What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-29 compared with 2023-02-24 · 72 added, 79 removed, 567 unchanged (21% of the section changed)

15 unchanged sentences

• retaining our management team and key employees and recruiting and retaining new employees;

• managing the increased complexity of our solutions and a higher volume of implementations;

• providing client support;

• managing the increased complexity of our clients’ integration and functionality requirements;

• shifts in the number of account holders and registered users of our solutions, their use of our solutions and our clients’ implementation and client support needs;

• acquiring or investing in other companies or pursuing business partnerships;

1 unchanged sentence

• cybersecurity breaches or other compromises of our security measures or those of third parties upon which we rely;

• increased privacy concerns, laws, regulations and standards and our processing and use of the personal information of end users;

• privacy and data security concerns, laws, regulations and standards and our processing and use of the PI of end users;

• intense competition in the markets we serve;

4 unchanged sentences

• protecting our intellectual property rights and defending ourselves against claims that we are misappropriating the intellectual property rights of others;

• using open-source software in our solutions;

• using open-source software in our solutions or risks resulting in the disclosure our proprietary source code to our clients;

• complying with license or technology agreements with third parties and our ability to enter into additional license or technology agreements on reasonable terms;

6 unchanged sentences

• future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders;

• anti-takeover provisions in our charter documents and Delaware law.

• anti-takeover and exclusive forum provisions in our governing documents.

Risks Relating to Our Business

8 unchanged sentences

If we fail to achieve the necessary level of efficiency in our organization as we grow, our business, financial condition and results of operations could be harmed.

Additionally, if we do not effectively manage the growth of our business and operations, the quality of our solutions could suffer, which would negatively affect our brand, operating results and overall business.

Additionally, if we do not effectively manage the growth and required maturation of our business and operations, the quality of our solutions could suffer, which would negatively affect our brand, operating results and overall business.

We may not be able to sustain the diversity and pace of improvements to our offerings successfully or implement systems, processes and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations.

21 unchanged sentences

We have limited historical data with respect to rates of client subscription renewals and cannot be certain of anticipated renewal rates.

Our renewal rates may decline or fluctuate as a result of a number of factors, including our clients’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels.

Our renewal rates may decline or fluctuate as a result of a number of factors, including our clients’ satisfaction with our pricing or our solutions or their

ability to continue their operations or spending levels.

As we sign more contracts, we will generally have an increasing amount of contracts coming up for renewal.

6 unchanged sentences

Prospective clients often undertake a prolonged evaluation process, which typically involves not only our solutions, but also those of our competitors.

We may spend substantial time, effort and money on our sales and marketing efforts without any assurance that our efforts will produce any sales.

It is also difficult to predict the level and timing of sales opportunities that come from our referral partners.

We spend substantial time, effort and money on our sales and marketing efforts without any assurance that our efforts will produce any sales.

Events affecting our clients’ businesses may occur during the sales cycle that could affect the size or timing of a purchase, contributing to more unpredictability in our business and results of operations.

9 unchanged sentences

If we are unable to effectively integrate our solutions with other systems used by our clients, or if there are performance issues with such third-party systems, our solutions will not operate effectively, and our business, financial condition and results of operations could be materially and adversely affected.

The Alkami Platform integrates with other third-party systems used by our clients, including core processing and payment systems.

The Alkami Digital Banking Platform integrates with other third-party systems used by our clients, including core processing and payment systems.

We do not have formal arrangements with many of these third-party providers regarding our access to their application program interfaces to enable these client integrations.

14 unchanged sentences

In addition, negative publicity resulting from issues related to our client relationships, regardless of accuracy, may adversely affect our ability to attract new clients and maintain and expand our relationships with existing clients.

If the use of our digital banking solutions increases, or if our clients demand more advanced features from our solutions, we will need to devote additional resources to improving our solutions, and we also may need to expand our technical infrastructure at a more rapid pace than we

have in the past.

This would involve spending substantial amounts to increase our cloud services infrastructure, purchase or lease data center capacity and equipment, upgrade our technology and infrastructure and introduce new or enhanced solutions.

26 unchanged sentences

Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

Defects, errors or other performance problems in the Alkami Platform could harm our reputation, result in significant costs to us, impair our ability to sell our solutions and subject us to substantial liability.

The Alkami Platform is complex and may contain defects or errors when implemented or when new functionality is released, or when we modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends.

Defects, errors or other performance problems in the Alkami Digital Banking Platform could harm our reputation, result in significant costs to us, impair our ability to sell our solutions and subject us to substantial liability.

