MITK 10-K & 10-Q changes, risk factors and insider trading

•Evolving domestic and international data privacy and Artificial IntelligenceAI laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

•Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.

•WeAlthough we have concluded that previously identified material weaknesses in our internal control over financial reporting,reporting andhave been remediated, if oursuch remediation of such material weaknesses iswas not effective, or if we failidentify toadditional developmaterial andweaknesses maintain an effective system of disclosure controls andin internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

Since 2018, United Services Automobile Association (“USAA”) has filed suit against various parties alleging patent infringement concerning four USAA-owned patents related to mobile deposits, including Wells Fargo Bank, N.A. (“Wells Fargo”) and PNC Bank. While these lawsuits do not name the Company as a defendant, given (among other factors) the Company’s prior history of litigation with USAA and the continued use of the Company’s products by its customers, on November 1, 2019, the Company filed a complaint in the U.S. District Court for the Northern District of California seeking declaratory judgment that its products do not infringe certain patents held by USAA (collectively, the “Subject Patents”)., On January 15, 2020,which USAA filed motions requesting the dismissal of the declaratory judgement of the Subject Patents and transfer of the case to the Eastern District of Texas, both of which the Company opposed. On April 21, 2020, the Court in the Northern District of California transferred the Company’s declaratory judgement action to the Eastern District of Texas and did not rule on USAA’s motion to dismiss. On April 28, 2021, the Court in the Eastern District of Texas granted USAA’s motionsought to dismiss thefor Company’slack declaratoryof judgmentstanding. actionFollowing various appeals and transfers, on jurisdictionalJune grounds.12, The Court’s ruling did not address the merits of the Company’s claim of non-infringement. The Company appealed the ruling on the motion to dismiss and the decision to transfer the declaratory judgment action from California to Texas to2025, the U.S. Court of Appeals for the Federal Circuit. The Federal Circuit heard oral argument onaffirmed the Company’sdismissal appeal on April 4, 2022 and on May 20 2022, issued an opinion vacating and remandingof the districtaction court’sfor orderlack grantingof USAA’sstanding, motionbut todid dismiss.not On August 1, 2022,address the partiesmerits submitted additional briefing toof the district court in light of Federal Circuit’s opinion. The court held another hearing on USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds, and once again granted USAA’s motion to dismiss on February 23, 2023.case. The Company timelychose filednot a notice ofto appeal tothis the U.S. Court of Appeals for the Federal Circuit. The appeal is fully briefed, and the Company is awaiting oral argument.decision. The Company continues to believe that its products do not infringe the Subject Patents and will vigorously defend the right of its end-users to use its technology.

Our ability to compete effectively depends upon our ability to meet changing market conditions and develop enhancements to our products on a timely basis in order to maintain our competitive advantage. The markets for products incorporating mobile imaging and voice software technology and products are characterized by rapid advancements in technology and changes in user preferences. Our continued growth will ultimately depend upon our ability to develop additional technologiestechnologies, enhance our existing applications to meet customers’ changing needs, and attract strategic alliances for related or separate products. When we develop a new offering or an enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market. There can be no assurance that we will be successful in developing and marketing product enhancements and additional technologies, that we will not experience difficulties that could delay or prevent the successful development, introduction and marketing of these products, or that our new products and product enhancements will adequately meet the requirements of the marketplace, will be of acceptable quality, or will achieve market acceptance.

New lines of business, productsproducts, or services could have a significant impact on the effectiveness of our system of internal controls and could reduce our revenues and potentially generate losses. New products and services, or entrance into new markets, may require substantial time, resources and capital, and profitability targets may not be achieved. Entry into new markets entails inherent risks associated with our inexperience, which may result in costly decisions that could harm our profit and operating results. There are material inherent risks and uncertainties associated with offering new products, and services, especially when new markets are not fully developed or when the laws and regulations regarding a new product are not mature. Factors outside of our control, such as developing laws and regulations, regulatory orders, competitive product offerings and changes in commercial and consumer demand for products or services may also materially impact the successful implementation of new products or services. Failure to manage these risks, or failure of any product or service offerings to be successful and profitable, could have a material adverse effect on our financial condition and results of operations.

Historically, sales of licenses to our channel partners have comprised a significant part of our revenue. This is primarily attributable to the timing of the purchase or renewal of licenses and does not represent a dependence on any single channel partner. IfThe weloss were to loseof a channel partner relationship,relationship we do not believe such a loss wouldcould adversely affect our operations because eitherwhich we orwould attempt to mitigate through the assignment of such business to another channel partner couldor sellthrough our own licensing of our products to the end-users that had purchased products from the channel partner we lost. However, in that case, we or another channel partner must establish a relationship with the end-users, which could take time to develop, if it develops at all.

