WIX.COM LTD.

FORM 20-F

ANNUAL REPORT FOR THE FISCAL YEAR ENDED DECEMBER 31, 2019

TABLE OF CONTENTS

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that future results, levels of activity, performance and events and circumstances reflected in the forward-looking statements will be achieved or will occur. Except as required by law, we undertake no obligation, and expressly disclaim any duty, to update publicly any forward-looking statements for any reason after the date of this annual report, to conform these statements to actual results or to changes in our expectations.

Item

The following tables reconcile revenues, the most directly comparable U.S. GAAP measure, to collections for the periods presented:

B.    Capitalization and Indebtedness

•

competitive factors affecting the software as a service, or SaaS, business market, including the competitive landscape and the strategies that may be implemented by our competitors;

competitors and the ease with which a user can switch to a competitor;

If the security of the data we store in our systems, including personal information or business data of our registered users and their users, is breached or otherwise subjected to unauthorized access, our reputation may be harmed and we may be exposed to liability.

Due to the nature of our business, our systems and the systems of our cloud providers with which we contract, store large amounts of data including our data, data of our prospective and registered users, as well as data relating to the visitors, customers and users of our users, which we refer to as our users of users. Such data that we store may include email addresses, geo-location, usage data, business data, passwords and also billing information, such as encrypted credit card numbers, full names, billing addresses, phone numbers and additional information they may view as confidential. Third-party applications available on our platform may also collect such data and share it with us. We do not regularly monitor or review the content that our users, and their users, upload and store, or information we receive from third-party applications and, therefore, we do not control the substance of the content on our servers, which may include personal information. Risks of external or internal unauthorized access or leaks exist.

Although we have implemented data security standards and controls, operating rules and certification requirements, including in accordance with Payment Card Industry, or PCI, Data Security Standards, pursuant to which we have maintained PCI compliance level 1 certification since February 2013, deploy third-party opposing forces (Red Team) to test our vulnerabilities, and constantly monitor our environments via security operations centers, we cannot be sure that the steps that we have taken to protect the security, integrity and confidentiality of the information we, or our users, collect, store, or transmit, will succeed in preventing inadvertent or unauthorized use or disclosure. Our payments system, for example, interfaces with a number of different gateway providers that link to a number of different payment card processors based on jurisdiction and other factors, and depend on the efficacy of secure transmission protocols and related technologies. There can be no assurance that the data security standards we have implemented, including for the collection and transmission of credit card and other payment information, or those of our third-party service providers, will adequately comply with the security standards of any future jurisdiction in which we seek to market our solution. Furthermore, like many online and other companies, we have experienced attempts by third parties to circumvent the security of our systems. We have and are experiencing attempts by hackers to penetrate our internal network and hosted servers using various techniques, including sophisticated tailored phishing attacks and other exploitation of known and unknown vulnerabilities. We may not be successful in identifying, blocking or otherwise preventing access to our systems, despite our security measures. Since techniques used to obtain unauthorized access change frequently, we may be unable to anticipate these techniques or to implement adequate preventative measures. Furthermore, we may be unable to promptly detect an attack, for example, in the case of an advanced persistent threat where unauthorized system access was obtained in advance and without our knowledge in preparation for a future attack. In addition, we rely on outside parties to provide physical security for our facilities, including data centers. Any physical breach of security could result in unauthorized access or damage to our systems.

If our security measures are breached, whether because of third-party action, employee error, malfeasance or otherwise, or if design flaws in our software are exposed, exploited or abused in any way, including through our Corvid by Wix solution (previously named Wix Code), and, as a result, an unauthorized party accesses any of our registered users’ data or the data of their users, or otherwise gains control of our platform, or if it is perceived that any unauthorized access has occurred (such as when users utilize weak passwords or their credentials are disclosed, stolen or lost), our brand may be negatively impacted, we may be unable to acquire new registered users or Partners, our relationships with our registered users or Partners may be damaged, our registered users may choose to cancel their premium subscriptions, and we could incur liability and be subject to regulatory investigations and fines, negatively impacting our financial performance, all of which may result in a decline of our share price. Even if such a data breach affects a competitor and does not arise out of our actions or inactions, the resulting concern about using our platform could negatively affect our business.

In addition, many jurisdictions have enacted laws requiring companies to notify individuals (and regulators) of data security breaches involving certain types of personal information, and, in addition, our agreements with certain of our providers require us to notify them in the event of a security incident. These mandatory disclosures regarding a security incident sometimes lead to negative publicity and may cause our registered users or providers to lose confidence in the effectiveness of our data security measures. We could be required to devote significant resources to investigate and address a security incident. Following the introduction of Wix Payments and the increased storage of personal and financial information of our users and their users, a violation of data privacy or security laws, many of which focus on personal financial and payment information, could lead to reputational harm, loss of business, legal action and / or regulatory inquiries, resulting in monetary, other penalties or other consequences that could negatively impact our reputation and adversely affect our operating results and financial condition.

