Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended June 30, 2021

OR

Commission File Number:  001-39149

BILL.COM HOLDINGS, INC.

(Exact name of registrant as specified in its charter)

(650) 621-7700

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the Registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes  ☒ No ☐

Indicate by check mark if the Registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act.  Yes ☐ No ☒

Indicate by check mark whether the Registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the Registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

Indicate by check mark whether the Registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the Registrant, based on the closing price of the shares of common stock on December 31, 2020 (the last business day of the registrant’s most recently completed second fiscal quarter) as reported by The New York Stock Exchange on December 31, 2020, was approximately $10.7 billion.

The number of shares of Registrant’s Common Stock outstanding as of August 23, 2021 was 94,782,906.

Table of Contents

BILL.COM HOLDINGS, INC.

TABLE OF CONTENTS

i

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements. All statements contained in this Annual Report on Form 10-K other than statements of historical fact, including statements regarding our future operating results and financial position, our business strategy and plans, market growth, and our objectives for future operations, are forward-looking statements. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “target,” “plan,” “expect,” and similar expressions are intended to identify forward-looking statements. Our fiscal year end is June 30. Our fiscal years ended June 30, 2021, 2020 and 2019 are referred to herein as fiscal 2021, fiscal 2020 and fiscal 2019, respectively.

Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Annual Report on Form 10-K.

1

Table of Contents

These forward-looking statements are subject to a number of risks, uncertainties, and assumptions, including those described in the section titled “Risk Factors” in Part I, Item 1A of this Annual Report on Form 10-K. Moreover, we operate in a very competitive and rapidly changing environment, and new risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. Additionally, the full impact of the COVID-19 pandemic is inherently uncertain at the time of this report. In light of these risks, uncertainties, and assumptions, the future events and trends discussed in this Annual Report on Form 10-K may not occur and actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements.

You should not rely upon forward-looking statements as predictions of future events. The events and circumstances reflected in the forward-looking statements may not be achieved or occur. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee future results, performance, or achievements. We undertake no obligation to update any of these forward-looking statements for any reason after the date of this Annual Report on Form 10-K or to conform these statements to actual results or to changes in our expectations, except as required by law.

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based upon information available to us as of the date of this Annual Report on Form 10-K, and while we believe such information forms a reasonable basis for such statements, such information may be limited or incomplete, and our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all potentially available relevant information.

You should read this Annual Report on Form 10-K and the documents that we reference in this Annual Report on Form 10-K and have filed with the SEC as exhibits to this Annual Report on Form 10-K with the understanding that our actual future results, performance, and events and circumstances may be materially different from what we expect.

In this Annual Report on Form 10-K, the words "we," "us," "our" and "Bill.com" refer to Bill.com Holdings, Inc. and its wholly owned subsidiaries, unless the context requires otherwise.

2

Table of Contents

PART I

Item 1. Business

Overview

Our mission is to make it simple to connect and do business.

We are champions of small and midsize businesses (SMBs). As a leading provider of cloud-based software that simplifies, digitizes, and automates complex back-office financial operations for SMBs, we create efficiencies and free our customers to run their businesses. Our vision is to become the leading one-stop solution that helps millions of businesses around the world manage their financial operations.

Our purpose-built, artificial-intelligence (AI)-enabled financial software platform creates seamless connections between our customers, their suppliers, and their clients. Customers use our platform to generate and process invoices, streamline approvals, make and receive payments, sync with their accounting system, and manage their cash. We have built sophisticated integrations with popular accounting software solutions, banks, card issuers and payment processors, enabling our customers to access these mission-critical services quickly and easily. We are central to an SMB’s accounts payable and accounts receivable operations.

On June 1, 2021, we completed our acquisition of DivvyPay, Inc. (Divvy), a leading provider of cloud-based spend management application and smart corporate cards to SMBs in the United States (U.S.), for an aggregate purchase price of $2.3 billion.  Divvy became our wholly owned subsidiary as a result of the acquisition of 100% of its outstanding equity interests. As of June 30, 2021, Divvy had approximately 9,900 active spending businesses using its free cloud-based spend management application that were not Bill.com existing customers.

Divvy’s cloud-based software solution provides a secure financial platform for businesses to manage payments and subscriptions, build strategic budgets, and eliminate the need for expense reports. With Divvy, employers can give employees direct access to funds, effectively eliminating expense reports and retroactive reimbursement. After signing up, the business owner and their designated employees receive physical Divvy credit cards. Divvy spending businesses can create online (virtual) cards, set spending and budget controls, and control card activity in Divvy. The card activity instantly integrates with the Divvy platform.

As of June 30, 2021, over 121,000 customers trusted our platform to manage their financial workflows and process their payments and spend, which totaled $140.3 billion in Total Payment Volume (TPV) during fiscal 2021. For the purposes of measuring our key business metrics, we define customers as entities that are either billed directly by us or for which we bill our strategic partners during a particular period. As of June 30, 2021, we had approximately 3.2 million network members. We define network members as our customers plus their suppliers and clients, who pay and receive funds electronically via our platform.

On July 19, 2021, we entered into an Agreement and Plan of Merger (Merger Agreement) with Invoice2go, Inc. (Invoice2go), a Delaware corporation that provides mobile-first accounts receivable software that empowers SMBs and freelancers to grow their client base, manage invoicing and payments, and build their brand. Pursuant to the terms of, and subject to the conditions set forth in, the Merger Agreement, we will pay an aggregate consideration of approximately $625.0 million in cash and shares of our common stock in exchange for all of the outstanding equity interests of Invoice2go. The closing of the merger is subject to customary closing conditions including (i) the approval of the Merger Agreement by Invoice2go stockholders in accordance with Delaware law and (ii) the expiration or termination of the applicable waiting period under the Hart-Scott Rodino Antitrust Improvements Act of 1976, as amended.

3

Table of Contents

Our Solution

Our cloud-based, intelligent platform automates the SMB back office and enables our customers to pay their suppliers and collect payments from their clients, in effect acting as a system of control for their accounts payable and accounts receivable activities. As a result, our platform frees our customers from cumbersome legacy financial processes and provides the following key benefits:

What Sets Us Apart

Our Platform

Every business transaction has two sides: for accounts payable, a customer and a supplier; and for accounts receivable, a customer and a client. The same transaction can be viewed differently depending on the party; one company’s debit is another’s credit. We built our platform with that in mind, leveraging the fact that we can see both sides, easily connect both parties, and promote the rapid exchange of information. This builds stronger business relationships.

Our AI-enabled, cloud-based platform automates this entire transaction lifecycle and delivers our customer-facing products, including accounts payable, accounts receivable, and payments, along with myriad value-added services.

4

Table of Contents

Accounts Payable Automation

Our accounts payable automation service streamlines the entire legacy payables process, from the receipt of a bill, through the approvals workflow, to the payment, and synchronization with the accounting system. Here are some highlights of our service:

Accounts Receivable Automation

Our accounts receivable service builds upon our accounts payable functionality, automating the entire receivable process, from the creation of an invoice, to its delivery to the client, to funds collection and synchronization back to the accounting system. Here are some highlights of this service:

5

Table of Contents

Payment Services

Using our platform, accounts payable customers can disburse funds to suppliers through multiple payment methods. Accounts receivable customers collect funds quickly and efficiently using electronic funds transfers. Our suite of comprehensive payment services includes:

In addition, our platform offers these value-added services:

6

Table of Contents

Mobile Capabilities

Integrated, robust mobile functionality is a key requirement for business users as more daily back-office tasks migrate away from the office and the desktop. Our mobile-native app, available in both iOS and Android, is easy to adopt and use. Through our app, our customers can manage their transaction workflows, send an invoice, or make payments on-the-go.

Partner Integrations  

We provide our financial institution strategic partners a technology platform that enables a simple, white-label integration with their existing business banking services. We deliver single sign-on, multi-factor authentication, integrated provisioning and entitlement of new accounts, as well as integration with required compliance systems. Transactions are synchronized automatically between the financial institution’s platform and ours, keeping the customer’s view current and consistent.

In addition to our white-labeled solution, we support a broad range of partners and customers with our platform APIs. These APIs allow our partners to integrate our platform seamlessly into their solutions, create web or mobile apps that integrate with ours, or leverage our payments capabilities. Through our APIs, developers can:

Our Data Asset

The payment activity of our over 121,000 customers and approximately 3.2 million network members as of June 30, 2021, paired with millions of documents, bills, and invoices processed through our platform, provides us with a unique data asset. This asset has allowed us to enhance the machine learning algorithms that power our artificial intelligence capabilities. The data provides a view into customer transactions and operational status of various payment processes, which enables us to effectively manage risk exposure. Our system continues to learn with each invoice uploaded and each new member that joins our network. This virtuous cycle of learning powers a network effect that facilitates customer satisfaction, offers intelligent insights, improves trust and safety, and will fuel further growth.

7

Table of Contents

Our Network

Through our AI-enabled platform, our customers can easily connect with existing network members. The benefit of being in the network is simple: customers connect with others to pay and be paid electronically, freeing them of the need to solicit or share bank account and routing numbers with each trading partner individually. The process of adding bank account details to our platform is easy and secure. For example, when a supplier of an accounts payable customer receives an invitation to join our network, the supplier can accept and securely share their bank account details once with Bill.com. From that point onward, all payments to that supplier will be electronic.

Once in the network, other Bill.com customers can easily link to that same supplier without the supplier having to repeat this process again. This approach to connecting businesses for accounts payable and accounts receivable has allowed us to build a robust and growing business-to-business payments directory, which includes approximately 3.2 million network members as of June 30, 2021. We define network members as our customers plus their suppliers and clients, who pay and receive funds electronically via our platform.

These network effects promote greater adoption of our platform, higher levels of engagement, and increased value across our ecosystem. We believe this is the fundamental power of our network.

Payment and Risk Management Services

Our payments engine powers our payment services. Through dedicated connections with banks and payment processors, we issue checks, credit and debit cards, originate ACH files, and execute wire transfers. Our payments engine handles all aspects of payment file transfers, exception file handling, and required payment status reporting. We have redundancy such that if one of our payment providers is unable to process a file on a given day, we have the option to re-route the file to another provider, preventing any interruption in payment processing services.

Our operations dashboard provides a full view of the current status of all payment processes. Notifications, alerts, and exceptions are sent to our network operations center, payment operations, and customer support teams so we can proactively monitor transactions on behalf of our customers throughout the business day and during off-hours. The data provides a view into customer transactions and operational status of various payment processes, enabling us to effectively manage risk exposure.

Through our risk engine, we use both proprietary and third-party tools to assess, detect, and mitigate financial risk associated with the payment volume that we process. Throughout the transaction lifecycle, we monitor data, and payments to ensure that we are safeguarding our customers, their suppliers and clients, and our company. When a bank account is added to the platform, we validate that the bank account is held at a U.S.-domiciled financial institution, is associated with the organization adding the account, and is in good standing.

When customers use our services, we monitor key activities looking for signals that would indicate anomalies that could create risk exposure and need to be investigated. Our risk engine analyzes many unique data elements to score transactions. Those that score above our thresholds are routed to trained risk agents for manual review. Agents have the latitude to contact customers to gather further information, or if a financial risk is imminent, to prevent funds from leaving our system until any suspicious activity can be resolved.

Once a payment transaction is processed, we continue to manage our exposure. We have extensive contacts in the banking industry, and we utilize these to reverse payments when possible. If a suspicious or fraudulent payment cannot be reversed, we follow a rigorous collections process to recover funds.

This risk management process gets progressively more accurate and insightful as our dataset gets larger and our AI-enabled risk engine gets smarter. This is an advantage that we expect to continue to grow over time. Our success in managing the risk inherent in moving funds for business customers is proven. As a percentage of our TPV, our fraud loss rates were negligible, less than one basis point for each of fiscal 2021, 2020 and 2019.

8

Table of Contents

Security, Privacy, and Data Protection

Trust is important for our relationship with customers and partners, and we take significant measures designed to protect their privacy and the data that they provide to us. Keeping our customers’ data safe and secure is a high priority. Our approach to security includes data governance as well as ongoing testing for potential security issues.

We have robust access controls in our production environment with access to data strictly assigned, monitored, and audited. To ensure our controls remain up-to-date, we undergo continuous external testing for vulnerabilities within our software architecture. These efforts have enabled us to certify our platform to SOC1 Type II, SOC2 Type II, and SOC3 standards. Our security program is aligned to the NIST-800-53 standards and is regularly audited and assessed by third parties as well as our strategic partners.

The focus of our program is working to prevent unauthorized access to the data of our customers and network members. To this end, our team of security practitioners work to identify and mitigate risks, implement best practices, and continue to evaluate ways to improve.

These steps include close attention to network security, classifying and inventorying data, limiting and authorizing access controls, and multi- factor authentication for access to systems. We also employ regular system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructures.

We take steps to help ensure that our security measures are maintained by the third-party suppliers we use, including conducting annual security reviews and audits.

Competition

Our primary competition remains the legacy manual processes that SMBs have relied upon for decades. Other competitors range from large firms that predominantly focus on selling to enterprises, to smaller niche providers of point solutions that focus exclusively on document management, workflow management, accounts payable solutions, spend management, accounts receivable solutions, or electronic bill presentment and payment.

Divvy’s primary competition includes corporate card and spend management platforms, expense management software, legacy payment methods, such as credit and debit cards, including those provided by card issuing banks, and technology solutions provided by payment companies.

We differentiate ourselves from our competitors by offering a financial back-office solution that handles accounts payable, spend management, accounts receivable, and payment services end-to-end. Our extensive investment in building a robust, fully-integrated two-way sync with popular accounting software providers is well-regarded in the industry. With respect to the domestic payments that comprise the bulk of our business, we disburse and collect funds on behalf of our customers through our proprietary payments engine.

We believe that the key competitive factors in our market include:

9

Table of Contents

We compare favorably with our competitors on the basis of these factors. We expect the market for SMB back-office financial software and business-to-business payment solutions to continue to evolve and grow, as greater numbers of SMBs and larger businesses digitize their back offices. We believe that we are well-positioned to help them.

Research and Development

We invest substantial time, energy, and resources to ensure we have a deep understanding of our customers’ needs, and we continually innovate to deliver value-added products and services through our platform. Our research and development organization consists of engineering, product, and design teams. These teams are responsible for the design, development, and testing of our applications. We focus our efforts on developing new functionality and further enhancing the usability, reliability, and performance of existing applications.

Sales and Marketing

We distribute our platform through direct and indirect sales channels, both of which we leverage to reach our target customers in an efficient manner. Our direct sales are driven by a self-service process and an inside sales team. Our inside sales team augments our direct sales capabilities by targeting potential customers that have engaged with us on their own.

We also reach customers indirectly through our partnerships with accounting firms, financial institutions, and accounting software providers. While these partners sometimes require an initial integration investment, a go-to-market flywheel takes effect as our partners accelerate the delivery of our platform across their customer base with minimal incremental investment from us.

We focus our marketing efforts on generating leads to develop our sales pipeline, building brand and category awareness, enabling our go-to-market partners, and growing our business from within our existing customers. Our sales leads primarily come through word-of-mouth, our accounting firm partners, and website searches. We generate additional leads through digital marketing campaigns, referrals, in-product customer education, brand advertising, public relations, and social media.

Customer Success

SMBs have unique needs and customer support contact expectations. With more than a decade of experience supporting our product, our customer success team has a deep understanding of their needs and has developed our support model accordingly. We recognize and understand patterns that our customers may not, because we see the aggregate – millions of accounts payable and accounts receivable transactions per month. We use what we learn to continuously improve the platform and the customer experience. We have developed an efficient support model. For instance, we offer online chat support to respond to customers within seconds of their initial outreach. We also leverage our machine learning tools to anticipate customer issues and provide in-app, real-time suggestions and support.

We provide onboarding implementation support, as well as ongoing support and training. We periodically contact our customers to discuss their utilization of our platform, highlight additional features that may interest them, and identify any additional tools that may be needed.

Regulatory Environment

We operate in a rapidly evolving regulatory environment. Most states in the U.S. require a license to offer money transmission services such as the payment services that we offer. We have procured and maintained money transmitter licenses in 52 U.S. jurisdictions and actively work to comply with new license requirements as they arise. We are also registered as a Money Services Business with the U.S. Department of Treasury’s Financial Crimes Enforcement Network. These licenses and registrations subject us, among other things, to record-keeping requirements, reporting requirements, bonding requirements, limitations on the investment of customer funds, and inspection by state and federal regulatory agencies.

As a Money Services Business and a licensed money transmitter we are subject to U.S. anti-money laundering (AML) laws and regulations. We have implemented and are expanding an AML program designed to prevent our platform from being used to facilitate money laundering, terrorist financing, and other financial crimes. Our program is also

10

Table of Contents

designed to prevent our products from being used to facilitate business in certain countries, or with certain persons or entities, including those on designated lists promulgated by the U.S. Department of the Treasury’s Office of Foreign Assets Controls and other foreign authorities. Our AML and sanctions compliance programs include policies, procedures, reporting protocols, and internal controls, including the designation of an AML compliance officer to oversee the programs, and is designed to address these legal and regulatory requirements and to assist in managing risk associated with money laundering and terrorist financing risks.

We are contractually obligated to comply with Federal Deposit Insurance Corporation (FDIC) federal banking regulations as well as with Visa and MasterCard network rules as a card program manager for the card program management banks (CPMB). As a card program manager for the CPMBs, we implemented compliance programs designed to ensure we are in compliance with applicable banking regulations and the Visa and MasterCard network rules. The CPMBs oversee our compliance program and conduct periodic audits to ensure compliance with applicable regulations and rules.  

We maintain loan brokering or servicing licenses in a number of states in which Divvy’s activity requires such licenses, and actively work to comply with new license requirements as they may arise which are applicable to Divvy’s business.

We are also subject to the examination and enforcement authority of the FDIC under the Bank Service Company Act.

In addition, our services utilize ACH transfers and require compliance with National Automated Clearing House Association rules.

To support our expanding international business, we obtained a Foreign Money Services Business (FMSB) license in Canada that is administered by The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and a Money Services Business License administered by Quebec’s Autorite Des Marches Financiers (Financial Markets Authority). The Office of Superintendent of Financial Institutions (OSFI), which administers Canadian sanctions programs, oversees our compliance. As a FMSB and Quebec money services business licensee, we have implemented compliance programs with policies and procedures that are designed to comply with Canadian anti-money laundering and sanctions laws and regulations.

We collect and use a wide variety of information for various purposes in our business, including to help ensure the integrity of our services and to provide features and functionality to our customers. This aspect of our business, including the collection, use, disclosure, and protection of the information we acquire in connection with our customers’ use of our services, is subject to numerous laws and regulations in the U.S. Accordingly, we publish our privacy policies and terms of service, which describes our practices concerning the use, transmission, and disclosure of information.

In addition, several foreign countries and governmental bodies, including the European Union, have laws and regulations dealing with the collection, use, disclosure, and protection of information which are more restrictive than those in the U.S. While we believe that the products and services that we currently offer do not subject us to such laws or regulations in foreign jurisdictions, such laws and regulations may be modified or subject to new or different interpretations, new laws and regulations may be enacted, or we may modify our products or services in the future, which may subject us to such laws and regulations.

Various regulatory agencies in the U.S. and in foreign jurisdictions continue to examine a wide variety of issues which are applicable to us and may impact our business. These issues include identity theft, account management guidelines, privacy, disclosure rules, cybersecurity, and marketing. As our business continues to develop and expand, we continue to monitor the additional rules and regulations that may become relevant.

Any actual or perceived failure to comply with legal and regulatory requirements may result in, among other things, revocation of required licenses or registrations, loss of approved status, private litigation, regulatory or governmental investigations, administrative enforcement actions, sanctions, civil and criminal liability, and constraints on our ability to continue to operate. For an additional discussion on governmental regulation affecting our business, please see the risk factors related to regulation of our payments business and regulation in the areas of privacy and data use, under the section titled “Risk Factors – Risks Related to our Business and Industry.”

11

Table of Contents

Human Capital

Our Culture and Employees

We are a people-centric company and actively develop and nurture a positive relationship with our employees. Our culture centers on our company values:  

Our values are core to who we are and who we hire, guide how we operate, define how we treat each other every day and ultimately make our teams strong cohesive units. We believe our culture enables us to attract and retain exceptional talent.

As of June 30, 2021, we had a total of 1,384 employees across three offices in the U.S., which include our recently acquired Divvy organization. We also employ individuals on a temporary basis and use the services of contractors as necessary. None of our employees are represented by a labor union with respect to his or her employment. Our executive leadership consists of eight team members made up of two women and four persons of color.

We have recruiting and hiring practices that meet business hiring needs while maintaining a high bar for talent. We leverage data and analytics to align the recruiting function to business growth and revenue drivers.  Our recruiting function was built to quickly scale with increased growth and expansion.  Recruiting champions drive inclusive and equitable practices to engage, attract, and hire diverse talent. We provide two key talent management programs to develop our leaders and high potential employees to be their best. We also provide a rigorous program for new people managers. In addition, each year we provide a curriculum of study, linked to business needs, leveraging our LinkedIn Learning platform. The curriculum offers coursework in inclusivity, resiliency and decision-making. In addition, each employee has access to over 8,600 courses on our learning platform. We foster a performance and continuous feedback culture including a bi-annual formal feedback cadence in addition to engaging our employees regularly to hear and take action on their sentiment.

Employee recognition is core to who we are and we take great pride in recognizing those who embody our values, are top achievers, drive results and have longevity.  Our recognition platform provides for peer-to-peer recognition and allows anyone in the company to recognize others for a job well done. On a quarterly basis we recognize four to five employees who embody our Company values and we celebrate tenure and experience by acknowledging five and ten years of service to the Company. Lastly, each year the Top Bill award is given to one individual that exhibits all of our values consistently, drives and delivers business results and is a master of their craft.

Social Justice

At Bill.com, we are building a diverse workforce, promoting equity in our practices and creating inclusive employee communities that encourage employee growth. Our mission is to build a company where inclusivity, authenticity and action matter, that fosters an equitable approach to hiring, career development, compensation and growth, and continuously cultivates a sense of inclusion and social responsibility. Shortly after witnessing the racial injustices in the summer of 2020, we created a Social Justice Initiative which brought together employees from across the company to work on five workstreams: Recruiting and Hiring, Diversity and Inclusion, Volunteerism, Minority Owned SMB’s and Vendors. Our Senior Vice President of People, a black woman, is the executive sponsor of our Social Justice Initiative. More than 200 of our employees actively participate in events, employee resource groups, sponsorships and other activities in support of this initiative.  

12

Table of Contents

Total Rewards

We are committed to providing a fair and equitable compensation and benefits program that supports our diverse workforce. We provide competitive pay and benefits to attract and retain talent, including offering market-competitive base salary, bi-annual bonuses and sales commissions, and equity. We offer employees equity at the time of hire and through annual equity refresh grants, and provide an employee stock purchase plan, to foster a strong sense of ownership and engage our employees in our long-term success. We routinely run analyses to ensure compensation is fair, considering compensable factors that can impact pay, such as role, level, experience, location and performance. Our full-time employees are eligible to receive, subject to the satisfaction of certain eligibility requirements, our comprehensive benefits package, including our medical, dental and vision insurance and life and income protection plans. In addition, we provide uncapped time off, as well as maintain a tax-qualified 401(k) retirement plan that provides eligible employees with an opportunity to save for retirement on a tax-advantaged basis. In offering these benefit plans, our intent is to provide a level of benefits that are comparable to those offered by similar companies.

Employee Wellness/ COVID-19 Response

In response to the COVID-19 pandemic, we instituted several programs and precautionary measures in support of employee well-being and to protect the health and safety of our workforce, our customers and the communities in which we participate. In March 2020, we closed our corporate headquarters in California and our office in Texas, implemented full-time work from home for our entire workforce and eliminated non-essential travel. We regularly surveyed our team members through our employee survey tool to best understand their needs.  Based on survey results, we established no meetings Wednesday afternoons, instituted a remote work program, provided several wellness days, gave employees a home office stipend, provided additional mental health resources, and options for social connections and vaccination support. We continue to monitor federal, state and local regulatory pronouncements and COVID-19 infection statistics and have begun to reopen our offices in phases, depending on location. In connection with our office re-openings we have instituted numerous social distancing measures to ensure the safety of our employees. As of June 30, 2021, a significant number of our employees continued to work in a remote capacity.

Intellectual Property

We seek to protect our intellectual property rights by relying upon a combination of patent, trademark, copyright, and trade secret laws, as well as contractual measures.

As of June 30, 2021, in the U.S., we had fourteen issued patents that expire between 2028 and 2038, and ten pending patent applications. These patents and patent applications seek to protect proprietary inventions relevant to our business. While we believe our patents and patent applications in the aggregate are important to our competitive position, no single patent or patent application is material to us as a whole. We intend to pursue additional patent protection to the extent we believe it would be beneficial and cost effective.

As of June 30, 2021, in the U.S., we had three trademark registrations covering the “Bill.com” logo and two trademark registrations related to the “Divvy” name. We also have pending trademark applications for certain logos. We will pursue additional trademark registrations to the extent we believe it would be beneficial and cost effective. We also own several domain names, including www.bill.com and www.getdivvy.com.

We rely on trade secrets and confidential information to develop and maintain our competitive position. It is our practice to enter into confidentiality and invention assignment agreements (or similar agreements) with our employees, consultants, and contractors involved in the development of intellectual property on our behalf. We also enter into confidentiality agreements with other third parties in order to limit access to, and disclosure and use of, our confidential information and proprietary information. We further control the use of our proprietary technology and intellectual property through provisions in our terms of service.

From time to time we also incorporate certain intellectual property licensed from third parties, including under certain open source licenses. Even if any such third-party technology was not available to us on commercially reasonable terms, we believe that alternative technologies would be available as needed.

13

Table of Contents

Despite our efforts to protect our intellectual property rights, they may not be respected in the future or may be invalidated, circumvented, or challenged. In addition, the laws of various foreign countries where our products are produced may not protect our intellectual property rights to the same extent as laws in the U.S. Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation based on allegations of patent infringement or other violations of intellectual property rights. We believe that competitors will try to develop products that are similar to ours and that may infringe our intellectual property rights. Our competitors or other third-parties may also claim that our solutions infringe their intellectual property rights. In particular, some companies in our industry have extensive patent portfolios. From time to time, third parties have in the past and may in the future assert claims of infringement, misappropriation, and other violations of intellectual property rights against us or our customers or partners, with whom our agreements may obligate us to indemnify against these claims. Successful claims of infringement by a third party could prevent us from offering certain products or features, require us to develop alternate, non-infringing technology, which could require significant time and during which we could be unable to continue to offer our affected products, require us to obtain a license, which may not be available on reasonable terms or at all, or force us to pay substantial damages, royalties, or other fees. Moreover, our products incorporate software components licensed to the general public under open source software licenses. Open source licenses grant licensees broad permissions to use, copy, modify, and redistribute our platform. As a result, open source development and license practices can limit the value of our software copyright assets. For additional information about our intellectual property and associated risks, see the section titled “Risk Factors—Risks Related to our Business and Industry.”

Available Information

Our internet address is www.bill.com. We make available free of charge on our website our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

14

Table of Contents

Item 1A. Risk Factors

Investing in our common stock involves a high degree of risk. You should consider carefully the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” our consolidated financial statements and the accompanying notes included elsewhere in this Annual Report on Form 10-K before deciding whether to invest in shares of our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of or that we deem immaterial may also become important factors that adversely affect our business. If any of the following risks actually occur, our business, financial condition, operating results, and future prospects could be materially and adversely affected. In that event, the market price of our common stock could decline, and you could lose part or all of your investment.

Summary of Risk Factors

Some of the material risks that we face include:

15

Table of Contents

Risks Related to Our Business and Industry

We have a history of operating losses and may not achieve or sustain profitability in the future.

We were incorporated in 2006 and have mostly experienced net losses and negative cash flows from operations since inception. We generated net losses of $98.7 million, $31.1 million and $7.3 million for fiscal 2021, 2020 and 2019, respectively. Our net loss for fiscal 2021 includes the results of operations of Divvy from the date of acquisition on June 1, 2021. As of June 30, 2021, we had an accumulated deficit of $247.5 million. While we have experienced significant revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of subscription and transaction fee revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our platform, including introducing new products and functionality, and to expand our marketing programs and sales teams to drive new customer adoption, expand strategic partner integrations, and support international expansion. Our profitability each quarter is also impacted by the mix of our revenue generated from subscriptions and transaction fees, on the one hand, and interest earned on customer funds that we hold in trust, on the other. Any changes in this revenue mix will have the effect of increasing or decreasing our margins. We will also face increased compliance and security costs associated with growth, the expansion of our customer base, and being a public company. Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for several reasons, including the other risks described herein, and unforeseen expenses, difficulties, complications, delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.

Our recent rapid growth, including growth in our volume of payments, may not be indicative of our future growth, and if we continue to grow rapidly, we may not be able to manage our growth effectively. Our rapid growth also makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful.

Our revenue was $238.3 million, $157.6 million and $108.4 million for fiscal 2021, 2020 and 2019, respectively. Our revenue for fiscal 2021 includes the revenue of Divvy from the date of acquisition on June 1, 2021. Our TPV was $140.3 billion, $96.5 billion and $71.3 billion for fiscal 2021, 2020 and 2019, respectively. Although we have recently experienced significant growth in our revenue and payment volume, even if our revenue continues to increase, we expect our growth

16

Table of Contents

rate will decline in the future as a result of a variety of factors, including the increasing scale of our business. Overall growth of our revenue depends on a number of factors, including our ability to:

We may not successfully accomplish any of these objectives, which makes it difficult for us to forecast our future operating results. Further, the revenue that we derive from interest income on customer funds is dependent on interest rates, which we do not control. If the assumptions that we use to plan our business are incorrect or change in reaction to changes in our market, or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability. You should not rely on our revenue from any prior quarterly or annual periods as any indication of our future revenue or revenue or payment growth.

In addition, we expect to continue to expend substantial financial and other resources on:

These investments may not result in increased revenue growth in our business. If we are unable to increase our revenue at a rate sufficient to offset the expected increase in our costs, or if we encounter difficulties in managing a growing volume of payments, our business, financial position, and operating results will be harmed, and we may not be able to achieve or maintain profitability over the long term.

Our risk management efforts may not be effective to prevent fraudulent activities by our customers, spending businesses or their counterparties, which could expose us to material financial losses and liability and otherwise harm our business.

We offer software that digitizes and automates back-office financial operations for a large number of customers and executes payments to their vendors or from their clients. We are responsible for verifying the identity of our customers and

17

Table of Contents

their users, and monitoring transactions for fraud. We have been in the past and will continue to be targeted by parties who seek to commit acts of financial fraud using techniques such as stolen identities and bank accounts, compromised business email accounts, employee or insider fraud, account takeover, false applications, and check fraud. We may suffer losses from acts of financial fraud committed by our customers and their users, our employees or third-parties.

The techniques used to perpetrate fraud on our platform are continually evolving, and we expend considerable resources to continue to monitor and combat them. In addition, when we introduce new products and functionality, or expand existing products, we may not be able to identify all risks created by such new products or functionality. Our risk management policies, procedures, techniques, and processes may not be sufficient to identify all of the risks to which we are exposed, to enable us to prevent or mitigate the risks we have identified, or to identify additional risks to which we may become subject in the future. Our risk management policies, procedures, techniques, and processes may contain errors, or our employees or agents may commit mistakes or errors in judgment as a result of which we may suffer large financial losses. The software-driven and highly automated nature of our platform could enable criminals and those committing fraud to steal significant amounts of money from businesses like ours.

Our current business and anticipated domestic and international growth will continue to place significant demands on our risk management efforts, and we will need to continue developing and improving our existing risk management infrastructure, policies, procedures, techniques, and processes. As techniques used to perpetrate fraud on our platform evolve, we may need to modify our products or services to mitigate fraud risks. As our business grows and becomes more complex, we may be less able to forecast and carry appropriate reserves in our books for fraud related losses.

Further, these types of fraudulent activities on our platform can also expose us to civil and criminal liability and governmental and regulatory sanctions as well as potentially cause us to be in breach of our contractual obligations to our third-party partners.

We transfer large sums of customer funds daily, and are subject to the risk of errors, which could result in financial losses, damage to our reputation, or loss of trust in our brand, which would harm our business and financial results.

For fiscal 2021, over 121,000 customers processed approximately $140.3 billion in TPV on our platform. For the purposes of measuring our key business metrics, we define customers as entities that are either billed directly by us or for which we bill our strategic partners during a particular period. We have grown rapidly and seek to continue to grow, and although we maintain a robust and multi-faceted risk management process, our business is always subject to the risk of financial losses as a result of credit losses, operational errors, software defects, service disruption, employee misconduct, security breaches, or other similar actions or errors on our platform. As a provider of accounts payable, accounts receivable, and payment solutions, we collect and transfer funds on behalf of our customers. Software errors in our platform and operational errors by our employees may also expose us to losses.

Moreover, our trustworthiness and reputation are fundamental to our business. As a provider of cloud-based software for complex back-office financial operations, the occurrence of any credit losses, operational errors, software defects, service disruption, employee misconduct, security breaches, or other similar actions or errors on our platform could result in financial losses to our business and our customers, loss of trust, damage to our reputation, or termination of our agreements with strategic partners and accountants, each of which could result in:

Although our terms of service allocate to our customers the risk of loss resulting from our customers’ errors, omissions, employee fraud, or other fraudulent activity related to their systems, in some instances we may cover such losses for efficiency or to prevent damage to our reputation. Although we maintain insurance to cover losses resulting from our errors and omissions, there can be no assurance that our insurance will cover all losses or our coverage will be sufficient to cover our losses. If we suffer significant losses or reputational harm as a result, our business, operating results, and financial condition could be adversely affected.

18

Table of Contents

Customer funds that we hold in trust are subject to market, interest rate, foreign exchange, and liquidity risks, as well as general political and economic conditions. The loss of these funds could have a material adverse effect on our business, financial condition, and results of operations.

We invest funds that we hold in trust for our customers, including funds being remitted to suppliers, in highly liquid, investment-grade marketable securities, money market securities, and other cash equivalents. Nevertheless, our customer fund assets are subject to general market, interest rate, credit, foreign exchange, and liquidity risks. These risks may be exacerbated, individually or in the aggregate, during periods of heavy financial market volatility. In the event of a global financial crisis, such as that experienced in 2008 and such as that which may result from the COVID-19 or other pandemics, employment levels and interest rates may decrease with a corresponding impact on our business. As a result, we could be faced with a severe constriction of the availability of liquidity, which could impact our ability to fulfill our obligations to move customer money to its intended recipient. Additionally, we rely upon certain banking partners and third parties to originate payments, process checks, execute wire transfers, and issue virtual cards, which could be similarly affected by a liquidity shortage and further exacerbate our ability to operate our business. Any loss of or inability to access customer funds could have an adverse impact on our cash position and results of operations, could require us to obtain additional sources of liquidity, and could have a material adverse effect on our business, financial condition, and results of operations.