•lack of familiarity with, and unexpected changes in, foreign laws and legal standards, including employment laws, Artificial Intelligence,AI, and privacy laws, which may vary widely across the countries in which we sell our products;

•compliance with differing and changing local laws and regulations in multiple domestic and international jurisdictions, including Artificial IntelligenceAI and data privacy laws, as well as compliance with U.S. laws and regulations where applicable in these jurisdictions; and

The transfer of personal data from the European Union (“EU”) to the U.S. has become a significant area of potential operational and compliance risk. In 2023, the Data Privacy Framework was introduced as a new mechanism for companies to transfer data from EU member states, the United Kingdom, or Switzerland to the U.S after its predecessor, the Data Privacy Shield, was invalidated. We currently participate in the EU‑U.S. Data Privacy Framework and its UK Extension and Swiss‑U.S. Data Privacy Framework. The EU, the United Kingdom, and Switzerland also allow the use of Standard Contractual Clauses (SCCs), but some decisions have indicated that Compliancecompliance with newthese transfer frameworks requirerequires significant effort for companies to review and revise their procedures and current EU-U.S. data transfer agreements. NYOBNOYB, or the European Center for Digital Rights, and its founder Max Schrems, the parties responsible for initiating actions to invalidate the previous Frameworks,frameworks, have indicated it will bring similar challenges against the Data Privacy Framework. Because of the legal challenges presented by these court and data protection authority decisions, there is continuing uncertainty regarding the legal basis for data transfers to the U.S., which could leadrequire us to interruptionimplement ofadditional measures, limit or suspend certain transfers, or, in some cases, cease such transfers. The complex nature and shiftingevolving laws related to EU/UK/SwitzerlandEU-, toUK-, U.S.and Switzerland-to-U.S. data transfers could cause operational interruptions, liabilitiesliabilities, and reputational harm. These and other requirements could increase the cost of compliance for us and our customers, restrict our and our customers’ ability to store and process data, negatively impact our ability to offer our solutions in certain locations and limit our customers’ ability to deploy our solutions globally. These consequences may be more significant in countries with legislation that requires data to remain localized “in country,” as this could require us or our customers to establish data storage in other jurisdictions or apply local operational processes that are difficult and costly to integrate with global processes.

If we fail to comply with such laws and regulations, we may be subject to significant fines, penalties or liabilities for noncompliance, thereby harming our business. For example, in 2016, the EU adopted the General Data Protection Regulation (“GDPR”), which establishes newcomprehensive requirements regarding the handling of personal data and which became effective in May 2018. Non-compliance with the GDPR may result in monetary penalties of up to the greater of €20 million or 4% of worldwide revenue.annual revenue, and materially similar penalties may apply under the UK GDPR.

Due to our international operations, we are subject to certain foreign tax regulations. Such regulations may not be clear, not consistently applied, and be subject to sudden change, particularly with regard to international transfer pricing. Our earnings could be reduced by the uncertain and changing nature of such tax regulations.

Evolving domestic and international data privacy and Artificial IntelligenceAI laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

Federal, state and foreign governments and supervising authorities have enacted, and may in the future enact, laws and regulations concerning the solicitation, collection, processing, disclosure, transfer and use of personal information. Such laws and regulations require or may in the future require us or our customers to implement additional and revise existing privacy and security policies and practices; permit individuals to access, correct or delete personal information stored or maintained by us or our customers; inform individuals of security breaches that affect their personal information; and, in some cases, obtain consent to use certain personal information for certain purposes. Many of these laws also impose data minimization, purpose‑limitation, and security obligations; restrict certain types of automated decision‑making and profiling; and require data protection impact assessments, vendor diligence, and contractual controls. Other proposed laws and regulations could, if enacted, impose additional requirements and prohibit the use of specific technologies, such as those that track individuals' activities on web pages or record when individuals click on a link contained in an email message and systems reliant on such technologies. In addition, restrictions on cross‑border transfers of personal data (including requirements for standard contractual clauses, transfer impact assessments, or participation in certification mechanisms) may limit how we provide services across jurisdictions and increase compliance costs. Such laws and regulations could restrict our and our customers' ability to collect and use web browsing data and personal information, which may reduce our customers' demand for our solutions. The laws in this area are complex and developing rapidly. Non‑compliance can result in investigations, orders, suspension of processing, or significant administrative fines, as well as private litigation where available.

In the United States, many states have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all states require businesses to provide notice to customers whose personal information has been disclosed as a result of a data breach. The laws are not identical, and compliance in the event of a widespread data breach is costly, as we must ensure our compliance with each individual state law. Further, states have continued adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provides such consumers new ways to opt-out of certain sales of personal information. California regulations also require recognition of certain browser‑ or device‑based opt‑out signals (such as Global Privacy Control) and impose specific obligations for targeted advertising and “sharing” of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The California Privacy Rights Act (the “CPRA”) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA was in full effect as of January 1, 2023. Similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023. Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island have adopted privacy laws, which take effect at different dates through 2026. Many of these state laws include requirements regarding data protection assessments, processing of sensitive data, consumer appeals of automated decision‑making, universal opt‑out mechanisms, and restrictions on targeted advertising and profiling that may require us to modify products and operational practices. Additional U.S. states have enacted, or are considering, similar data privacy laws. We cannot fully predict the impact of these state laws on our business or operations, but it may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We expect that new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. In addition to the growing number of state-level privacy laws, the U.S. Congress has been actively considering a federal privacy law for some time which, if passed, would likely create a comprehensive national framework for data protection and privacy. This law could supersede many state privacy laws and establish uniform privacy protections across the country, addressing issues such as data security, artificial intelligenceAI governance and consumer rights. The final form, timeline, and effective date of a potential U.S. federal privacy law is uncertain at this time. We may need to build new processes to honor federal requirements that differ from, or preempt, state obligations.

