high medium likelihood
R-001: Financial quality and valuation support are not public
Public sources verify financing, pricing and stale TPV-growth claims, but do not disclose audited revenue, take rate, gross margin, burn, cash runway, ARR/TPV bridge or support for any post-2021 valuation.
Diligence request: Request audited financials, monthly KPI pack, cash/burn, revenue recognition memo, TPV-to-revenue bridge, latest valuation support and board-approved model.
high medium likelihood
R-002: Multi-jurisdiction fintech regulatory and licensing exposure
Xendit operates regulated payment/remittance/VASP/lending activities across several Asian jurisdictions; public license claims require regulator confirmation and review of restrictions, renewals and enforcement history.
Diligence request: Commission local counsel review in Indonesia, Philippines, Singapore, Malaysia, Thailand, Vietnam and Hong Kong; collect licenses, correspondence, exams and remediation history.
high medium likelihood
R-006: Product reliability, fraud and security controls require private validation
Xendit documents APIs and fraud-detection products and status components, but SOC/PCI/penetration-test evidence, uptime SLAs and incident history were not public.
Diligence request: Obtain SOC/PCI/ISO reports if applicable, penetration tests, uptime SLA data, architecture review, incident postmortems and secure-SDLC evidence.
high unknown likelihood
R-003: Customer concentration, churn and contract economics are hidden
Public customer logos show use cases but do not disclose top-customer revenue, active status, pricing, renewals, churn/NRR or 5%+ concentration.
Diligence request: Request top-15 customer schedule, revenue by customer, contract terms, churn/NRR cohorts and independent references.
medium high likelihood
R-004: Operational dependency on bank, e-wallet and payment rails
Status page incidents show partner-rail disruptions for GoPay, virtual accounts, BSS, Landbank and Alipay Philippines, highlighting dependencies outside Xendit core systems.
Diligence request: Review supplier/rail contracts, SLA history, redundancy, incident postmortems, customer credits and business-continuity plans.
medium high likelihood
R-005: Competitive pricing and take-rate pressure
Payments infrastructure buyers can benchmark on payment-method coverage, reliability, developer tooling, local licensing and price; Xendit publishes list prices but realized discounts and competitor win/loss are private.
Diligence request: Run customer win/loss calls and compare realized pricing, acceptance rates, settlement speeds and support SLAs against local and global payment competitors.
medium unknown likelihood
R-007: Cap-table, preference stack and debt obligations unknown
Public sources name investors and amounts but not fully diluted ownership, liquidation preferences, warrants, notes, option pool or debt/off-balance-sheet obligations.
Diligence request: Request full cap table, financing documents, debt schedule, option plan and waterfall model.
medium unknown likelihood
R-008: Management depth, retention and employee-relations risk not public
Public sources identify founders and a team-size anchor, but not current leadership bench, attrition, compensation, employee relations or hiring plan.
Diligence request: Request org chart, executive agreements, compensation/benefits, option plan, attrition reports, employee-relations claims and hiring forecast.