be affected by a number of risks and uncertainties that should be considered carefully in evaluating us. In addition, this report also contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those anticipated in such forward-looking statements as a result of certain factors, including the risks faced by us described below. The occurrence of one or more of the events listed below could also have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Risks Related to Our Business and Industry

Our business is highly regulated, and if we fail to comply with applicable laws, regulations, rules and guidance, our business could be adversely affected.

Our products and services are subject to extensive regulation, supervision and licensing under various federal, state, local and international statutes, ordinances, regulations, rules and guidance. For example, our loan products may be subject to requirements that generally mandate licensing or authorization as a lender or as a credit services organization or credit access business (“CSO”(collectively, “CSO”), establish limits on the amount, duration, renewals or extensions of and charges for (including interest rates and fees) various categories of loans, direct the form and content of our loan contracts and other documentation, restrict collection practices, outline underwriting requirements and subject us to periodic examination and ongoing supervision by regulatory authorities, among other things. We must comply with federal laws, such as TILA, ECOA, FCRA, EFTA, GLBA and Title X of the Dodd-Frank Act, and the FDCPA, among other laws,others, as well as regulations adopted to implement those laws. In addition, our marketing and disclosure efforts and the representations made about our products and services are subject to unfair and deceptive practice statutes, including the FTC Act, the TCPA and the CAN-SPAM Act of 2003 in the United States and analogous state statutes under which the Federal Trade Commission (the “FTC”),FTC, the CFPB, state attorneys general or private plaintiffs may bring legal actions.

18Additionally, changes in laws or regulations or changes to the application or interpretation of the laws and regulations applicable to small business lenders could adversely affect the Company’s ability to operate in the manner in which the Company currently conducts business or make it more difficult or costly for the Company to originate or otherwise acquire additional small business loans, or for the Company to collect payments on the small business loans. Such changes could subject the Company to additional licensing, registration and other legal or regulatory requirements in the future or otherwise that could, individually or in the aggregate, adversely affect the Company’s ability to conduct its business.

We are also subject to various international laws, licensing or authorization requirements in connection with the products or services we offer in Brazil and the United Kingdom, which are discussed below.Brazil. Compliance with applicable laws, regulations, rules and guidance requires forms, processes, procedures, training, controls and the infrastructure to support these requirements. Compliance may also create operational constraints, be costly or adversely affect operating results. See “Business—Regulation” of Part I, Item 1 of this report for further discussion of the laws applicable to us.

The regulatory environment in which we conduct our business is extensive and complex. From time to time we become aware of instances where our products and services have not fully complied with requirements under applicable laws and regulations or applicable contracts. Determinations of compliance with applicable requirements or contracts, such as those discussed above, can be highly technical and subject to varying interpretations. When we become aware of such an instance, products or services that may not be in compliance with applicable laws, whether as a result of our compliance reviews, regulatorregulatory inquiry, customer complaint or otherwise, we generally conduct a review of the activity in question and determine how to address it, such as modifying the product, making customer refunds or providing additional disclosure. We also evaluate whether reports or other notices to regulators are required and provide notice to regulators whenever required. In some cases, we have decided and will decide to take corrective action even after applicable statutory or regulatory cure periods have expired, and in someother cases we have notified regulators even where such notification may not have been required. Regulators or customers reviewing such incidents or remedial activities may interpret the laws, regulations and customer contracts differently than we have, or may choose to take regulatory action against us or bring private litigation against us notwithstanding the corrective measures we have taken. This may be the case even if we no longer offer the product or service in question.

State, federal and international regulators, as well as the plaintiffs’ bars, have subjectedsubject our industry to intense scrutiny in recent years.scrutiny. In addition, our contracts for certain products and services aremay be governed by the law applicable in a state other than the state in which the customer resides. If a court were to reject our choice of law and determine that a contract was governed by the laws of another state, the contract may be unenforceable. A judgment that the choice of law provisions in our loan agreements is unenforceable also could result in costly and time-consuming litigation, penalties, damage to our reputation, trigger repurchase obligations, negatively impact the terms of our future loans and harm our operating results. Likewise, a judgment that the choice of law provision in other commercial loan agreements is unenforceable could result in challenges to our choice of law provision and that could result in costly and time-consuming litigation.

Failure to comply with applicable laws, regulations, rules and guidance, or any finding that our past forms, practices, processes, procedures, controls or infrastructure were insufficient or not in compliance, could subject us to regulatory enforcement actions, result in the assessment against us of civil, monetary, criminal or other penalties (some of which could be significant in the case of knowing or reckless violations), result in the issuance of cease and desist orders (which can include orders for restitution, as well as other kinds of affirmative relief), require us to refund payments, interest or fees, result in a determination that certain financial products are not collectible, result in a suspension or revocation of licenses or authorization to transact business, result in a finding that we have engaged in unfair and deceptive practices, limit our access to services provided by third-party financial institutions or cause damage to our reputation, brands and valued customer relationships. We may also incur additional, substantial expenses to bring those products and services into compliance with the laws of various jurisdictions or stop offering certain products and services in certain jurisdictions.

Our failure to comply with any regulations, rules or guidance applicable to our business could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows and could prohibit or directly or indirectly impair our ability to continue current operations.

The lending and financing industry continues to be targeted by new laws orand regulations in many jurisdictions that could restrict the lending and financing products and services we offer, impose additional compliance costs on us, render our current operations unprofitable or even prohibit our current operations.

Governments at the national, state and local levels, as well as international governments, may seek to impose new laws, regulatory restrictions or licensing requirements that affect the products or services we offer, the terms on which we may offer them, and the disclosure, compliance and reporting obligations we must fulfill in connection with our lending and financing business. They may also interpret or enforce existing requirements in new ways that could restrict our ability to continue our current methods of operation or to expand operations, impose significant additional compliance costs, and may have a negative effect on our business, prospects, results of operations, financial condition and cash flows. In some cases, these measures could even directly prohibit some or all of our current business activities in certain jurisdictions or render them unprofitable and/or impractical to continue.

In recent years, consumer loans and in particular the category commonly referred to as “payday loans,” which includes certain of our short-term loan products, have come under increased regulatory scrutiny that has resulted in increasingly restrictive regulations and legislation that makes offering such loans in certain states in the United States or the international countries where we operate (as further described below) less profitable or unattractive. Laws or regulations in some states in the United States require that all borrowers of certain short-termconsumer loan products be reported to a centralized database and limit the number of loans a borrower may receive or have outstanding. Other laws prohibit us from providing some of our consumer loan products in the United States to active duty military personnel, active members of the National Guard or members on active reserve duty and their spouses and immediatecovered dependents.

Certain consumer advocacy groups and federal and state legislators and regulators have advocated that laws and regulations should be tightened so as to severely limit, if not eliminate, the type of loan products and services we offer to consumers, and this has resulted in both the executive and legislative branches of the U.S. federal government and state governmental bodies exhibiting an interest in

19

debating legislation that could further regulate consumer and/or small business loan products and services such as those that we offer. The U.S. Congress, as well as other similar federal, state and local bodies and similar international governmental authorities, have debated, and may in the future adopt, legislation or regulations that could, among other things, place a cap (or decrease a current cap) on the interest or fees that we can charge or a cap on the effective annual percentage rate that limits the amount of interest or fees that may be charged, ban or limit loan renewals or extensions of short-term loans (where the customer agrees to pay the current finance charge on a loan for the right to make payment of the outstanding principal balance of such loan at a later date plus an additional finance charge), including the rates to be charged for loan renewals or extensions, require us to offer an extended payment plan, limit origination fees for loans, require changes to our underwriting or collections practices, require lenders to be bonded or to report consumer loan activity to databases designed to monitor or restrict consumer borrowing activity, impose “cooling off” periods between the time a loan is paid off and another loan is obtained or prohibit us from providing any of our consumer loan products in the United States to active duty members of the U.S. military, reservists and members of the National Guard and their immediate families.

Furthermore, legislative or regulatory actions may be influenced by negative perceptions of us and our industry, even if such negative perceptions are inaccurate, attributable to conduct by third parties not affiliated with us (such as other industry members), or attributable to matters not specific to our industry.

We cannot currently assess the likelihood of any future unfavorable federal, state, local or international legislation or regulations being proposed or enacted that could affect our products and services. We closely monitor proposed legislation in jurisdictions where we offer our loan products. Additional legislative or regulatory provisions could be enacted that could severely restrict, prohibit or eliminate our ability to offer a consumer or small business loan or financing product. In addition, under statutory authority, U.S. state regulators have broad discretionary power and may impose new licensing requirements, interpret or enforce existing regulatory requirements in different ways or issue new administrative rules, even if not contained in state statutes, that could adversely affect the way we do business and may force us to terminate or modify our operations in particular states or affect our ability to obtain new licenses or renew the licenses we hold.

Any of these or other legislative or regulatory actions that affect our lending and financing business at the national, state, international and local level could, if enacted or interpreted differently, have a material adverse impact on our business, prospects, results of operations, financial condition and cash flows and could prohibit or directly or indirectly impair our ability to continue current operations.

The Consumer Financial Protection Bureau has examination authority over our U.S. consumer lending businessbusinesses that could have a significant impact on our U.S. business.

In July 2010, the U.S. Congress passed the Dodd-Frank Act, and Title X of the Dodd-Frank Act created theThe CFPB, which regulates U.S. consumer financial products and services, including consumer loans offered by us. The CFPB has broad regulatory, supervisory and enforcement powers over providers of consumer financial products and services, such as us, including explicit supervisory authority to examine and require registration of such providers.

The CFPB exercises supervisory review over and examines certain non-bank providers of consumer financial products and services, including providers of consumer loans such as us. The CFPB has examined our lending products, services and practices, and we expect to continue to be examined on a regular basis by the CFPB. The CFPB’s examination authority permits CFPB examiners to inspect the books and records of providers of short-term, small dollar lenders, and ask questions about their business practices, and thepractices. The examination procedures include specific modules for examining marketing activities; loan application and origination activities; payment processing activities and sustained use by consumers; collections, accounts in default, and consumer reporting activities as well as third-party relationships. As a result of these examinations, we have been in the past and could be required in the future to change our products, services or practices, whether as a result of another party being examined or as a result of an examination of us, or we could be subject to monetary penalties, which could materially adversely affect us.

Furthermore, because the CFPB is a relatively new entity, its practices and procedures regarding examination, enforcement and other matters relevant to us and other CFPB-regulated entities are subject to further development and change. Where the CFPB holds powers previously assigned to other regulators, the CFPB may not continue to apply such powers or interpret relevant concepts consistent with previous regulators’ practice. This may adversely affect our ability to anticipate the CFPB’s expectations or interpretations in our interaction with the CFPB.

The CFPB also has broad authority to prohibit unfair, deceptive and abusive acts and practices and to investigate and penalize financial institutions that violate this prohibition. In addition to having the authority to obtain monetary penalties for violations of applicable federal consumer financial laws (including the CFPB’s own rules), the CFPB can require remediation of practices, pursue administrative proceedings or litigation and obtain cease and desist orders (which can include orders for restitution or rescission of

20

contracts, as well as other kinds of affirmative relief). Also, where a company has violated Title X of the Dodd-Frank Act or CFPB regulations implemented thereunder, the Dodd-Frank Act empowers state attorneys general and state regulators to bring civil actions to remedy violations of state law. If the CFPB or one or more state attorneys general or state regulators believe that we have violated any of the applicable laws or regulations, they could exercise their enforcement powers in ways that could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

We are subject to a Consent Order issued by the Consumer Financial Protection Bureau, and any noncompliance wouldcould materially adversely affect our business.

On November 20, 2013, Cash America, our parent company at the time,15, 2023, we consented to the issuance of a Consent Order by the CFPB (the “2023 Consent Order”) pursuant to which itwe agreed, without admitting or denying any of the facts or conclusions, made by the CFPB from its 2012 review of Cash America and us, to pay a civil money penalty of $5$15 million. The 2023 Consent Order alsosupersedes a prior January 2019 CFPB consent order in which we agreed, without admitting or denying any of the facts or conclusions, to pay a civil money penalty of $3.2 million. The 2023 Consent Order relates in part, to issues, the majority of which were self-disclosed, to the CFPB during its 2012 examination of us, including the making of a limited number of loans to consumers who may have been active duty members of the military at the time of the loan at rates in excess of the interest rate permitted by the federal Military Lending Act, for which we made refunds of approximately $33,500,payment processing and for certain failures to timely provide and preserve records and information in connection with the CFPB’s examination of us. In addition, as a result of the CFPB’s review, we enhanced our compliance management system and implemented additional policies and procedures to address the issues identified by the CFPB.debiting errors. We will remain subject to the restrictions and obligations of the 2023 Consent Order, including prohibitions from engaging in certain conduct, for a period of seven years from the CFPB’s order that we ensure compliance with federal consumer financial laws and develop more robust compliance policies and procedures. These new policies, procedures and other initiatives are in many cases subject to review and potential objection bydate of the CFPB, and no guarantee can be made regarding the timing, substance or effect of any such measures the CFPB may decide to take. Furthermore, the compliance plan mandated by the2023 Consent Order requires us to perform a formal consumer protection compliance risk review before introducing or implementing new or changed products or services. This requirement could result in additional delay or cost when introducing or implementing new or changed products or services, or a decision not to proceed with such initiatives.Order. Any noncompliance with the 2023 Consent Order or similar orders or agreements from other regulators could lead to further regulatory penalties and could have a material adverse impact on our business, prospects, results of operations, financial condition and cash flows and could prohibit or directly or indirectly impair our ability to continue current operations.

The CFPB recently finalized a new rule that may affect the consumer lending industry, and this rule could have a material adverse effect on our U.S. consumer lending business.