Changing industry standards and industry self-regulation regarding the collection, use and disclosure of data may have similar effects. Existing and future privacy and data protection laws and increasing sensitivity of consumers to unauthorized disclosures and use of personal information may also negatively affect the public's perception of our customers' sales practices. If our solutions are perceived to cause, or are otherwise unfavorably associated with, insecurity of personal information, whether or not illegal, we or our customers may be subject to public criticism. Public concerns regarding data collection, privacy and security may also cause some consumers to be less likely to visit our customers' websites or otherwise interact with our customers, which could limit the demand for our solutions and inhibit the growth of our business. Any failure on our part to comply with applicable privacy and data protection laws, regulations, policies and standards or any inability to adequately address privacy or security concerns associated with our solutions, even if unfounded, could subject us to liability, damage our reputation, impair our sales and harm our business. Furthermore, the costs to our customers of compliance with, and other burdens imposed by, such laws, regulations, policies and standards may limit adoption of and demand for our solutions. In addition, changes by major platforms and browsers including restrictions on third‑party cookies, mobile advertising identifiers, and tracking technologies, as well as evolving email and anti‑spam rules may reduce the effectiveness of certain features or require product changes, engineering workarounds, and increased costs.

Some of our solutions require the storage and transmission of proprietary and confidential information of our clients and their employees, including biometric data. “In limited cases, we may host and retain biometric templates or identifiers as instructed by our customers, and our ability to meet applicable retention, destruction, and security requirements depends on our customers’ configurations and instructions; any failure to adhere to required retention schedules or provide timely destruction upon request could increase our legal and operational risks.” Several jurisdictions have imposed legal and compliance requirements on biometric data that are more stringent than requirements on other classifications of personal data. For example, under GDPR, biometric data is considered “sensitive data” which requires special attention and technical and organizational measures to protect the biometric data against breaches of confidentiality, integrity, and availability. The processing of biometric data for such purposes is prohibited unless one of a very limited and specific set of conditions is satisfied (such as explicit consent of the data subject). Effective compliance in this area (including in the context of use of certain of our products) can be highly challenging, and we are reliant on our customers to ensure that such a condition is satisfied when they use our products to identify someone. In certain deployments, our customers act as controllers of biometric data and are responsible for providing notices, obtaining any required consents, and defining retention and deletion schedules; we may act as a processor and are dependent on our customers’ instructions to enable compliance. We may be unable to provide certain of our products in certain jurisdictions, in particular in Europe where provision of such technologies in compliance with the GDPR is highly challenging. If we or our customers fail to obtain valid consent or satisfy another lawful basis, or fail to meet requirements relating to purpose limitation, data minimization, retention, security, or cross‑border transfers, we could face investigations, enforcement actions, private claims where available, and substantial penalties.

Similarly, in the United States.,States, the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric identifiers and information, requires informed consent before collection, imposes fines for non-compliance, and grants residents a private right of action over improper collection and mishandling of biometric data. BIPA provides for substantial penalties and statutory damages and havehas generated significant class action activity; the cost of litigating and settling any claims that we have violated the BIPA or similar laws could be significant. Several other states have passed or are considering passing similar laws, such as the Texas Collection and Use of Biometric Information (“CUBI”) Act and the Washington Biometric Data Act. Similarly, Québec's Act respecting the protection of personal data in the private sector (“Law 25” formerly known as “Bill 64”) introduces substantial changes to the privacy landscape in Quebec, enhancing protection for personal data and introducing new obligations for transparency and accountability in data processing activities, including those involving biometric data. In addition, comprehensive state privacy laws in several U.S. jurisdictions impose obligations related to sensitive data, impact assessments, automated decision‑making, and consumer rights (such as access, deletion, and opt‑out rights) that can apply to biometric data and may require changes to our products and practices, additional contractual commitments with customers and vendors, and increased compliance costs. Evolving judicial interpretations and legislative amendments (including changes affecting the accrual of claims, available defenses, or the calculation of statutory damages) may increase or, in some cases, mitigate our exposure, but the overall legal risk environment for biometric technologies remains significant and uncertain.

Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.

AI, automated decision making, and ML technologies are increasingly subject to regulatory scrutiny and oversight, for example, under the comprehensive legal framework governing the use of artificial intelligenceAI adopted by the European Parliament in the European Union (the “EU AI Act”). The EU AI Act imposes onerous obligations related to the development, deployment and use of AI/ML-related systems. The EU AI Act classifies certain AI systems as prohibited, imposes transparency requirements on other systems, and designates a broad set of applications as ‘high‑risk’ subject to numerous compliance obligations, including governance, transparency, conformity assessment, quality management, technical documentation, risk management, post‑market monitoring, incident reporting, and human oversight requirements. In particular, the EU AI Act is likely to designate certain AI technologies, including technologies used in an employment-related context (such as in relation to recruitment, placement of targeted job advertisements, and decision-making concerning promotion, termination and task allocation), as ‘high risk’ and subject to numerous onerous compliance obligations, including various transparency, conformity and risk assessment, monitoring and human oversight requirements. As our products and services develop, they mallmay fall within one or more of these categories. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. The EU AI Act has a phased implementation process over several years, with certain obligations taking effect earlier than others, and compliance timelines may accelerate if our products are used in contexts deemed high‑risk. The EU AI Act is likely to be fully effective by Spring 2026. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors / competences. Additionally, several United States jurisdictions have enacted measures related to the use of AI in products and services for their potentially discriminatory effects. For example, New York City passed a law to regulate the use of automated employment decision tools by employers and employment agencies. Other U.S. jurisdictions have adopted or are considering rules addressing profiling, automated decision‑making, audits or impact assessments, and transparency obligations. Certain of these laws may be materially unfavorable to our interests and/or inconsistent with our existing operations, policies, practices or plans (or may be interpreted as such). We expect other jurisdictions will adopt similar laws. If any of our offerings are used in employment‑related, credit, housing, insurance, access control, biometric identification, or other contexts that could be categorized as high‑risk, our compliance burden and associated costs could increase materially.