The Alkami Digital Banking Platform is complex and may contain defects or errors when implemented or when new functionality is released, or when we modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends.

From time to time, we have discovered, and may in the future discover, defects or errors in our solutions.

2 unchanged sentences

In addition, if we have any such errors, defects or other performance problems, our clients could seek to terminate their contracts, elect not to renew their subscriptions, delay or withhold payment or make claims against us.

Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations.

Any of these actions could result in liability,

lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations.

Additionally, our software utilizes open-source software and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, financial condition and results of operations.

We rely on our management team and other key employees, and the loss of one or more key employees could harm our business.

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, Stephen Bohanon, our co-founder and Chief Strategy and Product Officer, W.

Bryan Hill, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions.

29 unchanged sentences

We may acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments or partnerships.

We have in the past considered and we may in the future consider, potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets.

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets.

We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies.

Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control.

In addition, we have limited experience in acquiring other businesses.

If an acquired business fails to meet our

expectations, our business, financial condition and results of operations could be materially and adversely affected.

In addition, we have limited experience in acquiring other businesses and the market reaction to our acquisitions may be unfavorable, which may impact our stock price.

If an acquired business fails to meet our expectations, our business, financial condition and results of operations could be materially and adversely affected.

We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target and we may not be successful in entering into an agreement with any particular target.

26 unchanged sentences

A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients’ customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations.

Certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support.

We, like other organizations, particularly in the financial technology sector, routinely are subject to cybersecurity threats, privacy breaches, insider threats, data breaches or other incidents that may either result in threatened or actual exposure resulting in unauthorized access, disclosure and misuse of PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business, and our technologies, systems and networks have been subject to attempted cybersecurity attacks.

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”).

We own and manage some of these IT Systems but also rely for on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third partners service providers, vendors, and business partners.

In addition certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support.

We, like other organizations, particularly in the financial technology sector, routinely are subject to and vulnerable to cybersecurity threats, privacy breaches, insider threats, data breaches or other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and may either result in threatened or actual exposure resulting in unauthorized access, disclosure and misuse of PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business, and our technologies, IT Systems and networks have been subject to attempted cybersecurity attacks.

Information security risks for banking and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties.

Because of our position in the financial services industry, we believe that we are likely to continue to be a target of such threats and attacks.

Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks.

Additionally, geopolitical events and resulting government activity could also lead to information security threats and attacks by affected jurisdictions and their sympathizers.

Although we maintain policies, procedures and technological safeguards and administrative controls designed to protect our information technology system and applications, violations of such policies, procedures and safeguards have occurred in the past and, despite the security measures we have in place, there can be no assurance that our safety and security measures (and those of our third-party providers) will prevent damage to, or interruption or breach of, our information systems and operations.

Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, our technology may fail to adequately secure the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the integrity or availability of data, PI or our systems and operations, and data contained in such systems and operations, or the related costs we may incur to mitigate the consequences from such events.

Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses.

Further, the Alkami Platform involves flexible and complex software solutions, and there is a risk that configurations of, or defects in, the solutions or errors in implementation could create vulnerabilities to security breaches or incidents.

There may be, and have been in the past, unlawful attempts to disrupt or gain access to our information technology systems that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations.

We may be unable to anticipate or prevent techniques used to obtain unauthorized

access or to sabotage systems, react in a timely manner or implement adequate preventative measures.

Although we maintain policies, procedures and technological safeguards and administrative controls designed to protect our information technology system and applications, violations of such policies, procedures and safeguards have occurred in the past and, despite the security measures we have in place, there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations.

Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, our technology may fail to adequately secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs we may incur to mitigate the consequences from such events.

Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Further, the Alkami Digital Banking Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities that can lead to security breaches or incidents.

We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations.

We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems, react in a timely manner or implement adequate preventative measures.

Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients which may have access to PI and other data about our clients.

Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information.

Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information.

Any of the foregoing could result in a material adverse effect on our business, reputation, financial condition and results of operations.

2 unchanged sentences

Our ability to monitor our third-party providers’ data security is limited.

A vulnerability in our third-party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions.

A vulnerability in our third-party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions.

Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are potentially vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted.

Threats to our computer systems and those of our third-party providers or clients may result from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure.

Furthermore, the use of generative artificial intelligence has made it easier for threat actors to develop and evolve attacks.

Threats to our IT Systems and those of our third-party providers or clients may result from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure.

In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions.

Current or future criminal capabilities, discovery of existing or new vulnerabilities and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions.