If our data security measures fail to protect the encrypted credit card details, passwords or personal information adequately, we could be liable to both our registered users and their users for any related losses (such as fraudulent credit card transactions), as well as certain of our providers under our contractual agreements, including fines and higher transaction fees. Additionally, we could face regulatory action, and our registered users and providers could terminate or materially change their relationships with us, any of which could harm our business, results of operations or financial condition. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular data related claim. Our existing general liability insurance coverage and coverage for errors and omissions may not continue to be available on acceptable terms in the future or may not be available in sufficient amounts to cover one or more large data related claims. The insurer may also deny coverage for any future data related claim. The successful assertion of one or more large data related claims against us that exceeds our available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, financial condition and results of operations.

If we are unable to maintain and enhance the strength of our brand, or if events occur that damage our reputation and brand, our ability to expand our base of registered users and premium subscriptions and to grow our revenues from such subscriptions may be impaired, and our business and financial results may be harmed.

Maintaining,

We dependacquire new registered users, who may purchase premium subscriptions and business solutions over time, through paid marketing channels, such as cost-per-click advertisements on highly skilled personnelsearch engines, social networking sites and through our affiliates program, targeted and generic banner advertisements on other sites, and social network influencers who promote our platform. In addition, premium subscriptions are further acquired through the selling and marketing activities of our sales and account management teams that targets partners, who may purchase a higher volume of premium subscriptions to enhancesell to their customers. Our selling and marketing activities also focus on increasing revenues from existing premium subscriptions by offering complementary business solutions such as additional features, products, and applications, including those developed by third parties. We may also invest a significant portion of our productmarketing expenses on more traditional advertising and promotion of our brand, including through sponsorships with professional sports franchises and others.

The payment card networks, such as Visa and MasterCard, have also adopted rules and regulations that apply to all merchants who process and accept credit cards for payment of goods and services.services, and have discretion to both set and interpret the rules and may do so with little or no prior notice. We are obligated to comply with these rules and regulations as part of the contracts we enter into with payment processors and acquiring banks. The rules and regulations adopted by the payment card networks include the PCI Data Security Standards, or PCI DSS. Under the PCI DSS, we are required to adopt and implement internal controls over the use, storage and security of payment card data to help prevent fraud. If we fail to comply with the rules and regulations adopted by the payment card networks, including the PCI DSS, we would be in breach of our contractual obligations to payment processors and merchant banks, which may include indemnification clauses. Such failure to comply may subject us and/or our users to fines, penalties, damages, higher transaction fees, and civil liability, and could eventually prevent us or our users from processing or accepting debit and credit cards, or could lead to a loss of payment processor partners. We also cannot guarantee that such compliance will prevent illegal or improper use of our payments systems or the theft, loss or misuse of the debit or credit card data of registered users or participants or regulatory or criminal investigations. Moreover, any such illegal or improper payments could harm our reputation and may result in a loss of service for our registered users, which would adversely affect our business, operating results and financial condition.

Failures of the third-party hardware, software and infrastructure on which we rely, including third-party data center hosting facilities, and failure to protect against cyber-attacks, could adversely affect our business.

Our servers, data centers and other facilities are also vulnerable to damage or interruption from fires, natural disasters, terrorist attacks, power loss, telecommunications failures or similar catastrophic events. Although we have multiple data centers, disruptions to any of these servers or facilities could interrupt our ability to provide our platform and solutions and materially adversely affect our business and results of operations.

In addition, we are lookingWe have implemented certain measures to expand our presence in new markets,protect personal information, including in emerging countries, for which we are in the processpersonal information of localizing our products in terms of the languages and currencies we use, expanding our systems to accept payments in forms that are common in these target markets and tailoring our customer care, to provide our users with a local experienceof users, but as described above, these measures may not adequately address all potential data privacy concerns and catersecurity threats and may fail to meet the expectations of our users, and their specific needs. We intendusers, or other stakeholders, which could thereby reduce the demand for our services. Furthermore, our users or service providers may respond to continue our international expansion efforts, includingthis data protection and privacy regulatory framework by partnering with large local sales channel partners who can assist us to penetrate new markets. To achieve our goals, we must continue to hire and train experienced personnel to staff and manage our international expansion. Our international expansion efforts may be slow or unsuccessful to the extentrequesting that we experience difficulties in recruiting, training, managing and retaining qualified personnel with international experience, language skills and cultural competencies in the geographic markets we target,undertake certain privacy or if we engage with a Partner who is not appropriately qualified to operate in local markets. In addition, the expansion of our existing international operations and entry into additional international markets has required, and will continue to require, significant management attention and financial resources. We may also face pressure to lower our prices in order to compete in emerging markets, which could adversely affect revenue derived from our international operations. These and other factors associated with our international operations could impair our growth prospects and adversely affect our business, operating results and financial condition.

We may face challenges expanding our premium subscription base and increasing revenues in emerging markets due to difficulties in these markets associated with payment collections as well as legal, economic, tax and political risksdata related contractual commitments that are greater than in more developed markets.