VisionStrategic Acquisitions and DifferentiationInnovation

•Revenues for the twelve months ended September 30, 20242025 were $172.1$179.7 million, aan decreaseincrease of less than 1%4% compared to revenues of $172.6$172.1 million for the twelve months ended September 30, 2023.2024.

Total revenue decreasedincreased $0.5$7.6 million, or less4%, thanto 1%,$179.7 million in 2025 compared to $172.1 million in 2024 compared to $172.6 million in 2023.2024. Software license and hardware revenue decreased $6.5$7.8 million, or 7%,10%, to $74.1 million in 2025 compared to $81.9 million in 2024 compared to $88.4 million in 2023.2024. This decrease is primarily due to anlower existingmulti-year customerterm havinglicense enteredrevenue intorenewal aof significant multiyearour Mobile Deposit® contractsoftware products and the license revenue associated with the full contract term was recognized in 2023, which did not recur. Thea decrease was, to a lesser extent, driven by a decline in sales of our legacy identifyidentity verification software and hardware products and ID R&D biometrics software products in 2024.2025. ServicesSaaS, maintenance, and other revenue increased $6.0$15.4 million, or 7%,17%, to $105.6 million in 2025 compared to $90.2 million in 2024 compared to $84.2 million in 2023,2024, primarily due to strong growth in transactional SaaS revenue from our CheckReader™Mobile Verify®, HooYu, MiVIP, Mobile Deposit®, and Check Fraud Defender,Defender MiVIP,products, andpartially Mobileoffset Deposit®by a decrease in sales of our legacy identity verification products in 20242025 compared to 2023.2024.

Cost of revenue includes personnel costs related to billable services, professional services, and software support, hosting costs, and the costs of royalties for third party products embedded in our products and excludes depreciation and amortization. Cost of revenue increased $1.4$2.4 million, or 6%,10%, to $26.8 million in 2025 compared to $24.4 million in 2024 compared to $23.0 million in 2023.2024. The increase in cost of revenue is primarily due to a related increase in transactional SaaS revenue, partially offset by a decrease in costs due to a decline in sales of our legacy identify verification software license and hardware products in 20242025 compared to 2023.2024.

Selling and marketing expenses include payroll, employee benefits, stock-based compensation, and other headcount-related costs associated with sales, marketing, sales operations, sales engineering and customer success personnel. Selling and marketing expenses also include non-billable costs of professional services personnel, advertising expenses, product promotion costs, trade shows, and other brand awareness programs. Selling and marketing expenses increased $0.2$0.7 million, or 1%,2%, to $41.5 million in 2025 compared to $40.8 million in 2024 compared to $40.6 million in 2023.2024. The increase in selling and marketing expense is primarily due to higher personnel-related costs due to increased headcount and higher product promotion costs,headcount, partially offset by lower other costs in 20242025 compared to 2023.2024.

Research and development expenses include payroll, employee benefits, stock-based compensation, third-party contractor expenses, and other headcount-related costs associated with softwareresearch, engineering and mobile capture science and product management personnel. Research and development expenses increased $5.6$0.6 million, or 20%,2%, to $35.3 million in 2025 compared to $34.6 million in 2024 compared to $29.0 million in 2023.2024. The increase in research and development expenses is primarily due to higher personnel-related costs as a result of compensation cost of living adjustments for employees that the Company moved to Spain from its offices in Russia and higher third-party contractor expenses, partially offset by lower other costs in 20242025 compared to 2023.2024.

General and administrative expenses include payroll, employee benefits, stock-based compensation, and other headcount-related costs associated with finance, legal, administration and information technology functions, as well as third-party legal, accounting, and other administrative costs. General and administrative expenses increaseddecreased $9.7$8.7 million, or 22%,16%, to $44.3 million in 2025 compared to $53.0 million in 2024 compared to $43.3 million in 2023.2024. The increasedecrease was primarily due to highera auditdecrease in audit, accounting and tax fees, higherlower personnel-relatedthird-party costs,and higherprofessional fees, lower executive transition costs, lower legal and higher legalother costs, partially offset by ahigher decreasepersonnel-related costs as we continue to replace full-time consultants with full-time employees in third-party and professional fees in 20242025 compared to 2023.2024.

Amortization and acquisition-related costs include amortization of acquired intangible assets, adjustments recorded due to changes in the fair value of contingent consideration, and other costs associated with acquisitions. Amortization and acquisition-related costs decreased $3.7$1.1 million, or 20%,8%, to $14.1 million in 2025 compared to $15.3 million in 2024 compared to $19.0 million in 2023.2024. The decrease in amortization and acquisition-related costs is primarily due to a larger increase in the fair value of acquisition-related contingent consideration associated with the ID R&D acquisition in 2023 which was paid in the first fiscal quarter of 2024 and a decrease in amortization expense of intangible assets from previous acquisitions that had been fully amortized in 20242025 compared to 2023.2024.