In the event our or our third-party providers’ protection efforts are unsuccessful and our systems or solutions are compromised, we could suffer substantial harm.

Current or future criminal capabilities, including by the use of generative artificial intelligence, discovery of existing or new vulnerabilities and attempts to exploit those vulnerabilities or other developments, may compromise or breach our IT Systems or solutions.

In the event our or our third-party providers’ protection efforts are unsuccessful and our IT Systems or solutions are compromised, we could suffer substantial harm.

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in operational disruptions and the loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations.

Any such incidents may also result in regulatory investigations and orders, litigation, disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations.

Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations.

Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future.

Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating and remediating any information security vulnerabilities and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition and results of operations.

Federal, state and international regulations may require us or our clients to notify governmental entities and individuals of data security incidents involving certain types of PI or information technology systems.

Federal, state and international regulations, including new regulations promulgated by the SEC, may require us or our clients to notify governmental entities, individuals and/or investors of data security incidents involving certain types of PI or IT Systems or that materially impact our business.

Security compromises experienced by others in our industry, our clients, our third-party providers or us may lead to public disclosures and widespread negative publicity.

Any security compromise in our industry, whether actual or perceived, could erode client confidence in the effectiveness of our security measures, negatively impact our ability to attract new clients, cause existing clients to elect not to renew or expand their use of our solutions or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, which could materially and adversely affect our business, financial condition and results of operations.

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or client customers could suffer harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes.

In such cases, we could face exposure to legal claims, particularly if the client and/or client customer suffered actual harm.

We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim.

enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim.

We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim.

7 unchanged sentences

Privacy and data security concerns, data collection and transfer restrictions, contractual obligations and U.S.

and foreign laws, regulations and industry standards related to data privacy, security and protection could limit the use and adoption of the Alkami Platform and materially and adversely affect our business, financial condition and results of operations.

and foreign laws, regulations and industry standards related to data privacy, security and protection could limit the use and adoption of the Alkami Digital Banking Platform and materially and adversely affect our business, financial condition and results of operations.

In operating our business and providing services and solutions to our clients, we collect, use, store, transmit and otherwise process sensitive employee and client data, including PI regarding client customers and other individuals, in and across multiple jurisdictions, including at times, across national borders.

13 unchanged sentences

These rules also impose requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines.

In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information.

In addition, every state in which we operate (and the District of Columbia) has laws that protect the privacy and security of sensitive and personal information.

state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

For example, California enacted the California Consumer Privacy Act of 2018 (“CCPA”) which went into effect in January 2020 and became enforceable by the California Attorney General in July 2020, and which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information.

For example, California enacted the California Consumer Privacy Act of 2018 (“CCPA”) which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information.

The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

Additionally, the California Privacy Rights Act (“CPRA”) was passed in November 2020.

Effective in most material respects beginning on January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and will significantly modify the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

The effects of the CCPA and the CPRA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

Certain other state laws impose similar privacy obligations, and all 50 states and the District of Columbia have laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others.

For example, the CCPA has prompted the enactment of several new state laws or amendments of existing state laws, such as in New York and Nevada.

The CCPA has also prompted a number of proposals for new federal and state-level privacy legislation, such as in Virginia, Colorado, Washington, Maryland, New York, Illinois and Nebraska.

This legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

Additionally, the California Privacy Rights Act (“CPRA”), passed in November 2020, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also created a new state agency vested with authority to implement and enforce the CCPA and the CPRA.

The effects of existing state legislation, including the CCPA and the CPRA, are significant and has required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

Internationally, many jurisdictions have established their own data privacy and security legal framework with which we or our clients may need to comply as client customers travel outside of the United States, including, but not limited to, the European Union (“EU”).

The EU’s data protection landscape is currently evolving, resulting in possible significant operational costs for internal compliance and risk to our business.

The EU has adopted the General Data Protection Regulation (“GDPR”), which went into effect in May 2018 and contains numerous requirements and changes from previously existing EU law, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies.

The EU has adopted the General Data Protection Regulation (“GDPR”), which contains numerous requirements and changes from previously existing EU law, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies.

In particular, under the GDPR, fines of up to 20 million euros or up to 4% of the annual global revenues of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements.

2 unchanged sentences

Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities.

In addition, any such

action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations.

In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations.

We cannot yet fully determine the impact these or future laws, rules, regulations and industry standards may have on our business or operations.

17 unchanged sentences

Potential clients may also prefer to continue their relationship with their existing partner rather than change to a new partner regardless of product performance or features.

As a result, even if the features of the Alkami Platform are superior, clients may not purchase our solution.