Expanding our business into emerging markets is an important component of our growth strategy and presents challenges that are different from those associated with more developed international markets. In particular, regulations limiting the use of local credit cards and foreign currency could constrain our growth in certain countries. For example, regulations in certain countries do not permit recurring charges on credit cards. We have established subsidiaries in certain foreign jurisdictions and may continue to expand into new jurisdictions in order to facilitate local payments, and may be subject to local regulations in such respective jurisdictions. It is often difficult to establish an effective local business model, and we may need to enter into agreements with third parties to process, on our behalf, payments via credit cards or alternative payment methods, including offline payment methods, or otherwise modify our business plans or operations in order to establish a local presence in emerging countries, which may delay our entry into these markets or increase our costs. Additionally, in emerging markets we may face the risk of rapidly changing government policies, including with respect to bank transfers and various payment methods including offline, and we may encounter sudden currency devaluations. Currency controls in emerging countries may make it hard for us to repatriate collections or profits that we generated in a particular country. It is possible that the governments of one or more countries may censor or block access to the Internet or specifically our website due to political concerns or in response to certain incidents or events, thereby preventing people in these countries, including our registered users, from accessing our products. The growth of our business may be materially adversely affected if we are unable or unwilling to expand our registered user base in emerging markets.

We may make, acquisitions and investments,all of which could result in operating difficulties and other harmful consequences.

From time to time, we evaluate potential strategic acquisition or investment opportunities. Any transactions that we enter into could be material to our financial condition and results of operations. As described in Item 4.A. under the header “Information on the Company-History and Development of the Company–Our History,” in 2017, we acquired U.S. - based DeviantArt, Inc., or DeviantArt. Prior to the DeviantArt acquisition, we had not made any significant acquisitions and our management has not had any experience making significant acquisitions or integrating acquired businesses. Additionally, in February 2020, we acquired U.S.-based InkFrog, Inc. and in March 2020 we acquired the assets and key employees of WebsPlanet Ltd. The process of integrating an acquired company, business or technology, could create unforeseen operating difficulties and expenditures. We may not be able to successfully integrate the acquired personnel, operations and technologies or effectively manage the combined business following the completion of the acquisition or any other complementary businesses or technologies we acquire in the future. Acquisitions and investments we evaluate from time to time may carry with them a number of risks, including the following:

•

diversion of management time and focus from operating our business;

•

an inability to achieve synergies as planned;

•

potential incompatibility of corporate cultures;

•

implementation or remediation of controls, procedures and policies of the acquired company;

•

coordination of product, engineering and selling and marketing functions;

•

retention of employees from the acquired company;

•

liabilities that are larger than we currently anticipate and unforeseen increased expenses or delays associated with acquisitions, including transition costs to integrate acquired businesses that may exceed the costs that we currently anticipate;

•

litigation or other claims arising in connection with the acquired company;

•

the need to integrate operations across different cultures and languages and to address the particular economic, currency, political and regulatory risks associated with specific countries;

•

the use of resources that are needed in other parts of our business;

•

the use of substantial portions of our available cash to consummate the acquisition;

•

share-based dilution as a result of equity grants to new hires of our acquired companies;

•

incurrence of acquisition-related costs; and

•

unrealistic goals or projections for the acquisition.

Our failure to address these risks or other problems encountered in connection with acquisitions and investments we evaluate from time to time could cause us to fail to realize the anticipated benefits of such acquisitions or investments, incur unanticipated liabilities and expenses andcan harm our business results of operations and our financial condition.

results.

To protect our trade-secrets, know-how and other proprietary information, we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances.alliances and other third parties to whom we may disclose confidential information. No assurance can be given that these agreements will be effective in controlling access to our trade-secrets, know-how, or proprietary information.information, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in Israel and the United States. Further, these agreements do not prevent our competitorsothers from independently developing technologies that are substantially equivalent or superior to our solutions. It is possible that others will independently develop the same or similar technology or otherwise obtain access to our unpatented technology.

From time to time, we may discover that third parties are infringing, misappropriating or otherwise violating our intellectual property rights. However, policing unauthorized use of our intellectual property and misappropriation of our technology is difficult and expensive, and we may therefore not always be aware of such unauthorized use or misappropriation, or have adequate resources to enforce our intellectual property rights. Despite our efforts to protect our intellectual property rights, unauthorized third parties may attempt to use, copy or otherwise obtain and market or distribute our intellectual property rights or technology or otherwise develop solutions with the same or similar functionality as our solutions. If competitors infringe, misappropriate or otherwise misuse our intellectual property rights and we are not adequately protected, or if such competitors are able to develop solutions with the same or similar functionality as ours without infringing our intellectual property, our competitive position and results of operations could be harmed and our legal costs could increase.

Third parties may assert infringement claims against our users relating to our products and solutions. These claims may require us to initiate or defend protracted and costly litigation on behalf of our users, regardless of the merits of these claims. If any of these claims succeed, we may be forced to pay damages on behalf of our users or may be required to obtain licenses for the products they use. If we cannot obtain all necessary licenses on commercially reasonable terms, our users may be forced to stop using our products.