Restructuring costs consist of employee severance obligations and other related costs. Restructuring costs were $0.8 million in 2025 and related to a restructuring that occurred in the first quarter of fiscal 2025. Restructuring costs were $1.8 million in 2024 and related to expenses incurred to relocate employees and a restructuring that occurred in the third quarter of fiscal 2024. Restructuring costs were $2.1 million in 2023 and related to a restructuring plan that was initially implemented in June and November 2022.

Other income (expense), net includes interest income net of amortization and net realized gains or losses on our marketable securities portfolio, and foreign currency transactional gains or losses. Other income (expense), net increaseddecreased $2.3$1.5 million, to net income of $4.6 million in 2025 compared to net income of $6.1 million in 2024 compared to net income of $3.8 million in 2023 primarily due to highera decrease in interest income net of amortization andamortization, higher foreign currency exchange transactional gains.losses, The increase was partially offset byand a favorableloss outcomeon extinguishment related to our Amended Credit Agreement in a2025 lawsuitcompared weto filed against Instacart that was settled and collected in 2023.2024.

The income tax provision for 2025 was $2.8 million which yielded an effective tax rate of 24% compared to an income tax benefit for 2024 wasof $4.2 million which yielded an effective tax rate of 461% compared to an income tax provision of $2.3 million which yielded an effective tax rate of 22% in 2023.2024. The income tax benefit for 2024 is primarily due to our negative pre-tax lossesbook inincome for the current year, research and development tax credits generated during the year and the release of a valuation allowance in certain of the foreign jurisdictions.year. Our effective tax rate for fiscal year 2024 wasand 2025 were higher than the U.S. federal statutory rate of 21% due to the impact of researchnon-deductible and development credits and theexpenses, release of valuation allowances in certain of the foreign jurisdictions.jurisdictions, generation of tax credits and state taxes on our tax provision.

For a discussion of the twelve months ended September 30, 20232024 compared to the twelve months ended September 30, 2022,2023, refer to Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations" in our Annual Report on Form 10-K for the twelve months ended September 30, 2023,2024, filed with the SEC on MarchDecember 19,2024,16, 2024, which is available free of charge on the SEC’s website at https://www.sec.gov and on our website at investors.miteksystems.com, on the “Investors Site” page under “Annual Reports.”investors.miteksystems.com.

Cash generated from operations hasand proceeds from the issuance of the 2026 Notes (as defined below) have historically been our primary sourcesources of liquidity to fund operations and investments to grow our business. Our currentadditional sources of liquidity include available cash balances, investments, our revolving credit line,balances and proceeds from the issuanceAmended ofCredit theAgreement 2026(as Notes.defined below). On September 30, 2024,2025, we had $141.8$196.5 million in cash and cash equivalents and investments compared to $134.9$141.8 million on September 30, 2023,2024, an increase of $8.6$54.7 million, or 6%.39%. The increase in cash and cash equivalents and investments is primarily due to cash flows from operations of $31.7$55.3 million partially offset by repurchases of our common stock, par value $0.001 per share (“Common Stock”) of $24.2$4.7 million.

Cash flows related to operating activities are dependent on net income, non-cash adjustments to net income and changes in working capital. Net cash provided by operating activities during fiscal 20242025 was $31.7$55.3 million and resulted primarily from net income of $3.3$8.8 million, net non-cash charges of $27.0$33.2 million, and unfavorablefavorable changes in operating assets and liabilities of $1.4$13.3 million. The increase in cash provided by operating activities during fiscal 20242025 compared to fiscal 20232024 of $0.1$23.7 million was primarily due to an increase in cashnet resultingincome fromand athe decreaserelated increase in contractincome assetstaxes payable due to the timing of income tax payments in fiscal 2025, an increase in stock-based compensation expense, and an increase in deferred revenue, offset by lower cash provided by net income and net non-cash charges in fiscal 2024.revenue.

Net cash provided by operating activities during fiscal 20232024 was $31.6$31.7 million and resulted primarily from net income of $8.0$3.3 million, net non-cash charges of $32.6$27.0 million, and unfavorable changes in operating assets and liabilities of $9.0$1.4 million. The increase in cash provided by operating activities during fiscal 20232024 compared to fiscal 20222023 of $0.1 million was primarily due to an increase in cash resulting from collection of receivables of $23.8 million year over year due to improvements in our collections process, and an increase in other liabilities of $1.7 million. These increases were partially offset by a decrease in contract assets and increase in deferred revenuerevenue, offset by lower cash provided by net income and net non-cash charges in fiscal 2023.2024.