As a result, even if the features of the Alkami Digital Banking Platform are superior, clients may not purchase our solution.

In addition, innovative start-up companies, and larger companies that are making significant investments in research and development, may develop similar or superior products and technologies that compete with our solutions.

5 unchanged sentences

We derive all of our revenues from clients in the financial services industry, and any downturn, consolidation or decrease in technology spend in the financial services industry could materially and adversely affect our business, financial condition and results of operations.

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns and increased regulation.

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns, the rapid and sustained increase in interest rates, exposure to loan assets and lending policies and the value, if any, of underlying collateral and increased regulation.

In the recent past, FIs have experienced consolidation, distress and failure, and very few new FIs are being created.

It is possible these conditions may continue into the future, and even if conditions improve for FIs, there can be no guarantee that these conditions will not reoccur.

If any of our clients fail or merge with, or are acquired by, other entities, such as FIs that have internally developed banking technology solutions or that are not our clients or use our solutions less, our business, financial condition and results of operations could be materially and adversely affected.

materially and adversely affected.

Additionally, changes in management of our clients could result in delays or cancellations of the implementation of our solutions.

5 unchanged sentences

The life cycles of our solutions are difficult to estimate.

Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our

current market position.

Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our current market position.

Other means of digital banking may be developed or adopted in the future, and our solutions may not be compatible with these new technologies.

17 unchanged sentences

Assuring that our products adapt to changes in the compliance obligations or expectations of our customers requires significant expense and devotion of resources on our part which may adversely affect our ability to operate profitably.

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with performing business functions that our solutions address.

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address.

As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the Federal Financial Institutions Examination Council (“FFIEC”), and we are also required to review and perform due diligence on certain of our third-party providers.

14 unchanged sentences

§§ 36.101, et seq.

Third-party advocates and individuals with disabilities seek changes to existing law and regulation, or advocate for novel legal rulings in court, against FIs when desktop websites or mobile applications do not meet or exceed the Web Content Accessibility Guidelines 2.1 digital accessibility standard, which was developed in part to help ensure that the content developed for banks, credit unions and other financial institutions can be accessed and used by

people with or without disabilities.

The evolving, complex and often unpredictable regulatory and litigation environment in which our clients operate could result in our failure to provide compliant solutions, which could result in clients not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible or for which our clients may seek indemnity from us.

9 unchanged sentences

registered patents related to automated clearing house transaction notifications and the facilitation of transaction disputes and 24 issued patents, inclusive of U.S.

registered patents and international patents, as well as six patent applications pending in the United States, related to our Segmint marketing technology business.

registered patents and international patents, as well as five patent applications pending in the United States, related to our Segmint marketing technology business.

We currently own the U.S.

31 unchanged sentences

We may not be able to obtain adequate remedies for such breaches.

Additionally, to the extent that our employees, independent contractors or other third parties with whom we do business use intellectual

property owned by others in their work for us, disputes may arise as to the rights in related or resulting know-how and inventions.

Additionally, to the extent that our employees, independent contractors or other third parties with whom we do business use intellectual property owned by others in their work for us, disputes may arise as to the rights in related or resulting know-how and inventions.

The loss of trade secret protection could make it easier for third parties to compete with our products and services by copying functionality.

30 unchanged sentences

From time to time, third parties may assert, and in the past have asserted, claims of infringement, misappropriation or other violation of intellectual property rights against us and FIs with whom we do business.

Recently, for instance, a large financial services company has been successfully enforcing certain patents related to the use of remote deposit capture technology--a process that virtually every FI offers to its end users.

Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit and regardless of the outcome, could cause us to incur substantial costs defending against the claim, distract our management from our business, require us to redesign or cease use of such intellectual property, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships.

The outcome of any allegation is often uncertain.

Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential

information could be compromised by disclosure during this type of litigation.

Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation.

If any of our technologies, products or services are found to infringe upon, misappropriate or violate a third party’s intellectual property rights, we could be required to obtain a license from such third party to continue commercializing or using such technologies, products and services.

28 unchanged sentences

Even if such licenses are available, we may be required to pay the licensor substantial royalties based on sales of our products and services.

Such royalties are a component of the cost of our products or services and may affect the margins on our products and services.

Such royalties are a component of the cost of our products or services

and may affect the margins on our products and services.

In addition, such licenses may be non-exclusive, which could give our competitors access to the same intellectual property licensed to us.

24 unchanged sentences

In the event of revenue shortfalls, we may not be able to mitigate the negative impact on our results of operations quickly enough to avoid short-term impacts.

