HealthEquity: The High-Float Royalty of Healthcare Fintech

I. Introduction & Episode Roadmap

There is a particular kind of business that investors dream about and almost never find: one that collects billions of dollars of other people's money, holds it for decades, earns a spread on it, and yet bears none of the risks a bank would bear for the privilege. No loan book that can go bad. No mortgage portfolio to blow up in a downturn. No deposit run to fear, because the depositors are not chasing yield — they are chasing a tax deduction, and they have nowhere better to put the money anyway. HealthEquity, a company headquartered not on Wall Street but in the Salt Lake City suburb of Draper, Utah, is as close to that dream as the American financial system produces.

Consider the shape of it. As of the fiscal year ended January 31, 2026, HealthEquity administered more than $36 billion in Health Savings Account assets, served 10.6 million active HSA members, and touched 17.8 million total consumer-directed accounts of one kind or another.¹ It generated $1.31 billion in revenue and $215 million of GAAP net income, doubling its net-income margin to roughly 16% in a single year.¹ And the single largest line of that revenue — nearly half of it — came not from software subscriptions or transaction fees but from something more elemental: the interest spread on member cash the company doesn't even hold on its own balance sheet.¹

How did a benefits-administration startup founded by a Utah trauma surgeon end up sitting on one of the great float machines in fintech? The answer is a story about policy, timing, and a single obscure regulatory license — and it begins with a law most Americans remember, if they remember it at all, for something else entirely.

The hook of this episode is that HealthEquity is a fintech company that holds no banking license, runs no lending operation, and takes essentially zero credit risk, yet monetizes a multi-billion-dollar pool of the stickiest deposits imaginable: tax-advantaged healthcare savings that members are actively incentivized never to withdraw. A minor 2003 change to Medicare law created the account type. A 2006 Treasury designation let HealthEquity own the whole value chain around it. Everything since has been about scale.

And scale, in this business, is not vanity — it is the source of the economics. A benefits platform is a fixed-cost machine: the software, the compliance apparatus, the security infrastructure, and the call centers cost roughly the same whether they serve five million accounts or fifteen. Every incremental account HealthEquity adds arrives at a very low marginal cost and, if it carries a cash balance, drops custodial revenue almost straight to the bottom line. That is why the story of HealthEquity is, at bottom, a story about accumulating accounts and assets faster than costs — through the ballot box of open enrollment, through acquisition, and through the slow behavioral drift of members treating a spending account like a savings vehicle. The company that gathers the most sticky, tax-advantaged dollars at the lowest cost per dollar wins. HealthEquity has, so far, gathered more of them than anyone.

Here is the arc we will walk. First, the regulatory origin — how the Medicare Modernization Act of 2003 quietly birthed the HSA and, with it, an entire industry. Second, the Non-Bank Trustee breakthrough — the structural advantage that let a software company behave like a custodian bank without becoming one. Third, the "triple tax advantage" flywheel and the three ways HealthEquity monetizes a single account: service fees, interchange fees, and the custodial spread. Fourth, the M&A consolidation playbook — WageWorks, Further, and BenefitWallet, and what each reveals about capital allocation. Fifth, the leadership handoff from founder-era operator Jon Kessler to marketplace veteran Scott Cutler. And finally, the bull case, the bear case, and the handful of numbers that will tell you whether the machine is still working.

Throughout, we will keep one question in the foreground, because it is the question a serious investor has to answer: is HealthEquity's advantage real and durable, or is it a rate-cycle mirage dressed up as a moat? The company would like you to believe it is the former. Our job is to test that. Let's start where the money starts — with a piece of legislation signed in the last month of 2003.

Subscribe on LinkedIn

↑ Back to Top

II. The Genesis of the HSA: Policy as a Platform

To understand HealthEquity, you first have to understand a problem that had been metastasizing in American healthcare since the 1990s: nobody buying care had any idea what it cost, and nobody had any reason to care. Employer-sponsored insurance, the dominant model, insulated the patient almost completely from price. A worker with a low-deductible plan handed over a $20 copay and never saw the $2,000 bill behind it. Economists called this the "moral hazard" of third-party payment, and it was widely blamed for the relentless, above-inflation march of medical costs. The proposed cure was to give consumers skin in the game — high-deductible health plans that made people spend their own money first, and therefore, in theory, shop.

The trouble with high deductibles is obvious: they are terrifying if you have no way to save for them. And so the policy world spent years searching for the savings vehicle that would make consumer-directed healthcare politically palatable. There had been an earlier attempt — the Archer Medical Savings Account, a Clinton-era pilot so hemmed in by restrictions that it never scaled. It was a prototype waiting for a better version.

That better version arrived, improbably, as a rider on a much larger bill. On December 8, 2003, President George W. Bush signed the Medicare Prescription Drug, Improvement, and Modernization Act — a sprawling law whose headline feature was Medicare Part D, the prescription-drug benefit for seniors.¹² Buried inside it was a provision that would prove, dollar for dollar, one of the most consequential in modern American personal finance: the creation of the Health Savings Account, a tax-advantaged account any individual covered by a qualifying high-deductible plan could open and fund. The Archer MSA had been a keyhole. The HSA blew the door open.

What made the HSA extraordinary was its tax treatment, and it is worth slowing down here because the entire HealthEquity thesis rests on it. Most tax-advantaged accounts give you one break. A traditional 401(k) lets you deduct contributions but taxes withdrawals. A Roth taxes contributions but frees withdrawals. The HSA does something no other account in the U.S. code does — it gives you all three breaks at once. Contributions go in pre-tax or fully deductible. The balance grows, compounds, earns interest and investment gains entirely tax-free. And withdrawals come out tax-free too, so long as they pay for qualified medical expenses.¹² Money goes in untaxed, grows untaxed, comes out untaxed. In the financial-planning world this is known, with a rare lack of hyperbole, as the "triple tax advantage."

The contributions are capped, which is what keeps the accounts from being an unlimited tax shelter and keeps the political coalition behind them intact. For 2026 the ceiling is $4,400 for an individual and $8,750 for a family, with an extra $1,000 catch-up allowance for savers aged 55 and older.¹⁴ These are not large numbers in isolation. But that is precisely the point an investor should internalize: the HSA is a slow compounding machine, not a fast one. It gathers a few thousand dollars per member per year, indefinitely, from millions of members who mostly never think about it. The individual streams are trickles. The aggregate is a river — and rivers, unlike floods, are bankable.