We are licensed as a money transmitter in all required U.S. states. In certain jurisdictions where we operate, we are required to hold eligible liquid assets, as defined by the relevant regulators in each jurisdiction, equal to at least 100% of the aggregate amount of all customer balances. Our ability to manage and accurately account for the assets underlying our customer funds and comply with applicable liquid asset requirements requires a high level of internal controls. As our business continues to grow and we expand our product offerings, we will need to scale our associated internal controls. Our success requires significant public confidence in our ability to properly manage our customers’ balances and handle large and growing transaction volumes and amounts of customer funds. Any failure to maintain the necessary controls or to accurately manage our customer funds and the assets underlying our customer funds in compliance with applicable regulatory requirements could result in reputational harm, lead customers to discontinue or reduce their use of our products, and result in significant penalties and fines, possibly including the loss of our state money transmitter licenses, which would materially harm our business.

We earn revenue from interest earned on customer funds held in trust while payments are clearing, which is subject to market conditions and may decrease as customers’ adoption of electronic payments and technology continues to evolve.

For fiscal 2021, 2020 and 2019, we generated $6.0 million, $21.2 million and $22.4 million, respectively, in revenue from interest earned on funds held in trust on behalf of customers while payment transactions are clearing, or approximately 3%, 13% and 21% of our total revenue for such periods, respectively. While these payments are clearing, we deposit the funds in highly liquid, investment-grade marketable securities, and generate revenue that is correlated to the federal funds rate. When interest rates decrease, the amount of revenue we generate from these investments decreases. Additionally, because we process electronic payments faster than checks, we hold customer funds for a shorter time and consequently, earn less revenue. If our customers transition from checks to electronic payments faster than we anticipate, or to new, faster payment rails like The Clearing House’s Real Time Payments Network, our revenue could decrease and our financial results could be adversely affected.

If we are unable to attract new customers or convert trial customers into paying customers, our revenue growth and operating results will be adversely affected.

To increase our revenue, we must continue to attract new customers and increase sales to those customers. As our market matures, product and service offerings evolve, and competitors introduce lower cost or differentiated products or services that are perceived to compete with our platform, our ability to sell subscriptions or successfully increase customer adoption of new payment products could be impaired. Similarly, our subscription sales could be adversely affected if customers or users perceive that features incorporated into alternative products reduce the need for our platform or if they prefer to purchase products that are bundled with solutions offered by other companies. Further, in an effort to attract new customers, we may offer simpler, lower-priced products or promotions, which may reduce our profitability.

We rely upon our marketing strategy of offering risk-free trials of our platform and other digital marketing strategies to generate sales opportunities. Many of our customers start a risk-free trial of our service. Converting these trial customers to paid customers often requires extensive follow-up and engagement. Many prospective customers never convert from the trial version of a product to a paid version of a product. Further, we often depend on the ability of individuals within an organization who initiate the trial versions of our products to convince decision makers within their

19

Table of Contents

organization to convert to a paid version. To the extent that these users do not become, or are unable to convince others to become, paying customers, we will not realize the intended benefits of this marketing strategy, and our ability to grow our revenue will be adversely affected. As a result of these and other factors, we may be unable to attract new customers, which would have an adverse effect on our business, revenue, gross margins, and operating results.

If we are unable to retain our current customers, sell additional functionality and services to them, or develop and launch new payment products, our revenue growth will be adversely affected.

To increase our revenue, in addition to acquiring new customers, we must continue to retain existing customers and convince them to expand their use of our platform by increasing the number of users and incenting them to pay for additional functionality. To date, a significant portion of our growth has been attributable to customer adoption of new payment products. Our ability to retain our customers and increase their usage could be impaired for a variety of reasons, including our inability to develop and launch new payment products, customer reaction to changes in the pricing of our products or the other risks described in this Annual Report on Form 10-K. As a result, we may be unable to retain existing customers or increase the usage of our platform by them, which would have an adverse effect on our business, revenue, gross margins, and other operating results, and accordingly, on the trading price of our common stock.

Our ability to sell new payment products or additional functionality to our existing customers may require more sophisticated and costly sales efforts, especially for our larger customers with more senior management and established procurement functions. Similarly, the rate at which our customers purchase additional products from us depends on several factors, including general economic conditions and the pricing of additional product functionality. If our efforts to sell additional functionality to our customers are not successful, our business and growth prospects would suffer.

While some of our contracts are non-cancelable annual subscription contracts, most of our contracts with customers and accounting firms primarily consist of open-ended arrangements that can be terminated by either party without penalty at any time. Our customers have no obligation to renew their subscriptions to our platform after the expiration of their subscription period. For us to maintain or improve our operating results, it is important that our customers continue to maintain their subscriptions on the same or more favorable terms. We cannot accurately predict renewal or expansion rates given the diversity of our customer base in terms of size, industry, and geography. Our renewal and expansion rates may decline or fluctuate as a result of several factors, including customer spending levels, customer satisfaction with our platform, decreases in the number of users, changes in the type and size of our customers, pricing changes, competitive conditions, the acquisition of our customers by other companies, and general economic conditions. If our customers do not renew their subscriptions, or if they reduce their usage of our platform, our revenue and other operating results will decline and our business will suffer. If our renewal or expansion rates fall significantly below the expectations of the public market, securities analysts, or investors, the trading price of our common stock would likely decline.

We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our operating results, our stock price and the value of your investment could decline.

Our operating results have fluctuated in the past and are expected to fluctuate in the future due to a variety of factors, many of which are outside of our control. As a result, our past results may not be indicative of our future performance. In addition to the other risks described herein, factors that may affect our operating results include the following:

20

Table of Contents

Any of these and other factors, or the cumulative effect of some of these factors, may cause our operating results to vary significantly. In addition, we expect to incur significant additional expenses due to the increased costs of operating as a public company. If our quarterly operating results fall below the expectations of investors and securities analysts who follow our stock, the price of our common stock could decline substantially, and we could face costly lawsuits, including securities class action suits.

We may not be successful in our efforts to promote Divvy corporate card usage through marketing and promotion and spending business rewards, which may materially impact our results of operations and financial condition.

The revenue growth of Divvy is dependent on increasing business spending on our cards. We have been investing in a number of growth initiatives, including to capture a greater share of spending businesses’ total spend, but there can be no assurance that such investments will be effective. In addition, if we develop new products or offerings that attract spending businesses looking for short-term incentives rather than displaying long-term loyalty, attrition and costs could increase. Expanding our service offerings, adding acquisition channels and forming new partnerships or renewing current partnerships could have higher costs than our current arrangements and could dilute our brand. In addition, we offer rewards to spending businesses based on their usage of spend management cards. Redemptions of rewards present significant associated redemption costs for our business. We operate in a highly competitive environment and may need to increase the rewards that we offer or provide other incentives to spending businesses in order to grow our business. Any significant change in, or failure by management to reasonably estimate, such costs could adversely affect or harm our business, operating results, and financial condition.

21

Table of Contents

Our business depends, in part, on our relationships with accounting firms.

Our relationships with our more than 5,400 accounting firm partners account for approximately 51% of our total customers as of June 30, 2021 and 46% of our total revenue for fiscal 2021. We market and sell our products and services through accounting firms. We also have a partnership with CPA.com to market our products and services to accounting firms, which then enroll their customers directly onto our platform. Although our relationships with accounting firms are independent of one another, if our reputation in the accounting industry more broadly were to suffer, or if we were unable to establish relationships with new accounting firms and grow our relationships with existing accounting firm partners, our growth prospects would weaken and our business, financial position, and operating results may be adversely affected.

Our business depends, in part, on our strategic partnerships with financial institutions.

To grow our business, we enter into relationships with our financial institution partners and partner with other banks and financial institutions. Sales to new strategic partner enterprises involve risks that may not be present or that are present to a lesser extent with sales to SMB organizations. With strategic partners, the decision to subscribe to our platform and then make our services available to their customers frequently requires the approval of multiple management personnel and more technical personnel than would be typical of a smaller organization. Purchases by strategic partners are also frequently subject to budget constraints and unplanned administrative, processing, and other delays, including considerable efforts to negotiate and document relationships with them. Even after we have successfully entered into agreements with our strategic partners, the deployment of our platform and its availability to our strategic partners’ customers may be subject to significant delays as a result of changes in the strategic partners’ business or to our strategic partners’ internal resource allocations or other priorities. We integrate our platform with our financial institution partners’ own websites and apps, which requires significant time and resources to design and deploy. Significant delays in the deployment of our platform to our strategic partners’ customers could cause us to incur significant expenditures for platform integration without generating corresponding revenue in the same period or at all, and could adversely impact our results of operations. If we are unable to increase sales of our platform to strategic partners or manage the costs associated with integrating with their systems, or the availability of our services to the strategic partners’ customers are delayed, our business, financial position, and operating results may be adversely affected.

We may not be able to attract new financial institution strategic partners if our potential partners favor our competitors’ products or services over our platform or choose to compete with our products directly. Further, many of our existing financial institution partners have greater resources than we do and could choose to develop their own solutions to replace ours. Moreover, certain financial institutions may elect to focus on other market segments and decide to terminate their SMB-focused services. For example, in late 2018, one of our former financial institution partners chose not to renew its relationship with us due to a change in business strategy. As a result, we lost approximately 5,000 customers. Although these customers did not represent a significant amount of revenue for our business, there can be no guarantee that other financial institution partners will not choose to terminate their relationships for strategic or other reasons. If we are unsuccessful in establishing, growing, or maintaining our relationships with strategic partners, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations may suffer.

Our business depends, in part, on our relationship with Intuit.

In addition to our relationship with financial institutions, we rely on our strategic relationship with Intuit Inc., a leading provider of financial, accounting, and tax preparation software, to further expand our business. Our platform is integrated into Intuit’s QuickBooks product, which millions of SMBs rely on for accounting services. Achieving this integration required extensive coordination and commitment of time and resources, and has led to thousands of additional customers for us. Our agreement with Intuit will terminate on June 26, 2023, unless earlier terminated in accordance with the agreement. The agreement enables us to continue supporting our platform within QuickBooks. In addition, we will be able to jointly market and promote our standalone offering, which includes advanced payment and workflow automation capabilities, to customers of Intuit’s QuickBooks Online Advanced product. If we are unable to increase adoption of our platform by Intuit’s customers, however, our growth prospects may be adversely affected. Additionally, if Intuit reconfigures its platform in a manner that no longer supports our integration with QuickBooks, we would lose customers and our business would be adversely affected. Intuit has integrated another third-party bill pay solution into its QuickBooks product.  Further, Intuit may seek to develop a solution of its own, acquire a solution to compete with ours, or decide to partner with other competing applications, any of which its SMB customers may select over ours, thereby harming our growth prospects and reputation and adversely affecting our results of operations.

22

Table of Contents

Our spend management business is dependent on our relationship with our issuing bank partners, Cross River Bank and WEX Bank.

The extensions of credit facilitated through our platform are originated through Cross River Bank and WEX Bank and we rely on these bank partners to comply with various federal, state and other laws. There has been significant recent U.S. Congressional and federal administrative agency lawmaking and rulings in the area of bank - non-bank partnership arrangements involving extensions of credit and the regulatory environment in this area remains unsettled. There has also been significant recent government enforcement action and litigation challenging the validity of such arrangements, including disputes seeking to recharacterize lending transactions on the basis that the non-bank party rather than the bank is the “true lender” or “de facto lender”, and in case law upholding the “valid when made” doctrine, which holds that federal preemption of state interest rate limitations are not applicable in the context of certain bank - non-bank partnership arrangements. If the legal structure underlying our relationship with our issuing bank partners were to be successfully challenged, we may be found to be in violation of state licensing requirements and state laws regulating interest rates. In addition, adverse orders or regulatory enforcement actions against our issuing banks, even if unrelated to our business, could impose restrictions on our issuing banks’ ability to continue to extend credit through our platform or on current terms.

Cross River Bank and WEX Bank are subject to oversight by the FDIC and state banking regulators and must comply with applicable rules and regulations and examination requirements. As a service provider to Cross River Bank and WEX Bank, we are subject to audit by these banks in accordance with FDIC guidance related to management of vendors and other bank specific requirements pursuant to the terms of our agreements with these banks. We are also subject to the examination and enforcement authority of the FDIC under the Bank Service Company Act. If we fail to comply with requirements applicable to us by law or contract, or if audits by our issuing banks were to conclude that our processes and procedures are insufficiently rigorous, we may be subject to fines or penalties or our issuing banks could terminate their relationships with us.

In the event of a challenge to the legal structure underlying our relationships with our issuing bank partners or if one or both of our issuing banks were to suspend, limit, or cease its operations, or were to otherwise terminate for any reason (including, but not limited to, the failure by an issuing bank to comply with regulatory actions), we would need to identify and implement alternative, compliant, bank relationships or otherwise modify our business practices in order to be compliant with prevailing law or regulation, which could result in business interruptions or delays, force us to incur additional expenses and potentially interfere with our existing customer and spending business relationships or make us less attractive to potential new customers and spending businesses, any of which could have a material adverse effect on our business.

We rely on a variety of funding sources to support Divvy’s business model. If our existing funding arrangements are not renewed or replaced, or if our existing funding sources are unwilling or unable to provide funding to us on terms acceptable to us, or at all, it could have a material adverse effect on our business, results of operations, financial condition, cash flows, and future prospects.

In order to support Divvy’s business model and the growth of Divvy’s business we must maintain a variety of funding arrangements, including warehouse facilities and purchase arrangements with financial institutions. In particular, we have financing arrangements in place pursuant to which we purchase from our issuing banks participation interests in the accounts receivables (Receivable) generated when Divvy spending businesses make purchases using our cards. We typically fund a substantial portion of these Receivable purchases by borrowing under credit facilities with our finance partners, although we may also fund Receivable purchases using corporate cash. Typically, we immediately sell a portion of the Receivables we have purchased to a warehousing subsidiary which funds the purchases through loans provided by our financing partners, and we may sell a portion of our receivables to a third-party institution pursuant to a purchase arrangement.  

If our finance partners terminate or interrupt their financing or purchase of our Receivables or are unable to offer terms which are acceptable to us, we may have to fund these purchases using corporate cash, which we have a limited ability to do and would place significant stress on our cash resources. An inability to purchase Receivables from our issuing banks, whether funded through financing or corporate cash, could result in the banks’ limiting extensions of credit to Divvy spending businesses or ceasing to extend credit for our cards altogether, which would interrupt or limit our ability to offer our card products and materially and adversely affect our business.

23

Table of Contents

We cannot guarantee that these funding arrangements will continue to be available on favorable terms or at all, and our funding strategy may change over time, depending on the availability of such funding arrangements. In addition, our funding sources may reassess their exposure to our industry and either curtail access to uncommitted financing capacity, fail to renew or extend facilities, or impose higher costs to access funding. In addition, there can be no assurances that we would be able to extend or replace our existing funding arrangements at maturity, on reasonable terms or at all.

If our existing funding arrangements are not renewed or replaced or our existing funding sources are unwilling or unable to provide funding to us on terms acceptable to us, or at all, we would need to secure additional sources of funding or reduce Divvy’s operations significantly. Further, as the volume of credit facilitated through our platform increases, we may need to expand the funding capacity under our existing funding arrangements or add new sources of capital. The availability and diversity of our funding arrangements depends on various factors and are subject to numerous risks, many of which are outside of our control. If we are unable to maintain access to, or to expand, our network and diversity of funding arrangements, our business, results of operations, financial condition, and future prospects could be materially and adversely affected.

Our Divvy card exposes us to credit risk and other risks related to Divvy spending businesses’ ability to pay the balances incurred on their cards. In addition, if collection efforts on overdue card balances are ineffective or unsuccessful, we may incur financial losses or lose the confidence of our funding sources.

We offer our Divvy card as a credit product to a wide range of businesses in the U.S., and the success of this product depends on our ability to effectively manage related risks. The credit decision-making process for our Divvy cards uses techniques designed to analyze the credit risk of specific businesses based on, among other factors, their past purchase and transaction history, as well as their credit scores. Similarly, proprietary risk models and other indicators are applied to assess current or prospective spending businesses who desire to use our cards to help predict their ability to repay. These risk models may not accurately predict creditworthiness due to inaccurate assumptions, including assumptions related to the particular spending business, market conditions, economic environment, or limited transaction history or other data, among other factors. The accuracy of these risk models and the ability to manage credit risk related to our cards may also be affected by legal or regulatory requirements, competitors’ actions, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

For a substantial majority of extensions of credit facilitated through our platform, we purchase from our issuing banks interests in the receivables generated when Divvy spending businesses make purchases using our cards and we bear the entire credit risk in the event that the spending businesses fail to pay card balances. Like other businesses with significant exposure to losses from credit, we face the risk that spending businesses will default on their payment obligations, creating the risk of potential charge-offs. The non-payment rate among Divvy spending businesses may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a business, worsening economic conditions, such as a recession or government austerity programs and high unemployment rates. Spending businesses who miss payments may fail to repay their outstanding statement balances, and spending businesses who file for protection under the bankruptcy laws generally do not repay their outstanding balances. Any such losses or failures of our risk models could harm our business, operating results, and financial condition. Non-performance, or even significant underperformance, of the receivables that we own could have an adverse effect on our business.

Additionally, our funding model relies on a variety of funding arrangements, including warehouse facilities and purchase arrangements, with a variety of funding sources. Any significant underperformance of the Receivables we own may adversely impact our relationship with such funding sources and result in an increase in our cost of financing, a modification or termination of our existing funding arrangements or our ability to procure funding, which would have a material adverse effect on our business, results of operations, financial condition, and future prospects.

24

Table of Contents

The pending acquisition of Invoice2go presents many risks, and we may not realize the strategic and financial goals that were contemplated at the time we entered into the Merger Agreement.

Risks we may face in connection with the pending acquisition and subsequent integration of Invoice2go include:

25

Table of Contents

The markets in which we participate are competitive, and if we do not compete effectively, our operating results could be harmed.

The market for financial back-office solutions is fragmented, competitive, and constantly evolving. Our competitors range from large entities that predominantly focus on enterprise resource planning solutions, to smaller niche suppliers of solutions that focus exclusively on document management, workflow management, accounts payable, accounts receivable, spend management, and/or electronic bill presentment and payment. With the introduction of new technologies and market entrants, we expect that the competitive environment will remain intense going forward. Our competitors that currently focus on enterprise solutions may offer products to SMBs that compete with ours. Accounting software providers, such as Intuit, as well as the financial institutions with which we partner, may internally develop products, acquire existing, third-party products, or may enter into partnerships or other strategic relationships that would enable them to expand their product offerings to compete with our platform or provide more comprehensive offerings than they individually had offered or achieve greater economies of scale than us. These software providers and financial institutions may have the operating flexibility to bundle competing solutions with other offerings, including offering them at a lower price or for no additional cost to customers as part of a larger sale. In addition, new entrants not currently considered to be competitors may enter the market through acquisitions, partnerships, or strategic relationships. As we look to market and sell our platform to potential customers, spending business or strategic partners with existing solutions, we must convince their internal stakeholders that our platform is superior to their current solutions.

We compete on several factors, including:

Our competitors vary in size, breadth, and scope of the products and services offered. Many of our competitors and potential competitors have greater name recognition, longer operating histories, more established customer relationships, larger marketing budgets, and greater resources than us. Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, and customer requirements. For example, an existing competitor or new entrant could introduce new technology that reduces demand for our platform.

In addition, the market for our products and services is competitive, and we expect the market to attract increased competition, which could make it difficult for us to succeed. We currently face competition for our offerings from a range of companies that continue to develop additional products and to become more sophisticated and effective. Many of our competitors have greater name recognition, longer operating histories and greater resources than we do. As a result, our competitors might be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements. Certain competitors have long-standing exclusive, or nearly exclusive, relationships with financial services provider partners to accept payment cards and other services that compete with what we offer. Competing services tied to established brands may engender greater confidence in the safety and efficacy of their services. If we are unable to differentiate ourselves from and successfully compete with our competitors, our business will be materially and adversely affected.

For these reasons, we may not be able to compete successfully against our current or future competitors, and this competition could result in the failure of our platform to continue to achieve or maintain market acceptance, any of which would harm our business, operating results, and financial condition.

26

Table of Contents

If we do not or cannot maintain the compatibility of our platform with popular accounting software solutions or offerings of our strategic partners, our revenue and growth prospects will decline.

To deliver a comprehensive solution, our platform integrates with popular accounting software providers including Intuit QuickBooks, Oracle NetSuite, Sage Intacct, and Microsoft Dynamics 365, through application program interfaces (APIs) made available by these software providers. We automatically synchronize customers, suppliers, clients, invoices, and payment transactions between our platform and these systems. This two-way sync eliminates duplicate data entry and provides the basis for managing cash-flow through an integrated solution for accounts payable, accounts receivable, and payments.

If any of the accounting software providers change the features of their APIs, discontinue their support of such APIs, restrict our access to their APIs, or alter the terms governing their use in a manner that is adverse to our business, we will not be able to provide synchronization capabilities, which could significantly diminish the value of our platform and harm our business, operating results, and financial condition.

The functionality and popularity of our platform depends, in part, on our ability to integrate our platform with the offerings of our strategic partners. Critically, our financial institution strategic partners must be able to integrate our platform into their existing offerings. These strategic partners periodically update and change their systems, and although we have been able to adapt our platform to their evolving needs in the past, there can be no guarantee that we will be able to do so in the future. In particular, if we are unable to adapt to the needs of our strategic partners’ platforms, our strategic partners may terminate their agreements with us and we may lose access to large numbers of customers as a result.

We depend upon several third-party service providers for processing our transactions. If any of our agreements with our processing providers are terminated, we could experience service interruptions.

We depend on banks, including JPMorgan Chase, and Silicon Valley Bank, to process ACH transactions and checks for our customers. We have entered into treasury services or similar agreements with these banks for payment processing and related services. Those agreements include significant security, compliance, and operational obligations. If we are not able to comply with those obligations or our agreements with the processing banks are terminated for any reason, we could experience service interruptions as well as delays and additional expenses in arranging new services.

Similarly, we have agreements with Cambridge. and Citibank’s WorldLink, under which these firms provide us with cross-border funds transfer capabilities. These arrangements have enabled us to offer our International Payments service, which we view as a significant growth opportunity for our business. Finally, we have an agreement with Comdata, under which Comdata acts as our program manager and issuer processor for our virtual card program.

In addition, we have agreements with WEX Bank, as issuing bank and payment processor for Divvy card transactions on the MasterCard network, and with Cross River Bank and Marqeta, as issuing bank and payment processor, respectively, for Divvy card transactions on the Visa network.

If any of our banking agreements related to ACH transactions or checks, or our agreements with Cambridge, Citibank’s WorldLink, Comdata, WEX Bank, Cross River Bank or Marqeta are terminated, we may experience business interruptions and delays, and be forced to incur additional expenses, potentially interfering with our existing customer and spending business relationships or making us less attractive to potential new customers and spending businesses.

Interruptions or delays in the services provided by AWS or other third-party data centers or internet service providers could impair the delivery of our platform and our business could suffer.

We host our platform using third-party cloud infrastructure services, including co-location facilities at Coresite, Equinix, Iron Mountain and Digital West. We also use public cloud hosting with Amazon Web Services (AWS). All of our products utilize resources operated by us through these providers. We therefore depend on our third-party cloud providers’ ability to protect their data centers against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, and similar events. Our operations depend on protecting the cloud infrastructure hosted by such providers by maintaining their respective configuration, architecture, and interconnection specifications, as well as the information stored in these virtual data centers and transmitted by third-party internet service providers. We have periodically experienced service disruptions in the past, and we cannot assure you that we will not experience interruptions or delays in our service in the future. We may also incur significant costs for using alternative

27

Table of Contents

equipment or taking other actions in preparation for, or in reaction to, events that damage the data storage services we use. Although we have disaster recovery plans that utilize multiple data storage locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion, computer viruses and disabling devices, natural disasters, military actions, terrorist attacks, negligence, and other similar events beyond our control could negatively affect our platform. Any prolonged service disruption affecting our platform for any of the foregoing reasons could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers, or otherwise harm our business. Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur. System failures or outages, including any potential disruptions due to significantly increased global demand on certain cloud-based systems during the COVID-19 pandemic, could compromise our ability to perform these functions in a timely manner, which could harm our ability to conduct business or delay our financial reporting. Such failures could adversely affect our operating results and financial condition.

Our platform is accessed by many customers, often at the same time. As we continue to expand the number of our customers and products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service. In addition, the failure of data centers, internet service providers, or other third-party service providers to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to grow our business and scale our operations. If our third-party infrastructure service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity, or damage to data centers, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services

Moreover, we are in the process of gradually migrating our systems from internal data centers and smaller vendors to AWS. AWS provides us with computing and storage capacity pursuant to an agreement that continues until terminated by either party. We have a limited history of operating on AWS. As we migrate our data from our servers to AWS’ servers, we may experience some duplication and incur additional costs. If our data migration is not successful, or if AWS unexpectedly terminates our agreement, we would be forced to incur additional expenses to locate an alternative provider and may experience outages or disruptions to our service. Any service disruption affecting our platform during such migration or while operating on the AWS cloud infrastructure could damage our reputation with current and potential customers, expose us to liability, cause us to lose customers, or otherwise harm our business.

Our business and operations have and may continue to be affected by the global outbreak of the COVID-19 pandemic.

Our business and operations have and may continue to be affected by the global outbreak of the COVID-19 pandemic. In response to the COVID-19 pandemic, governments, companies and other authorities have implemented restrictions or policies, such as travel restrictions, quarantines, shelter-in-place or stay-at-home orders, school closures, mandatory shut-downs, social-distancing and other operating requirements applicable to business establishments. These restrictions have forced many businesses in the U.S. and other jurisdictions, including certain of our strategic partners, vendors, accounting firm partners and customers, to reduce or suspend their operations, lay-off employees, and in some cases shut down operations. In certain cases, this has led us to take mitigating actions to ensure business continuity; for example, we added a second source for several vendor services necessary to enable our business in light of risks to our vendors’ business resulting from the pandemic.  Many of these measures continue to remain in place, and may continue to remain in place for a significant period of time. For so long as the COVID-19 pandemic persists and containment measures and related restrictions remain in place, these conditions will continue to have negative implications on business and consumer spending, the supply chain, production of goods and transportation, global capital markets and the global economy, and could result in a prolonged economic downturn. To the extent the pandemic continues to adversely impact the operations and business of our customers, it may have a material adverse impact on our customer growth, payment and transaction volumes, revenues and financial condition. The COVID-19 pandemic has caused us to impose restrictions on certain of our business practices (including limitations on employee travel and physical participation in meetings, events, and conferences). In addition, a significant portion of our employees are currently working remotely. This direct impact of the virus, and the disruption on our employees and operations, may negatively impact our productivity, our ability to meet customer demand and our revenue and profit margins. Additionally, the disruption and volatility in the global and domestic capital markets may increase the cost of capital and limit our ability to access capital. Moreover, due to the emergency interventions of the U.S. Federal Reserve to stabilize the U.S. economy, interest rates have fallen sharply, which has adversely impacted our revenue from interest earned on funds held from customers and, to the extent interest rates remain at historical lows, we will continue to experience this adverse impact in the future. The extent to which the pandemic continues to impact our business, results of operations, and financial condition will depend

28

Table of Contents

on developments that continue to be highly uncertain and difficult to predict, including, but not limited to, the duration and spread of the pandemic, its severity, the success of measures to contain the virus and treat its impact, the timing and efficacy of vaccinations, and how quickly and to what extent normal economic and operating conditions can resume. Even after the COVID-19 pandemic has subsided, we may experience material and adverse impacts to our business as a result of any resulting economic downturns, including bankruptcies or insolvencies of customers. To the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

We operate in an emerging and evolving market, which may develop more slowly or differently than we expect. If our market does not grow as we expect, or if we cannot expand our platform to meet the demands of this market, our revenue may decline or fail to grow, and we may incur additional operating losses.

Our primary competition remains the legacy manual processes that SMBs have relied on for generations. Our success will depend, to a substantial extent, on the widespread adoption of our cloud-based back-office solutions as an alternative to existing solutions or adoption by customers that are not using any such solutions at all. Some organizations may be reluctant or unwilling to use our platform for several reasons, including concerns about additional costs, uncertainty regarding the reliability and security of cloud-based offerings, or lack of awareness of the benefits of our platform. Our ability to expand sales of our platform depends on several factors, including prospective customers’ awareness of our platform, the timely completion, introduction, and market acceptance of enhancements to our platform or new products that we may introduce, the effectiveness of our marketing programs, the costs of our platform, and the success of our competitors. If we are unsuccessful in developing and marketing our platform, or if organizations do not perceive or value the benefits of our platform as an alternative to legacy systems, the market for our platform may not continue to develop or may develop more slowly than we expect, either of which would harm our growth prospects and operating results.

Payments and other financial services-related regulations and oversight are material to our business. Our failure to comply could materially harm our business.

The local, state, and federal laws, rules, regulations, licensing schemes, and industry standards that govern our business include, or may in the future include, those relating to banking, deposit-taking, cross-border and domestic money transmission, foreign exchange, payments services (such as money transmission, payment processing, and settlement services), anti-money laundering, combating terrorist financing, escheatment, international sanctions regimes, and compliance with the Payment Card Industry Data Security Standard, a set of requirements designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect spending business data. In addition, Divvy is required to maintain loan brokering or servicing licenses in a number of states in which it conducts business and is contractually obligated to comply with Federal Deposit Insurance Corporation (FDIC) federal banking regulations, as well as Visa and MasterCard network rules as a card program manager. These laws, rules, regulations, licensing schemes, and standards are enforced by multiple authorities and governing bodies in the U.S., including the Department of the Treasury, the FDIC, the SEC, self-regulatory organizations, and numerous state and local agencies. The regulations applicable to our activity in Canada are enforced by FINTRAC and Quebec’s Autorite Des Marches Financiers (Financial Markets Authority). As we expand into new jurisdictions, the number of foreign laws, rules, regulations, licensing schemes, and standards governing our business will expand as well. In addition, as our business and products continue to develop and expand, we may become subject to additional laws, rules, regulations, licensing schemes, and standards. We may not always be able to accurately predict the scope or applicability of certain laws, rules, regulations, licensing schemes, or standards to our business, particularly as we expand into new areas of operations, which could have a significant negative effect on our existing business and our ability to pursue future plans.

Our subsidiary, Bill.com, LLC, has obtained licenses or made registrations, as applicable, to operate as a money transmitter (or its equivalent) in the U.S., in the District of Columbia, the Commonwealth of Puerto Rico, and, to the best of our knowledge, in all the states where such licensure or registration is required for our business. As a licensed money transmitter, we are subject to obligations and restrictions with respect to the investment of customer funds, reporting requirements, bonding requirements, minimum capital requirements, and inspection by state regulatory agencies concerning various aspects of our business. Evaluation of our compliance efforts, as well as the questions of whether and to what extent our products and services are considered money transmission, are matters of regulatory interpretation and could change over time. In the past, regulators have identified violations and we have been subject to fines and other penalties by regulatory authorities due to their interpretations and applications to our business of their respective state money transmission laws. Regulators and third-party auditors have also identified gaps in our anti-money laundering program. In the future, as a result of the regulations applicable to our business, we could be subject to investigations and

29

Table of Contents

resulting liability, including governmental fines, restrictions on our business, or other sanctions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions, or be required to obtain additional licenses or regulatory approvals. There can be no assurance that we will be able to obtain or maintain any such licenses, and, even if we were able to do so, there could be substantial costs and potential product changes involved in maintaining such licenses, which could have a material and adverse effect on our business. In addition, there are substantial costs and potential product changes involved in maintaining and renewing such licenses, certifications, and approvals, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance, or other requirements of such licenses. These factors could impose substantial additional costs, involve considerable delay to the development or provision of our products or services, require significant and costly operational changes, or prevent us from providing our products or services in any given market.

Government agencies may impose new or additional rules on money transmission, including regulations that:

If we lose our founder or key members of our management team or are unable to attract and retain executives and employees we need to support our operations and growth, our business may be harmed.

Our success and future growth depend upon the continued services of our management team and other key employees. Our founder and Chief Executive Officer, René Lacerte, is critical to our overall management, as well as the continued development of our products, our strategic partnerships, our culture, our relationships with accounting firms, and our strategic direction. From time to time, there may be changes in our management team resulting from the hiring or departure of executives and key employees, which could disrupt our business. In addition, we may face challenges retaining senior management of acquired businesses. Our senior management and key employees are employed on an at-will basis. We currently do not have “key person” insurance for any of our employees. Certain of our key employees have been with us for a long period of time and have fully vested stock options or other long-term equity incentives that may become valuable and are publicly tradable now that we are a public company. The loss of our founder, or one or more of our senior management, key members of senior management of acquired companies or other key employees could harm our business, and we may not be able to find adequate replacements. We cannot ensure that we will be able to retain the services of any members of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart.

In addition, to execute our business strategy, we must attract and retain highly-qualified personnel. Competition for software developers, compliance and risk management personnel and other key employees in our industry and locations is intense and increasing. We compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software and payment systems, as well as for skilled legal and

30

Table of Contents

compliance and risk operations professionals. In addition, the current regulatory environment related to immigration is uncertain, including with respect to the availability of H1-B and other visas. If a new or revised visa program is implemented, it may impact our ability to recruit, hire, retain or effectively collaborate with qualified skilled personnel, including in the areas of artificial intelligence and machine learning, and payment systems and risk management, which could adversely impact our business, operating results and financial condition. Many of the companies with which we compete for experienced personnel have greater resources than we do and can frequently offer such personnel substantially greater compensation than we can offer. If we fail to identify, attract, develop and integrate new personnel, or fail to retain and motivate our current personnel, our growth prospects would be adversely affected.

Future acquisitions, strategic investments, partnerships, collaborations, or alliances could be difficult to identify and integrate, divert the attention of management, disrupt our business, dilute stockholder value, and adversely affect our operating results and financial condition.

We have in the past and may in the future seek to acquire or invest in businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities. However, we have limited experience in acquiring other businesses, and we may not successfully identify desirable acquisition targets. Moreover, an acquisition, investment, or business relationship may result in unforeseen operating difficulties and expenditures, including disrupting our ongoing operations, diverting management from their primary responsibilities, subjecting us to additional liabilities, increasing our expenses, and adversely impacting our business, financial condition, and operating results.

In addition, the technology and information security systems and infrastructure of businesses we acquire may be underdeveloped or subject to vulnerabilities, subjecting us to additional liabilities. We could incur significant costs related to the implementation of enhancements to information security systems and infrastructure of acquired businesses and related to the remediation of any related security breaches. If security, data protection and information security measures in place at businesses we acquire are inadequate or breached, or are subject to cybersecurity attacks, or if any of the foregoing is reported or perceived to have occurred, our reputation and business could be damaged and we could be subject to regulatory scrutiny, investigations, proceedings, and penalties. We may also acquire businesses whose operations may not be fully compliant with all applicable regulation, including governmental laws and requirements regarding economic and trade sanctions, anti-money laundering, and counter-terror financing and privacy law, subjecting us to potential liabilities and requiring us to spend considerable time, effort, and resources to become compliant.

Given the complexity of our platform and the deep and seamless integration that we offer to our accounting firm customers and strategic partners, it may be critical that certain businesses or technologies that we acquire be successfully and fully integrated into our platform. In addition, some acquisitions may require us to spend considerable time, effort, and resources to integrate employees from the acquired business into our teams, and acquisitions of companies in lines of business in which we lack expertise may require considerable management time, oversight, and research before we see the desired benefit of such acquisitions. Therefore, we may be exposed to unknown liabilities and the anticipated benefits of any acquisition, investment, or business relationship may not be realized, if, for example, we fail to successfully integrate such acquisitions, or the technologies associated with such acquisitions, into our company. The challenges and costs of integrating and achieving anticipated synergies and benefits of transactions, and the risk that the anticipated benefits of the proposed transaction may not be fully realized or take longer to realize than expected, may be compounded where we attempt to integrate multiple acquired businesses within similar timeframes, as would be the case if we close the proposed acquisition of Invoice2go and integrate some or part the business concurrent with integration efforts related to our recently-acquired Divvy business.

Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, as well as unfavorable accounting treatment and exposure to claims and disputes by third parties, including intellectual property claims. We also may not generate sufficient financial returns to offset the costs and expenses related to any acquisitions. In addition, if an acquired business fails to meet our expectations, our business, operating results, and financial condition may suffer.

If we fail to offer high-quality customer support, or if our support is more expensive than anticipated, our business and reputation could suffer.

Our customers rely on our customer support services, which we refer to as customer success, to resolve issues and realize the full benefits provided by our platform. High-quality support is also important for the renewal and expansion of our subscriptions with existing customers. We primarily provide customer support over chat and email, with limited phone-

31

Table of Contents

based support. If we do not help our customers quickly resolve issues and provide effective ongoing support, or if our support personnel or methods of providing support are insufficient to meet the needs of our customers, our ability to retain customers, increase adoption by our existing customers, and acquire new customers could suffer, and our reputation with existing or potential customers could be harmed. If we are not able to meet the customer support needs of our customers by chat and email during the hours that we currently provide support, we may need to increase our support coverage and provide additional phone-based support, which may reduce our profitability.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, and changing business needs, requirements, or preferences, our products may become less competitive.

The market for SMB financial back-office solutions is relatively new and subject to ongoing technological change, evolving industry standards, payment methods and changing regulations, and changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including launching new products and services. In addition, the market for our Divvy spend management solution and corporate cards is new and fragmented, and it is uncertain whether we will achieve and sustain high levels of demand and market adoption. The success of any new product and service, or any enhancements or modifications to existing products and services, depends on several factors, including the timely completion, introduction, and market acceptance of such products and services, enhancements, and modifications. If we are unable to enhance our platform, add new payment methods, or develop new products that keep pace with technological and regulatory change and achieve market acceptance, or if new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently, or more securely than our products, our business, operating results, and financial condition would be adversely affected. Furthermore, modifications to our existing platform or technology will increase our research and development expenses. Any failure of our services to operate effectively with existing or future network platforms and technologies could reduce the demand for our services, result in customer or spending business dissatisfaction and adversely affect our business.

If the prices we charge for our services are unacceptable to our customers, our operating results will be harmed.

We generate revenue by charging customers a fixed monthly rate per user for subscriptions as well as transaction fees. As the market for our platform matures, or as new or existing competitors introduce new products or services that compete with ours, we may experience pricing pressure and be unable to renew our agreements with existing customers or attract new customers at prices that are consistent with our pricing model and operating budget. Our pricing strategy for new products we introduce, including our virtual card and cross-border payment products, may prove to be unappealing to our customers, and our competitors could choose to bundle certain products and services competitive with ours. If this were to occur, it is possible that we would have to change our pricing strategies or reduce our prices, which could harm our revenue, gross profits, and operating results.

We typically provide service level commitments under our strategic partner agreements. If we fail to meet these contractual commitments, we could be obligated to provide credits or refunds for prepaid amounts related to unused subscription services or face contract terminations, which could adversely affect our revenue.

Our agreements with our strategic partners typically contain service level commitments on a monthly basis. If we are unable to meet the stated service level commitments or suffer extended periods of unavailability for our platform, we may be contractually obligated to provide these partners with service credits, up to 10% of the partner’s subscription fees for the month in which the service level was not met. In addition, we could face contract terminations, in which case we would be subject to refunds for prepaid amounts related to unused subscription services. Our revenue could be significantly affected if we suffer unexcused downtime under our agreements with our partners. Further, any extended service outages could adversely affect our reputation, revenue, and operating results.

We may not be able to scale our business quickly enough to meet our customers’ growing needs, and if we are not able to grow efficiently, our operating results could be harmed.

As usage of our platform grows and we sign additional strategic partners, we will need to devote additional resources to improving and maintaining our infrastructure and computer network and integrating with third-party applications to maintain the performance of our platform. In addition, we will need to appropriately scale our internal business systems and our services organization, including customer support, risk and compliance operations, and professional services, to serve our growing customer base.

32

Table of Contents

Any failure of or delay in these efforts could result in service interruptions, impaired system performance, and reduced customer satisfaction, resulting in decreased sales to new customers, lower subscription renewal rates by existing customers, the issuance of service credits, or requested refunds, all of which could hurt our revenue growth. If sustained or repeated, these performance issues could reduce the attractiveness of our platform to customers and could result in lost customer opportunities and lower renewal rates, any of which could hurt our revenue growth, customer loyalty, and our reputation. Even if we are successful in these efforts to scale our business, they will be expensive and complex, and require the dedication of significant management time and attention. We could also face inefficiencies or service disruptions as a result of our efforts to scale our internal infrastructure. We cannot be sure that the expansion and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could adversely affect our business, operating results, and financial condition.

Failure to effectively develop and expand our sales and marketing capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our platform will depend to a significant extent on our ability to expand our sales and marketing organizations, and to deploy our sales and marketing resources efficiently. Although we will adjust our sales and marketing spend levels as needed in response to changes in the economic environment, we plan to continue expanding our direct-to-SMB sales force as well as our sales force focused on identifying new strategic partners. We also dedicate significant resources to sales and marketing programs, including digital advertising through services such as Google AdWords. The effectiveness and cost of our online advertising has varied over time and may vary in the future due to competition for key search terms, changes in search engine use, and changes in the search algorithms used by major search engines. These efforts will require us to invest significant financial and other resources.

In addition, our ability to broaden the spending business base for our Divvy spend management offerings and achieve broader market acceptance of this platform will depend to a significant extent on the ability of our sales and marketing organizations to work together to drive our sales pipeline and cultivate spending business and partner relationships to drive revenue growth. If we are unable to recruit, hire, develop, and retain talented sales or marketing personnel, if our new sales or marketing personnel and partners are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective, our ability to broaden our spending business base and achieve broader market acceptance of our platform could be harmed. Moreover, our Divvy business relies on our reputation and recommendations from key spending businesses in order to promote our offering to potential spending businesses. Our marketing efforts depend significantly on our ability to call on our current spending businesses to provide positive references to new, potential spending business customers. Given our limited number of long-term spending businesses, the loss or dissatisfaction of any spending business could substantially harm our brand and reputation, inhibit the market adoption of our offering and impair our ability to attract new spending businesses and maintain existing spending businesses.

Our business and operating results will be harmed if our sales and marketing efforts do not generate significant increases in revenue. We may not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop, integrate, and retain talented and effective sales personnel, if our new and existing sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs and advertising are not effective.

We are subject to governmental regulation and other legal obligations, particularly those related to privacy, data protection, and information security, and our actual or perceived failure to comply with such obligations could harm our business, by resulting in litigation, fines, penalties, or adverse publicity and reputational damage that may negatively affect the value of our business and decrease the price of our common stock. Compliance with such laws could also result in additional costs and liabilities to us or inhibit sales of our products.

Our customers, their suppliers, and other users store personal and business information, financial information and other sensitive information on our platform. In addition, we receive, store, and process personal and business information and other data from and about actual and prospective customers and users, in addition to our employees and service providers. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (FTC), and various state, local, and foreign agencies. Our data handling also is subject to contractual obligations and industry standards.

33

Table of Contents

The U.S. federal and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use, and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising, and other communications with individuals and businesses. In the U.S., various laws and regulations apply to the collection, processing, disclosure, and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act, and state laws relating to privacy and data security. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of data. For example, in June 2018, California enacted the California Consumer Privacy Act (CCPA), which became operative on January 1, 2020 and broadly defines personal information, gives California residents expanded privacy rights and protections, and provides for civil penalties for violations and a private right of action for data breaches. Additionally, a new privacy law, the California Privacy Rights Act (CPRA), recently was approved by California voters in the November 2020 election. The CPRA will significantly modify the CCPA, and may create new obligations for us beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement commencing July 1, 2023. Many aspects of the CCPA, the CPRA, and their interpretation remain unclear, and their full impact on our business and operations remains uncertain. The laws and regulations relating to privacy, data protection, and information security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

In addition, several foreign countries and governmental bodies, including the European Union (EU), have laws and regulations dealing with the handling and processing of personal information obtained from their residents, which in certain cases are more restrictive than those in the U.S. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, and security of various types of data, including data that identifies or may be used to identify an individual, such as names, email addresses, and in some jurisdictions, Internet Protocol (IP) addresses. While we believe that the products and services that we currently offer do not subject us to such laws or regulations in foreign jurisdictions, such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future.

Within the EU, the General Data Protection Regulation (GDPR), significantly increases the level of sanctions for non-compliance from those in existing EU data protection law and imposes direct obligations on data processors in addition to data controllers. EU data protection authorities have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers, and data subjects. While we believe that the products and services that we currently offer do not subject us to the GDPR, the GDPR and other laws and regulations relating to privacy, data protection, and information security may be modified or subject to new or different interpretations or may be modified in the future, or modifications or enhancements that we make to our products may subject us to GDPR, or we otherwise may become, or have it asserted that we are, subject to the GDPR or other laws or regulations relating to privacy, data protection, or information security. If we are, or are asserted to be, subject to the GDPR, we may need to take steps to cause our processes to be compliant with applicable portions of the GDPR, but we cannot assure you that we will be able to implement changes in a timely manner or without significant disruption to our business, or that such steps will be effective, and we may face the risk of liability under the GDPR.

The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, as a result of the rapidly evolving regulatory framework for privacy issues worldwide. For example, laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users. As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures to preserve and protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, or unauthorized access. If our policies, procedures, or measures relating to privacy, data protection, information security, marketing, or customer communications fail to comply with laws, regulations, policies, legal obligations, or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties, and negative publicity, and could cause our application providers, customers, and partners to lose trust in us, and have an adverse effect on our business, operating results, and financial condition.

34

Table of Contents

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us. Because the interpretation and application of privacy, data protection and information security laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.

Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy, data protection, or information security, may result in governmental investigations and enforcement actions, litigation, fines and penalties, or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business. We expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, information security, marketing, and consumer communications, and we cannot determine the impact such future laws, regulations, and standards may have on our business. Future laws, regulations, standards, and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, or disclosure of data, or additional requirements for express or implied consent of our customers, partners, or end users for the use and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality.

If we are not able to comply with these laws or regulations, or if we become liable under these laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability. This may require us to expend substantial resources or to discontinue certain products, which would negatively affect our business, financial condition, and operating results. In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise adversely affect the growth of our business. Furthermore, any costs incurred as a result of this potential liability could harm our operating results.

We, our strategic partners, our customers, and others who use our services obtain and process a large amount of sensitive data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand, as well as have a material adverse effect on our business.

We, our strategic partners, our customers, and the third-party vendors and data centers that we use, obtain and process large amounts of sensitive data, including data related to our customers and their transactions, as well as other data of the counterparties to their payments. We face risks, including to our reputation as a trusted brand, in the handling and protection of this data, and these risks will increase as our business continues to expand to include new products and technologies.

Cybersecurity incidents and malicious internet-based activity continue to increase generally, and providers of cloud-based services have frequently been targeted by such attacks. These cybersecurity challenges, including threats to our own IT infrastructure or those of our customers or third-party providers, may take a variety of forms ranging from stolen bank accounts, business email compromise, customer employee fraud, account takeover, check fraud, or cybersecurity attacks, to “mega breaches” targeted against cloud-based services and other hosted software, which could be initiated by individual or groups of hackers or sophisticated cyber criminals. A cybersecurity incident or breach could result in disclosure of confidential information and intellectual property, or cause production downtimes and compromised data. We have in the past experienced cybersecurity incidents of limited scale. We may be unable to anticipate or prevent techniques used in the future to obtain unauthorized access or to sabotage systems because they change frequently and often are not detected until after an incident has occurred. As we increase our customer base and our brand becomes more widely known and recognized, third parties may increasingly seek to compromise our security controls or gain unauthorized access to our sensitive corporate information or our customers’ data.

We have administrative, technical, and physical security measures in place, and we have policies and procedures in place to contractually require service providers to whom we disclose data to implement and maintain reasonable privacy, data protection, and information security measures. However, if our privacy protection, data protection, or information security measures or those of the previously mentioned third parties are inadequate or are breached as a result of third-party action, employee or contractor error, malfeasance, malware, phishing, hacking attacks, system error, software bugs, or defects in our products, trickery, process failure, or otherwise, and, as a result, there is improper disclosure of, or someone obtains unauthorized access to or exfiltrates funds or sensitive information, including personally identifiable information, on our systems or our partners’ systems, or if we suffer a ransomware or advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred, our reputation and business could be damaged.

35

Table of Contents

Recent high-profile security breaches and related disclosures of sensitive data by large institutions suggest that the risk of such events is significant, even if privacy data protection, and information security measures are implemented and enforced. If sensitive information is lost or improperly disclosed or threatened to be disclosed, we could incur significant costs associated with remediation and the implementation of additional security measures, and may incur significant liability and financial loss, and be subject to regulatory scrutiny, investigations, proceedings, and penalties.

In addition, our financial institution strategic partners conduct regular audits of our cybersecurity program, and if any of them were to conclude that our systems and procedures are insufficiently rigorous, they could terminate their relationships with us, and our financial results and business could be adversely affected. Under our terms of service and our contracts with strategic partners, if there is a breach of payment information that we store, we could be liable to the partner for their losses and related expenses. Additionally, if our own confidential business information were improperly disclosed, our business could be materially and adversely affected. A core aspect of our business is the reliability and security of our platform. Any perceived or actual breach of security, regardless of how it occurs or the extent of the breach, could have a significant impact on our reputation as a trusted brand, cause us to lose existing partners or other customers, prevent us from obtaining new partners and other customers, require us to expend significant funds to remedy problems caused by breaches and implement measures to prevent further breaches, and expose us to legal risk and potential liability including those resulting from governmental or regulatory investigations, class action litigation, and costs associated with remediation, such as fraud monitoring and forensics. Any actual or perceived security breach at a company providing services to us or our customers could have similar effects. Further, as the current COVID-19 pandemic continues to result in a significant number of people working from home, these cybersecurity risks may be heightened by an increased attack surface across our business and those of our partners and service providers. We have heightened monitoring in the face of such risks, but cannot guarantee that our efforts, or the efforts of those upon whom we rely and partner with, will be successful in preventing any such information security incidents.

While we maintain cybersecurity insurance, our insurance may be insufficient or may not cover all liabilities incurred by such attacks. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

We currently handle cross-border payments and plan to expand our offering to new customers and to make payments to new countries, creating a variety of operational challenges.

A component of our growth strategy involves our cross-border payments product and, ultimately, expanding our operations internationally. Although we do not currently serve customers outside the U.S., starting in 2018 we introduced cross-border payments through our relationship with Cambridge, and now offer our U.S.-based customers the ability to disburse funds to over 130 countries with both Cambridge and Citibank’s WorldLink. We are continuing to adapt to and develop strategies to address payments to new countries. However, there is no guarantee that such efforts will have the desired effect.

Our cross-border payments product and international operations strategy involve a variety of risks, including:

36

Table of Contents

If we invest substantial time and resources to further expand our cross-border payments offering and are unable to do so successfully and in a timely manner, our business and operating results may suffer.

Our card payment products generate interchange revenues which exposes us to potential variability in income and other risks.

Our Divvy card product generates revenues primarily from interchange paid by the supplier accepting cards on a transactional basis, which involve a variety of risks, including:

In addition, a component of our growth strategy involves our virtual card payments products. In addition to our Divvy card offerings, through our relationship with Comdata we offer Bill.com customers the ability to pay their vendors with a virtual credit card. We generate revenues from virtual card payments primarily from interchange, which also subjects us to many of the risks described above. We are continuing to develop strategies to convert both check and ACH vendor payments to virtual card payments. There is no guarantee that such efforts will be successful.