On October 6, 2017, the CFPB issued its finala rule on payday and certain high-cost installment loans, also known as the “Small Dollar Rule,” which would cover some of the loans we offer. The rule requiresSmall Dollar Rule initially required that lenders who make short-term loans and longer-term loans with balloon payments reasonably determine consumers’ ability to repay the loans according to their terms before issuing the loans. The ruleSmall Dollar Rule also introducesintroduced new limitations on repayment processes for those lenders as well as lenders of other longer-term loans with an annual percentage rate greater than 36 percent that include an ACH authorization or similar payment provision. If a consumer has two consecutive failed payment attempts, the lender must obtain the consumer’s new and specific authorization to make further withdrawals from the consumer’s bank account. For loans covered by the rule,Small Dollar Rule, lenders must provide certain notices to consumers before attempting a first payment withdrawal or an unusual withdrawal and after two consecutive failed payment attempts. The rule will applyIn April 2018, an action in federal court in Texas was filed against the CFPB making a constitutional challenge to loan contracts entered into beginning August 19, 2019. However, under the Congressional Review Act, Congress has 60 legislative days after publication of the rule in the Federal Register (which occurred on November 17, 2017) to overturn it by a majority vote in both Houses of Congress. Small Dollar Rule. On January 16, 2018,July 7, 2020, the CFPB issued a statement that it intends to engage in a rulemaking process to reconsider the final rule. It is also likely that there will be legal challengesSmall Dollar Rule, rescinding the ability to repay ("ATR") and related provisions, such as the final rule if it does not change before it goes into effect. We cannot currently assessestablishment of registered information systems for checking ATR and reporting loan activity. The payment provisions of the likelihoodSmall Dollar Rule remain in place. On October 19, 2022, a three-judge panel of the Fifth Circuit U.S. Circuit Court of Appeals ruled in the federal case out of Texas that the funding structure of the CFPB will make changesis unconstitutional and vacated the Small Dollar Rule. On November 14, 2022, the CFPB filed a Petition for Writ of Certiorari with the U.S. Supreme Court to review the Fifth

Circuit ruling. The Supreme Court granted the Petition on February 27, 2023 and heard oral arguments on October 3, 2023. The Supreme Court is expected to rule nor whetheron the rule will become effective.matter in Spring of 2024. If the ruleSmall Dollar Rule does become effective in its current proposed form, we will need to make certain changes to our underwriting, payment processes and customer notifications in our U.S. consumer lending business. If we are not able to execute these changes effectively because of unexpected complexities, costs or otherwise, we cannot guarantee that the final ruleSmall Dollar Rule will not have a material adverse impact on our business, prospects, results of operations, financial condition and cash flows.

Election of a new U.S. president supported by a majority of the U.S. Congress from the same political party could significantly change regulatory, legal or other policies that could affect our business.

In January 2017, the Republican Party took control of a majority of both the U.S. House of Representatives and the U.S. Senate. In addition, a Republican was sworn in as the 45th President of the United States. The President and certain Republicans in the U.S. Congress have made statements regarding the desire to lessen the regulatory burden on businesses to create job growth and regarding the status of the Dodd-Frank Act and the many rules adopted thereunder. The Dodd-Frank Act created the CFPB, which regulates consumer financial products and services including consumer loans that we offer. Until specific laws are passed, executive actions are taken or federal regulatory action is taken, it is unclear what impact changes to regulatory, legal or other policies will have on our business.

21

The United Kingdom has imposed, and continues to impose, increased regulation of the short-term high-cost credit industry and previously stated its expectation that some firms will exit the market.

In the United Kingdom, the FCA regulates consumer credit and related activities pursuant to the FSMA and the FCA Handbook, which includes prescriptive rules and regulations and carries across many of the standards set out in the CCA and its secondary legislation as well as previous guidance initially set out by the OFT. The regulations under the FCA consumer credit regime are more prescriptive than the former U.K. consumer credit regime. The FSMA gives the FCA the power to authorize, supervise, examine and bring enforcement actions against providers of consumer credit, as well as to make rules for the regulation of consumer credit.

In 2014, the FCA issued the CONC contained in the FCA Handbook. The CONC incorporates prescriptive regulations for consumer loans such as those that we offer, including mandatory affordability checks on borrowers, limiting the number of rollovers on short-term loans to two, restricting how lenders can advertise, banning advertisements that the FCA deems misleading, and introducing a limit of two unsuccessful attempts on the use of continuous payment authority (which provides a creditor the ability to directly debit a customer’s account for payment when authorized by the customer to do so) to pay off a loan. The provisions of the CONC took effect in 2014. As a result of the FCA’s requirements, we made significant adjustments to many of our business practices in the United Kingdom, as discussed below under “— Our primary regulators in the United Kingdom previously expressed serious concerns about our compliance with applicable U.K. regulations, which caused us to make significant changes to our U.K. business that negatively impacted our operations and results, and future changes to our operations as a result of regulator concerns could have a material adverse effect on our U.K. business.”

On January 2, 2015, the FCA implemented a cap on the total cost of high-cost short-term credit. In 2015, the FCA also conducted a consultation and implemented a provision that requires providers of high-cost short-term credit include a risk warning in all financial promotions. In 2016, the FCA reviewed the loan price cap that was implemented in 2015 and decided not to change the price cap but to review it again in three years. In July 2017, the FCA issued a Consultation Paper on proposed changes to its rules and guidance on assessing creditworthiness in consumer credit. The FCA requested responses to the consultation by October 31, 2017 and expects to publish its findings in the second quarter of 2018. We do not currently know whether or how the FCA may amend its rules and guidance on assessing creditworthiness in consumer credit or how it will affect our business operations. If any new rules or guidance significantly restrict the conduct of our business, such implementation could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

The FCA also plans to investigate unarranged overdrafts, the long-term use of high-cost credit, rent-to-own, home-collected credit and catalog credit markets and to issue a Consultation Paper on proposed solutions in the spring of 2018. We do not currently know what solutions the FCA may implement as a result or how any changes may affect our business operations. If any new rules or guidance significantly restrict the conduct of our business, such implementation could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

The changes that we have implemented or are required to implement in the future as a result of such legislative and regulatory activities could have a material adverse effect on our U.K. business, as further described below under “—Our primary regulators in the United Kingdom previously expressed serious concerns about our compliance with applicable U.K. regulations, which caused us to make significant changes to our U.K. business that negatively impacted our operations and results, and future changes to our operations as a result of regulator concerns could have a material adverse effect on our U.K. business.” and “— Due to restructuring of the consumer credit regulatory framework in the United Kingdom, we are required to obtain full authorization from our U.K. regulators to continue providing consumer credit and perform related activities in the United Kingdom, and there is no guarantee that we will receive full authorization to continue offering consumer loans in the United Kingdom.” We cannot give any assurances that the result of the FCA’s review of the high-cost credit market and the payday loan rate cap and any potential new rules will not have a material impact on our U.K. products and services.

Our primary regulators in the United Kingdom previously expressed serious concerns about our compliance with applicable U.K. regulations, which caused us to make significant changes to our U.K. business that negatively impacted our operations and results, and future changes to our operations as a result of regulator concerns could have a material adverse effect on our U.K. business.

In February 2012, the OFT launched a review of the payday lending sector and conducted examinations of a number of payday lenders in the United Kingdom, including us. In May 2013, the OFT sent us a letter of findings related to its examination of our U.K. short term consumer loan (or payday) business, which indicated that we may not have been in full compliance with all relevant laws and guidance. In July 2013, we provided the OFT with an independent audit report setting out the steps taken to address each concern the OFT had identified.

On April 1, 2014, the FCA assumed the supervision and regulation of us, and we are subject to ongoing examination and review by the FCA. In 2014, the FCA informed us that it had serious concerns regarding our compliance with the FCA’s rules and principles, including those with respect to our affordability assessment process and our debt forbearance practices (or our practices regarding customers who have indicated they are experiencing financial difficulty). The FCA also noted concerns regarding certain of our

22

advertising practices. The FCA appointed an independent auditor to undertake a review of certain of our practices as well as our ability to be effectively supervised. That review identified activities that were deemed to have potentially caused consumer detriment or were not in full compliance with the FCA’s rules and guidance. On November 4, 2015, the FCA announced the final redress program, in which we provided 3,940 customers total redress of approximately $2.6 million through a combination of loan balance waivers and cash refunds of interest and fees paid. The skilled person oversaw the execution of the redress program, which was concluded in the fourth quarter of 2015.

We made significant adjustments to many of our business practices, including modifying our affordability assessments and underwriting standards, reducing certain maximum loan amounts, changing our collections processes (including our practices relating to continuous payment authority) and debt forbearance practices and altering certain advertising practices, all of which resulted in a significant year-over-year decrease in our U.K. loan volume, U.K. loan balances and U.K. revenue in the second half of 2014 and the first half of 2015. The implementation of stricter affordability assessments and underwriting standards resulted in a decrease in the number of consumer loans written, the average consumer loan amount and the total amount of consumer loans written to new and returning customers. Additionally, we experienced and will continue to experience an increase in compliance- and administrative-related costs for our U.K. operations. In addition, the FCA, in its supervisory role, could subject us to periodic or ongoing examination and review by the FCA, and as such, the FCA could require us to make additional changes to our business that could further negatively affect future results for our U.K. operations. We are continuing to assess the impact of the changes we have made to our U.K. operations, but the impact of these changes was significant, and future changes to our operations as a result of FCA oversight of our business could result in a material adverse effect on our U.K. business and our prospects, results of operation, financial condition and cash flows.

Competition regulators in the United Kingdom have reviewed and may in the future again review our industry and, together with the FCA, could require lenders to implement changes to their operations, which could have a negative effect on our operations in the United Kingdom.

In June 2013, the OFT referred the payday lending industry in the United Kingdom to the Competition Commission, which is now the Competition & Markets Authority (“CMA”), for a market investigation. The CMA gathered data from industry participants, including us, in connection with its review of the U.K. payday lending industry to determine whether certain features of the payday lending industry prevent, restrict or distort competition (which is also referred to as having an adverse effect on competition) and, if so, what remedial action should be taken.

On June 11, 2014, the CMA released a provisional findings report in which it indicated that it believed that many payday lenders fail to compete on price and that it would look at potential ways to increase price competition. On August 13, 2015, the CMA published its final order which required online lenders to provide details of their products on at least one price comparison website. The CMA also required online and storefront lenders to provide existing customers with a summary of their cost of borrowing as of August 13, 2016.

The impact of the CMA’s August 13, 2015 order on our operations has not been significant. However, we do not know whether future actions by the CMA and the FCA could impact consumer acceptance of our products or the consumer experience in obtaining loans or if any future actions could otherwise significantly restrict the conduct of our business or otherwise have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Customer complaints to the Financial Ombudsman Service (“FOS”) could increase, which could have a negative effect on our operations in the United Kingdom.

We have experienced an increased volume of complaints about loans issued prior to changes we implemented in 2014, and the FOS has taken a very consumer friendly approach to its complaint handling process and in dispute resolutions. We have been required to make significant payments to customers to resolve these complaints. If the FOS continues to issue findings in favor of consumers, and we are required to continue to make significant payments to resolve the complaints, such findings could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Our advertising and marketing materials and disclosures have been and continue to be subject to regulatory scrutiny, particularly in the United Kingdom.scrutiny.

In the jurisdictions where we operate, our advertising and marketing activities and disclosures are subject to regulation under various industry standards, consumer protection laws, and other applicable laws and regulations. Consistent with the consumer lending industry as a whole, our advertising and marketing materials have come under increased scrutiny. In the United Kingdom, for example, consumer credit firms are subject

Any inability to the financial promotions regime set out in the FSMA (Financial Promotions) Order 2005 and specific rules in the CONC, such as the inclusion of a risk warning on certain advertising materials. The FCA has also decided to adopt certain elements of industry codes as FCA rules on a case by case basis. Our advertising and marketing materials in the United Kingdom are reviewed both by the FCA and the Advertising Standards Authority. We have in some cases been ordered to withdraw, amend or add disclosures to such materials, or have done so voluntarily in response to inquiries or complaints. In addition, the FCA

23

now requires that providers of high-cost short-term credit include a risk warning in all financial promotions, including previously exempted size-limited ads like SMS text messages and pay-per-click ads.

Going forward, there can be no guarantee that we will be ablecontinue to advertise and market our business in the United Kingdom or elsewhere in a manner we consider effective. Any inability to do soeffective as a result of regulatory review or new restrictions could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Significant changes in international laws or regulations or a deterioration of the political, regulatory or economic environment of the United Kingdom or Brazil, or any other country in which we begin operations, could affect our operations in these countries.

We offer, arrange and/or service online consumer loans to customers in Brazil and the United Kingdom. The United Kingdom regularly evaluates the regulation of our industry and introduces new regulations and is likely to continue to do so. New legislation or regulations could further restrict the consumer loan products we offer.

Significant changes in international laws or regulations or a deterioration of the political, regulatory or economic environment of Brazil or the United Kingdom could restrict our ability to sustain or expand our operations in these countries. Similarly, a significant change in laws, regulations or overall treatment (including an interpretation or application of such laws and regulations not anticipated when exploring or initiating business) or a deterioration of the political, regulatory or economic environment of any other country in which we may decide to do business, could also materially adversely affect our prospects and could restrict our ability to initiate a pilot program or develop a pilot program into full business operations.

We have previously ceased business in certain jurisdictions due to regulatory restrictions and, if we are forced to exit many key jurisdictions in the future due to regulatory restrictions, itthis could adversely affect our business as a whole.

In the past we have ceased business in, restricted our operations in, or chosen not to begin business in, certain jurisdictions due to regulatory restrictions which render our operations impermissible, unprofitable or impractical. In addition, because we are in some cases subject to state/provincial and local regulation in addition to federal/national regulation, we may restrict or discontinue business in certain jurisdictions within countries where we are otherwise active. For example, as of December 31, 2017,2023, we did not offer or arrange consumer loans in 1713 U.S. states because we do not believe it is economically feasible to operate in those jurisdictions due to specific statutory or regulatory restrictions, such as interest rate ceilings or caps on the fees that may be charged.

The adoption of state regulatory measures cannot be predicted, but we expect that other states may propose or enact similar restrictions onimpacting our consumer or small business loan or financing products in the future, which could affect our operations in such states. Legislation or regulations targeting or otherwise directly affecting our products and services have been introduced or adopted in a number of states over the last few years, and we regularly monitor proposed legislation or regulations that could affect our business. For more information, see “Regulation and Legal Proceedings—U.S. State Regulation.”

If we are forced to exit many key jurisdictions due to such concerns, we cannot guarantee that we will be able to find suitably attractive additional business opportunities elsewhere, which could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

The COVID-19 pandemic negatively impacted our operations and financial results, and any future pandemics may also have a negative impact on our business, financial position, results of operations, liquidity, and prospects.