In February 2021, the Company issued $155.3 million aggregate principal amount of the 2026 Notes (including the Additional Notes, as defined below). The 2026 Notes are senior unsecured obligations of the Company. The 2026 Notes were issued pursuant to an Indenture, dated February 5, 2021 (the “Indenture”), between the Company and UMB Bank, National Association, as trustee. The Indenture includes customary covenants and sets forth certain events of default after which the 2026 Notes may be declared immediately due and payable and sets forth certain types of bankruptcy or insolvency events of default involving the Company after which the 2026 Notes become automatically due and payable. The Company granted the initial purchasers of the 2026 Notes (collectively, the “Initial Purchasers”) a 13-day option to purchase up to an additional $20.25 million aggregate principal amount of the 2026 Notes (the “Additional Notes”), which was exercised in full. The 2026 Notes were purchased in a transaction that was completed on February 5, 2021. As of January 13, 2024 ("Date of Noncompliance"), the Company was not in compliance with certain of the covenants in the Indenture as a result of the Company not timely filing its Form 10-K for the fiscal year ended September 30, 2023 (“Form 10-K”) with the SEC. As a result of not being in compliance, the 2026 Notes began to accrue additional special interest of 0.25% of the outstanding principal of the 2026 Notes for the 90 days after the Date of Noncompliance and 0.50% of the outstanding principal of the 2026 Notes for the 91st through 180th day after the Date of Noncompliance. The Company subsequently did not timely file its Form 10-Q for the quarter ended December 31, 2023 (the “Q1 Form 10-Q”) with the SEC. The Company then filed its Form 10-K with the SEC on March 19, 2024 and its Q1 Form 10-Q with the SEC on April 15, 2024. As of September 30, 2024,2025, the Company was in compliance with the covenants in the Indenture.

The net proceeds from thisthe offering2026 Notes were approximately $149.7 million, after deducting the Initial Purchasers’ discounts and commissions and the Company’s estimated offering expenses related to the offering. The 2026 Notes will mature on February 1, 2026, unless earlier redeemed, repurchased or converted. The 2026 Notes bear interest from February 5, 2021 at a rate of 0.750% per year payable semiannually in arrears on February 1 and August 1 of each year, beginning on August 1, 2021. The 2026 Notes will be convertible at the option of the holders at any time prior to the close of business on the business day immediately preceding August 1, 2025, only under the following circumstances: (1) during any calendar quarter commencing after the calendar quarter ended on June 30, 2021, if the last reported sale price per share of the Company’s Common Stock exceeds 130% of the conversion price for each of at least 20 trading days during the 30 consecutive trading days ending on, and including, the last trading day of the immediately preceding calendar quarter; (2) during five consecutive business days immediately after any five consecutive trading day period (such five consecutive trading day period, the “measurement period”) in which the trading price per $1,000 principal amount of notes for each trading day of the measurement period was less than 98% of the product of the last reported sale price per share of the Common Stock on such trading day and the conversion rate on such trading day; and (3) upon the occurrence of certain corporate events or distributions on the Common Stock. On or after August 1, 2025, until the close of business on the second scheduled trading day immediately preceding the maturity date, holders may convert all or any portion of the 2026 Notes, in multiples of $1,000 principal amount, at the option of the holder regardless of the foregoing circumstances. Upon conversion, the Company may satisfy its conversion obligation by paying and/or delivering, as the case may be, cash and, if applicable at the Company’s election, shares of Common Stock, based on the applicable conversion rate(s); provided that the Company will be required to settle conversions solely in cash unless and until the Company (i) receives stockholder approval to increase the number of authorized shares of the Common Stock and (ii) reserves such amount of shares of the Common Stock for future issuance as required pursuant to the indenture that will govern the 2026 Notes. The conversion rate for the 2026 Notes will initially be 47.9731 shares of the Common Stock per $1,000 principal amount of 2026 Notes, which is equivalent to an initial conversion price of approximately $20.85 per share of the Common Stock. The initial conversion price of the 2026 Notes represents a premium of approximately 37.5% to the $15.16 per share last reported sale price of the Common Stock on February 2, 2021. The conversion rate is subject to adjustment under certain circumstances in accordance with the terms of the Indenture. The impact of the convertible feature will be dilutive to our earnings per share when our average stock price for the period is greater than the conversion price.

As of December 16,11, 2024,2025, the 2026 Notes were not convertible, therefore, we had not purchased any shares under the Notes Hedge and the Warrant Transactions had not been exercised and remain outstanding. See Note 10.8. “Convertible Senior NotesDebt” of the notes to the consolidated financial statements included in this Form 10-K for more information relating to the Notes Hedge and Warrant Transactions.

On February 13, 2024, the Company entered into a Loan and Security Agreement (the “Credit Agreement”) with Silicon Valley Bank, a division of First-Citizens Bank & Trust Company (the “Bank”) that provides for a revolving line of credit whereby the Company may borrow up to $35.0 million (the “Revolving Line”) with an additional $15.0 million to be advanced under the Revolving Line at the sole discretion of the Bank. The Revolving Line iswas secured on a first priority basis by the Company’s assets. In connection with the Credit Agreement, the Company incurred issuance costs of $0.3 million which are amortized to interest expense using the straight-line method over the term of the Credit Agreement.

Borrowings under the Amended Credit Agreement generally bear interest at a variable rate equal to (a) term SOFR plus a specified margin or (b) WSJ prime plus a specified margin, in each case which will be adjusted based on the Company’s net leverage ratio at the time of borrowing. The CompanyBorrower must also pay the Bank (i) a commitment fee of $87,500$125,000 and (ii) an “Unused Revolving Line Facility Fee” of 0.25% per annum of the average unused portion of the Revolving Line.