We use open source software in our products, which could subject us to litigation or other actions.

We use open source software in our products. From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition, or require us to devote additional research and development resources to change our products. In addition, if we were to combine our proprietary software products with open source software in a certain manner under certain open source licenses, we could be required to release the source code of our proprietary software products. If we inappropriately use or incorporate open source software subject to certain types of open source licenses that challenge the proprietary nature of our products, we may be required to re-engineer such products, discontinue the sale of such products, or take other remedial actions.

If we fail to maintain and enhance our brands, our ability to expand our customer base will be impaired and our business, operating results, and financial condition may suffer.

We believe that maintaining and enhancing the Bill.com and Divvy brands are important to support the marketing and sale of our existing and future products to new customers and strategic partners and to expand sales of our platforms to new and existing customers and strategic partners. Our ability to protect our Bill.com brand is limited as a result of its descriptive nature. Successfully maintaining and enhancing our brands will depend largely on the effectiveness of our marketing and demand generation efforts, our ability to provide reliable products that continue to meet the needs of our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and products, and our ability to successfully differentiate our platform and products from competitive products and services. Our brand promotion activities may not generate customer awareness or yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand. If we fail to successfully promote and maintain our brands, our business could suffer.

If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights.

Our success is dependent, in part, upon protecting our proprietary technology. We rely on a combination of patents, copyrights, trademarks, service marks, trade secret laws, and contractual provisions to establish and protect our proprietary rights. However, the steps we take to protect our intellectual property may be inadequate. While we have been

37

Table of Contents

issued patents in the U.S. and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications. In addition, any patents issued in the future may not provide us with competitive advantages or may be successfully challenged by third parties. Any of our patents, trademarks, or other intellectual property rights may be challenged or circumvented by others or invalidated through administrative process or litigation. There can be no guarantee that others will not independently develop similar products, duplicate any of our products, or design around our patents. Furthermore, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and services that compete with ours.

No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our platform.

We have been in the past, and may in the future be, subject to intellectual property disputes, which are costly and may subject us to significant liability and increased costs of doing business.

We have been in the past and may in the future become subject to intellectual property disputes. Lawsuits are time-consuming and expensive to resolve and they divert management’s time and attention. Although we carry insurance, our insurance may not cover potential claims of this type or may not be adequate to indemnify us for all liability that may be imposed. We cannot predict the outcome of lawsuits and cannot assure you that the results of any such actions will not have an adverse effect on our business, operating results, or financial condition.

The software industry is characterized by the existence of many patents, copyrights, trademarks, trade secrets, and other intellectual and proprietary rights. Companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights. Our technologies may not be able to withstand any third-party claims against their use. In addition, many companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights and to defend claims that may be brought against them. Any litigation may also involve patent holding companies or other adverse patent owners that have no relevant product revenue, and therefore, our patents may provide little or no deterrence as we would not be able to assert them against such entities or individuals. If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop alternative technology for any infringing aspect of our business, we would be forced to limit or stop sales of our software or cease business activities related to such intellectual property. Any inability to license third-party technology in the future would have an adverse effect on our business or operating results and would adversely affect our ability to compete. We may also be contractually obligated to indemnify our customers in the event of infringement of a third party’s intellectual property rights. Responding to such claims, regardless of their merit, can be time consuming, costly to defend, and damaging to our reputation and brand.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement, data protection, and other losses.

Our agreements with strategic partners and some larger customers include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, data protection, damages caused by us to property or persons, or other liabilities relating to or arising from our platform or other contractual obligations. Some of these indemnity agreements provide for uncapped liability and some indemnity provisions survive termination or expiration of the applicable agreement. Large indemnity payments could harm our business, operating results, and financial condition. Although we normally limit our liability with respect to such obligations in our contracts with direct customers and with customers acquired through our accounting firm partners, we may still incur substantial liability, and we may be required to cease use of certain functions of our platform or products, as a result of IP-related claims. Any dispute with a customer with respect to these obligations could have adverse effects on our relationship with that customer and other existing or new customers, and harm our business and operating results. In addition, although we carry insurance, our insurance may not be adequate to indemnify us for all liability that may be imposed, or otherwise protect us from liabilities or damages with respect to claims alleging compromises of customer data, and any such coverage may not continue to be available to us on acceptable terms or at all.

Changes to payment card networks rules or fees could harm our business.

We are required to comply with Mastercard, American Express, and Visa payment card network operating rules in connection with Bill.com’s virtual card payments service and our subscription billing engine. We have agreed to reimburse our service providers for any fines they are assessed by payment card networks as a result of any rule violations by us.

38

Table of Contents

We may also be directly liable to the payment card networks for rule violations. The payment card networks set and interpret the card operating rules. The payment card networks could adopt new operating rules or interpret or reinterpret existing rules that we or our processors might find difficult or even impossible to follow, or costly to implement. We also may seek to introduce other card-related products in the future, which would entail additional operating rules. As a result of any violations of rules, new rules being implemented, or increased fees, we could lose our ability to make payments using cards, or such payments could become prohibitively expensive for us or for our customers. If we are unable to make customer payments to vendors using virtual cards, our business would be adversely affected. In addition, Divvy is contractually obligated to comply with MasterCard and Visa network rules as a card program manager. As a result of any violations of these rules or new rules being implemented, Divvy could lose its ability to act as a card program manager.

Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.

Our success and increased visibility may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business. We are subject to a wide variety of local, state, federal, and international laws, rules, regulations, licensing schemes, and industry standards in the U.S. and in other countries in which we operate. These laws, rules, regulations, licensing schemes, and standards govern numerous areas that are important to our business. In addition to the payments and financial services-related regulations, and the privacy, data protection, and information security-related laws described elsewhere, our business is also subject to, without limitation, rules and regulations applicable to: securities, labor and employment, immigration, competition, and marketing and communications practices. Laws, rules, regulations, licensing schemes, and standards applicable to our business are subject to change and evolving interpretations and application, including by means of legislative changes and/or executive orders, and it can be difficult to predict how they may be applied to our business and the way we conduct our operations, particularly as we introduce new products and services and expand into new jurisdictions. We may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and these changes may in turn impair our ability to offer our existing or planned features, products, and services and/or increase our cost of doing business.

Although we have a compliance program focused on the laws, rules, regulations, licensing schemes, and industry standards that we have assessed as applicable to our business and we are continually investing more in this program, there can be no assurance that our employees or contractors will not violate such laws, rules, regulations, licensing schemes, and industry standards. Any failure or perceived failure to comply with existing or new laws, rules, regulations, licensing schemes, industry standards, or orders of any governmental authority (including changes to or expansion of the interpretation of those laws, regulations, standards or orders), may:

The complexity of U.S. federal and state regulatory and enforcement regimes, coupled with the scope of our international operations and the evolving regulatory environment, could result in a single event giving rise to many overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

Any of the foregoing could, individually or in the aggregate, harm our reputation as a trusted provider, damage our brands and business, cause us to lose existing customers, prevent us from obtaining new customers, require us to expend significant funds to remedy problems caused by breaches and to avert further breaches, expose us to legal risk and potential liability, and adversely affect our results of operations and financial condition.

39

Table of Contents

We may require additional capital to support the growth of our business, and this capital might not be available on acceptable terms, if at all.

We have funded our operations since inception primarily through equity and debt financings, sales of subscriptions to our products, and usage-based transaction fees. We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business, which may require us to engage in equity or debt financings to secure additional funds. Additional financing may not be available on terms favorable to us, if at all. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, and financial condition. If we incur additional debt, the debt holders would have rights senior to holders of common stock to make claims on our assets, and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, including in connection with merger and acquisition transactions, stockholders will experience dilution. In addition, new equity securities could have rights senior to those of our common stock. The trading prices for our common stock and other technology companies have been highly volatile as a result of the COVID-19 pandemic and related governmental actions, which may reduce our ability to access capital on favorable terms or at all. In addition, a recession, depression or other sustained adverse market event resulting from the COVID-19 pandemic could materially and adversely affect our business and the value of our common stock. Because our decision to issue securities in the future will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities. As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our common stock and diluting their interests.

Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

As of June 30, 2021, we had net operating loss (NOL) carryforwards of approximately $867.6 million and $599.5 million for federal and state tax purposes, respectively, that are available to reduce future taxable income. If not utilized, the federal and state NOL carryforwards will begin to expire in 2027. As of June 30, 2021, approximately $761.9 million of the federal NOL carryforwards do not expire and will carry forward indefinitely until utilized. As of June 30, 2021, we had research and development tax credit carryforwards of approximately $23.6 million and $15.8 million for federal and state tax purposes, respectively. If not utilized, the federal tax credits will expire at various dates beginning in 2028. The state tax credits do not expire and will carry forward indefinitely until utilized. In general, under Sections 382 and 383 of the U.S. Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-change NOLs and other tax attributes such as research tax credits to offset future taxable income or income tax. If it is determined that we have in the past experienced an ownership change, or if we undergo one or more ownership changes as a result of future transactions in our stock, then our ability to utilize NOLs and other pre-change tax attributes could be limited by Sections 382 and 383 of the Code. Future changes in our stock ownership, many of which are outside of our control, could result in an ownership change under Sections 382 or 383 of the Code. Furthermore, our ability to utilize NOLs of companies that we may acquire in the future may be subject to limitations. For these reasons, we may not be able to utilize a material portion of the NOLs, even if we were to achieve profitability.

On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law. The CARES Act changes certain provisions of the 2017 Tax Cuts and Jobs Act (the 2017 Tax Act), which was enacted on December 22, 2017. The CARES Act did not have a material impact on our financial statements due to our historical losses and valuation allowance positions. Any future changes in tax laws could impact our ability to utilize NOLs in future years and may result in greater tax liabilities than we would otherwise incur and adversely affect our cash flows and financial position.

40

Table of Contents

We could be required to collect additional sales taxes or be subject to other tax liabilities that may increase the costs our customers would have to pay for our offering and adversely affect our operating results.

The vast majority of states have considered or adopted laws that impose tax collection obligations on out-of-state companies. States where we have nexus may require us to calculate, collect, and remit taxes on sales in their jurisdiction. Additionally, the Supreme Court of the U.S. recently ruled in South Dakota v. Wayfair, Inc. et al (Wayfair) that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s state. In response to Wayfair, or otherwise, states or local governments may enforce laws requiring us to calculate, collect, and remit taxes on sales in their jurisdictions. We may be obligated to collect and remit sales and use taxes in states where we have not collected and remitted sales and use taxes. A successful assertion by one or more states requiring us to collect taxes where we historically have not or presently do not do so could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest. The imposition by state governments or local governments of sales tax collection obligations on out-of-state sellers could also create additional administrative burdens for us, put us at a perceived competitive disadvantage if they do not impose similar obligations on our competitors, and decrease our future sales, which could adversely affect our business and operating results.

Changes in our effective tax rate or tax liability may adversely affect our operating results.

Our effective tax rate could increase due to several factors, including:

Any of these developments could adversely affect our operating results.

Natural catastrophic events, pandemics, and man-made problems such as power-disruptions, computer viruses, data security breaches, and terrorism may disrupt our business.

Natural disasters, pandemics such as COVID-19, or other catastrophic events may cause damage or disruption to our operations, international commerce and the global economy, and thus could harm our business. We have a large employee presence in the San Francisco Bay Area in California and in Draper, Utah and a smaller presence in Houston, Texas, and our data centers are located in California and Arizona. The west coast of the U.S. contains active earthquake zones and the Houston area frequently experiences significant hurricanes. In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, or terrorist attack, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security, and loss of critical data, all of which could harm our business, operating results, and financial condition.

Additionally, as computer malware, viruses, and computer hacking, fraudulent use attempts, and phishing attacks have become more prevalent, we, and third parties upon which we rely, face increased risk in maintaining the performance, reliability, security, and availability of our solutions and related services and technical infrastructure to the satisfaction of our customers. Any computer malware, viruses, computer hacking, fraudulent use attempts, phishing attacks, or other data security breaches related to our network infrastructure or information technology systems or to computer hardware we lease from third parties, could, among other things, harm our reputation and our ability to retain existing customers and attract new customers.

In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks, or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

41

Table of Contents

If we fail to develop and maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended (Exchange Act), the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, the listing requirements of the New York Stock Exchange (NYSE), and other applicable securities rules and regulations. Compliance with these rules and regulations will increase our legal and financial compliance costs, make some activities more difficult, time consuming, or costly, and increase demand on our systems and resources. The Exchange Act requires, among other things, that we file annual, quarterly, and current reports with respect to our business and operating results. The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. It may require significant resources and management oversight to maintain and, if necessary, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard. As a result, management’s attention may be diverted from other business concerns, which could adversely affect our business and operating results. Although we have already hired additional employees to comply with these requirements, we may need to hire more employees in the future or engage outside consultants, which would increase our costs and expenses.

We are required, pursuant to Section 404 of the Sarbanes-Oxley Act (Section 404), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting. Effective internal control over financial reporting is necessary for us to provide reliable financial reports and, together with adequate disclosure controls and procedures, are designed to prevent fraud. Any failure to implement required new or improved controls, or difficulties encountered in their implementation, could cause us to fail to meet our reporting obligations. Ineffective internal controls could also cause investors to lose confidence in our reported financial information, which could have a negative effect on the trading price of our common stock.

This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting, as well as a statement that our independent registered public accounting firm has issued an opinion on the effectiveness of our internal control over financial reporting. Because we are no longer an “emerging growth company” as of June 30, 2021, Section 404(b) of the Sarbanes-Oxley Act requires our independent registered public accounting firm to annually attest to the effectiveness of our internal control over financial reporting commencing with the fiscal year ended June 30, 2021, which has, and will continue to, require increased costs, expenses, and management resources. An independent assessment of the effectiveness of our internal controls could detect problems that our management’s assessment might not. Undetected material weaknesses in our internal controls could lead us to restate our financial statements, which could cause investors to lose confidence in our reported financial information, have a negative effect on the trading price of our common stock, and result in additional costs to remediate such material weaknesses. We will be required to disclose changes made in our internal control and procedures on a quarterly basis. To comply with the requirements of being a public company, we may need to undertake various actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff.

If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm issues an adverse opinion on the effectiveness of our internal control, including as a result of the material weakness described above, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline, and we may be subject to investigation or sanctions by the SEC. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NYSE.

We have identified a material weakness in our internal control over financial reporting, and if our remediation of such material weakness is not effective, or if we fail to develop and maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

In the course of preparing our financial statements for fiscal 2021, we identified a material weakness in our internal control over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. The material weakness identified pertains to the accounting for our business combination with Divvy, including a lack of sufficient precision in the performance of reviews of the analyses supporting the purchase price allocation accounting and other acquisition related entries and a lack of adequate documentation to provide evidence of design and operating effectiveness of select management review controls.

42

Table of Contents

To address our material weakness, we will re-evaluate the scope, level of precision and the personnel assigned for conducting the reviews over our analyses supporting the accounting for business combinations. We also plan to adopt policies on retaining documentation that supports the design and operating effectiveness of key management review controls relating to future business combinations. We will not be able to fully remediate this material weakness until these steps have been completed and have been operating effectively for a sufficient period of time. See Part II, Item 9A “Controls and Procedures” for additional information about this material weakness and our remediation efforts.

If we are unable to further implement and maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to record, process and report financial information accurately, and to prepare financial statements within required time periods could be adversely affected, which could subject us to litigation or investigations requiring management resources and payment of legal and other expenses, negatively affect investor confidence in our financial statements and adversely impact our stock price. If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by the stock exchange on which our securities are listed, the SEC or other regulatory authorities, which could require additional financial and management resources.

Furthermore, we cannot assure you that the measures we have taken to date, and actions we may take in the future, will be sufficient to remediate the control deficiencies that led to our material weaknesses in our internal control over financial reporting or that they will prevent or avoid potential future material weaknesses. Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business, such as our pending acquisition of Invoice2go. Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to implement and maintain effective internal control over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our common stock. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NYSE.

Our reported financial results may be adversely affected by changes in accounting principles generally accepted in the U.S.

U.S. generally accepted accounting principles (GAAP) is subject to interpretation by the Financial Accounting Standards Board (FASB), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our reported operating results and financial condition and could affect the reporting of transactions already completed before the announcement of a change.

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Operating Results—Critical Accounting Policies and Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant estimates and judgments involve the identification of performance obligations in revenue recognition, valuation of assets acquired and liabilities assumed in a business combination, estimation of fair value of a reporting unit when assessing goodwill impairment, determination of useful lives of finite-lived intangible assets, valuation of the 2025 Notes, present value estimation of operating lease liabilities, valuation of stock option grants, and the period of benefit for amortizing deferred commissions. Our operating results may be adversely

43

Table of Contents

affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

Any future litigation against us could be costly and time-consuming to defend.

In addition to intellectual property litigation, we have in the past and may in the future become subject to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes, employment claims made by our current or former employees, or claims for reimbursement following misappropriation of customer data. Litigation might result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, overall financial condition, and operating results. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our operating results and leading analysts or potential investors to reduce their expectations of our performance, which could reduce the trading price of our stock.

Our estimates of market opportunity and forecasts of market growth may prove to be inaccurate, and even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all.

Market opportunity estimates and growth forecasts, including those we have generated ourselves, are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable users or companies covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenue for us. Any expansion in the markets in which we operate depend on a number of factors, including the cost, performance, and perceived value associated with our platforms and those of our competitors. Even if the markets in which we compete meet the size estimates and growth forecasted, our business could fail to grow at similar rates, if at all. Our growth is subject to many factors, including our success in implementing our business strategy, which is subject to many risks and uncertainties. Accordingly, our forecasts of market growth should not be taken as indicative of our future growth.