The COVID-19 pandemic severely impacted global economic conditions, resulting in substantial volatility in the global financial markets, increased unemployment, and operational challenges resulting from measures that governments and other authorities imposed to control its spread, such as travel bans, business and school limitations and closures, quarantines, and shelter-in-place orders. The extent of the impact of any future pandemic or public health crisis, including due to any significant re-emergence or new variants of COVID-19, on our business is highly dependent on variables that are difficult to predict, such as the scope and duration of the pandemic or public health crisis, and the success rate of measures taken by the governments to control its spread and stabilize the economy. We could experience reduced demand and availability of our products, higher credit losses in our portfolio, impairments of other financial assets, and other negative impacts to our financial position. We could have issues meeting our financial performance covenants, which would require waiver/amendment or could result in default on our financing agreements. We are highly reliant on our employees for our continued operations, and to the extent our employee population is impacted by a pandemic or other public health crisis, or by the actions by governmental bodies taken in reaction to such events, this could adversely affect our ability to service our customers and to offer our products. Our access to capital markets could be hampered and could lead to a higher cost of capital.

Our access to payment processing systems to disburse and collect loan and financing proceeds and repayments, including the Automated Clearing House, is critical to our business, and any interruption or limitation on our ability to utilize any of the available means of processing deposits or payments could materially adversely affect our business.

When making loans and providing financing in the United States, we use several means of depositing proceeds into and collecting repayments from our customers’ bank accounts, including the use of ACH and remotely-created check processing.ACH. Our business, including loans made through the CSO programs and the Bank Program,program, depends on payment processing systems to collect amounts due by repayments from our customers’ bank accounts when we

have obtained authorization to do so from the customer. Our transactions are processed by banks, and if these banks cease to provide any of the available means of payment processing services, we would have to materially alter, or possibly discontinue, some or all of our business if alternative processing methods are not as effective or not available.

Previous heightened regulatory scrutiny by the U.S. Department of Justice, the Federal Deposit Insurance Corporation and other regulators, in an action referred to as Operation Choke Point, caused banks and ACH payment processors to cease doing business with certain short-term consumer lenders who were operating legally, without regard to whether those lenders were complying with applicable laws, simply to avoid the risk of heightened scrutiny or even litigation.

In addition, in 2014, the National Automated Clearinghouse Association (“NACHA”) (which oversees the ACH network) amended its operating rules that govern the use of the ACH system, which amendments became effective in 2015 and 2016. These amendments, among other things, established certain ACH return rate levels, enhanced limitations on certain ACH reinitiation activities, imposed

24

fees on certain unauthorized ACH returns and allowed for increased flexibility in how NACHA rules violation investigations can be initiated. The revised rules provide clarification that certain industries deal with customers who are more likely to experience an insufficient funds scenario. We implemented processes and procedures to address the amendments to the ACH operating rules.

Our access to payment processing systems could be impaired as a result of actions by regulators to cut off the access to payment processing systems to payday lenders or by rule changes by the NACHA rule amendments.National Automated Clearinghouse Association (“NACHA”), which oversees the ACH network. The limited number of financial institutions we depend on may choose to discontinue providing ACH processing, remotely created check processing and similar services to us. If our access to any of these means of payment processing is impaired, we may find it difficult or impossible to continue some or all of our business, which could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows. If we are unable to maintain access to needed services on favorable terms, we would have to materially alter, or possibly discontinue, some or all of our business if alternative processors are not available.

The failure to comply with debt collection regulations could subject us to fines and other liabilities, which could harm our reputation and business.

The FDCPA regulates persons who regularly collect or attempt to collect, directly or indirectly, consumer debts owed or asserted to be owed to another person. Many states impose additional requirements on persons collecting or attempting to collect consumer debts owed to them and on debt collection communications, and some of those requirements may be more stringent than the federal requirements. Moreover, regulations governing debt collection are subject to changing interpretations that differ from jurisdiction to jurisdiction.

In addition, in 2016, theEffective November 30, 2021, new CFPB issued an outline of proposals intended to increase consumer protection pertainingrules went into effect that apply to third-party debt collectors and others covered by the FDCPA, including our attempts to collect certain debt originated by other lenders such as under our CSO program. The rules (a) clarify the times and places at which woulda debt collector may communicate with a consumer; (b) require collectors to provide a channel-specific opt-out mechanism for debtors in all text messages and emails; (c) provide that a debt collector is presumed to violate the rule if it places a telephone call to a person more than 7 times within a 7-day period or within 7 days after a telephone conversation with the debtor; (d) include prohibitions against taking or threatening legal action on time-barred debt outside of proofs of claim filed in bankruptcy proceedings; (e) require debt collectors to speak to a consumer in person or by phone or send a letter or electronic message and wait a reasonable period of time before furnishing information to a credit reporting agency; and (f) adopts a set of specifications for the information that should be included in debt validation notices and when and how the validation notice should be provided to consumers. Creditors and other first-party collectors are not subject to the final rules, but they will impact Enova’s third-party collectors and debt buyers. Restrictions on our third-party debt collectors or that apply to our attempts to collect debt originated by other lenders, including under our CSO programs and our Bank Program. The proposals would not apply to our attempts to collect debt that we originate; however, the CFPB has announced that it plans to address consumer protection issues involving first-party debt collectors and creditors separately. The CFPB outline does not include proposed or final rules, and any future rules could be significantly different from those in the outline. The CFPB has not yet defined a date for any proposed rules related to debt collection nor has it defined the effective date for the implementation of final rules. We cannot give any assurances that the effect of such rules will notmay have a materialan adverse impact on our U.S. products and services.

Non-U.S. jurisdictions also regulate debt collection. For example, in the United Kingdom, due to changes to rules under the CONC, we previously made adjustments to our collections processes, which resulted in lower collections on loans made by us. In addition, the concerns previously expressed to us by the OFT and the FCA related in part to debt collection. We could be subject to fines, written orders or other penalties if we, or parties working on our behalf, are determined to have violated the FDCPA the CONC or analogous state or international laws, which could have a material adverse effect on our reputation, business, prospects, results of operations, financial condition and cash flows.

We use lead providers and marketing affiliates to assist us in obtaining new customers, and if lead providers or marketing affiliates do not comply with an increasing number of applicable laws and regulations, or if our ability to use such lead providers or marketing affiliates is otherwise impaired, it could adversely affect our business.

We are dependent on third parties, referred to as lead providers (or lead generators) and marketing affiliates, as a source of new customers. Our marketing affiliates place our advertisements on their websites that direct potential customers to our websites. Generally, lead providers operate, and also work with their own marketing affiliates who operate, separate websites to attract prospective customers and then sell those “leads” to online lenders. As a result, the success of our business depends substantially on the willingness and ability of lead providers or marketing affiliates to provide us customer leads at acceptable prices.

If regulatory oversight of lead providers or marketing affiliates is increased, through the implementation of new laws or regulations or the interpretation of existing laws or regulations, our ability to use lead providers or marketing affiliates could be restricted or eliminated. For example, the CFPB has indicated its intention to examine compliance with federal laws and regulations by lead providers and to scrutinize the flow of non-public, private consumer information between lead providers and lead buyers, such as us. Over the past few years, several states have taken actions that have caused us to discontinue the use of lead providers in those states. While these discontinuations did not have a material adverse effect on us, other states may propose or enact similar restrictions on lead providers and potentially on marketing affiliates in the future, and if other states adopt similar restrictions, our ability to use lead providers or marketing affiliates in those states would also be interrupted. We also expect that the ongoing regulatory review of consumer lending in the United Kingdom may lead to increased restrictions on the operations and/or use of lead providers.

Lead providers’ or marketing affiliates’ failure to comply with applicable laws or regulations, or any changes in laws or regulations applicable to lead providers or marketing affiliates’ or changes in the interpretation or implementation of such laws or regulations, could have an adverse effect on our business and could increase negative perceptions of our business and industry. Additionally, the use of lead providers and marketing affiliates could subject us to additional regulatory cost and expense. If our ability to use lead

25

generators or marketing affiliates were to be impaired, our business, prospects, results of operations, financial condition and cash flows could be materially adversely affected.

In addition, we do business with third parties who are not part of our independent sales organization program, including third parties who may refer potential small business customers to us or to whom we may refer potential customers for their business. In general, if we refer an applicant that takes a loan from one of our strategic partners, that strategic partner pays us a commission based on the amount of the originated loan. The partners determine whether to extend credit to referred applicants using their own credit models and criteria.

Certain states require a license to broker commercial loans or apply other restrictions to loan brokering activities. We believe that our strategic referral program for small business products would not be considered loan brokering under those state laws and, as such, would not require us to obtain a license. There is a risk that states could adopt new laws or amend or interpret existing laws to require us to obtain a broker license, impose penalties for noncompliance, or otherwise prevent us from making further referrals and collecting commissions from our referral partners. Challenges to our program could also result in costly and time-consuming litigation, damage to our reputation and harm our operating results.

To the extent that independent sales organization program partners, other third parties or internal sales representatives mislead loan applicants or engage or previously engaged in disreputable behavior, our reputation may be harmed and we may face liability.

We rely on third-party independent advisors, including commercial loan brokers, which we call independent sales organization program partners, or ISOs, for a significant portion of the small business customers to whom we issue loans. As a consequence of their status as independent contractors who provide services for multiple lenders, we have less control of third-party independent sales activities as compared to the activities of our internal sales representatives.

Because ISOs earn fees on a commission basis, ISOs may have an incentive to mislead loan applicants, facilitate the submission by loan applicants of false application data or engage in other disreputable behavior so as to earn additional commissions. We also rely on our internal sales representatives for customer acquisition in our direct marketing channel, who may also be motivated to engage in disreputable behavior to increase our customer base because such internal sales representatives are paid on a commission basis. If ISOs or our internal sales representatives mislead our customers or engage in other disreputable behavior, our customers are less likely to be satisfied with their experience and we may be subject to costly and time-consuming disputes. Negative publicity relating to ISOs or internal sales representatives could impair our ability to continue to increase our revenue and our business could otherwise be materially and negatively impacted.

We significantly enhanced, and regularly update, the nature and scope of the due diligence conducted on both prospective and existing ISOs. We also implemented certain enhanced contractual provisions and compliance-related measures related to our ISO program. While these measures were intended to improve certain aspects and reduce the risks of how we work with ISOs and how they work with our customers, we cannot assure that these measures will work or continue to work as intended, that other compliance-related concerns will not emerge in the future, that the ISOs will comply with these measures, and that these measures will not negatively impact our business from this channel or have other unintended or negative impacts on our business beyond the ISO channel.

In addition, we do business with third parties who are not part of our ISO program, including third parties who may refer potential customers to us. Although such third parties are solely intended to refer to our internal processes we are exposed to the risks of potential misleading or disreputable behavior from these third parties as well as from our ISOs.

As to our sales force, sales representatives are given sales scripts and receive rigorous training, including in-person training on avoiding unfair, abusive, and deceptive practices. In addition, internal sales representative calls are recorded and monitored for purposes of compliance and quality assurance. Despite these controls, we cannot assure that they will work as intended or that all of our internal sales representatives will comply with our procedures. Failure of our internal sales representatives to do so would expose us to the same, or worse, consequences than those relating to the ISO channel. We also refer merchants to third-party lenders. It is conceivable that we are exposed to risk if such third-party lenders engage in wrongful behavior.

We pay commissions to our strategic partners, other third parties and ISOs upfront and generally do not recover them in the event the related term loan or line of credit is eventually charged off.

We pay commissions to strategic partners and ISOs on the business installment loans and lines of credit we originate through these channels. We pay these commissions at the time the installment loan is originated or line of credit is opened or drawn on. We generally do not require that this commission be repaid to us in the event of a default on an installment loan or line of credit. While we generally

discontinue working with strategic partners and ISOs that refer customers to us that ultimately have unacceptably high levels of defaults, to the extent that our strategic partners and ISOs are not at risk of forfeiting their commissions in the event of defaults, they may, to an extent, be indifferent to the riskiness of the potential customers that they refer to us.

Any violations of our Code of Business Conduct and Ethics, or the failure to detect any such violations, may cause our business, financial condition or results of operations to be adversely affected.

Our Code of Business Conduct and Ethics prohibits us and our employees from engaging in unethical business practices. In addition, our ISOs are required to comply with a code of conduct, or the ISO Code, tailored to their brokering services. We refer to our Code of Business Conduct and Ethics and the ISO Code collectively as the “Code.” However, there can be no assurance that all of our employees, agents, or contractors will refrain from acting in violation of our Code, or that we will be able to detect any such violations. The investigation into potential violations of our Code, or even allegations of such violations, could disrupt our operations, involve significant management distraction, and lead to significant costs and expenses, and such expenses may have a material adverse effect on our financial results. If we, or our employees, agents or contractors, are found to have engaged in practices that violate our Code, we could suffer severe fines, penalties or other consequences that may have a material adverse effect on our business, financial condition or results of operations. In addition, negative public opinion could result from actual or alleged conduct by us, or our employees, agents or contractors acting on our behalf, in any number of activities or circumstances in violation of our Code, including employment related offenses, such as harassment (sexual or otherwise) and discrimination, regulatory compliance and the use and protection of data and systems, or from actions taken by regulators or others in response to such conduct.

The use of personal data for credit underwriting is highly regulated.regulated, which exposes us to compliance risk and increased costs.

In the United States, the FCRA regulates the collection, dissemination and use of consumer information, including consumer credit information. Compliance with the FCRA and related laws and regulations concerning consumer reports has recently been under regulatory scrutiny. The FCRA requires us to provide a Notice of Adverse Action to a consumer loan applicant when we deny an application for credit, which, among other things, informs the applicant of the action taken regarding the credit application and the specific reasons for the denial of credit. The FCRA also requires us to promptly update any credit information reported to a consumer reporting agency about a consumer and to allow a process by which consumers may inquire about credit information furnished by us to a consumer reporting agency. Historically, the FTC has played a key role in the implementation, oversight, enforcement and interpretation of the FCRA. Pursuant to the Dodd-Frank Act, the CFPB has primary supervisory, regulatory and enforcement authority of FCRA issues, although the FTC also retains its enforcement role regarding the FCRA. The CFPB has taken a more active approach than the FTC, including with respect to regulation, enforcement and supervision of the FCRA. Changes in the regulation, enforcement or supervision of the FCRA may materially affect our business if new regulations or interpretations by the CFPB or the FTC require us to materially alter the manner in which we use personal data in our credit underwriting.