The scale that trickle has produced across the industry is genuinely striking. By year-end 2025, according to the specialist research firm Devenir, Americans held nearly $174 billion across 41.7 million HSAs, with total assets rising about 19% year over year and invested assets alone reaching roughly $85 billion.⁷ Devenir projects the market will surpass 49 million accounts and $234 billion in assets by the end of 2028.⁷ An entire asset class — one that did not exist before 2004 — had been conjured into being by a few paragraphs of tax law. The only question was who would administer it.

Here is the twist that turned a healthcare-spending account into a wealth-management product, and it hinges on one word in the statute: the HSA has no "use it or lose it" rule. Its cousin, the Flexible Spending Account, forces you to spend the balance within the plan year or forfeit it — a design that keeps FSAs small and transactional. The HSA balance, by contrast, rolls over forever and belongs entirely to the account holder, portable across jobs and into retirement. That single difference rewired the incentives. A savvy account holder learns to pay current medical bills out of pocket, leave the HSA untouched to compound for decades, and simply keep the receipts. Years later, those old receipts can be used to justify tax-free withdrawals — a practice the personal-finance community affectionately calls "shoeboxing" or receipt-hoarding.

The strategic implication is the one to hold onto. Every dollar a member decides to "shoebox" rather than spend is a dollar that stays inside the system, compounding, for years or decades. The HSA was designed as a healthcare-spending tool, but its economics made it behave like a stealth retirement account — and that behavioral quirk is precisely what created the enormous, patient, sticky pool of money that a company like HealthEquity could build a business on. The law wrote the incentive. Someone still had to build the platform. And in Utah, someone already had.

↑ Back to Top

III. Founding HealthEquity & The Non-Bank Trustee Breakthrough

A year before the HSA existed in law, it already existed in the mind of a trauma surgeon. Dr. Stephen Neeleman was operating at American Fork Hospital and Utah Valley Regional Medical Center, stitching people back together in the emergency room, and growing quietly furious at what he saw as a broken relationship between patients and the healthcare system.² Patients arrived with no sense of cost, no ownership, no agency — they were passengers in their own care. Neeleman came from an entrepreneurial family; his brother David founded JetBlue, and the idea of re-engineering a consumer experience ran in the blood. In 2002 he assembled a small team in Draper, Utah, to build a company around a bet that consumer-directed healthcare was coming, and that the accounts underpinning it would need a specialist administrator.²

The timing looks prophetic in retrospect, but in 2002 it was a leap of faith — the HSA did not yet exist. HealthEquity onboarded its first client and first health-plan partner in 2003, essentially in lockstep with the legislation that would give the business its reason to exist.² For its first few years the company was a scrappy benefits-technology shop, building the software rails to let employers and health plans enroll members, process claims, and administer the new accounts. That was a useful business. It was not yet a great one. The thing that made it great came in 2006, and it is the single most important structural fact in this entire story.

That year, the U.S. Treasury granted HealthEquity a Non-Bank Trustee license.² To appreciate why this mattered, you have to understand the box every other HSA administrator was trapped in. HSAs, being tax-advantaged custodial accounts, legally require a bank or a Treasury-approved trustee to hold the assets. This split the young industry into two camps, each missing half the picture. On one side stood the banks — regional and national institutions with the balance sheets and regulatory approval to custody HSA cash, but without the specialized benefits-administration software, the payroll integrations, or the appetite to build them for a niche product. On the other side stood the software companies — nimble benefits administrators with slick enrollment platforms, who had no choice but to farm the actual custody of member cash out to a partner bank, handing that bank the deposits and, with them, the interest spread. The software firms owned the customer relationship but gave away the money. The banks held the money but didn't own the relationship.

The Non-Bank Trustee designation collapsed that divide. It let HealthEquity — a technology company — legally act as the custodian of HSA assets itself, without becoming a chartered bank. Suddenly one entity could own both halves: the software relationship with the employer and member and the economics of the deposits. HealthEquity could build the enrollment platform, integrate with the payroll system, service the account, issue the debit card, and control where the underlying cash was placed and what spread it earned. It is the difference between being the toll road and being the company that merely paints the lines on someone else's toll road.

This is what a "cornered resource" looks like in practice — a specific, hard-to-replicate asset that competitors cannot simply buy or build around. The NBT license is not literally unobtainable; a handful of other firms hold trustee status. But the combination of the license plus a purpose-built benefits platform plus deep integrations into health plans and payroll is genuinely rare, and it is why pure-play software startups have found the HSA custody business so hard to crack. The moat is not the license alone. It is what the license lets you keep.

It is worth pausing on the founder himself, because HealthEquity's culture bears his fingerprints in ways that still matter. Neeleman was not a career financier who spotted a regulatory arbitrage; he was a physician who had watched the doctor-patient relationship curdle under the weight of an opaque payment system, and who believed — earnestly, almost evangelically — that giving patients ownership of their own healthcare dollars would fix something broken. That the Neeleman family had already reinvented an industry once, when brother David built JetBlue into a low-cost aviation disruptor, meant Stephen understood that consumer experience and cost discipline could be a weapon rather than a trade-off. He later wrote a book, The Complete HSA Guidebook, and stayed with the company for more than two decades, serving as vice chairman long after handing off operational leadership.² Founder mission is not a line item on a balance sheet, but it shows up in retention, in the willingness to invest through cycles, and in a company's tolerance for playing a long game — and HealthEquity has generally played one.

The long game required patience with the balance sheet, and the milestone that funded the next decade of it came on July 31, 2014, when HealthEquity went public on the NASDAQ. The IPO priced at $14 per share — above its indicated range, a signal of strong demand — and raised roughly $127 million by selling about 9.1 million shares.¹¹ The public listing did two things at once. It gave the company a currency for the acquisitions that would come, and it imposed the discipline of quarterly scrutiny on a business whose economics, until then, few outside Utah had bothered to understand. A benefits-software company that had spent a dozen years as a niche specialist stepped onto the public stage just as the HSA market was inflecting from curiosity to mainstream. Timing, once again, was on Neeleman's side.

The go-to-market strategy that grew from this was classically B2B2C. HealthEquity did not, in its formative years, spend to acquire individual consumers one at a time. It sold to the enterprise — partnering with large national and regional health plans and directly with employers, embedding HSA enrollment into the annual benefits-onboarding ritual that every American worker knows. When you start a new job and click through the health-plan menu, the HSA option sitting there may well be administered by HealthEquity, chosen not by you but by your employer's benefits team. Acquire the employer once, and you acquire its workforce — and every new hire who follows — for years. That is cheap, durable distribution, and it set up the flywheel we turn to next: the three distinct ways a single account, opened almost by accident during open enrollment, throws off cash for years afterward.

↑ Back to Top

IV. The Double-Dipping Business Model: How the Flywheel Spins

Ask most people how a benefits administrator makes money and they'll guess "fees" — some monthly charge to the employer for running the software. They'd be a third right. The genius, and the fragility, of HealthEquity's model is that a single HSA generates revenue through three separate spigots, and they respond to completely different forces. Understanding how the three fit together — and which one really drives the machine — is the whole ballgame.

Start with the smallest and simplest. Service revenue was $485.0 million in fiscal 2026, roughly 37% of the total.¹ This is the SaaS-like layer: recurring administration fees, typically structured on a per-employee-per-month basis, that employers pay for HealthEquity to run their consumer-directed benefits. It is stable, contracted, and predictable — the boring backbone of the business. But it is also, revealingly, the slowest-growing of the three lines, up only about 2% year over year in the fourth quarter.³ Mega-employers have real bargaining power and grind these per-head fees down over time. Service revenue keeps the lights on and cements the customer relationship; it is not where the money is made.

Next, interchange revenue — $191.6 million, about 15% of the total.¹ Every time a member swipes their HealthEquity debit card to pay for a prescription, a doctor's copay, or a pair of glasses, the card networks route a small interchange fee back to the account's administrator. Multiply tiny fees by hundreds of millions of healthcare transactions across 17.8 million accounts and it adds up. Interchange grew about 6% in the fourth quarter, outpacing account growth, which tells you spending per account is ticking up.³ It is a genuinely capital-light, volume-driven stream — but it carries a subtle tension we'll return to, because interchange rewards members for spending their HSA, while the crown-jewel revenue line rewards them for doing the opposite.

That crown jewel is custodial revenue: $636.8 million in fiscal 2026, or roughly 49% of everything HealthEquity earns — nearly half the company from a single mechanism.¹ This is the float. Here is how it works, and it is worth being precise, because the elegance of the design is easy to miss. HealthEquity holds member HSA cash — about $18.0 billion of it at fiscal year-end 2026 — but it does not park that money on its own balance sheet.¹ Instead it places the cash with a panel of federally insured depository partners (banks) and, increasingly, with insurance-company partners, and collects a yield on those placements.¹³ It passes a portion of that yield back to members as the interest on their account, and keeps the spread. Because the cash never sits on HealthEquity's own books as a deposit liability, the company gets bank-like float economics without bank-like capital requirements, deposit-insurance assessments, or lending risk. It is, in the most literal sense, a spread business with no balance sheet.

An analogy helps. A traditional bank takes your deposit, lends it out at a higher rate, pays you a sliver of interest, and pockets the difference — but it carries the risk that the loan goes bad and the regulatory capital it must hold against that risk. HealthEquity runs the deposit half of that trade and skips the loan half entirely. It takes the member's cash, places it with regulated banks and insurers who do carry the lending and capital burden, collects a negotiated rate from them, passes a slice to the member, and keeps the spread. It is the landlord who sublets, not the one who fixes the boiler. This is why observers describe the model as "double-dipping," and it is worth being precise about the phrase: HealthEquity earns on the same member relationship twice over — once from the interchange when the member spends, and separately from the custodial spread when the member saves. Whichever the member does, the company gets paid. The only behavior that hurts is investing, which we come to shortly.

What keeps that spread from being whipsawed by the Federal Reserve is the contract structure, and this is where the model turns from clever to genuinely defensible. HealthEquity doesn't place the cash overnight at whatever rate prevails that morning. It ladders the placements into multi-year agreements, typically three to five years, at fixed and variable rates negotiated in advance.¹³ The effect is a portfolio that reprices slowly. When the Fed hikes, HealthEquity's average yield rises only gradually as old contracts mature and roll into new, higher-rate ones — it gives up some immediate upside. But when the Fed cuts, that same lag becomes a shield: the bulk of the book keeps earning yesterday's higher rates for years. On the Q4 call, management described locking Treasury forward contracts — roughly $2.4 billion at a blended 3.92% through January 2028 — precisely to nail down that future yield in advance.³ The average annualized yield on HSA cash rose from 3.11% in fiscal 2025 to about 3.53% in fiscal 2026, and management guided toward roughly 3.8% in fiscal 2027 even as short-term rates were expected to drift lower.¹³ That inversion — yield rising while the Fed eases — is the ladder doing its job.

There is a second layer of optionality here that reveals how HealthEquity manages the spread. Member cash comes in two flavors. "Basic" balances sit in plain FDIC-insured deposits earning members a modest rate, leaving HealthEquity a wide margin. "Enhanced" balances are placed through insurance-company group annuity contracts that are not FDIC-insured but offer members a higher headline rate — useful for keeping rate-sensitive savers from fleeing to a competitor — while still preserving a healthy spread for HealthEquity. By the fourth quarter of fiscal 2026, the company had migrated 58% of HSA cash into these enhanced-rate contracts.³ The enhanced tier is how HealthEquity competes on member rate without surrendering its own economics; it is a pressure valve.