The Amended Credit Agreement contains representations, warranties, and negative and affirmative covenants customary for transactions of this type. These include covenants limiting the ability of the Company,Borrower, and any of their subsidiaries, subject to certain exceptions and baskets, to, among other things, (i) incur indebtedness, (ii) incur liens on their assets, (iii) enter into any merger or consolidation with, or acquire all or substantially all of the equity or property of, another person, (iv) dispose of any of their business or property, (v) make or permit any payment on subordinated debt, or (vi) pay any dividend, make any other distribution, or redeem any equity.

The Amended Credit Agreement contains customary events of default and also provides that an event of default includes any default resulting in a right by third parties to accelerate maturity of indebtedness in excess of $0.5 million.$500,000. If any event of default occurs and is not cured within applicable grace periods set forth in the Amended Credit Agreement or waived, all loans and other obligations could become due and immediately payable and the facility could be terminated. In addition, the CompanyBorrower may be required to deposit cash with the Bank in an amount equal to 115%1.05 of any undrawn letters of credit denominated in U.S. Dollars or 1.15 of any undrawn letters of credit denominated in a foreign currency.

Our platform addresses key use cases across digital interactions and customer lifecycle, including new account openings, account access, and mobile check deposit. Core capabilities include AI, machine learning, computer vision, proprietary biometric liveness, and deepfake detection technologies that support identity verification, authentication, detect manipulation, and help prevent digital impersonation.

SecondThird Quarter Fiscal 2026 Highlights

•Revenue for the three months ended MarchJune 31,30, 2026 was $54.8$54.0 million, an increase of 6%18% compared to revenue of $51.9$45.7 million in the three months ended MarchJune 31,30, 2025.

•Net income was $9.5$8.4 million, or $0.20$0.17 per diluted share, during the three months ended MarchJune 31,30, 2026, compared to net income of $9.2$2.4 million, or $0.20$0.05 per diluted share, during the three months ended MarchJune 31,30, 2025.

•Cash provided by operating activities was $7.1$34.2 million for the sixnine months ended MarchJune 31,30, 2026, compared to cash provided by operating activities of $14.3$35.9 million for the sixnine months ended MarchJune 31,30, 2025.

•We added a new patent to our portfolio during the three months ended MarchJune 31,30, 2026, bringing our total number of issued patents to 112 as of MarchJune 31,30, 2026. In addition, we had 2526 patent applications outstanding as of MarchJune 31,30, 2026.

Comparison of the Three Months Ended MarchJune 31,30, 2026 and 2025

The following table summarizes certain aspects of our results of operations for the three months ended MarchJune 31,30, 2026 and 2025 (amounts in thousands, except percentages):

Total revenue increased $2.9$8.3 million, or 6%,18%, to $54.8$54.0 million in the three months ended MarchJune 31,30, 2026 compared to $51.9$45.7 million in the three months ended MarchJune 31,30, 2025. Software license revenue decreasedincreased $0.8$1.2 million, or 3%,6%, to $26.0$20.7 million in the three months ended MarchJune 31,30, 2026, compared to $26.7$19.5 million in the three months ended MarchJune 31,30, 2025. This decreaseincrease is primarily due to athe decreasetiming inof revenuelarge fromcheck ourverification Mobile Deposit® software products, partiallyrenewals, offset by increasesdecreases indue to customers transitioning to our CheckReader™Check andFraud biometricsDefender products(“CFD”) Software as a service (“SaaS”) offering in the three months ended MarchJune 31,30, 2026 compared to the same period in 2025. SaaS, maintenancemaintenance, and other revenue increased $3.7$7.1 million, or 15%,27%, to $28.9$33.3 million in the three months ended MarchJune 31,30, 2026, compared to $25.2$26.2 million in the three months ended MarchJune 31,30, 2025. This increase is primarily due to increased customeradoption adoptionand volume usage of Mobileour Verify® , MiVIP,fraud and Checkidentity Fraud Defendersolutions products in the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

Cost of revenue includes personnel costs related to billable services and software support, hosting costs, and the costs of royalties for third party products embedded in our products. Cost of revenue increased $2.0$1.2 million, or 31%,16%, to $8.6$8.2 million in the three months ended MarchJune 31,30, 2026, compared to $6.5$7.0 million in the three months ended MarchJune 31,30, 2025. The increase in cost of revenue is primarily due to an increase in SaaS revenue as well as increased investment in our SaaS products, and increases in service intensive customer work with more personnel costs directly supporting our customers during the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

Selling and marketing expenses include payroll, employee benefits, stock-based compensation, and other headcount-related costs associated with sales and marketing personnel. Selling and marketing expenses also include non-billable costs of professional services personnel, advertising expenses, product promotion costs, trade shows, and other brand awareness programs. Selling and marketing expenses decreased $0.9$1.1 million, or 9%,10%, to $9.6$10.0 million in the three months ended MarchJune 31,30, 2026, compared to $10.5$11.1 million in the three months ended MarchJune 31,30, 2025. The decrease in selling and marketing expense is primarily due to a re-allocation of headcount to focus on service intensive customer work and $1.3$1.0 million increase onin deferred contract costs in the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