We are subject to governmental laws and requirements regarding economic and trade sanctions, anti-money laundering, and counter-terror financing that could impair our ability to compete in international markets or subject us to criminal or civil liability if we violate them.

Although we currently only operate in the United States, in the future we will seek to expand internationally and will become subject to additional laws and regulations, and will need to implement new regulatory controls to comply with applicable laws. We are currently required to comply with U.S. economic and trade sanctions administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) and we have processes in place to comply with the OFAC regulations as well as similar requirements in other jurisdictions. As part of our compliance efforts, we scan our customers against OFAC and other watch lists. While we offer services only to customers domiciled in the United States, our application could be accessed from anywhere in the world. If our services are accessed from a sanctioned country in violation of the trade and economic sanctions, we could be subject to fines or other enforcement action. We are also subject to various anti-money laundering and counter-terrorist financing laws and regulations around the world that prohibit, among other things, our involvement in transferring the proceeds of criminal activities. In the United States, most of our services are subject to anti-money laundering laws and regulations, including the Bank Secrecy Act, as amended (BSA), and similar laws and regulations. The BSA, among other things, requires money transmitters to develop and implement risk-based anti-money laundering programs, to report large cash transactions and suspicious activity, and in some cases, to collect and maintain information about customers who use their services and maintain other transaction records. Regulators in the United States and globally continue to increase their scrutiny of compliance with these obligations, which may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our customers and to monitor transactions on our system, including payments to persons outside of the U.S. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or verify identities of customers, and any change in such thresholds could result in greater costs for compliance.

44

Table of Contents

We are subject to anti-corruption, anti-bribery, and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business.

We are subject to the FCPA, U.S. domestic bribery laws, and other anti-corruption laws. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly to generally prohibit companies, their employees, and their third-party intermediaries from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public sector. These laws also require that we keep accurate books and records and maintain internal controls and compliance procedures designed to prevent any such actions. Although we currently only maintain operations in the U.S., as we increase our international cross-border business and expand operations abroad, we may engage with business partners and third-party intermediaries to market our services and obtain necessary permits, licenses, and other regulatory approvals. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We cannot assure you that all of our employees and agents will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we increase our international business, our risks under these laws may increase.

Detecting, investigating, and resolving actual or alleged violations of anti-corruption laws can require a significant diversion of time, resources, and attention from senior management. In addition, noncompliance with anti-corruption or anti-bribery laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, enforcement actions, fines, damages, other civil or criminal penalties, injunctions, suspension or debarment from contracting with certain persons, reputational harm, adverse media coverage, and other collateral consequences. If any subpoenas are received or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal proceeding, our business, operating results, and financial condition could be materially harmed. In addition, responding to any action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees.

If we cannot maintain our company culture as we grow, our success and our business may be harmed.

We believe our culture has been a key contributor to our success to date and that the critical nature of the platform that we provide promotes a sense of greater purpose and fulfillment in our employees. Inorganic growth through mergers and acquisitions may pose significant challenges to assimilating the company cultures of acquired companies. Any failure to preserve our culture could negatively affect our ability to retain and recruit personnel, which is critical to our growth, and to effectively focus on and pursue our corporate objectives. As we grow and develop the infrastructure of a public company, we may find it difficult to maintain these important aspects of our culture. If we fail to maintain our company culture, our business and competitive position may be adversely affected.

Risks Related to the 2025 Notes

Our debt service obligations, including the 2025 Notes, may adversely affect our financial condition and results of operations.

As of June 30, 2021, we had $1.15 billion aggregate principal amount of the 2025 Notes outstanding due on December 1, 2025 as described in Note 10 to the consolidated financial statements included elsewhere in this Annual Report on Form 10-K. Our ability to make payments of the principal of, to pay interest on or to refinance our indebtedness, including the 2025 Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, any of our future debt agreements may contain restrictive covenants that may prohibit us from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.

45

Table of Contents

In addition, our indebtedness, combined with our other financial obligations and contractual commitments, could have other important consequences. For example, it could:

Any of these factors could harm our business, results of operations, and financial condition. In addition, if we incur additional indebtedness, the risks related to our business and our ability to service or repay our indebtedness would increase. We are also required to comply with the covenants set forth in the Indenture governing the 2025 Notes. Our ability to comply with these covenants may be affected by events beyond our control. If we breach any of the covenants and do not obtain a waiver from the note holders or lenders, then, subject to applicable cure periods, any outstanding indebtedness may be declared immediately due and payable. In addition, changes by any rating agency to our credit rating may negatively impact the value and liquidity of our securities. Downgrades in our credit ratings could restrict our ability to obtain additional financing in the future and could affect the terms of any such financing.

We may not have the ability to raise the funds necessary for cash settlement upon conversion of the 2025 Notes or to repurchase the 2025 Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the 2025 Notes or to repurchase the 2025 Notes.

Holders of the 2025 Notes have the right to require us to repurchase their notes upon the occurrence of a fundamental change (as defined in the Indenture) at a repurchase price equal to 100% of the principal amount of the 2025 Notes to be repurchased, plus accrued and unpaid special interest, if any. In addition, upon conversion of the 2025 Notes, unless we elect to deliver solely shares of our common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the 2025 Notes being converted. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the 2025 Notes surrendered therefor or 2025 Notes being converted. In addition, our ability to repurchase the 2025 Notes or to pay cash upon conversions of the 2025 Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

In addition to the 2025 Notes, we and our subsidiaries may incur substantial additional debt in the future, subject to the restrictions contained in our current and future debt instruments, some of which may be secured debt. We are not restricted under the terms of the Indenture from incurring additional debt, securing existing or future debt, recapitalizing our debt or taking a number of other actions that could have the effect of diminishing our ability to make payments on the 2025 Notes when due.

Our failure to repurchase the 2025 Notes at a time when the repurchase is required by the Indenture or to pay any cash payable on future conversions of the 2025 Notes as required by the Indenture would constitute a default under the Indenture. A default under the Indenture or the fundamental change itself could also lead to a default under agreements governing our existing or future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the 2025 Notes or make cash payments upon conversions thereof.

The conditional conversion feature of the notes, if triggered, may adversely affect our financial condition and operating results.

Prior to the close of business on the business day immediately preceding September 1, 2025, the holders of the 2025 Notes may elect to convert their notes during any calendar quarter (and only during such calendar quarter) if the last reported sale price of our common stock for at least 20 trading days (whether or not consecutive) during a period of 30 consecutive trading days ending on, and including, the last trading day of the immediately preceding calendar quarter is greater than or equal to 130% of the conversion price on each applicable trading day (the “Conversion Condition”). In the event the Conversion Condition is triggered, holders of the 2025 Notes will be entitled to convert the 2025 Notes at any

46

Table of Contents

time during specified periods at their option. If one or more holders elect to convert their 2025 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity. In addition, even if holders do not elect to convert their 2025 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2025 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The Capped Calls may affect the value of our 2025 Notes and our common stock.

In connection with the sale of the 2025 Notes, we entered into privately negotiated Capped Call transactions (Capped Calls) with certain financial institutions (option counterparties). The Capped Call transactions are expected generally to reduce the potential dilution upon conversion of the 2025 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2025 Notes, as the case may be, with such reduction and/or offset subject to a cap.

The option counterparties and/or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2025 Notes (and are likely to do so following any conversion, repurchase, or redemption of the 2025 Notes, to the extent we exercise the relevant election under the Capped Calls). This activity could also cause or avoid an increase or a decrease in the market price of our common stock or the 2025 Notes, which could affect note holders’ ability to convert the 2025 Notes and, to the extent the activity occurs during any observation period related to a conversion of the 2025 Notes, it could affect the number of shares and value of the consideration that note holders will receive upon conversion of the 2025 Notes.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the 2025 Notes or our common stock. In addition, we do not make any representation that the option counterparties will engage in these transactions or that these transactions, once commenced, will not be discontinued without notice.

We are subject to counterparty risk with respect to the Capped Calls.

The option counterparties are financial institutions, and we are subject to the risk that any or all of them might default under the Capped Calls. Our exposure to the credit risk of the option counterparties will not be secured by any collateral. Past global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions. If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at that time under the Capped Calls with such option counterparty. Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our common stock. In addition, upon a default by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock. We can provide no assurance as to the financial stability or viability of the option counterparties.

Risks Related to Ownership of Our Common Stock

The stock price of our common stock has been, and will likely continue to be volatile, and you may lose part or all of your investment.

The market for our common stock has been, and will likely continue to be, volatile. In addition to the factors discussed in this report, the market price of our common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including:

47

Table of Contents

In addition, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies. Stock prices of many companies, and technology companies in particular, have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and adversely affect our business.

Concentration of ownership of our common stock among our existing executive officers, directors, and principal stockholders may prevent new investors from influencing significant corporate decisions.

As of June 30, 2021, our executive officers, directors, and current beneficial owners of 5% or more of our common stock, in the aggregate, beneficially own approximately 40.6% of our outstanding common stock. These persons, acting together, may be able to significantly influence all matters requiring stockholder approval, including the election and removal of directors and any merger or other significant corporate transactions. The interests of this group of stockholders may not coincide with the interests of other stockholders.

48

Table of Contents

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management and affect the market price of our common stock.

Provisions in our restated certificate of incorporation and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management. Our restated certificate of incorporation and restated bylaws include provisions that:

In addition, our restated certificate of incorporation provides that the Court of Chancery of the State of Delaware, to the fullest extent permitted by law, will be the exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a breach of fiduciary duty, any action asserting a claim against us arising pursuant to the Delaware General Corporation Law (DGCL), our restated certificate of incorporation, or our restated bylaws, or any action asserting a claim against us that is governed by the internal affairs doctrine. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. This exclusive forum provision will not apply to claims that are vested in the exclusive jurisdiction of a court or forum other than the Court of Chancery of the State of Delaware, or for which the Court of Chancery of the State of Delaware does not have subject matter jurisdiction. For instance, the provision would not preclude the filing of claims brought to enforce any liability or duty created by the Exchange Act or Securities Act or the rules and regulations thereunder in federal court.

Moreover, Section 203 of the DGCL may discourage, delay, or prevent a change in control of our company. Section 203 imposes certain restrictions on mergers, business combinations, and other transactions between us and holders of 15% or more of our common stock.

We have incurred and will continue to incur increased costs as a result of operating as a public company, and our management is required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

As a public company, we will incur significant legal, accounting, and other expenses that we did not incur as a private company, which we expect to further increase. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the NYSE, and other applicable securities rules and regulations impose various requirements on public companies. Our management and other personnel devote a substantial amount of time to compliance with these requirements. Moreover, these rules and regulations will increase our legal and financial compliance costs and will make some activities more time-consuming and costly compared to when we were a private company.

49

Table of Contents

Our management team has limited experience managing a public company.

Our management team has limited experience managing a publicly traded company, interacting with public company investors and securities analysts, and complying with the increasingly complex laws pertaining to public companies. These new obligations and constituents require significant attention from our management team and could divert their attention away from the day-to-day management of our business, which could harm our business, operating results, and financial condition.

We do not intend to pay dividends for the foreseeable future.

We have never declared or paid any cash dividends on our capital stock, and we do not intend to pay any cash dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

If securities or industry analysts do not publish research or publish unfavorable or inaccurate research about our business, our stock price and trading volume could decline.

Our stock price and trading volume is heavily influenced by the way analysts and investors interpret our financial information and other disclosures. If securities or industry analysts do not publish research or reports about our business, downgrade our common stock, or publish negative reports about our business, our stock price would likely decline. If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our common stock could decrease, which might cause our stock price to decline and could decrease the trading volume of our common stock.

Sales of substantial amounts of our common stock in the public markets, particularly sales by our directors, executive officers, and significant stockholders, or the perception that these sales could occur, could cause the market price of our common stock to decline and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.

The market price of our common stock could decline as a result of sales of a large number of shares of our common stock in the market. The perception that these sales might occur may also cause the market price of our common stock to decline. We had a total of 94,503,565 shares of our common stock outstanding as of June 30, 2021. All shares of our common stock are freely tradable, generally without restrictions or further registration under the Securities Act, subject to certain exceptions for shares held by our “affiliates” as defined in Rule 144 under the Securities Act and certain shares that are subject to lock-up agreements in connection with our recent acquisitions. 

In addition, there were 7,727,585 shares of common stock issuable upon the exercise of options outstanding and vesting of RSUs as of June 30, 2021. We have registered all of the shares of common stock issuable upon exercise of outstanding options or settlement of RSUs or other equity incentives we may grant in the future on a registration statement on Form S-8 for public resale under the Securities Act. The shares of common stock will become eligible for sale in the public market to the extent such options are exercised or such RSUs are settled, subject to compliance with applicable securities laws.

Moreover, certain holders of our common stock have rights, subject to some conditions, to require us to file registration statements covering the sale of their shares or to include their shares in registration statements that we may file for ourselves or other stockholders.

In addition, we have in the past, and may in the future, issue our shares of common stock or securities convertible into our common stock from time to time in connection with financings, acquisitions, investments, or otherwise. We also expect to grant additional equity awards to employees and directors under our 2019 Equity Incentive Plan and rights to purchase our common stock under our 2019 Employee Stock Purchase Plan. Any such issuances could result in substantial dilution to our existing stockholders and cause the trading price of our common stock to decline.

50

Table of Contents

Item 1B. Unresolved Staff Comments

None.

Item 2. Properties

We lease our office facilities, which consisted of the following as of June 30, 2021:

We believe that our office facilities are adequate to meet our needs for the immediate future, and that, should it be needed, suitable additional space will be available to accommodate any such expansion of our operations.

Item 3. Legal Proceedings

From time to time, we may be subject to legal proceedings and claims in the ordinary course of business, including patent, commercial, product liability, employment, class action, whistleblower, and other litigation and claims, as well as governmental and other regulatory investigations and proceedings. In addition, third parties may from time to time assert claims against us in the form of letters and other communications. We are not currently a party to any legal proceedings that we believe to be material to our business or financial condition.

The results of any future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources, and other factors.

Item 4. Mine Safety Disclosures

Not applicable.

51

Table of Contents

PART II

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Market Information

Our common stock began trading on The New York Stock Exchange under the symbol “BILL” on December 12, 2019. Prior to that date, there was no public trading market for our common stock.

Holders of Record

As of June 30, 2021, there were 163 holders of record of our common stock. This number does not include beneficial owners whose shares are held by nominees in street name.

Dividend Policy

We have not declared or paid any dividends, or authorized or made any distribution upon or with respect to any class or series of our capital stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends on our capital stock in the foreseeable future. Any future determination to declare dividends will be made at the discretion of our board of directors, subject to applicable laws, and will depend on our financial condition, operating results, capital requirements, general business conditions and other factors that our board of directors may deem relevant.

Stock Performance Graph

The following performance graph and related information shall not be deemed “soliciting material” or to be “filed” with the SEC for purposes of Section 18 of the Exchange Act, nor shall such information be incorporated by reference into any future filing under the Securities Act or the Exchange Act, whether made before or after the date hereof and irrespective of any general incorporation language in any such filing, or otherwise subject to the liabilities under the Securities Act or Exchange Act, except to the extent that we specifically incorporate it by reference into such filing.

52

Table of Contents

The following graph depicts the total cumulative stockholder return on our common stock from December 12, 2019, the first day of trading of our common stock on The New York Stock Exchange, through June 30, 2021, relative to the performance of the S&P 500 Index and S&P 500 IT Index. The graph assumes an initial investment of $100.00 at the close of trading on December 12, 2019 and that all dividends paid by companies included in these indices have been reinvested. The performance shown in the graph below is not intended to forecast or be indicative of future stock price performance.

Recent Sales of Unregistered Equity Securities

On June 1, 2021, we issued a total of 10,767,140 shares of our unregistered common stock to stockholders of Divvy in connection with the Acquisition.  The issuance and sale of the securities were exempt from registration under the Securities Act of 1933, as amended (the “Act”) pursuant to Section 4(a)(2) of the Act and Rule 506 of Regulation D promulgated thereunder.

Issuer Purchases of Equity Securities

None.

Item 6. RESERVED

This item is no longer required as we have elected to early adopt the changes to Item 301 of Regulation S-K contained in SEC Release No. 33-10890.

53

Table of Contents

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion and analysis of our financial condition and results of operations together with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. Some of the information contained in this Annual Report on Form 10-K includes forward-looking statements that involve risks and uncertainties. You should read the sections titled “Special Note Regarding Forward-Looking Statements” and “Risk Factors” for a discussion of important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis.

Overview

We are a leading provider of cloud-based software that simplifies, digitizes, and automates complex back-office financial operations for SMBs. By transforming how SMBs manage their cash inflows and outflows, we create efficiencies and free our customers to run their businesses.  Our vision is to become the leading one-stop solution that helps millions of businesses around the world manage their financial operations.

Our purpose-built, artificial-intelligence (AI)-enabled financial software platform creates seamless connections between our customers, their suppliers, and their clients. Customers use our platform to generate and process invoices, streamline approvals, make and receive payments, reconcile their books, and manage their cash. We have built sophisticated integrations with popular accounting software solutions, banks, card issuers, and payment processors, enabling our customers to access these mission-critical services through a single connection. In essence, we sit at the center of an SMB’s accounts payable and accounts receivable operations.