In the United Kingdom, we are also subject to the requirements of the Data Protection Act 1988 (the “DPA”) and are required to be fully registered as a data-controller under the DPA. The DPA controls how organizations, businesses and/or the government use personal data and how they should process it. The current Data Protection regime will be strengthened by changes from the EU General Data Protection Regulation (“GDPR”), a regulation by which the European Parliament, the European Council and the European Commission intend to strengthen and unify data protection for individuals within the European Union (“EU”). It also addresses export of personal data outside the EU. The GDPR contains a number of new protections for EU data subjects and threatens significant fines and penalties for non-compliant data controllers and processors once it comes into effect on May 25, 2018. When the United Kingdom exits the European Union, it is expected that the United Kingdom will establish a new framework for data flow between the United Kingdom and the United States or will agree to continue the protections of the GDPR for the transfer of personal data into and out of the United Kingdom. We expect to comply with any framework established by the United Kingdom for the transfer of personal data into and out of the United Kingdom.

We previously had Safe Harbor certification, which evidenced compliance with the DPA and the European Union Data Protection Directive and allowed companies to pass European Union data to non-European Union countries if certain certification requirements were met by the company. Although the European Court of Justice invalidated the Safe Harbor framework in 2015, there are other circumstances under which a company is exempt from complying with those laws and regulations. In addition, in 2016, the European Commission and the United States agreed on a new framework for transatlantic data flows: the “EU-US Privacy Shield”, which will replace the invalided Safe Harbor framework. We do not expect to apply for certification to the EU-US Privacy Shield and, despite the invalidation of the Safe Harbor framework, we believe that we are exempt from and/or are in compliance with all E.U. and U.K. privacy laws and regulations and will continue to be so under the GDPR.

The oversight of the FCRA by both the CFPB and the FTC and any related investigation or enforcement activities or our failure to comply with the DPA may have a material adverse impact on our business, including our operations, our mode and manner of conducting business and our financial results.

In 2018, the State of California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which came into effect on January 1, 2020 and expands the privacy rights of California residents and regulates the sharing of consumer information of California residents. On November 3, 2020, Californians voted to approve Proposition 24, a ballot measure that creates the California Privacy Rights Act (“CPRA”). The CPRA amends and expands the rights and obligations under the CCPA. Most of the CPRA’s substantive provisions took effect on January 1, 2023. The CPRA amends the CCPA and adds new requirements. Therefore, businesses must comply with both the CCPA and the CPRA. Compliance with the CCPA and the CPRA may increase the cost of conducting business in California, and we could see increased litigation costs as a result of the enactment of these laws. Several other states have passed legislation regarding data privacy and use, which could create more risks and potential costs.

Negative public perception of our business could cause demand for our products to significantly decrease.

In recent years, consumer advocacy groups and some media reports have advocated governmental action to prohibit or place severe restrictions on short-term and high-cost consumer loans. Such consumer advocacy groups and media reports generally focus on the annual percentage rate for this type of consumer loan, which is compared unfavorably to the interest typically charged by banks to consumers with top-tier credit histories. The fees and/or interest charged by us and others in the industry attract media publicity about the industry and canmay be perceived as controversial. If the negative characterization of these types of loans becomes increasingly accepted by consumers, demand for any or all of the consumer loan products that we offer could significantly decrease, which could materially affect our business, prospects, results of operations, financial condition and cash flows. Additionally, if the negative characterization of these types of loans is accepted by legislators and regulators, we could become subject to more restrictive laws and regulations applicable to short-term loans or other consumer loan products that we offer that could materially adversely affect our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

In addition, our ability to attract and retain customers is highly dependent upon the external perceptions of our level of service, trustworthiness, business practices, financial condition and other subjective qualities. Negative perceptions or publicity regarding these matters—even if related to seemingly isolated incidents, or even if related to practices not specific to short-term loans, such as debt collection—could erode trust and confidence and damage our reputation among existing and potential customers, which could

26

make it difficult for us to attract new customers and retain existing customers and could significantly decrease the demand for our products, could materially adversely affect our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

Control of the Congress and the executive branch of the U.S. government could have a significant impact on financial services legislation passed in Congress and signed into law.

In January 2021, the Democratic party took control of the Senate and Joseph Biden was inaugurated as President of the United States. In January 2023, the Republican party took control of the House of Representatives. The Biden administration has publicly discussed raising income tax rates, including corporate income taxes. Such legislation would likely lead to an increase in our total tax expense. Further, tax rate changes can also lead to discrete tax expense events at the time of enactment. We are unable to predict at this time the effect of any such new legislation or regulations.

Current and future litigation or regulatory proceedings could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

We have been and are currently subject to lawsuits (including purported class actions) that could cause us to incur substantial expenditures, generate adverse publicity and could significantly impair our business, force us to cease doing business in one or more jurisdictions or cause us to cease offering or alter one or more products. We are also likely to be subject to further litigation in the future. An adverse ruling in or a settlement of any current or future litigation against us or another provider orof loans or financings similar to those we offer could cause us to have to refund fees and/or interest collected, forego collection of the principal amount of loans or the delivery of purchased receivables, pay treble or other multiple damages, pay monetary penalties and/or modify or terminate our operations in particular jurisdictions.

Defense of any lawsuit, even if successful, could require substantial time and attention of our management and could require the expenditure of significant amounts for legal fees and other related costs. We and others are also subject to regulatory proceedings, and we could suffer losses as a result of interpretations of applicable laws, rules and regulations in those regulatory proceedings, even if we are not a party to those proceedings. Any of these events could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

Judicial decisions, CFPB rulemaking or amendments to the Federal Arbitration Act could render the arbitration agreements we use illegal or unenforceable.

We include arbitration provisions in our consumer and business loan and financing agreements. These provisions are designed to allow us to resolve any customer disputes through individual arbitration rather than in court and explicitly provide that all arbitrations will be conducted on an individual and not on a class basis. Thus, our arbitration agreements, if enforced, have the effect of shielding us from class action liability. Our arbitration agreements do not generally have any impact on regulatory enforcement proceedings. We take the position that the arbitration provisions in loan and financing agreements, including class action waivers, are valid and enforceable; however, the enforceability of arbitration provisions is often challenged in court. If those challenges are successful, our arbitration and class action waiver provisions could be unenforceable, which could subject us to additional litigation, including additional class action litigation.

In addition, the U.S. Congress has considered legislation that would generally limit or prohibit mandatory arbitration agreements in consumer contracts and has enacted legislation with such a prohibition with respect to certain mortgage loan agreements and also certain consumer loan agreements to members of the military on active duty and their dependents. Further, the Dodd-Frank Act directed the CFPB to study consumer arbitration and report to the U.S. Congress, and it authorized the CFPB to adopt rules limiting or prohibiting consumer arbitration, consistent with the results of its study.

The CFPB did issue a final rule on arbitration, which would have prohibited class action waivers in certain consumer financial services contracts. However, the House and Senate each passed a resolution of disapproval of the rule, pursuant to their powers under the Congressional Review Act, and the President signed the bill. Because the rule was disapproved, it cannot be reissued in substantially the same form, and the CFPB cannot issue a substantially similar rule unless the new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule.

Any judicial decisions, legislation or other rules or regulations that impair our ability to enter into and enforce consumer arbitration agreements and class action waivers will increase our exposure to class action litigation as well as litigation in plaintiff-friendly jurisdictions, which would be costly and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

In some circumstances, federal preemption and application of an out-of-state choice of law provision will not, or may not, be available for the benefit of certain non-bank purchasers of loans to defend against a state law claim of usury.

Over the past few years there have been several litigation and enforcement actions aimed at issuing banks and their non-bank lending partners. These actions have primarily challenged the validity of the issuing bank partner model that is used by many non-bank lenders, including by the Company.

In May 2015, the U.S. Court of Appeals for the Second Circuit held in Madden v. Midland Funding, LLC that federal law did not preempt a state’s interest rate limitations when applied to a non-bank debt buyer of a consumer credit card loan seeking to collect interest at the rate originally contracted for by a national bank.

In June 2020, each of the Office of the Comptroller of the Currency (“OCC”) and the Federal Deposit Insurance Corporation (“FDIC”) implemented rules to address the valid-when-made doctrine and the uncertainty created by the Madden case. Generally, the rules clarify that the permissible interest on a loan is determined at the time the loan is made by national banks, Federal savings associations, state banks and insured branches of foreign banks and such permissible interest rate is not affected by a subsequent sale, assignment or other transfer to non-bank financial companies or a subsequent change in state law. In July 2020, the attorneys general for California, Illinois and New York filed a complaint in the U.S. District Court for the Northern District of California challenging the OCC rule on both substantive and procedural grounds. Additionally, in August 2020, the attorneys general for California, Illinois, Massachusetts, Minnesota, New Jersey, New York, North Carolina and the District of Columbia filed suit in the U.S. District Court for the Northern District of California challenging the FDIC rule on similar grounds. In February 2022, the OCC and FDIC prevailed in the litigation brought by the attorneys general. There have also been numerous litigation and enforcement actions that challenge the status of the issuing bank partner as the “true lender” of the loan in question. These actions primarily rely on the reasoning set forth in CashCall, Inc. v. Morrisey. In that case, the court held that the non-bank consumer lending platform, CashCall, and not its bank partner, was the “true lender” for certain loans made to West Virginia residents. The court relied on a “predominate economic interest” test that sought to determine which party (as between the issuing bank and the non-bank lending platform) retained the most economic risk in the loan transaction and should, therefore, be deemed the “true lender” of the loan. The CashCall decision and other similar actions challenge whether the loans should be subject to the interest rate limitations in the state where the consumer is located rather than in the bank’s home state because the non-bank lending platform, and not the bank, is the “true lender.” The state law remedies with respect to the “true lender” actions vary depending on the jurisdiction in which the action is filed.

If we were deemed by a court to be the “true lender” of any loans originated by the issuing bank partner, it could impact the enforceability of the loans; it could subject us to regulatory investigations, penalties and fines; we might have to alter the terms of the loans we broker; it could create challenges for our capital markets and securitization models; we would have to change the way we do business in such jurisdictions; and we may suffer an adverse impact on our business.

Significant changes in international laws or regulations or a deterioration of the political, regulatory or economic environment of Brazil, or any other country in which we begin operations, could affect our operations in these countries.

We offer, arrange and/or service online consumer loans to customers in Brazil. New legislation or regulations could further restrict the loan products we offer.

Significant changes in international laws or regulations or a deterioration of the political, regulatory or economic environment of Brazil could restrict our ability to sustain or expand our operations. Similarly, a significant change in laws, regulations or overall treatment (including an interpretation or application of such laws and regulations not anticipated when exploring or initiating business) or a deterioration of the political, regulatory or economic environment of any other country in which we may decide to do business, could also materially adversely affect our prospects and could restrict our ability to initiate a pilot program or develop a pilot program into full business operations.

If our relationship with certain of our issuing bank partners was to end, or if the legal structure supporting such relationship is successfully challenged, then we may have to comply with additional laws, regulations, and restrictions, and certain states may require us to obtain a lending or similar license, or we may determine to withdraw from doing business in such state.

In states that do not require a license to make commercial loans, we make certain small business loans directly to customers pursuant to a specific state’s law. However, some states and jurisdictions require a license to make or solicit certain commercial loans in that state

or jurisdiction and/or may not honor the choice of another state’s law. These states assert either that their own licensing laws and requirements should generally apply to commercial loans made by nonbanks to residents of their state or apply to commercial loans made by nonbanks to residents of their state of certain principal amounts or with certain interest rates or other terms. In such states and jurisdictions and in some other circumstances, certain of our small business loans are originated by an issuing bank partner, which is not subject to state licensing, and offered to us for sale. With respect to OnDeck loans, a bank currently originates all loans in certain states as well as some loans to customers in other states and jurisdictions. These bank originated loans are governed by Utah law, the law of the issuing bank partner’s home state. The remainder of OnDeck loans provide that they are governed by Virginia or Utah law. Loans originated by our issuing bank partner are generally priced the same as loans originated by us under Virginia or Utah law. While the other U.S. states where we originate loans currently honor our choice of law, future legal changes could result in any one or more of those states no longer honoring our choice of law or introducing a new licensing regime applicable to our business. In that case, we could potentially address the legal change by altering the terms of our loans, curtailing our originations, or placing more loans through our issuing bank partner.

If we were otherwise not able to work with an issuing bank partner or if we were to seek to make commercial and consumer loans directly in certain states, we would have to attempt to comply with the laws of these states in other ways, including through obtaining the appropriate licenses. Compliance with the laws of such states could be costly, and if we are unable to obtain such licenses, our lending activity could substantially decrease or cease entirely in that state jurisdiction and our revenues, growth and profitability would be harmed.

As of December 31, 2023, we operated programs with three separate bank partners, with purchases under these programs representing 28% of our consolidated originations and purchases for the year ended December 31, 2023. If our relationship with an issuing bank partner of commercial and consumer loans were to end or if any other issuing bank partner were to cease operations, we would either need to find a replacement financial institution with which to enter into a similar arrangement or we would need to obtain individual federal, state or local lending licenses and otherwise comply with the laws of those jurisdictions in order to make loans in those jurisdictions. Even if we were able to obtain the necessary licenses in those jurisdictions, compliance with the laws, rules and regulations of those jurisdictions could be costly and, depending on the terms of the loans, the interest rates or other loan terms and practices applicable to loans in those jurisdictions might be subject to limits, prohibitions or restrictions. If we were unable to maintain the necessary relationships, unable to obtain the necessary licenses or unable to otherwise comply with applicable law, or in the absence of a relationship with a bank partner were to determine that compliance with an applicable jurisdiction’s laws is cost-prohibitive, we would be required to (or would seek to voluntarily) discontinue or curtail our business activity, or limit the rates of interest charged on such loans, in those jurisdictions and would face increased costs and compliance burdens.

In addition, if it were found that our activities under our current arrangements with our issuing bank partners constituted impermissible lending within any such jurisdiction, we could face penalties and fines within such jurisdictions, and all or a portion of the interest charged on the loans and/or all or a portion of the principal of the loans could be found to be unenforceable or recoverable by the borrower and, to the extent it is determined that the loans were not originated in accordance with all applicable laws, we could be obligated to purchase certain loans that failed to comply with such legal requirements. Further, any finding that we engaged in lending in states where we are not properly licensed to do so could lead to litigation, harm to our reputation and negatively impact our ability to originate loans.