Research and development expenses include payroll, employee benefits, stock-based compensation, third party contractor expenses, and other headcount-related costs associated with software engineering and mobileproduct capture science.development. Research and development expenses decreased $2.2$0.9 million, or 23%,10%, to $7.6$8.1 million in the three months ended MarchJune 31,30, 2026, compared to $9.8$9.0 million in the three months ended MarchJune 31,30, 2025. The decrease in research and development expenses is primarily due to increased capitalization of costs for internal-use software of $1.3$1.7 million commensurate with alignment of priorities and resources to focus on plaform-levelplatform-level capabilities.capabilities, partially offset by an additional $1.2 million in personnel-related costs excluding stock-based compensation expense. The decrease in research and development expenses areis also driven by lower stock-based compensation expense of $0.9$0.7 million, reflecting ongoing optimization of our cost structure and strategic realignment of resources toward platform-level capabilities including reversal of expense for roles that exited the organization as part of this realignment in the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

General and administrative expenses include payroll, employee benefits, stock-based compensation, and other headcount-related costs associated with finance, legal, administration, and information technology functions, as well as third party legal, accounting, and other administrative costs. General and administrative expenses increased $2.1$1.7 million, or 21%,15%, to $12.2$12.9 million in the three months ended MarchJune 31,30, 2026, compared to $10.1$11.3 million in the three months ended MarchJune 31,30, 2025. The increase in general and administrative expenses is primarily due to higher personnel-related costs including higher stock-based compensation expenseexpense, higher bonus expense, and higher badseverance debt expense due to one customer defaulting on a payment plan,costs, partially offset by lower auditaudit, accounting and accountingtax feesfees, and lower bad debt expense during the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

Amortization of acquired intangibles and acquisition-related costs include amortization of intangible assets, adjustments recorded due to changes in the fair value of contingent consideration,assets and other costs associated with acquisitions. Amortization of acquired intangibles and acquisition-related costs decreased $0.3 million, or 8%,7%, to $3.3 million in the three months ended MarchJune 31,30, 2026, compared to $3.6 million in the three months ended MarchJune 31,30, 2025. The decrease is primarily due to a decrease in amortization expense of intangible assets from previous acquisitions that were fully amortized prior to the three months ended MarchJune 31,30, 2026 compared to the same period in 2025.

Restructuring costs consist of employee severance obligations and other related costs. Restructuring costs were immaterial$0.5 million in the threenine months ended MarchJune 31,30, 2026 related to a restructuring that occurred in the first quarter of fiscal 2026. Restructuring costs were immaterial$0.8 million in the threenine months ended MarchJune 31,30, 2025 and related to a restructuring that occurred in the first quarter of fiscal 2025.

Interest expense decreased $0.8$2.6 million, or 17%,35%, to $4.0$4.7 million for the sixnine months ended MarchJune 31,30, 2026, compared to $4.8$7.3 million for the sixnine months ended MarchJune 31,30, 2025. The current period consisted of $3.0 million of amortization of debt discount and issuance costs and $1.0$1.7 million of cash interest, compared to $4.2$6.4 million of amortization and $0.6$0.9 million of cash interest in the prior year period. The decrease in amortization following repayment of the 2026 Notes in February 2026 was partially offset by approximately twofive months of cash interest on the Term Loan drawn in January 2026.

Other Income (Expense),Income, Net

Other income (expense),income, net includes interest income net of amortization and net realized gains or losses on our marketable securities portfolio and foreign currency transactional gains or losses. Other income (expense),income, net increaseddecreased $0.5$1.0 million, or 28%,29%, to $2.1$2.5 million income in the sixnine months ended MarchJune 31,30, 2026, compared to $1.7$3.5 million income in the sixnine months ended MarchJune 31,30, 2025. The increasedecrease was primarily due to andecreased increaseinvestment income as a result of reduced average cash and investment balances following repayment of the 2026 Notes in interestFebruary income received from our marketable securities in the six months ended March 31, 2026 as compared to the same period in 2025.2026.

Income Tax Benefit (Provision)

For the sixnine months ended MarchJune 31,30, 2026, we recorded an income tax provision of $4.8$7.6 million which yielded an effective tax rate of 28%.27%. For the sixnine months ended MarchJune 31,30, 2025, we recorded an income tax provision of $0.6$1.4 million which yielded an effective tax rate of 12%.16%. The difference between the U.S. federal statutory tax rate and our effective tax rate for the sixnine months ended MarchJune 31,30, 2026 was primarily due to a mix of worldwide income, the impact of non-deductible executive compensation, as well as the impact of the global intangible low-taxed income inclusion and federal, state and foreign research and development credits on the tax provision. The difference between the U.S. federal statutory tax rate and our effective tax rate for the sixnine months ended MarchJune 31,30, 2025 was primarily due to a mix of worldwide income, the impact of non-deductible executive compensation, release of valuation allowances relating to one of the Company's operations in a foreign jurisdiction, as well as the impact of stock-based compensation, and federal, state and foreign research and development credits on the tax provision.

Cash generated from operations, proceeds from the issuance of the 2026 Notes (as defined above), and proceeds from the Term Loan (as defined below) have historically been our primary sources of liquidity to fund operations and investments to grow our business. Our additionalcurrent sources of liquidity include available cash balances and the Revolving Line (as defined below). On MarchJune 31,30, 2026, we had $77.6$100.2 million in cash and cash equivalents and investments compared to $196.5 million on September 30, 2025, a decrease of $118.9$96.3 million, or 61%.49%. This decrease was primarily driven by the repayment of $155.3 million for the 2026 Notes,Notes and share repurchases of $17.8$19.8 million, partially offset by $50.0 million in borrowings under the Term Loan and cash generated from operations. In summary, our cash flows from continuing operations were as follows (amounts in thousands):