Risk Sleuth
TOST · 10-K filed 18 Feb 2026 · year to 31 Dec 2025

Toast

30 named things its latest annual report says its results depend on, each in the company's own words. 18 of them are also named by other companies we've read.

Customers

Small- and medium-sized restaurants (SMBs)

concentrated innamed as a risk
A majority of our customers are SMBs and we expect they will continue to comprise a large portion of our customer base for the foreseeable future.Risk factors (Item 1A)

Suppliers

Amazon Web Services (AWS)

depends onnamed as a risk
We primarily rely on Amazon Web Services to deliver our services to customers on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely affect our business, financial condition, and results of operations.Risk factors (Item 1A)

Also named by AAON, ABNB, ADSK, AIOT, BLK, CARR, CG, COF and 56 more

Third-party payment processors

depends onnamed as a risk
While we may continue to seek payment processing relationships with additional payment processors from time to time, we expect to continue to rely on a limited number of payment processors for the foreseeable future.Risk factors (Item 1A)

Also named by CART, COST, DKNG, EBAY, EXPE, GDDY, KR, RBLX

Single-source hardware components and contract manufacturer

depends onnamed as a risk
In addition, in some cases, we rely only on one hardware manufacturer to fabricate, test, and assemble our products.Risk factors (Item 1A)

Partners and platforms

Toast Capital bank partner (Utah-chartered FDIC-insured industrial bank)

depends on · 15% of the original principal amount of loans made in the applicable quarternamed as a risk
We do not currently have partnerships with other financial institutions for such loans and are reliant on our bank partner to support this program.Risk factors (Item 1A)

Visa

subject tonamed as a risk
Further, our contracts with third-party payment processors require, and additional contracts may in the future require, us to bear risk for compliance with the operating rules, or the Payment Network Rules, of Visa, Mastercard, and other payment networks, or collectively, the Payment Networks, with whom we are registered as a payment facilitator or certified service provider, and applicable law, and the risk of fraud.Risk factors (Item 1A)

Also named by AFRM, AXP, CASH, COF, EEFT, FIS, FISV, GPN and 6 more

Online food marketplace referral partners

depends onnamed as a risk
If any of our third-party partners, such as our partners in the online food marketplace that provide referrals, were to switch to providing marketing support for another payment processor, terminate their relationship with us, merge with or be acquired by one of our competitors, or shut down or become insolvent, we may no longer receive the benefits associated with that relationship, such as new customer referrals, and we also risk losing existing customers and the related payment processing that were originally referred to us by such third-party.Risk factors (Item 1A)

Places

United States

concentrated in · approximately 20% of the U.S. restaurant market
Despite our rapid growth and scale, we estimate that U.S. restaurant locations on our platform account for approximately 20% of the U.S. restaurant market.Business (Item 1)

Also named by ABBV, ADP, AJG, AMGN, APA, AXGN, AXP, BALL and 139 more

China

depends onnamed as a risk
Additionally, various sources of supply-chain risk, including strikes or shutdowns at delivery ports or loss of or damage to our products while they are in transit or storage, intellectual property theft, losses due to tampering, third-party vendor issues with quality or sourcing control, failure by our suppliers to comply with applicable laws and regulations, existing and potential tariffs and sanctions, including those applicable to our relationships with vendors in China, or other trade restrictions, or other similar problems could increase our cost of production, limit or delay the supply of our products, or harm our reputation.Risk factors (Item 1A)

Also named by A, AA, AAOI, AAP, AAPL, AB, ADI, AEHR and 261 more

Asia

depends onnamed as a risk
For example, we have several long-term contracts with companies based in Asia.Risk factors (Item 1A)

Also named by AAPL, AYI, CART, CB, CDW, CHD, CLS, COHR and 31 more

Commodities and inputs

Memory chips

exposed to its pricenamed as a risk
For example, the recent increase in demand for memory chips, driven by the rapid development of generative AI and large language models, could adversely affect our ability to source certain components for our hardware products, potentially leading to higher sourcing costs, increased delivery lead times, and production or delivery delays.Risk factors (Item 1A)

Also named by ANET, EXTR, FTNT, INTC

Interchange fees

exposed to its pricenamed as a risk
Changes in permissible interchange fee limits as a result of change in law or new legal developments may adversely affect our results of operations.Business (Item 1)

Also named by HRB, SYF

Regulators

Federal Trade Commission (FTC)

subject tonamed as a risk
The FTC has jurisdiction over us and our business practices.Business (Item 1)

Also named by AMZN, AN, AVGO, BJ, CART, CELH, CHD, CHE and 56 more

Federal Deposit Insurance Corporation (FDIC)

subject tonamed as a risk
As a service provider to financial institutions, such as banks, we are or may become subject to regulatory oversight and examination by the Federal Financial Institutions Examination Council, an interagency body, the Board of Governors of the Federal Reserve System, or the Federal Reserve, the Office of the Comptroller of the Currency, or the OCC, the FDIC, the Consumer Financial Protection Bureau, or CFPB, and various other federal and state regulatory authorities.Risk factors (Item 1A)

Also named by AFRM, BAC, BNY, CASH, CFG, CFR, COF, FCFS and 27 more

Financial Crimes Enforcement Network (FinCEN)

subject tonamed as a risk
Our subsidiary, Toast Processing Services LLC, or TPS, is registered as an MSB with FinCEN in its capacity as a money transmitter.Business (Item 1)

Also named by ABNB, ADP, AFRM, BMNR, COIN, CORZ, EEFT, FISV and 2 more

Laws and programs

EU General Data Protection Regulation (GDPR)

subject to · 4% of worldwide annual revenue or €20 millionnamed as a risk
For example, under the GDPR, noncompliance can result in penalties up to the greater of 4% of worldwide annual revenue or €20 million (£17.5 million in the UK) depending on the circumstances.Risk factors (Item 1A)

Also named by ACN, ADSK, AIG, ALK, AMG, ANET, APG, AXON and 61 more

State insurance laws

subject to · all 50 states plus Washington, D.C.named as a risk
Our subsidiary, Toast Insurance Services, Inc., has obtained certain insurance related licenses from all 50 states plus Washington, D.C.Business (Item 1)

California Consumer Privacy Act (CCPA)

subject tonamed as a risk
The effects of the CCPA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.Risk factors (Item 1A)

Also named by AAP, AIOT, AKAM, ALL, APP, AYI, BAC, BBSI and 69 more

EU Artificial Intelligence Act

subject tonamed as a risk
As enacted, the AI Act imposes significant obligations on providers and deployers of high-risk AI systems and encourages providers and deployers of AI systems to account for EU ethical principles in their development and use of these systems.Risk factors (Item 1A)

Also named by ABNB, ADP, AIOT, AKAM, ALAB, AMG, APP, AVAV and 24 more

Payment Card Industry Data Security Standard (PCI DSS)

subject tonamed as a risk
The Payment Network Rules require us to also comply with the Payment Card Industry Data Security Standard, or the Security Standard, which is a set of rules and standards designed to ensure that all companies that process, store, or transmit payment card information maintain a secure environment to protect cardholder data.Risk factors (Item 1A)

Also named by ABNB, AZO, BJ, BKNG, CASH, CASY, COST, DOV and 20 more

Bank Secrecy Act (BSA)

subject tonamed as a risk
Registration as an MSB subjects us to the regulatory and supervisory jurisdiction of FinCEN, the anti-money laundering provisions of the BSA, and its implementing regulations applicable to MSBs.Risk factors (Item 1A)

Also named by AUB, BAC, CASH, CPAY, CUBI, EFSC, EWBC, EZPW and 10 more

Equal Credit Opportunity Act

subject tonamed as a risk
Lending facilitated through the Toast Capital platform must comply with anti-discrimination statutes such as the Equal Credit Opportunity Act and state law equivalents that prohibit creditors from discriminating against loan applicants and borrowers based on certain characteristics, such as race, religion and national origin.Risk factors (Item 1A)

Also named by AFRM

Nacha Rules

subject tonamed as a risk
If we or our customers fail to comply with the Nacha Rules or if our processing of customer transactions is materially or routinely delayed or otherwise disrupted, our partner financial institutions could suspend or terminate our access to Nacha’s clearing and settlement network, which would make it impossible for us to conduct our business on its current scale.Risk factors (Item 1A)

State money transmitter licensing laws

subject tonamed as a risk
TPS is licensed as a money transmitter in most states in connection with certain payroll processing services we provide.Business (Item 1)

State usury and true lender laws

subject tonamed as a risk
If we were to be determined the “true lender” of loans facilitated through the Toast Capital platform, we could face penalties and/or loans facilitated through the Toast Capital platform may be or become void, voidable, or otherwise impaired in a manner that may have adverse effects on our operations (either directly or as a result of an adverse impact on our relationship with our bank partner).Risk factors (Item 1A)

Interagency Guidance on Third-Party Relationships: Risk Management

subject tonamed as a risk
The increased supervisory attention on bank partnership arrangements could make bank service provider arrangements more costly, and lead to increases in our operating costs.Risk factors (Item 1A)

Toast PayOut on-demand pay regulation

subject tonamed as a risk
These proposals or issuances may impact our ability to offer PayOut in a particular jurisdiction, or at all.Business (Item 1)

Durbin Amendment / Regulation II

subject to
The Durbin Amendment to the Dodd-Frank Act and its implementing regulation, Regulation II, limit the amount of interchange revenue that the bank partner may receive, and share with us, on transactions made using these cards.Business (Item 1)

Electronic Fund Transfer Act / Regulation E

subject to
For example, the Electronic Fund Transfer Act, and its implementing regulation, Regulation E, impose requirements on payroll cards, including requirements related to consumers’ rights and liabilities, treatment of funds on lost or stolen cards, error resolution and investigation, upfront fee disclosures, and access to account information.Business (Item 1)

Technology

Android

depends on
Our hardware utilizes the open-source Android mobile operating system which enables us to freely distribute the operating system to the Toast terminal and handheld devices.Business (Item 1)

Also named by AAPL, ZBRA