Corpay Inc (CPAY)

How it makes money

Corpay does not sell software by subscription so much as it earns a slice of the money that passes through it. The filing describes several streams: transaction and processing fees charged to customers and merchants; interchange income earned when its cards are used, including on its own proprietary networks; spread on foreign-exchange and cross-border transactions; interest (float) earned on customer money held before it is paid out; and late fees and finance charges on outstanding card balances. Revenue is therefore volume-driven and recurring: it rises with the number of transactions, with fuel prices and with cross-border volumes, and the float portion moves with interest rates.

Revenue by segment

The 10-K argues the company's advantage comes from proprietary closed-loop networks: Corpay contracts directly with fuel merchants and hotels, so it captures data at the point of sale that an open card network does not see, and it keeps the economics of both sides of the transaction. Scale across four continents and payment programs that sit inside a customer's payables or fleet workflow make the product awkward to rip out. The advantage is real but not absolute: fuel cards, AP automation and virtual cards are all contested by banks, fintechs and the card networks themselves, and growth has depended heavily on acquisitions.

Demand follows business activity rather than consumer sentiment, and the filing notes that business customers tend to have relatively predictable, consistent volumes — companies keep fuelling trucks and paying suppliers in most conditions. But the revenue is not insulated: fleet fuel volumes and fuel prices, cross-border trade flows, corporate travel and the hotel nights bought by airlines all soften in a downturn, and the float component shrinks when interest rates fall, as management flagged for Corporate Payments in 2025.

Key risks

• Credit losses on customer receivables — Corpay extends credit to business customers when they use its cards and settles with merchants before being paid. The filing lists the management of credit risk, the adequacy of the allowance for losses, and the ability to keep securitising receivables among its risks: a deterioration in customers' finances would show up directly in losses and in funding capacity.
• Fraud, data breaches and system outages — The company holds payment credentials and customer funds and processes transactions continuously. It discloses risks from fraud and cybersecurity incidents, and from disruption of its computer systems and data centres; an incident could mean direct losses, remediation cost and loss of customer trust.
• Regulation, supervision and pending litigation — The filing cites regulatory supervision and litigation with the Federal Trade Commission, plus obligations on privacy and data protection and on anti-money-laundering and counter-terrorism rules across many countries. Changes in these rules, or an adverse outcome, could force changes to fee practices.
• Dependence on partners and merchants — Much of the business runs through relationships with fuel merchants, hotels, card networks and distribution partners. The 10-K lists the retention and performance of these partners among its risks: losing a large network relationship would remove volume the company does not originate on its own.
• Acquisitions and their integration — Growth has come partly from purchases — the filing names the AvidXchange and Alpha transactions — and discloses risks around integrating acquired businesses and executing the growth strategy, together with remediation of internal control weaknesses.
• Macroeconomic conditions, currencies and trade policy — The company discloses exposure to macroeconomic conditions and market volatility, to international operations and currency movements, to global conflicts and to changes in tariffs and trade policy — all of which move the transaction volumes it earns on.

The annual report we read does not state a percentage of revenue attributable to the largest customer or customers, and no single-customer concentration disclosure was found. What the filing does flag is dependence on partners: the retention and performance of merchants, hotels, card networks and distribution partners appears among its risk factors, so the exposure is more to a handful of large network relationships than to one end customer.