The failure of third parties who provide products, services or support to us to maintain their products, services or support could disrupt our operations or result in a loss of revenue.

A portion of our short-term consumer loan and installment loan revenue depends in part on the willingness and ability of unaffiliated third-party lenders, through the CSO programs and the Bank Program,program, to make loans to customers. We also utilize many other third parties to provide services to facilitate our lending and financing, including in our underwriting and payment processing. In addition, we rely on a third partythird-party lender in connection with our lending business in Brazil. The loss of the relationship with any of these third parties, and an inability to replace them or the failure of these third parties to maintain quality and consistency in their programs or services or to have the ability to provide their products and services, could cause us to lose customers and substantially decrease the revenue and earnings of our business. Our revenue and earnings could also be adversely affected if any of those third-party providers make material changes to the products or services that we rely on. We also use third parties to support and maintain certain of our

27

communication systems and information systems. If a third-party provider fails to provide its products or services, makes material changes to such products and services, does not maintain its quality and consistency or fails to have the ability to provide its products and services, our operations could be disrupted. Any of these events could result in a loss of revenue and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Our business depends on the uninterrupted operation of our systems and business functions, including our information technology and other business systems, as well as the ability of such systems to support compliance with applicable legal and regulatory requirements.

Our business is highly dependent upon our employees’ ability to perform, in an efficient and uninterrupted fashion, necessary business functions, such as internet support, callcontact center activities, and processing and servicing of our loans and receivables purchase agreements. A shut-down of or inability to access the facilities in which our internet operations and other technology infrastructure are based, such as a power outage, a failure of one or more of our information technology, telecommunications or other systems, or sustained or repeated disruptions of such systems could significantly impair our ability to perform such functions on a timely basis and could result in a deterioration of our ability to underwrite, approve and process loans and finance receivables, provide customer service, perform collections activities, or perform other necessary business functions. Any such interruption could have a materially adverse effect on our business, prospects, results of operations, financial condition and cash flows.

In addition, our systems and those of third parties on whom we rely must consistently be capable of compliancecomply with applicable legal and regulatory requirements and be capable of timely modification to comply with new or amended requirements. For example, we believe that the federal Military Lending Act compliance issues involved in the CFPB’s Consent Order were related in part to system errors. Any such systems problems going forward could have a material adverse effect on our business, prospects, results of operations, financial conditions and cash flows and could impair or prohibit our ability to continue current operations.

Decreased demand for our products and specialty financial services and our failure to adapt to such decrease could result in a loss of revenue and could have a material adverse effect on us.

The demand for a particular product or service may decrease due to a variety of factors, such as regulatory restrictions that reduce customer access to particular products, the availability of competing or alternative products or changes in customers’ financial conditions. Should we fail to adapt to a significant change in our customers’ demand for, or access to, our products, our revenue could decrease significantly. For example, on December 22, 2017, a law commonly known as the U.S. Tax Cuts and Jobs Act (the "Tax Act") was enacted, lowering the tax rates applicable to many businesses and individuals. The perceived financial benefits of the Tax Act could adversely impact the demand for our products. Even if we make adaptations or introduce new products to fulfill customer demand, customers may resist or may reject products whose adaptations make them less attractive or less available. In any event, the effect of any product change on the results of our business may not be fully ascertainable until the change has been in effect for some time. In particular, we have changed, and will continue to change, some of our operations and the products we offer. Any of these events could result in a loss of revenue and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Potential union activities could have an adverse effect on our relationship with our workforce.

None of our employees are currently covered by a collective bargaining agreement or represented by an employee union. Occasionally we experience union organizing activities. In addition, in 2015, the National Labor Relations Board enacted new representation election rules, which may make it easier for unions to organize. If our employees become represented by an employee union or become subject to a collective bargaining agreement, it may make it more difficult for us to manage our business and to attract and retain new employees and may increase our cost of doing business. Having our employees become represented by an employee union, having a collective bargaining agreement or having additional requirements related to our employees imposed on us could result in work stoppages and higher employee costs and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

If our allowance for losses and liability for estimated losses on third-party lender-owned consumer loans is not adequate to absorb losses or if we do not successfully manage our credit risk for our unsecured loans or financings, our business, prospects, results of operations, financial condition and cash flows may be adversely affected.

As more fully described under Note 1 to our consolidated financial statements for the year ended December 31, 2017 included in Part II, Item 8, Financial Statements and Supplementary Data in this report, we utilize a variety of underwriting criteria, monitor the performance of our loan portfolios and maintain either an allowance or liability for estimated losses on loans (including fees and interest) at a level estimated to be adequate to absorb credit losses inherent in the receivables portfolio and expected losses from loans guaranteed under the CSO programs. The allowance deducted from the carrying value of consumer loans was $123.0 million at December 31, 2017, and the liability for estimated losses on third-party lender-owned consumer loans was $2.3 million at December 31, 2017. These reserves are estimates, and if actual loan losses or losses on our receivables purchase agreements are

28

materially greater than our reserves, our results of operations and financial condition could be adversely affected. In addition, if we do not successfully manage credit risk for our unsecured loans and receivables purchase agreements through our underwriting, we could incur substantial credit losses due to customers being unable to repay their loans or financings. Any failure to manage credit risk could materially adversely affect our business, prospects, results of operations, financial condition and cash flows.

We are subject to impairment risk.

At December 31, 2017,2023, we had goodwill totaling $267.0$279.3 million on our consolidated balance sheets,sheet, all of which represents assets capitalized in connection with acquisitions and business combinations. Accounting for goodwill requires significant management estimates and judgment. Events may occur in the future, and we may not realize the value of our goodwill. Management performs periodic reviews of the carrying valuesvalue of our goodwill to determine whether events and circumstances indicate that impairment in value may have occurred. A variety of factors could cause the carrying value of goodwill or an intangible asset to become impaired. Should a review indicate impairment, a write-down of the carrying value of the goodwill or intangible asset would occur, resulting in a non-cash charge, which could adversely affect our results of operations and could also lead to our inability to comply with certain covenants in our financing documents, which could cause a default under those agreements.

If the information provided by customers to us is incorrect or fraudulent, we may misjudge a customer’s qualification to receive a loan and our operating results may be harmed.

Our lending decisions are based partly on information provided to us by loan applicants. To the extent that these applicants provide information to us in a manner that we are unable to verify, our loan decisioning process, including the OnDeck Score®, may not accurately reflect the associated risk. In addition, data provided by third-party sources is a significant component of our loan decisioning and this data may contain inaccuracies. Inaccurate analysis of credit data that could result from false loan application information could harm our reputation, business and operating results.

In addition, we use identity and fraud checks analyzing data provided by external databases to authenticate each customer’s identity. From time to time in the past, these checks have failed and there is a risk that these checks could also fail in the future, and fraud, which may be significant, may occur. We may not be able to recoup funds underlying loans made in connection with inaccurate statements, omissions of fact or fraud, in which case our revenue, operating results and profitability will be harmed. Fraudulent activity or significant increases in fraudulent activity could also lead to regulatory intervention, negatively impact our operating results, brand and reputation, and require us to take steps to reduce fraud risk, which could increase our costs.

We are subject to anticorruption laws including the U.S. Foreign Corrupt Practices Act, and the U.K. Bribery Act 2010, anti-money laundering laws and economic sanctions laws, and our failure to comply therewith, particularly asif we continue to expand internationally, could result in penalties

that could harm our reputation and have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Anticorruption Laws. We are subject to the FCPA, which generally prohibits companies and their agents or intermediaries from making improper payments to foreign officials for the purpose of obtaining or keeping business and/or other benefits. Although we have policies and procedures designed to ensure that we, our employees, agents and intermediaries comply with the FCPA and other anticorruption laws, such policies or procedures may not work effectively all of the time or protect us against liability for actions taken by our employees, agents and intermediaries with respect to our business or any businesses that we may acquire. In the event that we believe, or have reason to believe, that our employees, agents or intermediaries have or may have violated applicable anti-corruption laws, including the FCPA, we may be required to investigate or have a third party investigate the relevant facts and circumstances, which can be expensive and require significant time and attention from senior management. Our continued operation and expansion outside the United States could increase the risk of such violations in the future.

We are subject to other anti-corruption laws, such as the Bribery Act, which prohibit the giving or receiving of a bribe to any person, including but not limited to public officials, and make failing to prevent bribery by relevant commercial organizations a criminal offense. This offense applies when any person associated with the organization offers or accepts bribes anywhere in the world intending to obtain or retain a business advantage for the organization or in the conduct of business. The Bribery Act is applicable to businesses that operate in the United Kingdom such as us. The Bribery Act is broader in scope than the FCPA in that it directly addresses commercial bribery in addition to bribery of government officials and it does not allow certain exceptions, notably facilitation payments that are permitted by the FCPA.

Other countries in which we operate or have operated, including Brazil, Australia, Canada and other countries where we intend to operate also have anticorruption laws, which we are, have been or will be subject to.

If we are not in compliance with the FCPA the Bribery Act and other laws governing the conduct of business with government entities (including local laws), we may be subject to criminal and civil penalties and other remedial measures, which could have an adverse effect on our business, reputation, results of operations and financial condition. Any investigation of any potential violations of the FCPA the Bribery Act or other anticorruption laws by U.S. or foreign authorities could harm our reputation and could have a material adverse effect on our business, reputation, prospects, results of operations, financial condition and cash flows.

Anti–Money Laundering Laws. We are also subject to anti-money laundering laws and related compliance obligations in the United States and other jurisdictions in which we do business. In the United States, the USA PATRIOT Act and the Bank Secrecy Act require us to maintain an anti-money laundering compliance program covering certain of our business activities. The program must include: (1) the development of internal policies, procedures and controls; (2) designation of a compliance officer; (3) an ongoing employee training program; and (4) an independent audit function to test the program. Furthermore, certain of our subsidiaries are registered as money services businesses with the Treasury Department and must re-register with the Financial Crimes Enforcement Network (“FinCEN”) at least every two years. If we are not in compliance with U.S. or other anti-money laundering laws, we may be subject to criminal and civil penalties and other remedial measures, which could have an adverse effect on our business, results of operations, financial condition and cash flows. Any investigation of any potential violations of anti-money laundering laws by U.S. or international authorities could harm our reputation and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows. In the United Kingdom, we are also subject to specific anti-money laundering and counter terrorist financing requirements that require us to develop and maintain anti-money laundering and counter terrorist financing policies and procedures, including reporting suspicious activity to the National Crime Agency pursuant to the Proceeds of Crime Act

29

2002 and the Terrorism Act 2000. On June 26, 2017, the European Union’s Fourth Anti-Money Laundering Directive came into force, with an emphasis on employing a risk-based approach to money laundering.

Economic Sanctions Laws. The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. In particular, the United States prohibits U.S. persons from engaging with individuals and entities identified as “Specially Designated Nationals,” such as terrorists and narcotics traffickers. These prohibitions are administered by the Treasury Department’s Office of Foreign Assets Control (“OFAC”). OFAC rules prohibit U.S. persons from engaging in financial transactions with or relating to the prohibited individual, entity or country, require the blocking of assets in which the individual, entity or country has an interest. Blocked assets (e.g., property or bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Other countries in which we operate also maintain economic and financial sanctions regimes. In the event that we believe, or have reason to believe, that our employees, agents or intermediaries have or may have violated applicable laws or regulations, we may be required to investigate or have a third party investigate the relevant facts and circumstances, which can be expensive and require significant time and attention from senior management. If we are not in compliance with OFAC regulations and other economic and financial sanctions regulations, we may be subject to criminal and civil penalties and other remedial measures, which could have an adverse effect on our business, prospects, results of operations, financial condition and cash flows. Any investigation of any potential violations of OFAC regulations or other economic sanctions by U.S. or foreign authorities could harm our reputation and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

OurAny continued international expansion could increase the risk of violations of FCPA, the Bribery Act, anti-money laundering laws, OFAC regulations, or similar applicable laws and regulations in the future.

Failure of operating controls could produce a significant negative outcome, including customer experience degradation, legal expenses, increased regulatory cost, significant internal and external fraud losses and vendor risk.

Losses from operational failures can be material. These losses can arise from a wide range of breaches in controls, procedures, processes and security. Breaches in any of these controls, procedures, processes or security measures could lead to significant legal expense and even punitive damages. Internal fraud, including the stealing and dissemination of client personally identifiable information, can create significant client distrust and result in serious legal action against us. Breaches in client onboarding and servicing processes can degrade customer experience and place current and future revenues at risk. The continued proliferation and technological advances in first and third-party fraud can result in large losses over a short period of time if undetected. While we seek to enhance and develop our operational risk strategy and control structure, there can be no assurance that our efforts will be successful and that we will avoid material operational

losses. These potential operational risk loss scenarios are not exhaustive and we could experience a significant loss in any scenario if our operational risk enhancements do not keep pace with our business, capabilities or our continued organizational growth and complexity. In addition, operational failures could have a significant effect on our reputation which could cause additional material harm to our business and prospects.

Increased competition from banks, credit card companies, other consumer lenders, and other entities offering similar financial products and services could adversely affect our business, prospects, results of operations, financial condition and cash flows.

We have many competitors. Our principal competitors are consumer loan and finance companies, CSOs, online lenders, credit card companies, consumer finance companies, pawnshopsauto title lenders and other financial institutions that offer similar financial services.products and services, including loans on an unsecured as well as a secured basis. Many other financial institutions or other businesses that do not now offer products or services directed toward our traditional customer base, many of whom may be much larger than us, could begin doing so. Significant increases in the number and size of competitors for our business could result in a decrease in the number of loans that we fund or necessitate a change in the terms of the loans that we offer, resulting in lower levels of revenue and earnings in these categories.

Competitors of our business may operate, or begin to operate, under business models less focused on legal and regulatory compliance, which could put us at a competitive disadvantage. Some of our U.S. competitors operate using other business models, including a “tribal model” where the lender follows the laws of a Native American tribe regardless of the state in which the customer resides. Competitors using these models may be able to lend in jurisdictions where we do not and may have higher revenue per customer and significantly less burdensome compliance requirements, among other advantages. Additionally, negative perceptions about these models could cause legislators or regulators to pursue additional industry restrictions that could affect the business model under which we operate. To the extent that these models or other new lending models gain acceptance among consumers, small businesses and investors or that they face less onerous regulatory restrictions than we do, we may be unable to replicate their business practices or otherwise compete with them effectively, which could cause demand for our products to decline substantially. We may be unable to compete successfully against any or all of our current or future competitors. As a result, we could lose market share and our revenue could decline, thereby affecting our ability to generate sufficient cash flow to service our indebtedness and fund our operations. Any such changes in our competition could materially adversely affect our business, prospects, results of operations, financial condition and cash flows.

Our success is dependent, in part, upon our officers, and if we are not able to attract and retain qualified officers, our business could be materially adversely affected.

Our success depends, in part, on our officers, which are a relatively small group of individuals. Many members of the senior management team have significant industry experience, and we believe that our senior management would be difficult to replace, if necessary. Because the market for qualified individuals is highly competitive, we may not be able to attract and retain qualified officers or candidates. In addition, increasing regulations on and negative publicity about the consumer financial services industry could affect our ability to attract and retain qualified officers. If we are unable to attract or retain qualified officers, it could materially adversely affect our business.

Our international operations subject us to foreign exchange risk.

We are subject to the risk of unexpected changes in foreign currency exchange rates by virtue of our loans to residents of Brazil and the United Kingdom. In 2017, 15.9% of our total revenue was derived from our international operations. Our results of operations and certain of our intercompany balances associated with our Brazil and United Kingdom businesses are denominated in their respective

30

currencies and are, as a result, exposed to foreign exchange rate fluctuations. Upon consolidation, as exchange rates vary, gross profit and other operating results may differ materially from expectations, and we may record significant gains or losses on the remeasurement of intercompany balances.

A sustained deterioration in the economy could reduce demand for our products and services and result in reduced earnings.

A sustained deterioration in the economy could cause deterioration in the performance of our loan and finance receivables portfolios. An economic slowdown could result in a decreased number of loans and financing being made to customers due to higher unemployment or an increase in defaults in our products. During an economic slowdown, we could be required to tighten our underwriting standards, which would likely reduce loan and finance receivable balances, and we could face more difficulty in collecting defaulted receivables, which could lead to an increase in losses.

We may be unable to protect our proprietary technology and analytics or keep up with that of our competitors.

The success of our business depends to a significant degree upon the protection of our software, fraud defenses, underwriting algorithms and other proprietary intellectual property rights. We may be unable to deter misappropriation of our proprietary information, detect unauthorized use or take appropriate steps to enforce our intellectual property rights. In addition, competitors could, without violating our proprietary rights, develop technologies that are as good as or better than our technology. Our failure to protect our software and other proprietary intellectual property rights or to develop technologies that are as good as our competitors’ could put us at a disadvantage relative to our competitors. Any such failures could have a material adverse effect on our business.

We may be subject to intellectual property disputes, which are costly to defend and could harm our business and operating results.

From time to time, we face, and we expect to face in the future, allegations that we have infringed the trademarks, copyrights, patents or other intellectual property rights of third parties, including from our competitors or non-practicing entities. Patent and other intellectual property litigation may be protracted and expensive, and the results are difficult to predict and may require us to stop offering certain products or product features, acquire licenses, which may not be available at a commercially reasonable price or at all, or modify our products, product features, processes or websites while we develop non-infringing substitutes.

In addition, we use open source software in our technology platform and plan to use open source software in the future. From time to time, we may face claims from parties claiming ownership of, or demanding release of, the source code, potentially including our valuable proprietary code, or derivative works that were developed using such software, or otherwise seeking to enforce the terms of the applicable open source license. These claims could also result in litigation, require us to purchase a costly license or require us to devote additional research and development resources to change our platform, any of which could have a negative effect on our business and operating results.

We are subject to cyber securitycybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents.

Our business involves the storage and transmission of consumers’ and businesses’ proprietary information, and security breaches could expose us to a risk of loss or misuse of this information, litigation, and potential liability. We are entirely dependent on the secure operation of our websites and systems as well as the operation of the internet generally. While we have incurred no material cyber-attacks or security breaches to date, a number of other companies have disclosed cyber-attacks and security breaches, some of which have involved intentional attacks. Attacks may be targeted at us, our customers, or both. Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to us and our customers, our security measures may not provide absolute security. Despite our efforts to ensure the integrity of our systems, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches, of these types, especially because the techniques used by hackers change frequently or aremay not be recognized until launched, and because cyber-attacks can originate from a wide variety of sources, including third parties outside the companyCompany such as persons who are involved with organized crime or associated with external service providers or who may be linked to terrorist organizations or hostile foreign governments. These risks may increase in the future as we continue to increase our mobile and other internet-based product offerings and expand our internal usage of web-based products and applications or expand into new countries. If an actual or perceived breach of security occurs, customer and/or supplier perception of the effectiveness of our security measures could be harmed and could result in the loss of customers, suppliers or both. Actual or anticipated attacks and risks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third partythird-party experts and consultants.

A successful penetration or circumvention of the security of our systems could cause serious negative consequences, including significant disruption of our operations, misappropriation of our confidential information or that of our customers, or damage to our computers or systems or those of our customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, loss of confidence in our security measures, customer dissatisfaction, significant litigation

31

exposure, and harm to our reputation, all of which could have a material adverse effect on us. In addition, our applicants provide sensitive information, including bank account information when applying for loansor financing. We rely on encryption and authentication technology licensed from third parties to provide the security and authentication to effectively secure transmission of confidential information, including customer bank account and other personal information. Advances in computer capabilities, new discoveries in the field of cryptography or other developments may result in the technology used by us to protect transaction data being breached or compromised. Data breaches can also occur as a result of non-technical issues. In addition, federal and some state regulators are considering rules and standards to address cybersecurity risks and many U.S. states have already enacted laws requiring companies to notify individuals of data security breaches involving their personal data. These mandatory disclosures regarding a security breach are costly to implement and may lead to widespread negative publicity, which may cause customers to lose confidence in the effectiveness of our data security measures.

Our servers are also vulnerable to computer viruses, physical or electronic break-ins, and similar disruptions, including denial-of-service attacks. We may need to expend significant resources to protect against security breaches or to address problems caused by breaches. Security breaches, including any breach of our systems or by persons with whom we have commercial relationships that result in the unauthorized release of consumers’ personal information or businesses’ proprietary information, could damage our reputation and expose us to a risk of loss or litigation and possible liability. In addition, many of the third parties who provide products, services or support to us could also experience any of the above cyber risks or security breaches, which could impact our customers and our business and could result in a loss of customers, suppliers or revenue.

Any of these events could result in a loss of revenue and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Our ability to collect payment on loans and maintain the accuracy of accounts may be adversely affected by computer viruses, electronic break-ins, technical errors and similar disruptions.

The accessibility and automated nature of our platform may make for an attractive target for hacking, computer viruses, physical or electronic break-ins and similar disruptions. Despite efforts to ensure the integrity of our platform, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches of these types, in which case there would be an increased risk of fraud or identity theft, and we may experience losses on, or delays in the collection of amounts owed on, a fraudulently induced loan. In addition, the software that we have developed is highly complex and may contain undetected technical errors that could cause our computer systems to fail. Because each loan and financing provided involves our proprietary underwriting and fraud scoring models, and the applications are highly automated, any failure of our computer systems involving our proprietary credit and fraud scoring models and any technical or other errors contained in the software pertaining to our proprietary underwriting and fraud scoring models could compromise the ability to accurately evaluate potential customers, which would negatively impact our results of operations. Furthermore, any failure of our computer systems could cause an interruption in operations that may result in disruptions or

reductions in the amount of collections from the loans and financings we provide to customers. If any of these risks were to materialize, it could have a material adverse effect on our business, prospects, results of operations, financial condition or cash flows.

If internet search engine providers change their methodologies for organic rankings or paid search results, or our organic rankings or paid search results decline for other reasons, our new customer growth or volume from returning customers could decline.

Our new customer acquisition marketing and our returning customer relationship management is partly dependent on search engines such as Google, Bing and Yahoo! to direct a significant amount of traffic to our desktop and mobile websites via organic ranking and paid search advertising. Our competitors’ paid search activities, pay per click or search engine marketing may result in their sites receiving higher paid search results than ours and significantly increasing the cost of such advertising for us.

Our paid search activities may not produce (and in the past have not always produced) the desired results. Internet search engines often revise their methodologies, which could adversely affect our organic rankings or paid search results, resulting in a decline in our new customer growth or existing customer retention, difficulty for our customers in using our web and mobile sites, more successful organic rankings, paid search results or tactical execution efforts for our competitors than for us, a slowdown in overall growth in our customer base and the loss of existing customers, and higher costs for acquiring returning customers, which could adversely impact our business. In addition, search engines could implement policies that restrict the ability of consumer finance companies such as us to advertise their services and products, which could preclude companies in our industry from appearing in a favorable location or any location in the organic rankings or paid search results when certain search terms are used by the consumer. For example, in 2016, Google implemented a new policy that prohibits lenders, lead providers and affiliates from advertising certain financial products on Google AdWords. Advertisements for personal loans whichthat require repayment within 60 days, or U.S. loans with an APR of 36 percent or more, are no longer allowed on Google paid search advertising. In addition, Google requires that advertisements for personal loans contain or link to information about the features, fees, risks and benefits of the advertised loan product.

Our online marketing efforts are also susceptible to actions by third parties that could negatively impact our search results. Our sites have experienced meaningful fluctuations in organic rankings and paid search results in the past, and we anticipate similar fluctuations in the future. Any reduction in the number of consumers or small businesses directed to our web and mobile sites could harm our business and operating results.

Our operations could be subject to natural disasters and other business disruptions, which could adversely impact our future revenue and financial condition and increase our costs and expenses.

Our services and operations are vulnerable to damage or interruption from tornadoes, hurricanes, earthquakes, fires, floods, power losses, telecommunications failures, terrorist attacks, acts of war, human errors and similar events. A significant natural disaster, such as a tornado, hurricane, earthquake, fire or flood, could have a material adverse impact on our ability to conduct business, and our insurance coverage may be insufficient to compensate for losses that may occur. Acts of terrorism, war, civil unrest, violence or human error could cause disruptions to our business or the economy as a whole. Any of these events could cause consumer and small business confidence to decrease, which could result in a decreased number of loans and financing being made to customers. Any of these occurrences could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

Failure to keep up with the rapid changes in e-commerce and the uses and regulation of the internet could harm our business.

The business of providing products and services such as ours over the internet is dynamic and relatively new. We must keep pace with rapid technological change, consumer and small business use habits, internet security risks, risks of system failure or inadequacy, and

32

governmental regulation and taxation, and each of these factors could adversely impact our business. In addition, concerns about fraud, computer security and privacy and/or other problems may discourage additional consumers and small businesses from adopting or continuing to use the internet as a medium of commerce. In countries such as the United States, and the United Kingdom, where e-commerce generally has been available for some time and the level of market penetration of our online financial services is relatively high, acquiring new customers for our services may be more difficult and costly than it has been in the past. In order to expand our customer base, we must appeal to and acquire customers who historically have used traditional means of commerce to conduct their financial services transactions. If these customers prove to be less profitable than our previous customers, and we are unable to gain efficiencies in our operating costs, including our cost of acquiring new customers, our business could be adversely impacted.

Our business is subject to complex and evolving U.S. and international laws and regulations regarding privacy, data protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.

Our business is subject to a variety of laws and regulations in the United States and internationally that involve user privacy issues, data protection, advertising, marketing, disclosures, distribution, electronic contracts and other communications, consumer protection and online payment services. The introduction of new products or expansion of our activities in certain jurisdictions may subject us to additional laws and regulations. In addition, international data protection, privacy, and other laws and regulations can be more restrictive than those in the United States. U.S. federal and state and international laws and regulations, which can be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and the U.S. government, including the FTC and the Commerce Department, of Commerce, has announced that it is reviewing the need for greater regulation of the collection of information concerning consumer behavior on the internet, including regulation aimed at restricting certain targeted advertising practices. In addition, the application and interpretation of these laws and regulations are often uncertain, particularly in the new and rapidly evolving e-commerce industry in which we operate, and may be interpreted and applied inconsistently from country to country and inconsistently with our current or past policies and practices. A number of proposals are pending before federal, state, and international legislative and regulatory bodies that could significantly affect our business. There have been a number of recent legislative proposals in the United States, at both the federal and state level, that could impose new obligations in areas such as privacy. In addition, some countries are

considering legislation requiring local storage and processing of data that, if enacted, would increase the cost and complexity of delivering our services. These existing and proposed laws and regulations can be costly to comply with and can delay or impede the development of new products, the expansion into new markets, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to inquiries or investigations, claims or other remedies, including demands that we modify or cease existing business practices or pay fines, penalties or other damages.

Growth may place significant demands on our management and our infrastructure and could be costly.

We have experienced substantial growth in our business. This growth has placed and may continue to place significant demands on our management and our operational and financial infrastructure. Expanding our products or entering into new jurisdictions with new or existing products can be costly and require significant management time and attention. Additionally, as our operations grow in size, scope and complexity and our product offerings increase, we will need to enhance and upgrade our systems and infrastructure to offer an increasing number of enhanced solutions, features and functionality. The expansion of our systems and infrastructure will require us to commit substantial financial, operational and technical resources in advance of an increase in the volume of business, with no assurance that the volume of business will increase. Continued growth could also strain our ability to maintain reliable service levels for our customers, develop and improve our operational, financial and management controls, develop and enhance our legal and compliance controls and processes, enhance our reporting systems and procedures and recruit, train and retain highly skilled personnel. Competition for these personnel is intense and is particularly intense for technology and analytics professionals. We may not be successful in attracting and retaining qualified personnel. We have from time to time in the past experienced, and we expect to experience in the future, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources or more attractive compensation mixes than we have had. Managing our growth will require significant expenditures and allocation of valuable management resources. Failure to achieve the necessary level of efficiency in our organization as it grows could materially adversely affect our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

New top leveltop-level domain names may allow the entrance of new competitors or dilution of our brands, which may reduce the value of our domain name assets.

We have invested heavily in promoting our brands, including our website addresses. The Internet Corporation for Assigned Names and Numbers, the entity responsible for administering internet protocol addresses, has introduced additional new domain name suffixes in different formats, many of which may be more attractive than the formats held by us and which may allow the entrance of new competitors at limited cost. It may also permit other operators to register websites with addresses similar to ours, causing customer confusion and dilution of our brands, which could materially adversely affect our business, prospects, results of operations,

33

financial condition and cash flows. Any defensive domain registration strategy or attempts to protect our trademarks or brands could become a large and recurring expense and may not be successful.

Future acquisitions could disrupt our business and harm our financial condition and operating results.

Our success will depend, in part, on our ability to expand our product and service offerings and markets and grow our business in response to changing customer demands, regulatory environments, technologies and competitive pressures. In some circumstances, we may expand our offerings through the acquisition of complementary businesses, solutions or technologies rather than through internal development. The identification of suitable acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete identified acquisitions. Furthermore, even if we successfully complete an acquisition, we may not be able to successfully assimilate and integrate the business, technologies, solutions, personnel or operations of the business that we acquire, particularly if key personnel of an acquired company decide not to work for us. In addition, we may issue equity securities to complete an acquisition, which would dilute our stockholders’ ownership and could adversely affect the price of our common stock. Acquisitions may also involve the entry into geographic or business markets in which we have little or no prior experience or may expose us to additional material liabilities. Consequently, we may not achieve anticipated benefits of the acquisitions, which could harm our operating results.

The preparation of our financial statements and certain tax positions taken by us require the judgment of management, and we could be subject to risks associated with these judgments or could be adversely affected by the implementation of new, or changes in the interpretation of existing, accounting principles, financial reporting requirements or tax rules.

The preparation of our financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, and disclosure of contingent assets and liabilities, at the dates of the consolidated financial statements and the reported amounts of revenue and expenses during the reporting periods.

We carry our loans and finance receivables at fair value on the consolidated balance sheets. The fair values of our loans and finance receivables are determined using Level 3 inputs for which changes could significantly impact our fair value measurements. Valuations

are highly dependent upon the reasonableness of our assumptions and the predictability of the relationships that drive the results of our valuation methodologies. A variety of factors including, but not limited to, estimated customer default rates, the timing of expected payments, estimated utilization rates on line of credit accounts, estimated costs to service the portfolio, interest rates, observed credit spreads in the marketplace and valuations of comparable portfolios may ultimately affect the fair values of our loans and finance receivables. Modifications to our assumptions due to the passage of time and more information becoming available could result in material changes to our fair value calculations. These changes to fair value could adversely affect our results of operations. These changes are generally recorded directly to the income statement, which may make our financial statements less comparable to others in the industry that do not record their loan balances under the fair value option.

Management’s judgment is required in determining the provision for income taxes, the deferred tax assets and liabilities and any valuation allowance recorded against deferred tax assets. Management’s judgment is also required in evaluating whether tax benefits meet the more-likely-than-not threshold for recognition under Accounting Standards Codification 740-10-25, Income Taxes. Our interpretations of tax laws are subject to review and examination by the various taxing authorities in the jurisdictions where we operate, and disputes may occur regarding our view on a tax position. These disputes over interpretations with the various taxing authorities may be settled by audit, administrative appeals or adjudication in the court systems of the tax jurisdictions in which we operate. In addition, we may revise our estimate of income taxes due to changes in income tax laws, legal interpretations, and business strategies. It is possible that revisions in our estimate of income taxes may materially affect our results of operations in any reporting period. We regularly review whether we may be assessed additional income taxes as a result of the resolution of these matters, and we record additional reserves as appropriate.

In addition, we prepare our financial statements in accordance with U.S. generally accepted accounting principles (“GAAP”), and its interpretations are subject to change over time. If new rules or interpretations of existing rules require us to change our financial reporting, our results of operations and financial condition could be materially adversely affected, and we could be required to restate historical financial reporting.

Our U.S. consumer and small business loan businesses are seasonal in nature, which causes our cash flows to fluctuate over the year.

Our U.S. consumer and small business loan businesses are affected by fluctuating demand for our products and services and fluctuating collection rates throughout the year. Demand for our consumer loan products in the United States has historically been highest in the third and fourth quarters of each year, corresponding to the holiday season, and lowest in the first quarter of each year, corresponding to our customers’ receipt of income tax refunds. Demand for our small business loan products and services in the United States has historically been highest in the fourth quarter and early first quarter of each year, corresponding generally to holiday and post-holiday season needs, and lowest at the end of the first quarter and beginning of the second quarter of each year, where we believe that our customers’ businesses are generally slower. This seasonality requires us to manage our cash flows over the course of the year. If our originations were to increase and our collections were to fall substantially below what we would normally expect during certain periods, our ability to service debt and meet our other liquidity requirements may be adversely affected, which could have a material adverse effect on our business, prospects, results of operations, and financial condition.

Potential union activities could have an adverse effect on our relationship with our workforce.

None of our employees are currently covered by a collective bargaining agreement or represented by an employee union. Occasionally we experience union organizing activities. If our employees become represented by an employee union or become subject to a collective bargaining agreement, it may make it more difficult for us to manage our business and to attract and retain new employees and may increase our cost of doing business. Having our employees become represented by an employee union, having a collective bargaining agreement or having additional requirements related to our employees imposed on us could result in work stoppages and higher employee costs and could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations.

Our success is dependent, in part, upon our officers, and if we are not able to attract and retain qualified officers, our business could be materially adversely affected.

Our success depends, in part, on our officers, which are a relatively small group of individuals. Many members of the senior management team have significant industry experience, and we believe that our senior management would be difficult to replace, if necessary. Because the market for qualified individuals is highly competitive, we may not be able to attract and retain qualified officers or candidates. In addition, increasing regulations on and negative publicity about the consumer financial services industry could affect our ability to attract and retain qualified officers. If we are unable to attract or retain qualified officers, it could materially adversely affect our business.

Our operations could be subject to natural disasters and other business disruptions, which could adversely impact our future revenue and financial condition and increase our costs and expenses.

Our services and operations are vulnerable to damage or interruption from tornadoes, hurricanes, earthquakes, fires, floods, other natural disasters, power losses, telecommunications failures, terrorist attacks, acts of war, human errors, public health crises and similar events. A significant natural disaster, such as a tornado, hurricane, earthquake, fire or flood, could have a material adverse impact on our ability to conduct business, and our insurance coverage may be insufficient to compensate for losses that may occur. Despite any precautions we may take, system interruptions and delays could occur if there is a natural disaster, if a third-party provider closes a facility we use without adequate notice for financial or other reasons, or if there are other unanticipated problems at our leased facilities. Because we rely heavily on our servers, computer and communications systems and the internet to conduct our business and provide high-quality customer service, disruptions could harm our ability to run our business and cause lengthy delays which could harm our business, results of operations and financial condition. Acts of terrorism, war, civil unrest, violence or human error could cause disruptions to our business or the economy as a whole. Our business interruption insurance may not be sufficient to compensate us for losses that may result from interruptions in our service as a result of system failures or other disruptions. Any of these events could cause consumer and small business confidence to decrease, which could result in a decreased number of loans and financing being made to customers. Any of these occurrences could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

We may incur property, casualty or other losses not covered by insurance.

We maintain a program of insurance coverage for various types of property, casualty and other risks. The types and amounts of insurance that we obtain will vary from time to time, depending on availability, cost and management’s decisions with respect to risk retention. The policies are subject to deductibles and exclusions that could result in our retention of a level of risk on a self-insurance basis. Losses not covered by insurance could be substantial and may increase our expenses, which could harm our results of operations and financial condition.

The preparation of our financial statements and certain tax positions taken by us require the judgment of management, and we could be subject to risks associated with these judgments or could be adversely affected by the implementation of new, or changes in the interpretation of existing, accounting principles, financial reporting requirements or tax rules.

The preparation of our financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, and disclosure of contingent assets and liabilities, at the dates of the consolidated financial statements and the reported amounts of revenue and expenses during the reporting periods. In addition, management’s judgment is required in determining the provision for income taxes, the deferred tax assets and liabilities and any valuation allowance recorded against deferred tax assets. Management’s judgment is also required in evaluating whether tax benefits meet the more-likely-than-not threshold for recognition under Accounting Standards Codification 740-10-25, Income Taxes. Upon audit, if the ultimate determination of the taxes owed by us is for an amount in excess of amounts previously accrued, we could be required to make certain additional tax payments, which could materially adversely affect our results of operations and cash flows.

On December 22, 2017, the U.S. government enacted comprehensive Federal tax legislation commonly referred to as the U.S. Tax Cuts and Jobs Act of 2017 (the “Tax Act”). The Tax Act makes changes to the corporate tax rate, business-related deductions, among others, that will generally be effective for taxable years beginning after December 31, 2017. We are continuing to evaluate the Tax Act and its requirements, as well as its application to our business and its impact on our effective tax rate. At this stage, it is unclear how many U.S. states will incorporate these federal law changes, or portions thereof, into their tax codes. Overall, the impact of U.S. tax reform should reduce our effective tax rate; however, additional guidance or interpretations of the Tax Act could negatively impact our financial results.

In addition, we prepare our financial statements in accordance with generally accepted accounting principles (“GAAP”) and its interpretations are subject to change over time. If new rules or interpretations of existing rules require us to change our financial reporting, our results of operations and financial condition could be materially adversely affected, and we could be required to restate historical financial reporting.

Our U.S. consumer loan businesses are seasonal in nature, which causes our revenue and earnings to fluctuate.

Our U.S. consumer loan businesses are affected by fluctuating demand for our products and services and fluctuating collection rates throughout the year. Demand for our consumer loan products in the United States has historically been highest in the third and fourth quarters of each year, corresponding to the holiday season, and lowest in the first quarter of each year, corresponding to our customers’ receipt of income tax refunds. Typically, our cost of revenue for our consumer loan products in the United States, which represents our loan loss provision, is lowest as a percentage of revenue in the first quarter of each year, corresponding to our customers’ receipt of income tax refunds, and increases as a percentage of revenue for the remainder of each year. This seasonality requires us to manage our cash flows over the course of the year. If our revenue or collections were to fall substantially below what we

34

would normally expect during certain periods, our ability to service debt and meet our other liquidity requirements may be adversely affected, which could have a material adverse effect on our business, prospects, results of operations, and financial condition.

Risks Related to the Spin-Off

Enova International, Inc. was formed on September 7, 2011. Prior to November 13, 2014, we were a wholly-owned subsidiary of Cash America. Since 2011, we have owned all of the assets and incurred all of the liabilities related to Cash America’s e-commerce business, with some limited exceptions, in which case such assets were transferred to us and such liabilities were assumed by us pursuant to a separation and distribution agreement upon completion of a tax-free spin-off (the “Spin-off”), which occurred on November 13, 2014. Following the Spin-off, we became an independent, publicly traded company, and our shares of common stock are listed on the New York Stock Exchange under the symbol “ENVA.” On September 1, 2016, Cash America merged with First Cash Financial Services, Inc. and is now known as FirstCash, Inc. (“First Cash”).

.In connection with our Spin-off from Cash America, we and Cash America (and our successors) agreed to indemnify each other for certain liabilities. If we are required to act on our indemnities, we may need to divert cash to meet those obligations, and Cash America’s (or its successors) indemnity could be insufficient or Cash America (or its successors) could be unable to satisfy its indemnification obligations.

Pursuant to the Separation and Distribution Agreement and other agreements with Cash America, Cash America (and any successor) agreed to indemnify us for certain liabilities related to tax, regulatory, litigation or other liabilities, and we agreed to indemnify Cash America (and any successor) for certain similar liabilities, in each case for uncapped amounts. Indemnities that we may be required to provide Cash America (and any successor) are not subject to any cap, may be significant and could negatively impact our business, particularly indemnities relating to our actions that could impact the tax-free nature of the distribution. Third parties could also seek to hold us responsible for any of the liabilities that Cash America (and any successor) agreed to retain. Further, the indemnity from Cash America (and any successor) could be insufficient to protect us against the full amount of such liabilities, or Cash America (and any successor) may be unable to fully satisfy its indemnification obligations. Moreover, even if we ultimately succeed in recovering from Cash America (and any successor) any amounts for which we are held liable, we may be temporarily required to bear these losses ourselves and could suffer reputational risks if the losses are related to regulatory, litigation or other matters. Each of these risks could have a material adverse effect on our business, prospects, results of operations, financial condition and cash flows.

The Spin-off may expose us to potential liabilities arising out of state and federal fraudulent conveyance laws and legal distribution requirements.

The Spin-off could be challenged under various state and federal fraudulent conveyance laws. An unpaid creditor or an entity vested with the power of such creditor (such as a trustee or debtor-in-possession in a bankruptcy) could claim that the distribution left Cash America insolvent or with unreasonably small capital or that Cash America intended or believed it would incur debts beyond its ability to pay such debts as they mature and that Cash America did not receive fair consideration or reasonably equivalent value in the Spin-off. If a court were to agree with such a claim, then such court could void the distribution as a fraudulent transfer and could impose a number of different remedies, including without limitation, returning our assets or the distributed shares of our stock to Cash America, voiding our liens and claims against Cash America, or providing Cash America with a claim for money damages against us in an amount equal to the difference between the consideration received by Cash America and the fair market value of our Company at the time of the distribution.

The measure of insolvency for purposes of the fraudulent conveyance laws will vary depending on which jurisdiction’s law is applied. Generally, however, an entity would be considered insolvent if either the fair saleable value of its assets is less than the amount of its liabilities (including the probable amount of contingent liabilities), or it is unlikely to be able to pay its liabilities as they become due. We do not know what standard a court would apply to determine insolvency. Further, a court could determine that Cash America was insolvent at the time of or after giving effect to the distribution of Enova common stock.

Under the Separation and Distribution Agreement, we are responsible for the debts, liabilities and other obligations related to the business or businesses which we own and operate. Although we do not expect to be liable for any obligations not expressly assumed by us pursuant to the Separation and Distribution Agreement, it is possible that we could be required to assume responsibility for certain obligations retained by Cash America should Cash America (or its successor) fail to pay or perform its retained obligations.

35

Risks Related to our Indebtedness

We have incurred significant indebtedness, which could adversely affect our financial condition and prevent us from fulfilling our obligations under anticipated agreements governing our indebtedness.

As of December 31, 20172023, we had approximately $788.5$2,943.8 million of total debt outstanding. Interest expense on our indebtedness totaled $75.8$197.3 million during the year ended December 31, 2017.2023. Our level of debt could have important consequences to our stockholders, including:

We and our subsidiaries may incur significant additional indebtedness in the future. If new indebtedness is added to our current indebtedness levels, the related risks that we face would increase.