We efficiently reach SMBs through our proven direct and indirect go-to-market strategies. We acquire customers directly through digital marketing and inside sales, and indirectly through accounting firms and strategic partnerships. As of June 30, 2021, our partners included some of the most trusted brands in the financial services business, including 85 of the top 100 accounting firms and six of the top ten largest financial institutions in the U.S., including Bank of America, JPMorgan Chase, Wells Fargo Bank and American Express. As we add customers and partners, we expect our network to continue to grow organically.

On June 1, 2021, we completed our acquisition of DivvyPay, Inc. (Divvy), a leading provider of cloud-based spend management application and smart corporate cards to SMBs in the U.S. for an aggregate purchase price of $2.3 billion. Following the acquisition, Divvy became our wholly owned subsidiary. Our consolidated results of operations shown below for fiscal 2021 include the operating results of Divvy from the acquisition date on June 1, 2021. See Note 3 to our consolidated financial statements included elsewhere in this Annual Report on Form 10-K for additional discussion about the acquisition of Divvy.

We have grown rapidly and scaled our business operations in recent periods. Our total revenue and net losses during fiscal 2021, which include the results of Divvy from the acquisition date, were $238.3 million and $98.7 million, respectively. Our total revenue during fiscal 2020 and 2019 was $157.6 million and $108.4, respectively, and our net losses during fiscal 2020 and 2019 were $31.1 million and $7.3 million, respectively.

Proposed Acquisition of Invoice2go

On July 19, 2021, we entered into an Agreement and Plan of Merger (Merger Agreement) with Invoice2go, Inc. (Invoice2go), a Delaware corporation that provides mobile-first accounts receivable software that empowers SMBs and freelancers to grow their client base, manage invoicing and payments, and build their brand. Invoice2go has operations in the U.S. and in Australia, and serves a large global customer base of SMBs. Pursuant to the terms of, and subject to the conditions set forth in the Merger Agreement, including customary purchase price adjustments, we will pay aggregate consideration of approximately $625.0 million in cash and stock in exchange for all of the outstanding equity interests of Invoice2go. Upon the consummation of the transactions contemplated by the Merger Agreement, Invoice2go will become our wholly owned subsidiary. The closing of the merger is subject to customary closing conditions such as (i) the approval of the Merger Agreement by Invoice2go stockholders in accordance with Delaware law and (ii) the expiration or termination of the applicable waiting period under the Hart-Scott Rodino Antitrust Improvements Act of 1976, as amended.

Impact of COVID-19

The full impact of the COVID-19 pandemic is inherently uncertain at the time of this report. The COVID-19 pandemic has resulted in travel restrictions and in some cases, prohibitions of non-essential activities, disruption and shutdown of

54

Table of Contents

businesses, and greater uncertainty in global financial markets. As the COVID-19 pandemic persists, it has significantly impacted the health and economic environment around the world. Many public and commercial establishments, including schools, restaurants, and shopping malls, have restricted their operations or closed due to restrictions imposed by the government. Our customers have been, and may continue to be, negatively impacted by the shelter-in-place and other similar state and local orders, the closure of manufacturing sites and country borders, and the increase in unemployment. These conditions may continue to have negative implications on demand for goods, the supply chain, production of goods, and transportation. A negative impact on our customers may cause them to go out of business, request discounts, extension of payment terms, or cancellation of their subscription to our platform. Any of these actions may have a negative impact on our future results of operations, liquidity, and financial condition.

Our business continues to operate despite the disruption of many business operations in the U.S. due to the COVID-19 pandemic. Although we have not experienced significant business disruptions thus far from the COVID-19 pandemic and there have been positive developments recently in the U.S. and in other countries in combating the COVID-19 pandemic because of vaccinations, we are unable to predict the full impact that the COVID-19 pandemic will have on our future results of operations, liquidity and financial condition due to numerous uncertainties, including the duration of the pandemic, the actions that may be taken by government authorities across the U.S. or other countries, the efficacy of vaccinations, the impact to our customers, strategic partners, and suppliers, and other factors described in the section titled “Risk Factors” in Part I, Item 1A of this Annual Report on Form 10-K.

Our Revenue Model

We generate revenue by charging subscription and transaction fees, and by earning interest on funds held in trust on behalf of customers while their payment transactions are clearing.

Our subscription revenue is primarily based on a fixed monthly or annual rate per user charged to our customers. Our transaction revenue is comprised of transaction fees and interchange income on a fixed or variable rate per transaction. Transactions primarily include card payments, check issuance, ACH origination, cross-border payments, and creation of invoices. Much of our revenue comes from repeat transactions, which are an important contributor to our recurring revenue.

We also generate revenue from interest earned on funds held in trust on behalf of customers while payment transactions are clearing. When we process payment transactions, the funds flow through our bank accounts and we have a balance of funds held for customers that is a function of the volume and the type of payments processed. Interest is earned from interest-bearing deposit accounts, certificates of deposit, money market funds, commercial paper, and U.S. Treasury securities. We hold these funds from the day they are withdrawn from a payer’s account to the day the funds are credited to the receiver. This revenue can fluctuate depending on the amount of customer funds held, as well as our yield on customer funds invested, which is influenced by market interest rates and our investments. We are authorized to hold customer funds and process payments through our bank accounts because we are a licensed money transmitter in all required U.S. states. This allows us to provide advanced treasury services and protect our customers from potential fraud.

Our Receivables Purchases and Servicing Model

We market Divvy charge cards to potential spending businesses and issue business-purpose charge cards through our partnerships with card issuing banks. When a business applies for a Divvy card, we utilize proprietary risk management capabilities to confirm the identity of the business, and perform a credit underwriting process to determine if the business is eligible for a Divvy card pursuant to our credit policies. Once approved for a Divvy card, the business is provided a credit limit and can use the Divvy software to request virtual cards or physical cards.

The majority of cards issued through our platform are by Cross River Bank, an FDIC-insured New Jersey state chartered bank and WEX Bank, an FDIC-insured Utah state chartered bank. Our partnerships with these banks allow us to benefit from the banks’ ability to issue cards under their membership with the Visa and Mastercard networks while leveraging their banking licenses to comply with various federal, state, and other laws. Under this arrangement, we must comply with the banks’ credit policies and underwriting procedures, and the banks maintain ultimate authority to decide whether to issue a card or approve a transaction. We are responsible for all fraud and unauthorized use of a card and generally are required to hold the bank harmless from such losses unless claims regarding fraud or unauthorized use are due to the sole gross negligence of the bank.

55

Table of Contents

When a spending business completes a purchase transaction, the payment to the merchant is made by our bank partner that issued the card. Obligations incurred by the spending business in connection with their purchase transaction are reflected as receivables on the bank’s balance sheet. The bank then sells a 100% participation interest in the receivable to us. Pursuant to our agreements with the banks, we are obligated to purchase the participation interests in all of the receivables originated through our platform, and our obligation are secured by cash deposits. When we purchase the participation right in the receivable, the purchase price is equal to the outstanding principal balance of the receivable

We act as the servicer on all receivables we purchase from our issuing bank partners and earn a servicing fee on loans we sell to our funding sources. We do not sell the servicing rights on any of the loans, allowing us to control the consumer experience end-to-end.

In order to purchase the participation rights in the receivables, we maintain a variety of funding arrangements, including warehouse facilities and purchase arrangements with a diverse set of funding sources. We typically fund a substantial portion of these receivable purchases by borrowing under credit facilities with our finance partners, although we may also fund receivables purchases using corporate cash. Typically, we immediately sell a portion of the receivables interests we have purchased to our warehousing subsidiary which funds the purchases through loans provided by our financing partners, and we may sell a portion of our receivables to a third-party institution pursuant to a purchase arrangement. As of June 30, 2021, we had $155.0 million in committed credit facility capacity, with $77.5 million drawn, and this is shown on our consolidated balance sheets included elsewhere in this Annual Report on Form 10-K. On average, our spending businesses pay their statement balances in approximately 20 days. We act as the servicer on all receivables we purchase from our issuing bank partners and earn a servicing fee and retain a beneficial interest derivative in the form of a deferred purchase price on loans we sell to our funding sources.

Our Business Model

We efficiently reach SMBs through our proven direct and indirect go-to-market strategies. We acquire customers directly through digital marketing and inside sales. We also acquire customers indirectly by partnering with leading companies that are trusted by our current and prospective customers, including accounting firms, financial institutions, and software companies.

Our revenue is visible and predictable from our existing customers. For fiscal 2021, over 85% of our subscription and transaction revenue, which we also refer to as core revenue, came from customers who were acquired prior to the start of the fiscal year. We expand within our existing customer base by adding more users, increasing transactions per customer, launching additional products, and through pricing and packaging our services. We make it easy for SMBs to try our platform through our risk-free trial program. Should an SMB choose to become a customer after the trial period, it can take several months to adapt their financial operations to fully leverage our platform. Even with a transition period, however, we believe our customer retention is strong. Excluding those customers of our financial institution partners, approximately 85% of customers as of June 30, 2020 were still customers as of June 30, 2021.

Net Dollar-Based Retention Rate

Net dollar-based retention rate is an important indicator of customer satisfaction and usage of our platform, as well as potential revenue for future periods. We calculate our net dollar-based retention rate at the end of each fiscal year. We calculate our net dollar-based retention rate by starting with the revenue billed to customers in the last quarter of the prior fiscal year (Prior Period Revenue). We then calculate the revenue billed to these same customers in the last quarter of the current fiscal year (Current Period Revenue), excluding interest earned on customer funds held in trust. Current Period Revenue includes any upsells and is net of contraction or attrition, but excludes revenue from new customers and excludes interest earned on customer funds held in trust. We then repeat the calculation of Prior Period Revenue and Current Period Revenue with respect to each of the preceding three quarters, and aggregate the four Prior Period Revenues (the Aggregate Prior Period Revenue) and the four Current Period Revenues (the Aggregate Current Period Revenue). Our net dollar-based retention rate equals the Aggregate Current Period Revenue divided by Aggregate Prior Period Revenue.

Our net dollar-based retention rate was 124%, 121% and 110% during fiscal 2021, 2020 and 2019, respectively. These consecutive increases are primarily attributable to increases in the number of users, more transactions per customer, and selling additional products to those customers.

56

Table of Contents

Customer Acquisition Efficiency

Our efficient direct and indirect go-to-market strategy, combined with our recurring revenue model, results in our short payback period. We define “payback period” as the number of quarters it takes for the cumulative non-GAAP gross profit we earn from customers acquired during a given quarter to exceed our total sales and marketing spend in that same quarter. For customers acquired during fiscal 2020, the average payback period was approximately five quarters.

Key Business Metrics

We regularly review several metrics, including the metrics presented in the table below, to measure our performance, identify trends affecting our business, prepare financial projections, and make strategic decisions. We believe that these key business metrics provide meaningful supplemental information for management and investors in assessing our historical and future operating performance. The calculation of the key metrics and other measures discussed below may differ from other similarly-titled metrics used by other companies, securities analysts or investors.

Number of Customers

For the purposes of measuring our key business metrics, we define customers as entities that are either billed directly by us or for which we bill our strategic partners during a particular period. Customers who are using our services during a trial period are not counted as new customers during that period. If an organization has multiple entities billed separately for the use of our platform, each entity is counted as a customer. The number of customers in the table above represents the total number of customers at the end of each fiscal year.

Total Payment Volume

To grow revenue from customers we must deliver a product experience that helps them automate their back-office financial operations. The more they use the product and rely upon our features to automate their operations, the more transactions they process on our platform. This metric provides an important indication of the value of transactions that customers are completing on the platform and is an indicator of our ability to generate revenue from our customers. We define TPV as the value of customer transactions that we process on our platform during a particular period. Our calculation of TPV includes payments that are subsequently reversed. Such payments comprised approximately 1% of TPV during fiscal 2021. TPV does not include transactions made by spending businesses on our spend management platform.

57

Table of Contents

Transactions Processed

We define transactions processed as the number of customer payment and spend transactions initiated and processed through our platform during a particular period. Payment transactions include checks, ACH items, wire transfers and card payments. Transactions processed do not include transactions made by spending businesses on our spend management platform.

Components of Results of Operations

Revenue

We generate revenue from two sources: (1) subscription and transaction fees, and (2) interest on funds held for customers.

Subscription fees are fixed monthly or annually and charged to our customers for the use of our platform to process transactions. Subscription fees are generally charged on a per user per period basis, normally monthly or annually. Transaction fees are fees collected for each transaction processed through our platform, on either a fixed or variable fee basis. Transaction fees primarily include processing of payments in the form of checks, ACH, cross-border payments, virtual cards, creation of invoices, and use of spend management application whereby we receive interchange income from merchants that accept Divvy cards.

Our contracts with SMB and accounting firm customers are generally either monthly or annual contracts. We determine the transaction price for these contracts by estimating the total consideration to be received over the contract term from subscription and transaction fees. We recognize the transaction price as a single performance obligation based on the proportion of transactions processed to the total estimated transactions to be processed over the contract period.

We enter into multi-year contracts with financial institutions which typically include fees for initial implementation services that are paid during the period the implementation services are provided as well as fees for subscription and transaction processing services, which are subject to guaranteed monthly minimum fees that are paid monthly over the contract term. These contracts enable the financial institutions to provide their customers with access to our online bill pay services through the financial institutions’ online platforms. Implementation services are required up-front to establish an infrastructure that allows the financial institutions’ online platforms to communicate with the Company’s online platform. A financial institution’s customers cannot access online bill pay services until implementation is complete. The fees we earn through these contracts vary based on the number of users and transactions to be processed. We have determined these contracts meet the variable consideration allocation exception and therefore we recognize the guaranteed monthly payments and any overages as revenue in the month they are earned. We recognize implementation fees based on the proportion of transactions processed to the total estimated transactions to be processed over the contract period.

Interest on funds held for customers consists of the interest that we earn from customer funds while payment transactions are clearing. Interest is earned from interest-bearing deposit accounts, certificates of deposit, money market funds, commercial paper, and U.S. Treasury securities, until those payments are cleared and credited to the intended recipient.

Cost of Revenue and Expenses

Cost of revenue – Cost of revenue consists primarily of personnel-related costs, including stock-based compensation expenses, for our customer success and payment operations teams, certain costs that are directly attributed to processing customers’ transactions (such as the cost of printing checks), postage for mailing checks, expenses for processing payments (ACH, check, and cross-border wires), direct and amortized costs for implementing and integrating our cloud-based platform into our strategic partners’ systems, costs for maintaining, optimizing, and securing our cloud payments infrastructure, amortization of capitalized internal-use developed software, amortization of developed technology, fees on the investment of customer funds, and allocation of overhead costs. We expect that cost of revenue will increase in absolute dollars, but may fluctuate as a percentage of total revenue from period to period, as we continue to invest in growing our business.

Research and development – Research and development expenses consist primarily of personnel-related expenses, including stock-based compensation expenses, incurred in developing new products or enhancing existing products, and allocated overhead costs. We capitalize certain software development costs that are attributable to developing new products and adding incremental functionality to our platform and amortize such costs in cost of revenue over the estimated life of the new product or incremental functionality, which is generally three years.

58

Table of Contents

We expense a substantial portion of research and development expenses as incurred. We believe that delivering new functionality is critical to attract new customers and expand our relationship with existing customers. We expect to continue to make investments in and expand our offerings to enhance our customers’ experience and satisfaction, and to attract new customers. We expect our research and development expenses to increase in absolute dollars, but they may fluctuate as a percentage of total revenue from period to period as we expand our research and development team to develop new products and product enhancements.

Sales and Marketing – Sales and marketing expenses consist primarily of personnel-related expenses, including stock-based compensation expenses, sales commissions, marketing program expenses, travel-related expenses and costs to market and promote our platform through advertisements, marketing events, partnership arrangements, direct customer acquisition, amortization of intangible assets, and allocated overhead costs. Sales commissions that are incremental to obtaining new customer contracts are deferred and amortized ratably over the estimated period of our relationship with new customers.

We focus our sales and marketing efforts on generating awareness of our company, platform, and products, creating sales leads, and establishing and promoting our brand. We plan to continue investing in sales and marketing efforts by driving our go-to-market strategies, building our brand awareness, and sponsoring additional marketing events; however, we will adjust our sales and marketing spend level as needed, as the spend may fluctuate from period to period, in response to changes in the economic environment.

General and Administrative – General and administrative expenses consist primarily of personnel-related expenses, including stock-based compensation expenses, for finance, risk management, legal and compliance, human resources and information technology, costs incurred for external professional services, provision for credit losses, losses from fraud, and allocated overhead costs. We expect to incur additional general and administrative expenses as we explore various growth initiatives, which include incurring higher professional services. We also expect to increase the size of our general and administrative functions to support the growth in our business. As a result, we expect that our general and administrative expenses will increase in absolute dollars but may fluctuate as a percentage of total revenue from period to period.

Other (expense) income, net – Other (expense) income, net consists primarily of the amortization of debt discount and issuance costs in connection with our issuance of the 2025 Notes, interest expense on our borrowings from credit agreements, loss on sale of card receivables, and loss on the revaluation of redeemable convertible preferred stock warrant liabilities, partially offset by interest income on corporate funds invested in money market instruments and highly liquid, investment-grade fixed income marketable securities, and accretion of debt premium.

(Benefit from) provision for income taxes – (Benefit from) provision for income taxes consists primarily of the income tax benefit from the change in deferred tax liability balance relating to the 2025 Notes and a partial release of valuation allowance in connection with the acquisition of Divvy.

59

Table of Contents

Results of Operations

The following table sets forth our results of operations for the periods presented (in thousands):