There is a subtler risk buried in that pressure valve, and an independent analysis should name it. The enhanced-rate contracts trade FDIC insurance for higher yield. In a placid environment no one notices. But the enhanced tier concentrates member cash with insurance-company counterparties whose own solvency is now, however remotely, part of the risk picture — and it does so with money that members almost certainly assume is as safe as a bank deposit. HealthEquity discloses the structure, and the counterparties are regulated and rated, so this is not an alarm so much as a footnote. Still, a business whose entire franchise rests on being the trustworthy custodian of healthcare savings is a business for which even a low-probability counterparty problem would be reputationally expensive out of all proportion to the dollars. The pursuit of a wider spread and the preservation of member trust are not perfectly aligned, and the enhanced tier sits exactly on that seam.

The three spigots also pull against one another in a way that is easy to miss. Interchange revenue rewards members for spending their HSA at the pharmacy counter; the custodial spread rewards them for saving it; the thin investment fee is what's left when they invest it. A member who spends aggressively is good for interchange but starves the float. A member who hoards cash is a custodial gold mine but generates little interchange. A member who invests everything is the worst of both for near-term revenue even as they build the long-term asset base. HealthEquity's revenue is therefore a portfolio of member behaviors, and the company's job is less to push any single behavior than to make sure that whichever one a member chooses, a toll gets collected. That is a genuinely resilient revenue architecture — but it is not the frictionless flywheel the word "flywheel" implies, and the tension between interchange and float is real.

Now the plot complication, and it is a real one. As of fiscal 2026, HSA investment assets reached $18.5 billion — and for the first time surpassed HSA cash assets of $18.0 billion.¹ When a member takes the "shoeboxing" strategy to its logical conclusion and moves their balance out of cash and into mutual funds inside the HSA, something happens to HealthEquity's economics that is easy to overlook: the lucrative custodial spread on that money disappears, replaced by a much thinner, flat investment-administration fee. Invested assets grew 26% in the year while cash grew just 3%.³ In other words, the single behavior that makes the HSA such a beautiful long-term asset-gathering story — members treating it as a retirement account and investing the balance — is simultaneously a headwind to the highest-margin revenue line the company has. Management frames the two as different cohorts: new accounts feed cash, while older, higher-balance accounts feed investments.³ That's true, and it means the cash pool can keep growing in absolute terms even as the mix shifts. But investors should be clear-eyed that the long-term compounding tailwind and the near-term float headwind are two faces of the same coin. Which brings us to how HealthEquity has spent the last several years buying more coins.

↑ Back to Top

V. The M&A Consolidation Engine

For most of the 2010s, HealthEquity grew the hard way — one employer, one health plan, one open-enrollment season at a time. Then, on June 27, 2019, it did something that reset the entire scale of the company. It agreed to acquire WageWorks, a larger, older rival in the consumer-directed benefits world, for $51.35 per share in cash — roughly $2.0 billion in enterprise value, a premium of about 28% to where WageWorks had been trading.⁶ For a company HealthEquity's size at the time, this was a bet-the-company move, funded substantially with new debt, and it closed on August 30, 2019.⁶

Why do it? Because WageWorks owned the half of the consumer-directed-benefits market that HealthEquity didn't. HealthEquity was the HSA specialist. WageWorks was the market leader in everything around the HSA — Flexible Spending Accounts, Health Reimbursement Arrangements, COBRA continuation administration, and commuter transit benefits. Bolting the two together transformed HealthEquity from a pure-play HSA custodian into a "total solution" benefits platform that could walk into any employer and administer the entire menu. Strategically, it also created a conversion funnel: WageWorks' vast base of FSA and other accounts represented millions of members who could, over time, be nudged toward the more valuable HSA.

The integration was not clean, and this is where an independent lens matters. Management had guided to roughly $50 million in annualized synergies within two to three years of closing, to be harvested from custodial and interchange revenue and operating efficiencies.⁶ The company would later point to synergy realization running ahead of that initial target. But the deal also saddled HealthEquity with years of technology-integration debt — two large platforms that had to be stitched together — and organizational complexity that management spent much of the following half-decade digesting. WageWorks was, by common assessment at the time, expensive and messy. It was also, in hindsight, the move that gave HealthEquity the scale and product breadth to dominate. Both things are true, and a sober investor holds them together rather than picking the flattering one.

The financial hangover was as instructive as the strategic logic. To fund a $2 billion cash deal, HealthEquity took on well over a billion dollars of new debt, transforming a company that had been essentially debt-free into a leveraged one overnight. For a business whose entire appeal is capital-light, high-margin float, carrying a heavy debt load is an uncomfortable fit — interest expense became a real drag, and the years that followed were defined as much by deleveraging and integration as by growth. That the WageWorks deal closed in August 2019, mere months before a global pandemic upended employment, benefits enrollment, and healthcare utilization, only sharpened the test. HealthEquity spent the early 2020s paying down that debt out of the cash flows the combined business generated — a slow, unglamorous grind that, by the mid-2020s, had restored the balance-sheet flexibility to go shopping again. The lesson for an investor watching capital allocation is that HealthEquity is willing to lever up hard for a transformational asset and then discipline itself back down. Whether that reflects genuine prudence or merely the good fortune of a rising-rate environment that inflated custodial revenue and made the debt easy to service is a fair question — and one worth holding open.

Two years later came a cleaner, smaller tuck-in. On November 1, 2021, HealthEquity closed its acquisition of Further, the nation's ninth-largest HSA custodian, for $455 million in cash, with up to $45 million more contingent on the migration of certain assets.⁸ Further brought roughly 270,000 consumer-directed accounts and about 28,000 employer clients, deepening HealthEquity's footprint and adding technology to its account-processing engine.⁸ It was a straightforward scale play — buy a competitor's book, plug it into your platform, run it at your cost structure.

But the acquisition that best illustrates the economics of this business — the one worth dwelling on — was BenefitWallet. On May 14, 2024, HealthEquity completed the purchase of the BenefitWallet HSA portfolio from Conduent for an aggregate $425 million in cash.⁹ What it got for that money is the tell. The portfolio brought more than 616,000 HSA members and approximately $2.7 billion in HSA assets, about a third of which were already invested.⁹

Run the arithmetic the way an analyst would, and the appeal becomes obvious. HealthEquity paid $425 million to bring roughly $2.7 billion of custodial assets onto its platform — a purchase price of about 16% of the assets acquired. Those assets, once placed through the custodial machine at yields in the mid-3% range, throw off well over $90 million of high-margin custodial revenue a year before counting the interchange and service fees the accounts also generate. That implies a payback period on the purchase price measured in a handful of years, after which the cash flow is nearly pure margin for as long as the members stay — and HSA members, embedded in their employers' benefits systems, tend to stay a very long time. This is the core insight of the consolidation engine: buying a book of HSA assets is one of the highest-return uses of capital available to the company, arguably higher-return than building the accounts organically. That is why HealthEquity keeps a war chest ready and why the M&A pipeline matters so much to the bull case.

There is a strategic subtlety to why HealthEquity is willing to buy accounts that are not even HSAs — the FSA, HRA, COBRA, and commuter books that came with WageWorks. Those products are individually less lucrative than an HSA; they generate service fees but little of the prized custodial float. Their value is as a conversion funnel. A member sitting in a WageWorks FSA is a member already inside HealthEquity's system, one plan-design change or one employer decision away from being steered into an HSA that does throw off float. Owning the full menu of consumer-directed benefits means HealthEquity is present for every employer's benefits conversation and holds the relationship through which the higher-value account can eventually be sold. The "total solution" is not really about the FSA revenue; it is about controlling the on-ramp to the HSA.

That logic is sound, but it carries the classic conglomerate risk that a skeptical investor should weigh rather than wave away. Bolting FSA, HRA, COBRA, and commuter administration onto an HSA custodian added real organizational and technological complexity — multiple legacy platforms, different regulatory regimes, distinct operational rhythms — in pursuit of a cross-sell that is easy to assert and hard to measure. Is the "total solution" a genuine flywheel, or is it diworsification dressed in strategy-deck language, a collection of lower-margin businesses that dilute focus on the one thing HealthEquity does uniquely well? The honest answer is that it depends on conversion rates the company does not cleanly disclose. The bull reads the breadth as a durable distribution advantage; the bear reads it as complexity that has kept margins lower and integration costs higher than a pure-play HSA custodian would carry. Both readings survived the WageWorks integration, and the debate is not fully settled even now.

The obvious caveat is that these returns are a function of the interest-rate environment that makes custodial spreads fat in the first place. Buy a book at a 16% price-to-assets ratio when spreads are wide and the math sings; the same purchase in a near-zero-rate world would look far more pedestrian. The acquisition engine is real, but it is levered to the same macro variable as the rest of the business. Which is one reason the board went looking, in late 2024, for a leader whose instincts ran toward organic engagement rather than balance-sheet arbitrage.

↑ Back to Top

VI. The Scott Cutler Era: From Founder-Led to Digital Marketplace

For fifteen years, HealthEquity had essentially one operating personality at the top: Jon Kessler. He took the company public in 2014, engineered the WageWorks mega-deal, and shepherded the messy integration that followed. Kessler was the archetype of the founder-era operator — deep in the mechanics of HSAs, fluent in the regulatory weeds, personally identified with the company's growth. So when HealthEquity announced on November 12, 2024, that Kessler would retire and hand the CEO role to an outsider effective January 6, 2025, it was not a routine succession. It was a statement about where the board thought the next decade of value would come from.¹⁰

The choice was telling. Scott Cutler, then 55, was not a healthcare or benefits executive at all. He had spent the prior five years as CEO of StockX, the online sneaker-and-collectibles marketplace, and before that as Senior Vice President for the Americas at eBay and president of StubHub — the ticket-resale marketplace.¹⁰ Earlier in his career he had held a senior role at the New York Stock Exchange and worked as a technology investment banker and corporate securities lawyer.¹⁰ The through-line of his résumé is unmistakable: marketplaces, transaction platforms, and consumer engagement at scale. HealthEquity did not hire a custodian. It hired a marketplace operator.

Cutler's defining act before HealthEquity was StockX, and the shape of that business tells you what the board was buying. StockX took an opaque, trust-poor market — resale of sneakers, streetwear, and collectibles, historically the domain of eBay listings and forum haggling — and rebuilt it as a transparent, authenticated marketplace with real-time bid-ask pricing that borrowed the vocabulary of a stock exchange. Cutler's genius there was making a messy consumer transaction feel liquid, safe, and even fun, and monetizing the flow of it. Before StockX he had run StubHub, another marketplace that turned a fragmented, trust-anxious activity — reselling event tickets — into a slick transactional platform. The pattern is a career spent lowering the friction and raising the trust in consumer transactions, then taking a cut of the resulting volume. A board that hands the keys to a person with that résumé is telling you, in the clearest possible terms, that it believes the next phase of HealthEquity's value is a consumer-engagement and transaction-optimization phase, not another leg of enterprise consolidation.

The strategic logic behind that choice reveals how the board reads its own opportunity. HealthEquity had spent a decade proving it could win the enterprise sale and consolidate portfolios. What it had arguably not fully cracked was the consumer — the 10.6 million members themselves, most of whom barely engage with their accounts. On his first earnings calls, Cutler leaned hard into this, framing the business around a "save, spend, invest" flywheel and repeating a pair of statistics that double as a mission statement: roughly 95% of members have not hit their annual contribution limit, and more than 90% have not invested a dollar of their balance.³ To a marketplace operator, those are not disappointing numbers — they are enormous untapped demand sitting inside an existing customer base. Get members to contribute more and invest more, and you grow assets, interchange, and engagement all at once, without acquiring a single new account.

Whether Cutler can convert that thesis into results is the open question, and it is fair to be skeptical rather than starstruck by the pedigree. A consumer-engagement playbook honed on sneaker drops and concert tickets does not obviously translate to getting a 34-year-old to increase their HSA contribution. The behavioral inertia that leaves 90% of members uninvested is deep, and prior management tried to move it too. Cutler's marketplace instincts point toward optimizing member-portal UX, interchange yield, and premium investment-advisory features — plausible levers, but unproven in this context. Investors should watch execution, not narrative.

Judging management by behavior rather than rhetoric, the record through the transition is reasonably encouraging on the metric investors should weigh most heavily: guidance discipline. Across fiscal 2026, HealthEquity repeatedly raised its full-year outlook rather than cutting it, and the fourth-quarter results landed at the high end, prompting a raised fiscal 2027 outlook of $1.405 to $1.415 billion in revenue and non-GAAP earnings of $4.56 to $4.65 per diluted share.¹ A company that sets targets and then beats and raises them is displaying the opposite of the overpromise-underdeliver pattern that erodes credibility. Management has also leaned on a memorable internal yardstick it calls the "Rule of 50" — the sum of HSA-member growth and a profitability measure clearing 50 — and framed fiscal 2026 as a third consecutive year of achieving it, with a fourth guided.³ Self-invented scorecards deserve a skeptical eye, since companies choose metrics that flatter them. But the discipline of naming a public bar and clearing it repeatedly is, at minimum, a form of accountability, and the consistency of the language across successive calls suggests a narrative that is not lurching from quarter to quarter.

The place a critical listener should press is the quality of the growth beneath those beats. Much of fiscal 2026's earnings surge came from custodial revenue rising on higher yields — a tailwind handed to the company by the interest-rate environment, not manufactured by it. On the Q4 call, analysts probed exactly this, pointing out that the macro backdrop for account growth was soft — on the order of 181,000 jobs added in a month against more than a million new HSAs from sales — and pushing on how durable the newer growth cohorts, including accounts tied to Affordable Care Act plans, would prove.³ Management conceded the ACA cohort was only months old and its long-term value premature to judge, which is a candid answer rather than a defensive one.³ Distinguishing the portion of HealthEquity's earnings that reflects genuine operating execution from the portion that reflects a favorable rate cycle is the single most important act of judgment an investor of this company must perform, and management's own framing does not always make the separation easy.

On the numbers that management can control, the early evidence is at least consistent with the story it tells. The company generated strong free cash flow — operating cash flow exceeded $340 million in fiscal 2025 — and used it with visible discipline: deleveraging after the acquisition binge, and returning capital to shareholders.¹ In fiscal 2026 HealthEquity returned more than $300 million through buybacks, reducing diluted share count by roughly 3%, with about $178 million left on the repurchase authorization at year-end.³ Executive incentives are tied to EPS metrics and HSA-account growth, which broadly aligns management with the two things shareholders most want.¹

But the era did not begin on a clean sheet, and the most serious test of the new regime's credibility was inherited, not chosen. In July 2024 — under Kessler, but landing squarely on Cutler's desk — HealthEquity disclosed a major cybersecurity incident that we will examine in detail in the bear case. Its fallout, in the form of elevated fraud-prevention, security, and compliance spending, pressured margins into 2025 and forced management to demonstrate it could stabilize operations while absorbing the cost. On the Q4 fiscal 2026 call, Cutler pointed to fraud reimbursements having fallen to a trickle — just $300,000 in the quarter, well inside the company's own tolerance — and cited full-year fraud costs of 1.1 basis points as evidence the crisis had been contained.³ That is the kind of specific, falsifiable claim a skeptical investor can actually track. Whether the containment holds, and whether Cutler's consumer strategy delivers growth that isn't just a function of interest rates, are the two things his tenure will ultimately be judged on. To weigh that, we need to lay out the full competitive structure he inherited.

↑ Back to Top

VII. The Playbook: Lessons in B2B2C, High-Margin Float, and Platform Lock-In

Step back from the quarterly detail and HealthEquity resolves into a case study in a very specific kind of advantage — the kind that comes not from a better product but from a better position. It is worth running the business through two of the frameworks investors use to pressure-test durability, because they surface both the strength of the moat and its precise edges.

Begin with Hamilton Helmer's 7 Powers. Three of the seven map cleanly onto HealthEquity, and naming them precisely matters more than collecting them. The first and most important is switching costs. Ripping out an employer's benefits-administration platform is not like changing a software vendor; it is open-heart surgery on the plumbing that connects the company's payroll system, its health insurers, and its employees' paychecks, all of which must keep functioning flawlessly through every pay cycle and every open-enrollment season. The integration work, the compliance risk, and the sheer operational terror of a botched migration make incumbents extraordinarily sticky. This is why HealthEquity routinely cites revenue retention above 98% — a figure that, if it holds, is the single best evidence that the switching-cost moat is real rather than asserted.³

It is worth dwelling on why the lock-in is so deep, because the mechanism is more interesting than "software is sticky." A benefits platform sits at the confluence of three systems that a large employer cannot afford to have fail: the payroll engine that funds contributions out of each paycheck, the health-plan feeds that determine eligibility, and the banking rails that move money and issue cards. Every one of those connections is a custom integration, tested over years, that quietly does its job every pay period. Ripping it out means re-plumbing all three simultaneously, migrating years of account history and receipt records, retraining an HR team, and — most dangerously — risking that an employee's HSA card gets declined at a pharmacy during the switchover. For the benefits manager who owns that decision, the upside of switching is a modestly lower per-employee fee; the downside is being the person who broke healthcare payments for ten thousand colleagues. That asymmetry, not the software itself, is the moat. It explains why retention sits near 98% even as mega-employers grind down the service fees, and why the real competitive battleground is the new account and the newly bidding employer rather than the installed base. A switching-cost moat is strongest at the back door and weakest at the front — which is exactly why Fidelity attacks at the front.

There is a governance-flavored caveat worth registering here, since a moat built on inertia can mask a multitude of sins. High retention can flatter a company by making stagnant service quality or gradually uncompetitive pricing invisible in the churn numbers, because customers stay out of sheer switching friction rather than genuine satisfaction. The honest test of whether HealthEquity's lock-in reflects a loved product or merely a costly-to-leave one is not retention — it is win rates on new competitive bids and net promoter among members who actually engage. Management asserts it gains share faster than the market grows.³ That claim, if independently borne out over several years, is what would convert the switching-cost story from "customers are trapped" into "customers are trapped and the company keeps winning new ones" — a far more valuable proposition.

The second power is the cornered resource we met earlier: the Non-Bank Trustee license paired with a purpose-built platform, which lets HealthEquity capture custodial economics that a pure software competitor structurally cannot. The third is scale economies. The cost of building and maintaining the platform — the software, the compliance apparatus, the call centers, the security infrastructure — is largely fixed, and spreading it across 17.8 million accounts drives real operating leverage. You can see it in the financials: adjusted EBITDA of $566 million on $1.31 billion of revenue in fiscal 2026, with margins that expand as the account base grows.¹ The larger HealthEquity gets, the harder it is for a subscale rival to match its cost per account — which is exactly why the smaller regional custodians keep selling their books to it.

Notice what is not on the list. HealthEquity has no meaningful network effect in the classic sense — one employer's HSA does not become more valuable because another employer joins — and its brand, while respected in benefits circles, is not a consumer household name that commands a price premium. The moat is real, but it is a moat of position and lock-in, not of network or brand. That distinction matters because it tells you where the vulnerability lies: at the point of initial sale, before the switching costs have taken hold, HealthEquity must win on price, service, and product like anyone else.

Porter's Five Forces sharpens the same picture. The threat of new entrants is genuinely low: a would-be competitor needs the trustee status, the payroll and health-plan integrations, and the insurer relationships all at once, and assembling them from scratch is a multi-year, capital-intensive slog with an entrenched incumbent already in every enrollment portal. Buyer power is the interesting split — it is high for the mega-employers who negotiate down per-employee service fees and can credibly threaten to switch at renewal, but essentially nil for the individual member, who did not choose HealthEquity and faces real friction leaving it. And the force that keeps management honest is competitive rivalry, which is intense among the industry's "Big Four": HealthEquity, Fidelity, Optum's HSA business, and HSA Bank. It is worth putting faces on those rivals, because they are not interchangeable. Together the "Big Four" — HealthEquity, Optum's HSA business, Fidelity, and HSA Bank — control close to two-thirds of the total HSA market.⁷ Each comes at it from a different fortress. Optum Bank is the custody arm of UnitedHealth Group's healthcare-services empire, with a natural pipeline of members flowing from the nation's largest health insurer — a distribution advantage HealthEquity cannot replicate. HSA Bank, a division of Webster Bank, is the old-guard bank-model incumbent, holding deposits on its own balance sheet the traditional way. And Fidelity, the newest serious threat, comes from the wealth-management side, wielding a zero-fee product and a hundred million existing brokerage relationships. HealthEquity's distinction is that it is the largest dedicated, non-bank custodian — the only one of the four for which HSAs and adjacent consumer-directed benefits are the entire business rather than a feature bolted onto a bank or an insurer.⁷ That focus is a double-edged sword: it makes HealthEquity the purest expression of the model, but it also means the company has nowhere to hide if the model's economics deteriorate. Optum can subsidize its HSA with insurance profits; Fidelity can give the account away to win the brokerage relationship. HealthEquity has to make the HSA itself pay.

That rivalry is the hinge of the entire investment debate, because one of those four does not play by the others' rules — and that is where the bull and bear cases collide.

↑ Back to Top

VIII. The Bull & Bear Stress Tests

Every great float business eventually meets the same two questions: what happens when rates fall, and what happens when someone decides to give the product away for free? HealthEquity faces both, and the honest answer is that its fate turns on which force compounds faster — its structural advantages or its structural exposures. Let's war-game both sides.

The bull case rests on two engines, one financial and one demographic. The first is the consolidation flywheel. The HSA custody business is quietly brutal for subscale players: rising compliance burdens, security requirements, and the capital intensity of building competitive technology are driving smaller regional banks out of the business entirely. When they exit, they sell their HSA books — and HealthEquity, with its cost advantage and its trustee infrastructure, is the natural, often the only serious, buyer. BenefitWallet was one such portfolio; management speaks of a continuing pipeline of others.³ Each acquisition, as we saw, pays for itself in a few years and then prints high-margin cash. As long as spreads stay reasonable and cheap portfolios keep coming to market, this is a genuinely powerful, self-reinforcing loop.

The second bull engine is generational and slower-burning: the "shoeboxing" tail. The behavioral shift toward treating the HSA as a retirement account is still early. On the Q4 call, management stressed that roughly 95% of members have not maxed their contributions and more than 90% have never invested.³ If millennials and Gen Z workers increasingly do what the sophisticated minority already does — max the account, invest the balance, hoard the receipts, and let it compound for decades — then average balances swell across the entire base, dragging up custodial assets, investment-administration fees, and interchange together. This is a multi-decade demographic tailwind that requires no acquisition and no new customer, only engagement. The industry-wide data lends this thesis real support rather than mere hope: across the whole HSA market, invested assets jumped roughly 30% in 2025 to around $85 billion even though only about 10% of all accounts hold any invested dollars at all.⁷ The behavior is spreading from a small, sophisticated minority toward the mainstream, and it has decades left to run. It is precisely the opportunity the board hired Scott Cutler to harvest.

The bear case is equally coherent, and it starts with the mirror image of the model's greatest strength. HealthEquity's earnings are levered to interest rates through the custodial spread. The laddered contract book delays the pain of rate cuts — that is its purpose — but it does not eliminate it. In a sustained Federal Reserve easing cycle, HealthEquity's multi-year placements will eventually mature and roll over into lower-yielding contracts, and the fat spread that produces nearly half the company's revenue will compress. The ladder buys time; it does not repeal the rate cycle. An investor who mistakes the smoothness of the yield curve for immunity from it is misreading the business. The $2.4 billion of forward contracts locked through January 2028 is comforting precisely because it is finite.³

To see why this matters so much, size the exposure. Custodial revenue is roughly half of total revenue and carries the fattest margins in the business, so the average yield on HSA cash is not one variable among many — it is arguably the variable. Every tenth of a percentage point of yield across an $18 billion cash pool is on the order of $18 million of revenue that falls almost entirely to profit. Management's guidance for the yield to rise toward 3.8% in fiscal 2027 even as short rates ease is the ladder working exactly as designed, but it also means the company is, in a sense, harvesting the last of a rate cycle that has already turned. The bear does not need a crash; a patient grind of maturing contracts rolling into lower rates over three or four years would quietly compress the highest-margin dollars in the model, and no amount of account growth on the slower-growing service line would fully offset it. The ladder converts a cliff into a slope. It does not build a floor.

The second bear pillar has a name: Fidelity. While HealthEquity monetizes members through spreads and fees, Fidelity has spent years attacking the market from the consumer side, offering zero-fee, retail-friendly HSAs directly to individuals, integrated into the brokerage accounts millions already hold. Fidelity does not need to make money on the HSA itself; it is happy to gather the assets and monetize the broader relationship. For the high-balance, investment-oriented saver — the exact customer whose "shoeboxing" behavior the bull case depends on — Fidelity's free, self-directed product is a direct and attractive alternative. This is the strategic vulnerability of a position-based moat: Fidelity is not trying to migrate HealthEquity's locked-in employer accounts, which would be hard. It is competing for the new, self-directed, rate-sensitive saver at the point of choice, where HealthEquity's switching-cost moat does not yet exist. Industry-wide fee compression is the natural consequence, and it is a slow bleed rather than a sudden break.

The third bear pillar is the one that already drew blood: cybersecurity. On July 2, 2024, HealthEquity disclosed in an SEC filing that it had suffered a data breach.⁵ The company had detected a systems anomaly on March 25, 2024, and its investigation ultimately determined that unauthorized access — traced to compromised credentials belonging to a vendor's user accounts, used to reach files in a SharePoint-based online storage location — had exposed the personal information of approximately 4.3 million individuals.⁴ The compromised data varied by person but could include names, contact and employer information, Social Security numbers, and health-plan and benefits details — precisely the sensitive Protected Health Information that makes a benefits administrator an attractive target.⁴ HealthEquity offered affected individuals two years of credit monitoring and identity-restoration services.⁴ The incident did not breach the company's core systems, but that nuance offers cold comfort: it exposed the structural risk of a platform that sits atop a web of employer, health-plan, and vendor integrations, any one of which can become the weak link. The fallout — remediation costs, elevated ongoing security and fraud-prevention spending, compliance overhead, and the tail risk of class-action litigation — pressured margins into fiscal 2025 and remains a live overhang. Management's claim that fraud costs have since fallen back inside its own tolerance is credible and specific, but a business built on custodial trust cannot treat a breach of 4.3 million records as a one-time event fully behind it.³

An activist or short-seller stress-testing HealthEquity would press on exactly these seams: the interest-rate sensitivity dressed up as recurring revenue, the fee compression Fidelity is importing into the category, the integration and technology debt still lingering from WageWorks, and the governance question of whether a marketplace CEO with no benefits background is the right steward for a regulated custodial business. None of these is fatal on its own. Together they define the boundary of the bull case — the set of things that, if they break, break the story. Which is why the honest way to hold this company is not as a verdict but as a small set of numbers to watch.

↑ Back to Top

IX. Epilogue & What to Watch

There is a temptation, with a business this elegant, to fall in love with the mechanism — the float, the ladder, the tax code that keeps the deposits sticky — and to stop asking whether it still works. The discipline is to reduce the whole sprawling story to the two or three signals that will actually tell you, quarter by quarter, whether HealthEquity is winning or slowly being competed down. Three stand out.

The first is the average annualized yield on HSA cash. This single number is the live readout on whether the laddered contract strategy is doing its job. If the Fed eases and HealthEquity's yield holds up — as management's guidance toward roughly 3.8% in fiscal 2027 implies — then the ladder is working as advertised and the highest-margin revenue line is insulated.³ If the yield starts sliding faster than the roll-over schedule should allow, the core of the bear case is materializing in real time. Watch it against the direction of short-term rates; the gap between the two is the whole story.

The second is the mix between HSA cash and HSA investments. Fiscal 2026 was the crossover year, when invested assets ($18.5 billion) first exceeded cash ($18.0 billion).¹ The direction of travel from here matters enormously, because it pits the two halves of the model against each other: rising investment balances are wonderful for long-term asset growth and terrible for near-term custodial spread. The number to watch is not the level but the pace — is cash still growing in absolute dollars as new accounts arrive, or is the migration into funds outrunning new deposits and shrinking the float pool outright? The former is healthy compounding; the latter is a warning.

The third is net new HSA additions, the cleanest test of whether the platform is still winning at the point of sale where its switching-cost moat does not yet protect it. HealthEquity has added more than a million new HSAs from sales in each of the last two years.¹ Sustaining that under Cutler's consumer-engagement strategy — and against Fidelity's free-product incursion — is the proof that the enterprise distribution engine still works and that the company is gaining share rather than merely riding a growing market.

It is worth closing by fact-checking the two narratives that tend to attach themselves to this company, because both are half-myths. The bull narrative holds that HealthEquity is a capital-light SaaS compounder with a regulatory moat and a multi-decade demographic tailwind — essentially a software company that happens to earn interest. The reality is that nearly half its revenue and the great majority of its incremental profit come from an interest-rate spread, which makes it, in an important sense, a lightly regulated specialty-finance business wearing a software company's multiple. The bear narrative holds the mirror image: that HealthEquity is just a leveraged bet on rates, a float business whose recent earnings are a sugar high that a Fed easing cycle will burn off. The reality there is that the switching costs, the trustee license, the enterprise distribution, and the genuine secular growth in HSA adoption are real, durable advantages that no amount of rate-cutting erases. The truthful description sits between the two myths: HealthEquity is a structurally advantaged distribution and custody platform whose near-term earnings power is nonetheless heavily geared to a macro variable it does not control. An investor who holds only one of those two facts will misjudge the company — the bull by underpricing the rate risk, the bear by underpricing the moat.

Track those three and you will know most of what matters about HealthEquity without a single earnings call. The larger truth the company embodies is a genuinely unusual one. HealthEquity is a crossover creature: it used a quirk of healthcare policy to build an enterprise software business, then used a quirk of trustee regulation to monetize that business like a bank, all without taking on a bank's risks. It is neither a pure fintech nor a pure health-tech nor a pure SaaS company, but a chimera that borrows the best economics of each. That is what makes it fascinating. It is also what makes it fragile in a specific way: a business that depends on a rate spread, a regulatory license, and the continued goodwill of members who trust it with their most sensitive data is a business whose moat, however wide today, must be re-earned every year. The float is real. The question every investor has to keep asking is how long, and at what price, HealthEquity gets to keep the spread.