The terms of the agreements governing our indebtedness restrict our current and future operations, particularly our ability to respond to changes or to take certain actions, which could harm our long-term interests.

The agreements governing our indebtedness (including the indenture governing the 2021 Senior Notes, 2024 Senior Notes and the 2017 Credit Agreement, as defined under “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources” in Part II, Item 7 of this report) contain various restrictive covenants and in the case of the 2017 Credit Agreement, require that we maintain certain financial ratios that impose operating and financial restrictions on us and limit our ability to engage in actions that may be in our long-term best interests. These restrictive covenants, among other things, restrict our ability to:

As a result of all of these covenants and restrictions, we may be:

Any failure to comply with any of these financial and other affirmative and negative covenants could constitute an event of default or trigger an amortization event under our debt agreements, entitling the lenders to, among other things, terminate future credit availability (including under our 2017 Credit Agreement, and/orAgreement), increase the interest rate on outstanding debt, and/or accelerate the maturity of outstanding obligations under our debt agreements. If we were unable to repay the amounts due and payable under such debt agreements that are secured, the applicable lenders and noteholders could seek remedies, including against the collateral pledged under such facilities. An acceleration of the debt under certain facilities could also lead to a default under other facilities due to cross-acceleration provisions. Any such default could materially adversely affect our business, prospects, results of operations, financial condition and cash flows and could impair our ability to continue current operations. In addition, we act as servicer with respect to certain of our securitization facilities. If we default in our servicing obligations, an early amortization event or default could occur with respect to the applicable facility and we could be replaced as servicer.

See “Management’s Discussion and Analysis of Financial

36

Condition and Results of Operations—Liquidity and Capital Resources” in Part II, Item 7 of this report for additional information concerning our indebtedness.

We may not be able to generate sufficient cash to service our indebtedness and may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

Our ability to make scheduled payments on or refinance prior to maturity our debt obligations will depend on our financial condition and operating performance and our ability to enter into other debt financings, which are subject to prevailing economic and competitive conditions and to financial, business, legislative, regulatory, capital markets and other factors beyond our control. We might not be able to maintain a level of cash flows from operating activities sufficient to permit us to pay the principal, premium, if any, and interest on our indebtedness. For information regarding the risks to our business that could impair our ability to satisfy our obligations under our indebtedness, see “Risk Factors—Risks Related to Our Business and Industry.” If our cash flows and capital resources are insufficient to fund our debt service obligations, we could face substantial liquidity problems and could be forced to reduce or delay investments and capital expenditures or to dispose of material assets or operations, seek additional debt or equity capital or restructure or refinance our indebtedness. We may not be able to affect any such alternative measures on commercially reasonable terms or at all and, even if successful, those alternative actions may not allow us to meet our scheduled debt service obligations. If we cannot make scheduled payments on our debt, we will be in default, and lenders could declare all outstanding principal and interest to be due and payable, the lenders under our 2017 Credit Agreement could terminate their commitments to loan money and we could be forced into bankruptcy or liquidation. The agreements governing our indebtedness restrict our ability to dispose of certain assets and use the proceeds from those dispositions and may also restrict our ability to raise debt or equity capital to be used to repay other indebtedness when it becomes due. We may not be able to consummate those dispositions or to obtain proceeds in an amount sufficient to meet any debt service obligations then due. Our inability to generate sufficient cash flows to satisfy our debt obligations, or to refinance our indebtedness on commercially

reasonable terms or at all, would materially and adversely affect our financial condition, liquidity, results of operations and cash flows and our ability to satisfy our obligations under our indebtedness.

Changes in our financial condition or a potential disruption in the capital markets could reduce available capital.

If funds are not available from our operations and any excess cash or from our 2017 Credit Agreement, we willmay be required to rely onaccess the banking and credit markets to meet our financial commitments and short-term liquidity needs. We also expect to periodically access the debt capital markets to obtain capital to finance growth. Efficient access to the debt capital markets will be critical to our ongoing financial success; however, our future access to the debt capital markets could become restricted due to a variety of factors, including a deterioration of our earnings, cash flows, balance sheet quality, or overall business or industry prospects, adverse regulatory changes, a disruption to or deterioration in the state of the capital markets or a negative bias toward our industry by market participants. Disruptions and volatility in the capital markets may cause banks and other credit providers to restrict availability of new credit. Due to the negative bias toward our industry, commercial banks and other lenders have restricted access to available credit to participants in our industry, and we may have more limited access to commercial bank lending than other businesses. Our ability to obtain additional financing in the future will depend in part upon prevailing capital market conditions, and a potential disruption in the capital markets may adversely affect our efforts to arrange additional financing on terms that are satisfactory to us, if at all. If adequate funds are not available, or are not available on acceptable terms, we may not have sufficient liquidity to fund our operations, make future investments, take advantage of acquisitions or other opportunities, or respond to competitive challenges and this, in turn, could adversely affect our ability to advance our strategic plans. Additionally, if the capital and credit markets experience volatility, and the availability of funds is limited, third parties with whom we do business may incur increased costs or business disruption and this could adversely affect our business relationships with such third parties.

Increases in customer default rates could make us and our loans less attractive to lenders under debt facilities and investors in securitizations which may adversely affect our access to financing and our business.

Increases in customer default rates could make us and our loans less attractive to our existing (or prospective) funding sources. If our existing funding sources do not achieve their desired financial returns or if they suffer losses, they (or prospective funding sources) may increase the cost of providing future financing or refuse to provide future financing on terms acceptable to us or at all. Certain of our securitization facilities and asset-backed notes issued by our subsidiaries are non-recourse to Enova and are collateralized by our loans. If the loans securing such securitization facilities and asset-backed notes fail to perform as expected, the lenders under our securitization facilities and investors in our asset-backed notes, or future lenders or investors in similar arrangements, may increase the cost of providing financing or refuse to provide financing on terms acceptable to us or at all. If we were to be unable to arrange new or alternative methods of financing on favorable terms, we may have to curtail or cease our origination of loans, which could have a material adverse effect on our business, financial condition, operating results and cash flow.

Risks Related to our Common Stock and the Securities Market

Certain provisions of our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law may discourage takeovers.

Our amended and restated certificate of incorporation authorizes our Board of Directors to issue preferred stock and to determine the designations, powers, preferences, and relative, participating, optional, or other special rights, if any, and the qualifications, limitations, or restrictions of our preferred stock, including the number of shares, in any series, without any further vote or action by the stockholders. The rights of the holders of our common stock will be subject to the rights of the holders of any preferred stock that may be issued in the future. The issuance of preferred stock could delay, deter, or prevent a change in control and could adversely affect the voting power or economic value of our stock.

In addition, some provisions of our amended and restated certificate of incorporation and amended and restated bylaws could make it more difficult for a third party to acquire control of us, even if the change of control would be beneficial to our stockholders, including:

37

The market price of our shares may fluctuate widely.

The market price of our common stock may be influenced by many factors, some of which are beyond our control, including, among other things:

The stock markets have experienced price and volume fluctuations that have affected and continue to affect the market price of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of these companies. These broad market fluctuations, as well as general economic, systemic, political, and market conditions, such as recessions, loss of investor confidence or interest rate changes, may negatively affect the market price of our common stock.

If securities or industry analysts publish research that is unfavorable about our business, our stock price and trading volume could decline.

The trading market for our common stock depends in part on the research and reports that securities or industry analysts publish about us or our business. We currently have a limited number of analysts who are publishing research about us. In the event that one or more of our analysts downgrades our stock or publishes misleading or unfavorable research about our business, our stock price could decline. If one or more of these analysts ceases coverage of our company, demand for our stock may decrease, which could cause our stock price or trading volume to decline.

We do not anticipate paying any dividends on our common stock in the foreseeable future. As a result, stockholders will need to sell their shares of common stock to receive any income or realize a return on their investment.

We do not anticipate paying any dividends on our common stock in the foreseeable future. Any declaration and payment of future dividends to holders of our common stock may be limited by the provisions of the Delaware General Corporation Law (“DGCL”) and are limited by the terms of the 2017 Credit Agreement, 20212025 Senior Notes, 2028 Senior Notes and 2024 Senior Notes.our loan securitization facilities. The future payment of dividends, if permitted, by our 2017 Credit Agreement and the indentures governing the 2021 Senior Notes and 2024 Senior Notes, will be at the sole discretion of our Board of Directors and will depend on many factors, including our earnings, capital requirements, financial condition, and other considerations that our Board of Directors deem relevant. As a result, to receive any income or realize a return on their investment, our stockholders will need to sell their shares of common stock.

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware will be the sole and exclusive forum for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of a fiduciary duty owed to us or our stockholders by any of our directors, officers, employees or agents, (iii) any action asserting a claim against us arising under the DGCL or (iv) any action asserting a claim against us that is governed by the internal affairs doctrine. Our stockholders are deemed to have notice of and have consented to the provisions of our amended and restated certificate of

38

incorporation related to choice of forum. The choice of forum provision in our amended and restated certificate of incorporation may limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

None.ITEM 1C. CYBERSECURITY

Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

Risk Management and Strategy

Our cybersecurity risk management program is focused on the following key areas:

We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, internal assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. See “Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents.”

Governance

Board and Audit Committee Oversight

The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident

that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer (“CTO”) or a member of the IT Risk Management function.

Management’s Role

Our CTO is the primary senior management team member responsible for assessing, monitoring and managing material risks from cybersecurity threats, and works closely with out IT Risk Management team members. The CTO and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.

ITEM 2. PROPERTIES

We lease our corporate headquarters, which is located in Chicago, Illinois. We also maintain aadditional leased officeoffices in Gurnee, Illinois(i) South Jordan, Utah focusing on consumer and small business application intake and support functions and small business underwriting functions, (ii) New York, New York and Denver, Colorado for one of our call center operations, a leased office in Blue Ash, Ohio for The Business Backerprimarily small business operations and leased office space in London, United Kingdom(iii) São Paulo, for our U.K. operations and São Paulo, Brazil for our BrazilBrazilian operations. We do not own any real property. We believe that our leased facilities are adequate to support our operations and that, as needed, we will be able to obtain suitable additional facilities on commercially reasonable terms.

On March 8, 2013, Flemming Kristensen, on behalf of himself and others similarly situated, filed a purported class action lawsuit in the U.S. District Court of Nevada against us and other unaffiliated lenders and lead providers. The lawsuit alleges that the lead provider defendants sent unauthorized text messages to consumers on behalf of us and the other lender defendants in violation of the Telephone Consumer Protection Act. The complaint seeks class certification. On March 26, 2014, the Court granted class certification. On July 20, 2015, the court granted our motion for summary judgment, denied Plaintiff’s motion for summary judgment and, on July 21, 2015, entered judgment in favor of us. Plaintiff filed a motion for reconsideration, which was denied. On May 3, 2016, Plaintiff filed a notice of appeal of the order granting summary judgment for us, the judgment in favor of us, and the order denying Plaintiff’s motion to reconsider. On January 10, 2018, the Ninth Circuit filed an opinion affirming the district court's entry of summary judgment for us and the other defendants. The plaintiff has 90 days from the date of the opinion (until April 10, 2018) to petition the United States Supreme Court to review the matter. Neither the likelihood of an unfavorable appellate decision nor the ultimate liability, if any, with respect to this matter can be determined at this time, and we are currently unable to estimate a range of reasonably possible losses, as defined by Accounting Standards Codification 450-20-20, Contingencies–Loss Contingencies–Glossary, for this litigation. We believe that the plaintiff’s claims in the complaint are without merit and intend to vigorously defend this lawsuit.

We are also involved in certain routineITEM 3. LEGAL PROCEEDINGS

Information concerning legal proceedings claimsis incorporated herein by reference to Note 11, “Commitments and litigation matters encountered inContingencies,” to the ordinary course of our business. Certain of these matters may be covered to an extent by insurance or by indemnification agreements with third parties. We have recorded accruals in our financial statements for those matters in which it is probable that we have incurred a loss and the amount of the loss, or range of loss, can be reasonably estimated. In the opinion of management, the resolution of these matters will not have a material adverse effect on our financial position, results of operations or liquidity.Consolidated Financial Statements.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable.

Not Applicable.PART II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

39

PART II

Principal Market

The principal market for our common stock is the New York Stock Exchange (“NYSE”). The following table sets forth the high, and low intra-day sales prices per share for our shares of common stock onare listed under the NYSE.symbol “ENVA.”

Stockholders

Stockholders

There were 332258 registered stockholders of record of Enova common stock as of February 22, 2018.21, 2024.

Dividends

We do not anticipate paying any dividends on our common stock in the foreseeable future. We currently intend to retain our future earnings for use in the operation and expansion of our business. The declaration and amount of any future dividends, however, will be determined by our Board of Directors and will depend on our financial condition, earnings and capital requirements, covenants associated with our debt obligations and any other factors that our Board of Directors believes are relevant. There can be no assurance, however, that we will pay any cash dividends on our common stock in the future. In addition, the terms of the indentures governing the 2021 Senior Notes and 2024 Senior Notes and our 2017 Credit Agreement limit our ability to pay future dividends. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources” in Part II, Item 7 of this report.

40

Performance Graph

The following graph shows a comparison of the cumulative total shareholder return for our common stock to the total shareholder return for the S&P SmallCap 600® Index, and with our peer grouprepresenting a broad-based equity market index that we are a part of, the S&P SmallCap 600® Financials Index, representing an industry-based index that we are a part of, from November 13, 2014 (the date our common stock began trading on the NYSE)December 31, 2018 through December 31, 2017.2023. This data assumes an investment of $100 in each of our common stock and the two indices on November 13, 2014December 31, 2018 and that all dividends were reinvested. Our peer group indexNote that historic performance is comprisednot necessarily indicative of CBOE Holdings, Inc., CoreLogic, Inc., CoStar Group Inc., EZCORP, Inc., Fair Isaac Corporation, Green Dot Corporation, Investment Technology Group Inc., Liquidity Services, Inc., Nelnet, Inc., OneMain Holdings, Inc., Regional Management Corp., Shutterfly, Inc., SS&C Technologies Holdings, Inc., TripAdvisor Inc. and World Acceptance Corp.future performance.

Unregistered Sales of Equity Securities

We did not sell any unregistered securities during the three years ended December 31, 2017.2023.

Issuer Purchases of Equity Securities

The following table provides the information with respect to purchases made by us of shares of our common stock.

ITEM 6. RESERVED

41

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS.

42