Because we recognize revenues from our solutions over the terms of our client agreements, the impact of changes in the subscriptions for our solutions will not be immediately reflected in our operating results.

We generally recognize revenues from subscription fees paid by clients over their contractual term.

Because we recognize revenues from our solutions over the terms of our client agreements, beginning from live use of the service, the impact of changes in the subscriptions for our solutions will not be immediately reflected in our operating results.

We generally recognize revenues from subscription fees paid by clients over their contractual term beginning from live use of the service.

As a result, the substantial majority of the revenues we report in each quarter is related to agreements entered into during previous quarters.

1 unchanged sentence

Accordingly, the effect of significant downturns in sales and market acceptance of our solutions, or changes in our rate of renewals, may not be fully reflected in our results of operations until future periods.

Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as we generally recognize subscription revenues from new clients over the applicable subscription terms.

Our limited operating history makes it difficult to evaluate our current business and future prospects, and our recent success may not be indicative of our future results of operations.

10 unchanged sentences

We intend to continue to expend significant resources to support further growth and extend the functionality of our solutions, expand our sales and product development headcount and increase our marketing activities.

We will also face increased costs associated with growth, the expansion of our client base and the costs of being a public company.

We will also face

increased costs associated with growth, the expansion of our client base, regulatory compliance and information security and the costs of being a public company.

Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses.

19 unchanged sentences

Section 382 of the Code may further limit our ability to utilize our pre-change NOLs or other pre-change tax attributes if we undergo a future ownership change.

We have experienced ownership changes in the past and could experience one or more ownership changes in the future and as a result of future changes in our stock ownership, some of which changes may be outside our control.

We have experienced ownership changes in the past and could experience one or more ownership changes in the future, some of which changes may be outside our control.

As a result, if we earn net taxable income, our ability to use our pre-change NOL carryforwards to offset post-change taxable income may be subject to limitations.

13 unchanged sentences

If we raise additional capital through debt financing, the terms of any new debt could further restrict our ability to operate our business.

On April 29, 2022, the Company entered into an amended and restated credit agreement with Silicon Valley Bank, Comerica Bank, and Canadian Imperial Bank of Commerce (the “Amended Credit Agreement”).

The Amended Credit Agreement amends and restates the prior credit facility provided by Silicon Valley Bank and KeyBank National Association (“the Original Credit Agreement”).

The Amended Credit Agreement matures on April 29, 2025.

The Amended Credit Agreement provided us with a term loan facility of $85.0 million and a revolving credit facility of up to $40.0 million.

On June 27, 2023, the Company entered into a First Amendment (the “First Amendment”) to the Company’s Amended and Restated Credit Agreement dated as of April 29, 2022 (as amended by the First Amendment, the “Amended Credit Agreement”), with Silicon Valley Bank (“SVB”), Comerica Bank, and Canadian Imperial Bank of Commerce.

The First Amendment, among other things, extended the maturity date of the Amended Credit Agreement to April 29, 2026.

Our payment obligations under the Amended Credit Agreement reduce cash available to fund working capital, capital expenditures, research and development and other corporate purposes, and limit our ability to obtain additional financing for working capital, capital expenditures, expansion plans and other investments, which may in turn limit our ability to implement our business strategy, heighten our vulnerability to downturns in our business, the industry, or in the general economy, limit our flexibility in planning for, or reacting to, changes in our business and the industry and prevent us from taking advantage of business opportunities as they arise.

16 unchanged sentences

If that were to happen, we may not be able to repay all of the amounts that would become due under our indebtedness or refinance our debt, which could materially harm our business and force us to seek bankruptcy protection.

Our outstanding indebtedness and any future indebtedness, combined with our other financial obligations, could increase our vulnerability to adverse changes in general economic, industry and market conditions, limit our flexibility in planning for, or reacting to, changes in our business and the industry and impose a competitive disadvantage compared to our competitors that have less debt or better debt servicing options.

Any future indebtedness, combined with our other financial obligations, could increase our vulnerability to adverse changes in general economic, industry and market conditions, limit our flexibility in planning for, or reacting to, changes in our business and the industry and impose a competitive disadvantage compared to our competitors that have less debt or better debt servicing options.

Risks Related to Being a Newly Public Company

47 unchanged sentences

Nothing in our current certificate of incorporation or bylaws or our restated certificate of incorporation or amended and restated bylaws precludes stockholders that assert claims under the Exchange Act from bringing such claims in federal court, to the extent that the Exchange Act confers exclusive federal jurisdiction over such claims, subject to applicable law.

Unresolved Staff Comments.

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors