What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-26 compared with 2025-02-27 · 71 added, 45 removed, 380 unchanged (23% of the section changed)

9 unchanged sentences

We face intense competition in our businesses and we expect competition to remain intense in the future.

We have many competitors that are significantly larger than us and have significantly greater financial, technical and marketing resources, have well-established relationships with our

current or potential customers, advertise aggressively or beat us to the market with new products and services.

We have many competitors that are significantly larger than us and have significantly greater financial, technical and marketing resources, have well-established relationships with our current or potential customers, advertise aggressively or beat us to the market with new products and services.

Mergers and acquisitions by, and collaborations between, the companies we compete against may lead to even larger competitors with more resources.

8 unchanged sentences

If we experience business interruptions, cybersecurity incidents or failure of our information technology and communication systems, the availability of our products and services could be interrupted which could adversely affect our reputation, business and financial condition.

Our ability to provide reliable service in a number of our businesses depends on the efficient and uninterrupted operation of our data centers, information technology and communication systems, and those of our external service providers or business partners.

We have experienced non-material incidents in the past.

9 unchanged sentences

Cybersecurity incidents vary in their form and can include the deployment of harmful malware or ransomware, denial-of-services attacks, and other attacks, which may affect business continuity and threaten the availability, confidentiality and integrity of our systems and information.

Cybersecurity incidents can also include employee or personnel failures, fraud, phishing or other social engineering attempts or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient.

Cybersecurity threat actors also may attempt to exploit vulnerabilities in software including software commonly used by companies in cloud-based services and bundled software.

Cybersecurity incidents can also include employee or personnel failures, fraud, phishing or other social engineering attempts, AI deep fakes, zero-day sophistication, supply chain threats, AI created malware or ransomware, or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient.

Cybersecurity threat actors also may attempt to exploit vulnerabilities in both ACI and cloud provider infrastructure along with vulnerabilities in software including software commonly used by companies in cloud-based services and bundled software.

Like many other companies, we detect attempts by threat actors to gain access to our systems and networks on a frequent basis, and the frequency of such attempts could increase in the future.

Unauthorized access, use, or disruptions to our data, computer systems or databases or other cybersecurity incidents or similar attacks could result in the theft or publication of confidential information or the deletion or modification of records or could

otherwise cause interruptions in our operations.

Unauthorized access, use, or disruptions to our data, computer systems or databases or other cybersecurity incidents or similar attacks could result in the theft or publication of confidential information, including intellectual property and consumer information, or the deletion or modification of records or could otherwise cause interruptions in our operations.

These concerns about security are increased when we transmit information over the Internet.

5 unchanged sentences

A cybersecurity incident or failure or disruption relating to our information or systems or that of our third-party business partners, or any failure by us or our third-party business partners to effectively address, enforce and maintain our information technology infrastructure, systems, or security measures may result in substantial harm to our business strategy, results of operations and financial condition, including major disruptions to business operations, loss of intellectual property, release of confidential information, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity.

The shift to a remote/hybrid work model has expanded our attack surface, increasing the complexity of securing our information systems and data.

Although we maintain a cyber insurance policy, there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a cybersecurity incident or that such coverage will continue to be available on commercially reasonable terms or at all.

We rely on third-party cloud infrastructure and related services to deliver and operate our platform and deliver our solutions, and any disruption, limitation, or change in these cloud services could adversely affect our business, results of operations and financial condition.

Our platform and solutions depend on third-party cloud service providers for computing, storage, networking, and data management infrastructure.

We currently use Microsoft Azure and Amazon Web Services and may also utilize other cloud providers for hosting, content delivery, analytics, and AI services.

These cloud environments are critical to operating our platform and delivering our solutions.

If any of these third-party providers experience interruptions, capacity constraints, cybersecurity incidents, or performance degradation, or if we or our clients encounter technical issues in connecting to their platforms, our platform and solutions could become slow, unreliable, or unavailable.

Even temporary outages could harm our reputation, trigger service-level penalties under client contracts, and cause clients to delay renewals or choose our competitors.

Because many of the services we use are proprietary to our cloud providers, we may have limited ability to quickly migrate workloads to alternative vendors without incurring substantial costs or service disruption.

Our dependence on a small number of cloud vendors also exposes us to risks of pricing increases, changes in service terms, data egress or storage costs, and regional availability limitations.

Additionally, cloud service failures can originate not only from the primary vendor but from underlying networks, software updates, or third-party subprocessors integrated into those environments.

If our providers fail to maintain adequate security, availability, or compliance certifications, or if regulatory changes restrict cross-border data transfers or cloud usage for certain types of data, we may need to re-architect or relocate infrastructure, resulting in additional expense and operational complexity.

Any material disruption, data loss, increase in cost, or limitation in the performance, features, or availability of third-party cloud services could adversely affect our business, results of operations, and reputation.

Our reliance on third parties could adversely affect our operations, compliance, security and reputation.

We rely on third parties to operate our business, including with respect to software development and integration, intermediaries and agents that support international sales, external information technology and cloud service providers, and outsourced customer support providers.

These relationships introduce performance, financial, compliance, information security, continuity, and concentration risks that are often outside our control.

Our oversight, audit rights, and contractual remedies may be limited, and service level commitments or indemnities may not fully compensate for losses.

Failures by our third party partners to perform as expected, maintain adequate internal controls, protect data, meet quality or timeliness standards, or comply with applicable laws and regulations could result in interruptions to critical operations, delays in product delivery, security and privacy incidents, investigations, fines or penalties, adverse contract outcomes, and reputational harm.

Replacing or migrating away from a third party can be costly, complex, and time-consuming, and viable alternatives may not be available on acceptable terms or timelines.

Some third parties may also use or integrate AI tools in their development, support, or operational processes.

Such use can heighten risks of data leakage or misuse of confidential information, introduce biased or inaccurate outputs, or inadvertently incorporate third-party intellectual property.

Limited visibility into a partner’s AI governance, training data, and control frameworks may increase our exposure to compliance, IP, privacy, and reputational risks.

If any key third party were to fail to perform, cease operations, suffer a material disruption, or otherwise not provide services on acceptable terms, we could experience business interruptions, degraded platform or solution performance, increased costs to replace or duplicate services, customer dissatisfaction and churn, and litigation, any of which could materially and adversely affect our business, results of operations and financial condition.

If we engage in acquisitions, strategic partnerships or significant investments in new business, we will be exposed to risks which could materially adversely affect our business.

12 unchanged sentences

Occasionally, we may wind down certain business activities and perform other organizational restructuring projects in an effort to reduce costs and streamline operations.

For example, we divested our corporate online banking solutions related assets and liabilities to One Equity Partners on September 1, 2022.

Divestiture activities involve risks as they may divert management's attention from our core businesses, increase expenses on a short‑term basis and lead to

potential issues with employees or customers.

Divestiture activities involve risks as they may divert management's attention from our core businesses, increase expenses on a short‑term basis and lead to potential issues with employees or customers.

If we do not complete these activities in a timely manner, or do not realize anticipated cost savings, synergies and efficiencies, business disruption occurs during or following such activities, or we incur unanticipated charges, this may negatively impact our business, financial condition, operating results, and cash flows.

24 unchanged sentences

Competition for such skillsets is intense, and our failure to hire and retain talented personnel could have an adverse effect on our internal control environment and impact our operating results.

During the global COVID-19 pandemic, a significant portion of our workforce worked mostly in a remote environment.

While our employees have begun to transition back to the office, this remote environment has continued after the pandemic for some of our workforce in part or in full, and could impact the quality of our corporate culture.

Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent, or to maintain a corporate culture that fosters innovation, creativity, and teamwork could harm our overall business and results of operations.

To the extent that we convert some or all of our on-premise licenses from a fixed-term to a subscription model, our future financial results will be affected by the frequency at which our customers adopt our subscription model, which carries with it certain risks.

Our on-premise licenses currently have a five-year fixed term model.

In the future, we may transition some or all of these licenses to a subscription model.

A transition to a subscription model would reflect a significant shift from a fixed-term license.

In addition, a subscription model presents a number of risks to us including the following:

• arrangements entered into on a subscription basis generally delay the timing of revenue recognition and can require the incurrence of up-front costs, which may be significant and could make it difficult for investors to understand our results of operations as they compare to prior periods;

• subscription models make it difficult to rapidly increase revenues through additional bookings in any period, as revenues are recognized ratably over the subscription period;

• customers in a subscription arrangement may elect not to renew their contract upon expiration or they may attempt to renegotiate pricing or other contractual terms at the point of (or prior to) renewal on terms that are less favorable to us;

• there is no assurance that our customers will broadly accept a subscription model for our on-premise licenses.

Certain anti-takeover provisions contained in our charter and under Delaware law could hinder a takeover attempt.

82 unchanged sentences

Political, military, and other international developments can undermine bilateral cooperation in key policy areas, significantly disrupt trade, and otherwise adversely affect economic conditions.

Recent events in eastern Europe and the Middle East present challenges and risks to us, and no assurances can be given that current or future developments would not have a material adverse effect on our business, results of operations and financial condition.

The crises in eastern Europe and the Middle East continue to be a challenge to global companies, including us.

Macroeconomic and geopolitical conditions could adversely affect our business, results of operations and financial condition.

Adverse or uncertain macroeconomic conditions, including inflation, interest rate volatility, recessionary pressures, reduced consumer spending, banking stress, and foreign currency fluctuations, may lead customers to delay or reduce spending, extend sales and implementation cycles, pressure pricing and renewals, impair collections, increase our operating costs, and limit access to capital.

Our global operations also expose us to differing local conditions and exchange‑rate movements that can affect reported results.

Current and potential conflicts continue to challenge global companies, including us.

We currently have one employee in Russia, a dormant customer in Russia, and customers located in the Middle East.

and other global governments have placed restrictions on how companies may transact with, and provide services or solutions to, parties in these regions, particularly Russia, Belarus and restricted areas in Ukraine.

No assurances can be given that additional developments in the impacted regions, and responses thereto from the U.S.

and other global governments, would not have a material adverse effect on our business, results of operations and financial condition.

and other global governments have placed restrictions on how companies may transact with, and provide services or solutions to certain countries, including Russia.

Geopolitical instability and related government actions (such as sanctions and export controls), can disrupt financial markets and payment networks, depress transaction volumes, restrict cross‑border activity, and increase operational risks.

We may be required to suspend or modify services, incur additional compliance and resiliency costs, or experience outages or vendor disruptions.

Any of these developments could materially adversely affect our business, results of operations and financial condition.

Risks Related to Our Products and Services

If customers do not adopt our new payment solution, ACI Connetic, as anticipated, our business, results of operations and financial condition could be adversely affected.

We have invested significant resources to design, develop, launch and commercialize ACI Connetic, which is our comprehensive cloud-native payments hub solution.

Customer adoption of ACI Connetic depends on our ability to provide compelling functionality and predictable implementation and migration paths from our existing products and solutions.

Introducing a new platform presents numerous operational, technical, financial and commercial risks.

Unanticipated defects, outages, latency, or other performance shortfalls could harm our reputation for reliability, trigger service credits or other remedies under customer agreements, increase our support and remediation costs, delay sales cycles, and reduce renewals or expansions.

Customers may delay or decline adoption if they perceive operational risk, insufficient incremental value, heightened or unnecessary switching costs, or a disruption to their existing user experience.

Even where customers elect to adopt ACI Connetic, implementation at a customer may prove to be more difficult, costly or time consuming than originally anticipated.

In addition, our competitors may offer their own solutions with features that our customers prefer.

Larger or better-capitalized competitors may replicate or outpace our innovations in ACI Connetic, bundle offerings, leverage broader ecosystems, or use pricing and contract terms that make it more difficult for us to retain our current customers or win new business.

If a material number of our customers choose not to adopt ACI Connetic or if we are unable to attract sufficient new customers to fuel our growth, our revenue could be adversely affected.

The introduction of ACI Connetic also creates risks of cannibalization and pricing pressure if our current customers migrate from higher‑priced legacy arrangements to ACI Connetic with different pricing or consumption models.

Any shift toward usage‑based or cloud‑delivered services could introduce revenue variability, require new go‑to‑market motions, or necessitate changes to partner programs and channel economics.

Additionally, to the extent ACI Connetic incorporates third‑party

technologies, cloud infrastructure, data residency options, artificial intelligence or machine learning features, or new compliance tooling, we may be exposed to supplier performance, intellectual property, regulatory, model governance, explainability, and data privacy risks, as well as evolving security standards and threat vectors.

Meeting financial services regulatory expectations across multiple jurisdictions is complex and may require incremental investment, controls, certifications, and audits, and any failure or delay could impede adoption or result in penalties or contractual remedies.

If we fail to execute on our ACI Connetic roadmap or if we do not gain a threshold level of market acceptance, we may experience slower than expected growth, lower retention rates, reduced revenue and margins and reputational harm.

The timing and magnitude of these effects are subject to uncertainty given the rapid pace of technological change and competition in the payments industry.

Even if market adoption of ACI Connetic occurs, it may take longer or cost more than we anticipate and may not generate the revenues we expect, which could materially adversely affect our business, results of operations and financial condition.

Global economic conditions could reduce the demand for our products and services or otherwise adversely impact our cash flows, operating results and financial condition.

10 unchanged sentences

Continued inflationary pressures could negatively impact our customers' ability to purchase our products and services, thereby negatively impacting our revenue and results of operations.

A negative or unpredictable economic climate could create uncertainty or financial pressures that impact the ability or willingness of our customers to make capital expenditures, thereby affecting their decision to purchase or roll out our products or services

or to pay accounts receivable owed to us.

Additionally, if customers respond to a negative or unpredictable economic climate by consolidation, it could reduce our base of potential customers.

30 unchanged sentences

courts, and the manner in which we configure and use these technologies may expose us to claims of copyright infringement or other intellectual property misappropriation.

New laws have been adopted in the EU, and it is possible that new laws and regulations will be adopted in the United States and in other countries, or that existing laws and regulations will be interpreted in ways that would affect the operation of our solution and the way in which

Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could harm our business, reputation, financial condition and results of operations.

21 unchanged sentences

We could also be forced to change our business practices or be required to obtain additional licenses or regulatory approvals that could cause us to incur substantial costs.

In addition, our customers must ensure that our services comply with the government regulations, including the EU GDPR, and industry standards that apply to their businesses.

In addition, our customers must ensure that our services comply with the government regulations, including the EU GDPR, DORA, and industry standards that apply to their businesses.

Federal, state, foreign or industry authorities could adopt laws, rules, or regulations affecting our customers’ businesses that could lead to increased operating costs that may lead to reduced market acceptance.

8 unchanged sentences

These laws and other developments relating to cross-border data transfer could result in increased costs of compliance and limitations on our customers and us.

If we fail to comply with applicable laws and regulations, including the EU GDPR, CCPA, and other laws, we could be exposed to regulatory investigations and actions, lawsuits for breach of contract or to governmental or consumer claims, our customer relationships and reputation could be harmed, and we could be inhibited in our ability to obtain new customers.

If we fail to comply with applicable laws and regulations, including the EU GDPR, DORA, CCPA, and other laws, we could be exposed to regulatory investigations and actions, lawsuits for breach of contract or to governmental or consumer claims, our customer relationships and reputation could be harmed, and we could be inhibited in our ability to obtain new customers.

Compliance with these and new laws could involve substantial expenses and divert resources from other initiatives and projects.

3 unchanged sentences

have adopted or proposed new privacy and cybersecurity laws targeting these issues.

Legislation and regulations on cybersecurity, data privacy, data protection and data localization may compel us to need to modify our systems, invest in new systems or alter our business practices or our policies on data governance and privacy.

Legislation and regulations on cybersecurity,

data privacy, data protection and data localization may compel us to need to modify our systems, invest in new systems or alter our business practices or our policies on data governance and privacy.

These actions could significantly increase our operational costs.

11 unchanged sentences

We are required to conduct our operations in compliance with the Consent Orders and Compliance Agreements.

While we have complied with the Consent Orders and Compliance Agreements, and have implemented processes by which we believe we will maintain compliance with the Consent Orders and Compliance Agreements going forward, we cannot be certain that we will

maintain compliance with the Consent Orders and Compliance Agreements in all instances.

In the event that we are deemed to be non-compliant with the terms of the Consent Orders and/or Compliance Agreements, the state and/or federal regulators have the authority to subject us to additional, and potentially more significant, corrective actions and could seek to initiate further enforcement actions against us, including seeking civil money penalties.

21 unchanged sentences

The Pillar Two Framework (“Pillar Two”) introduces a 15% global minimum effective tax rate for certain multinational groups.

Although the U.S.

has not yet adopted Pillar Two into law, several countries in which we operate have enacted tax legislation based on the Pillar Two framework.

Based on legislation enacted to date and currently available guidance, we have not recorded a material tax liability related to Pillar Two.

However, these global minimum tax rules are new and technically complex, and governments continue to issue updates on how they should be interpreted and applied.

Differences in how jurisdictions implement the rules, as well as future guidance from the OECD or taxing authorities, could change our tax obligations in future periods.

We continue to evaluate the impact of these legislative changes as additional guidance becomes available.

8 unchanged sentences

Any fluctuations in quarterly operating results may result in volatility in our stock price.

price may also be volatile, in part, due to external factors such as speculation regarding potential transactions, announcements by third parties or competitors, inherent volatility in the technology sector, variability in demand from our existing customers, failure to meet the expectations of market analysts, the level of our operating expenses, changing market conditions in the software industry, and the global economic downturn.

Our stock price may also be volatile, in part, due to external factors such as speculation regarding potential transactions, announcements by third parties or competitors, inherent volatility in the technology sector, variability in demand from our existing customers, failure to meet the expectations of market analysts, the level of our operating expenses, changing market conditions in the software industry, and the global economic downturn.

In addition, the financial markets have experienced significant price and volume fluctuations that have particularly affected the stock prices of many technology companies and financial services companies, and these fluctuations sometimes are unrelated to the operating performance of these companies.

46 unchanged sentences

Our outstanding debt contains restrictions and other financial covenants that limit our flexibility in operating our business.

Our credit facility and the indenture governing our 5.750% Senior Notes due 2026 (“2026 Notes”) contain customary affirmative and negative covenants for debt of these types that limit our ability to engage in specified types of transactions.

If an event of default occurs, the lenders, trustee, or holders of the 2026 Notes will be entitled to take various actions, including, but not limited to, demanding payment for all amounts outstanding.

Our credit facility contains customary affirmative and negative covenants for debt of these types that limit our ability to engage in specified types of transactions.

If an event of default occurs, the lenders or trustees will be entitled to take various actions, including, but not limited to, demanding payment for all amounts outstanding.

If adverse global economic conditions persist or worsen, we could experience decreased revenues from our operations attributable to reduced demand for our products and services and as a result, we could fail to satisfy the financial and other restrictive covenants to which we are subject under our existing debt, resulting in an event of default.

5 unchanged sentences

(ii) our debt level may limit operational flexibility and our ability to pursue business opportunities and implement certain business strategies;

(iii) we use a large portion of our operating cash flow to pay principal and interest on our credit facility and the 2026 Notes, which reduces the amount of money available to finance operations, acquisitions and other business activities;

(iii) we use a large portion of our operating cash flow to pay principal and interest on our credit facility, which reduces the amount of money available to finance operations, acquisitions and other business activities;

(iv) we have a higher level of debt than some of our competitors or potential competitors, which may cause a competitive disadvantage and may reduce flexibility in responding to changing business and economic conditions, including increased competition and vulnerability to general adverse economic and industry conditions;

1 unchanged sentence

(vi) there are significant maturities on our debt that we may not be able to fulfill or that may be refinanced at higher rates;

and (vii) if we fail to satisfy our obligations under our outstanding debt or fail to comply with the financial or other restrictive covenants

required under our credit facility and the 2026 Notes, an event of default could result that could cause all of our debt to become due and payable and could permit the lenders under our credit facility to foreclose on the assets securing such debt.

and (vii) if we fail to satisfy our obligations under our outstanding debt or fail to comply with the financial or other restrictive covenants required under our credit facility, an event of default could cause all of our debt to become due and payable and could permit the lenders under our credit facility to foreclose on the assets securing such debt.

Despite our current levels of debt, we may still incur substantially more debt, including secured debt, and similar liabilities,

which would increase the risks described in these risk factors relating to indebtedness.

Although the agreements governing our credit facility and our 2026 Notes include restrictions on our ability to incur additional debt, those agreements do not prohibit us from incurring additional debt or pursuing other financing arrangements.

Although the agreements governing our credit facility include restrictions on our ability to incur additional debt, those agreements do not prohibit us from incurring additional debt or pursuing other financing arrangements.

As a result, the amount of additional debt and other obligations that we could incur could be substantial.

Accordingly, to the extent permitted under our credit agreement or indenture, we could incur significant additional debt, liabilities or similar obligations in the future.

Accordingly, to the extent permitted under our credit agreement, we could incur significant additional debt, liabilities or similar obligations in the future.

In addition, if we form or acquire any subsidiaries in the future, those subsidiaries also could incur debt or similar liabilities.

24 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors