What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-28 compared with 2024-02-29 · 146 added, 81 removed, 558 unchanged (29% of the section changed)

13 unchanged sentences

• our dependence on the data centers operated by third parties and third-party internet hosting providers;

• defects, errors or performance problems associated with our solutions;

• defects, errors or other performance problems associated with our solutions;

• retaining our management team and key employees and recruiting and retaining new employees;

3 unchanged sentences

• natural or man-made disasters;

• use and reliance upon technology and development resources in India;

• environmental and social matters;

• cybersecurity breaches or other compromises of our security measures or those of third parties upon which we rely;

3 unchanged sentences

• evolving technological requirements and changes and additions to our solution offerings;

• the political, economic and competitive conditions in the markets and jurisdictions where we operate;

• reliance on the development of the market for digital banking solutions;

• regulations and laws applicable to us, our clients and our solutions;

• protecting our intellectual property rights and defending ourselves against claims that we are misappropriating the intellectual property rights of others;

• using open-source software in our solutions or risks resulting in the disclosure our proprietary source code to our clients;

• using open-source software in our solutions or risks resulting in the disclosure of our proprietary source code to our clients;

• complying with license or technology agreements with third parties and our ability to enter into additional license or technology agreements on reasonable terms;

2 unchanged sentences

• the way we recognize revenue, which has the effect of delaying changes in the subscriptions for our solutions from being reflected in our operating results;

• our limited operating history, our history of operating losses and our ability to use our net operating loss (“NOL”) carryforwards;

• our limited operating history, our history of operating losses and our ability to use our net operating loss carryforwards;

• our ability to raise sufficient capital and the resulting dilution and the terms of our Amended Credit Agreement (as defined below);

• our status as an emerging growth company;

• unanticipated changes in tax laws or regulations;

• loss of emerging growth company status;

• future strategic initiatives, including acquisitions of businesses and strategic investments;

• future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders;

34 unchanged sentences

We have limited historical data with respect to rates of client subscription renewals and cannot be certain of anticipated renewal rates.

Our renewal rates may decline or fluctuate as a result of a number of factors, including our clients’ satisfaction with our pricing or our solutions or their

ability to continue their operations or spending levels.

Our renewal rates may decline or fluctuate as a result of a number of factors, including our clients’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels.

As we sign more contracts, we will generally have an increasing amount of contracts coming up for renewal.

32 unchanged sentences

Further, any failure of or delays in our systems could cause service interruptions or impaired system performance.

Some of our client agreements require us to issue credits for downtime in excess of certain thresholds and in some instances give our clients the ability to terminate their agreements with us in the event of significant amounts of downtime.

Some of our client agreements require us to issue credits for downtime in excess of certain thresholds and in some instances give our clients the ability to terminate their

agreements with us in the event of significant amounts of downtime.

If sustained or repeated, these performance issues could reduce the attractiveness of our solutions to new and existing clients, cause us to lose clients, decrease our revenues and lower our renewal rates by existing clients, each of which could materially and adversely affect our business, financial condition and results of operations.

8 unchanged sentences

We depend on data centers operated by third parties and third-party internet hosting providers, principally Amazon Web Services, and any disruption in the operation of these facilities or access to the internet could adversely affect our business.

We primarily serve our clients from third-party data center hosting facilities provided by Amazon Web Services (“AWS”).

We primarily serve our clients from third-party data center hosting facilities provided by AWS.

We rely upon AWS to operate certain aspects of our solutions, and any disruption of or interference with our use of AWS has in the past and could in the future impair our ability to deliver our solutions to our clients, resulting in client dissatisfaction, damage to our reputation, loss of clients and harm to our business.

20 unchanged sentences

The Alkami Digital Banking Platform is complex and may contain defects or errors when implemented or when new functionality is released, or when we modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends.

From time to time, we have discovered, and may in the future discover, defects or errors in our solutions.

From time to time, we have discovered, and may in the future discover, defects or errors in

our solutions.

Any performance problems or defects in our solutions could materially and adversely affect our business, financial condition and results of operations.

1 unchanged sentence

In addition, if we have any such errors, defects or other performance problems, our clients could seek to terminate their contracts, elect not to renew their subscriptions, delay or withhold payment or make claims against us.

Any of these actions could result in liability,

lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations.

Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations.

Additionally, our software utilizes open-source software and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, financial condition and results of operations.

We rely on our management team and other key employees, and the loss of one or more key employees could harm our business.

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, Stephen Bohanon, our co-founder and Chief Strategy Officer, W.

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, W.

Bryan Hill, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions.

From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business.

We also are dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients.

We are also dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients.

We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause;

however, our employment agreements with our named executive officers provide for the payment of severance under certain circumstances.

We have also entered into employment agreements with our other executive officers which provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements.

We have also entered into employment agreements with our other executive officers that provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements.

The loss of one or more of our key employees could harm our business.

24 unchanged sentences

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets.

We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies.

We may also enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies.

Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control.

22 unchanged sentences

Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time.

Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations.

Moreover, although we have disaster recovery plans, they may prove inadequate.

Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations, and our disaster recovery plans may prove inadequate.

We may not carry sufficient business insurance to compensate for losses that may occur, and if such events become more frequent it may adversely impact the cost or availability of insurance going forward.

1 unchanged sentence

In addition, the facilities of our third-party providers, including AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which could cause disruptions, difficulties or otherwise materially and adversely affect our business, financial condition and results of operations.

Risks Relating to Cybersecurity or Data Privacy

A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients’ customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations.

Our use and reliance upon technology and development resources in India may expose us to unanticipated costs and liabilities, which could affect our ability to realize cost savings from our technology operations in India.

We have expanded our presence abroad by establishing a subsidiary in India during 2024.

While its operations are currently immaterial, we may face challenges related to regulatory compliance, tax implications, labor laws, currency fluctuations, and operational scaling in the future.

Our current and potential future operations in India are subject to certain risks, including:

• difficulties and costs of staffing and managing foreign operations as well as additional employment regulations, union workforce negotiations and potential disputes;

• heightened exposure to changes in economic, security and political conditions, civil unrest, armed conflicts and acts of terrorism;

• different standards of protection for intellectual property rights and confidentiality;

• the effects of pandemics, epidemics or other health crises on general health and economic conditions and natural disasters;

• fluctuations in foreign currency exchange rates and global market volatility;

• compliance with local laws and regulations, including privacy and security laws and regulations and labor laws;

• compliance with laws governing doing business outside the United States, including foreign or domestic legal and regulatory requirements resulting in the imposition of new or more onerous sanctions and anti-corruption laws, export and import controls, trade restrictions, tariffs, duties, taxes, embargoes, exchange or other government controls;

• laws and business practices favoring local companies;

• management of potentially adverse tax consequences from India, the United States, or both, as a result of our multi-jurisdiction operations.

The enforcement of intellectual property rights and confidentiality protections in India may not be as effective as in the U.S.

or other countries.

Policing unauthorized use of proprietary technology is difficult and expensive, and we might need to resort to litigation to protect our trade secrets and confidential information.

The experience and capabilities of Indian courts in handling intellectual property litigation vary, and outcomes are unpredictable.

Further, such litigation may require significant expenditure of cash and a diversion of resources and management attention.

An adverse determination in any such litigation will impair our intellectual property rights and may harm our business, operating results and financial condition.

The historical rate of wage inflation has been higher in India than in the U.S.

In addition, if the Rupee strengthens against the U.S.

Dollar, our costs will increase.

If the cost of technology and development work in India significantly increases or the labor environment in India changes unfavorably, our cost savings may be diminished.

With the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly.

If the cost of technology and development work in India significantly increases or the labor environment in India changes unfavorably, we may be unable to cost-effectively retain our current employee base in India or hire additional new talent.

Any such developments could adversely affect our business, operating results and financial condition.

We are subject to various risks associated with environmental and social matters.

There is increased scrutiny from investors, customers, policymakers, and other stakeholders regarding companies’ management of climate change, human capital, and various other environmental and social matters.

While we may from time to time engage in initiatives to manage such matters and address stakeholder expectations, such initiatives can be costly and may not have the desired effect.

For example, many environmental and social initiatives leverage methodologies, standards, and data that are complex and continue to evolve.

Moreover, various stakeholders have different, and at times conflicting, expectations.

Regulatory expectations are likewise not uniform, which may increase the cost or complexity of compliance.

Addressing stakeholder expectations can result in a diversion of resources and management attention, and any failure to successfully navigate such expectations, as well as evolving interpretations of any existing governmental laws or requirements, may result in reputational harm, issues attracting and retaining employees or customers, regulatory or investor engagement, or other adverse impacts to our business.

Risks Relating to Cybersecurity, Data Privacy and Artificial Intelligence

A breach or other compromise of our security measures or those of third parties we rely on could materially and adversely impact our reputation, business, financial condition and results of operations.

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”).

We own and manage some of these IT Systems but also rely for on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third partners service providers, vendors, and business partners.

We own and manage some of these IT Systems but also rely on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third-party service providers, vendors, and business partners.

In addition, certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support.

We, like other organizations, particularly in the financial technology sector, routinely are subject to and vulnerable to cybersecurity threats, privacy breaches, insider threats, data breaches or other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and may either result in threatened or actual exposure resulting in unauthorized access, disclosure and misuse of PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business, and our technologies, IT Systems and networks have been subject to attempted cybersecurity attacks.

We, like other organizations, particularly in the financial technology sector, are vulnerable to and have experienced cybersecurity attacks, insider threats and other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business.

While to date no attacks or incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future.

Information security risks for banking and technology companies such as ours have significantly increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties.

Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks.

Additionally, geopolitical events and resulting government activity could also lead to information security threats and attacks by affected jurisdictions and their sympathizers.

Although we maintain policies, procedures and technological safeguards and administrative controls designed to protect our information technology system and applications, violations of such policies, procedures and safeguards have occurred in the past and, despite the security measures we have in place, there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations.

Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, our technology may fail to adequately secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs we may incur to mitigate the consequences from such events.

Additionally, geopolitical events and resulting government activity also heighten information security threats and attacks by affected jurisdictions and their sympathizers.

Violations of our policies, procedures and technological safeguards and administrative controls designed to protect our IT Systems and applications have occurred in the past, and there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations.

Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, it is impossible to comprehensively secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs of mitigating the consequences from such events.

Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Further, the Alkami Digital Banking Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities that can lead to security breaches or incidents.

And, given the scanning tools we deploy in our broader network environment, we regularly identify, track and patch security vulnerabilities but are unable to comprehensively apply patches or mitigating measures or ensure that patches or measures will be applied before vulnerabilities can be exploited by a threat actor.

We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations.

We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems, react in a timely manner or implement adequate preventative measures.

Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients which may have access to PI and other data about our clients.

We cannot anticipate or prevent all techniques used by threat actors to obtain unauthorized access or to sabotage systems or implement adequate preventative measures.

Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients, which have access to PI and other data about our clients.

Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information.

3 unchanged sentences

Our ability to monitor our third-party providers’ data security is limited.

A vulnerability in our third-party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions.

Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are potentially vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

A vulnerability in our third-

party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in a material compromise to the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions.

Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted.

We have incorporated and may continue to incorporate artificial intelligence/machine learning solutions and features within our business, which may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents.

Furthermore, the use of generative artificial intelligence has made it easier for threat actors to develop and evolve attacks.

Threats to our IT Systems and those of our third-party providers or clients may result from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure.

Threats to our IT Systems and those of our third-party providers or clients include those resulting from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure.

In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions.

Current or future criminal capabilities, including by the use of generative artificial intelligence, discovery of existing or new vulnerabilities and attempts to exploit those vulnerabilities or other developments, may compromise or breach our IT Systems or solutions.

In the event our or our third-party providers’ protection efforts are unsuccessful and our IT Systems or solutions are compromised, we could suffer substantial harm.

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in operational disruptions and the loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations.

We have acquired and will likely continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to additional cybersecurity, operational, and financial risks.

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in material operational disruptions and the material loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations.

Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations.

4 unchanged sentences

Any security compromise in our industry, whether actual or perceived, could erode client confidence in the effectiveness of our security measures, negatively impact our ability to attract new clients, cause existing clients to elect not to renew or expand their use of our solutions or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, which could materially and adversely affect our business, financial condition and results of operations.

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or client customers could suffer harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes.

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or clients’ customers could suffer material harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes.

In such cases, we could face exposure to legal claims, particularly if the client and/or client customer suffered actual harm.

enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim.

We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim.

We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim.

3 unchanged sentences

In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent clients from potentially terminating their contracts with us.

Furthermore, although our client contracts typically include limitations on our potential liability, we cannot ensure that such limitations of liability would be adequate.

We also cannot be sure that our existing general liability insurance coverage and coverage for errors or omissions will be available on acceptable terms or will be available in sufficient amounts to cover one or more claims, or that our insurers will not deny or attempt to deny coverage as to any future claim.

The successful assertion of one or more claims against us, the inadequacy or denial of coverage under our insurance policies, litigation to pursue claims under our policies or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could materially and adversely affect our business, financial condition and results of operations.

Privacy and data security concerns, data collection and transfer restrictions, contractual obligations and U.S.

and foreign laws, regulations and industry standards related to data privacy, security and protection could limit the use and adoption of the Alkami Digital Banking Platform and materially and adversely affect our business, financial condition and results of operations.

and foreign laws, regulations and industry standards related to data privacy, security and protection could materially and adversely affect our business, financial condition and results of operations.

In operating our business and providing services and solutions to our clients, we collect, use, store, transmit and otherwise process sensitive employee and client data, including PI regarding client customers and other individuals, in and across multiple jurisdictions, including at times, across national borders.

2 unchanged sentences

Data privacy, information security, and data protection are significant issues in the United States and globally.

The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other PI, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations.

The regulatory framework

governing the collection, processing, storage, use and sharing of certain information, particularly financial and other PI, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations.

The occurrence of unanticipated events and development of evolving technologies often rapidly drives the adoption of legislation or regulation affecting the use, collection or other processing of data and manner in which we conduct our business.

We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of information.

Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so.

We may at times fail to comply with our published policies and documents or be alleged to have failed to do so.

Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer protection-related laws, regulations, orders or industry standards in one or more jurisdictions could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations.

7 unchanged sentences

state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

For example, California enacted the California Consumer Privacy Act of 2018 (“CCPA”) which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information.

For example, California enacted CCPA which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information.

The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

Additionally, the California Privacy Rights Act (“CPRA”), passed in November 2020, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also created a new state agency vested with authority to implement and enforce the CCPA and the CPRA.

The effects of existing state legislation, including the CCPA and the CPRA, are significant and has required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

The CCPA also created a new state agency vested with authority to implement and enforce the CCPA.

The effects of existing state legislation, including the CCPA, are significant and have required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

34 unchanged sentences

We derive all of our revenues from clients in the financial services industry, and any downturn, consolidation or decrease in technology spend in the financial services industry could materially and adversely affect our business, financial condition and results of operations.

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns, the rapid and sustained increase in interest rates, exposure to loan assets and lending policies and the value, if any, of underlying collateral and increased regulation.

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns, the rapid and sustained increase in interest rates, inflation, exposure to loan assets and lending policies and the value, if any, of underlying collateral and increased regulation.

In the recent past, FIs have experienced consolidation, distress and failure, and very few new FIs are being created.

It is possible these conditions may continue into the future, and even if conditions improve for FIs, there can be no guarantee that these conditions will not reoccur.

If any of our clients fail or merge with, or are acquired by, other entities, such as FIs that have internally developed banking technology solutions or that are not our clients or use our solutions less, our business, financial condition and results of operations could be

materially and adversely affected.

Additionally, changes in management of our clients could result in delays or cancellations of the implementation of our solutions.

10 unchanged sentences

The process of developing new technologies and solutions is complex and expensive.

The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective.

The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies, such as artificial intelligence and machine learning technologies, or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective.

The success of any enhanced or new solution depends on several factors, including timely completion, adequate testing and market release and acceptance of the solution.

13 unchanged sentences

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address.

As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the Federal Financial Institutions Examination Council (“FFIEC”), and we are also required to review and perform due diligence on certain of our third-party providers.

As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the FFIEC, and we are also required to review and perform due diligence on certain of our third-party providers.

Matters subject to review and examination by the FFIEC, federal and state regulatory agencies and external auditors include, but are not limited to, our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities and the design of our solutions, as well as our systems and technical infrastructure, our cybersecurity posture, our business recovery planning, our management and our financial condition.

In addition, while we are not regulated by the National Credit Union Administration (“NCUA”), as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA.

In addition, while we are not regulated by the NCUA, as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA.

In addition, the Dodd-Frank Act granted the CFPB authority to promulgate rules and interpret certain federal consumer financial protection laws, some of which apply to the solutions we offer to our clients.

4 unchanged sentences

In recent years, there has been increasing enforcement activity in the areas of digital accessibility, privacy, data protection and information security in various markets in which our customers operate.

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the Gramm-Leach-Bliley Act (“GLBA”) related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs.

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs.

We may also be subject to other laws because of the solutions we provide to FIs.

4 unchanged sentences

§§ 36.101, et seq.

Third-party advocates and individuals with disabilities seek changes to existing law and regulation, or advocate for novel legal rulings in court, against FIs when desktop websites or mobile applications do not meet or exceed the Web Content Accessibility Guidelines 2.1 digital accessibility standard, which was developed in part to help ensure that the content developed for banks, credit unions and other financial institutions can be accessed and used by people with or without disabilities.

Third-party advocates and individuals with disabilities seek changes to existing law and regulation, or advocate for novel legal rulings in court, against FIs when desktop websites or mobile applications do not meet or exceed the Web Content Accessibility Guidelines 2.1 digital accessibility standard, which was developed in part to help ensure that the content developed for banks, credit unions and other FIs can be accessed and used by people with or without disabilities.

The evolving, complex and often unpredictable regulatory and litigation environment in which our clients operate could result in our failure to provide compliant solutions, which could result in clients not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible or for which our clients may seek indemnity from us.

19 unchanged sentences

For example, we may fail to obtain effective intellectual property protection, or the efforts we have taken to protect our intellectual property rights may not be sufficient or effective, and any of our intellectual property rights may be challenged, which could result in them being narrowed in scope or declared invalid or unenforceable.

Despite our efforts to protect our proprietary rights, there can be no assurance our intellectual property rights will be sufficient to protect against others offering products or services that are substantially similar to ours and compete with our business or that unauthorized parties may attempt to copy aspects of our technology and use information that we consider proprietary.

There can be no assurance our intellectual property rights will be sufficient to protect against others offering products or services that are substantially similar to ours and compete with our business or that unauthorized parties may attempt to copy aspects of our technology and use information that we consider proprietary.

For example, it is possible that third parties, including our competitors, may obtain patents relating to technologies that overlap or compete with our technology.

27 unchanged sentences

Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation.

An adverse outcome in such litigation or proceedings may expose us to a loss of our competitive position, expose us to significant liabilities or require us to seek licenses that may not be available on commercially acceptable terms, if at all.

An adverse outcome in such litigation or proceedings

may expose us to a loss of our competitive position, expose us to significant liabilities or require us to seek licenses that may not be available on commercially acceptable terms, if at all.

Some of our products and services contain open-source software, which may pose particular risks to our proprietary software, products and services in a manner that could have a material and adverse effect on our business, financial condition and results of operations.

35 unchanged sentences

Claims that we have misappropriated the confidential information or trade secrets of third parties could similarly harm our business.

If we are required to make substantial payments or undertake any of the other actions noted above as a result of any intellectual property infringement, misappropriation or violation claims against us, such payments, costs or actions could have a material adverse effect on our competitive position, business, financial condition and results of operations.

If we are required to make substantial payments or undertake any of the other actions noted above as a result of any intellectual property infringement, misappropriation or violation claims

against us, such payments, costs or actions could have a material adverse effect on our competitive position, business, financial condition and results of operations.

Additionally, in certain of our agreements with clients and licensors of software we use internally or license to our clients, we agree to indemnify them for losses related to, among other things, claims by third parties that our intellectual property infringes upon, misappropriates or violates the intellectual property of such third party.

From time to time, clients or licensors have required, and may in the future require, us to indemnify them for such infringement, misappropriation or violation, breach of confidentiality or violation of applicable law, among other things.

Although we normally seek to contractually limit our liability with respect to such obligations, some of these indemnity agreements may provide for uncapped liability and some indemnity provisions survive termination or expiration of the applicable agreement.

Some of our indemnity agreements may provide for uncapped liability and some indemnity provisions survive termination or expiration of the applicable agreement.

Any legal claims from clients or other third parties could result in substantial liabilities, reputational harm, the delay or loss of market acceptance of our products, and could have adverse effects on our relationships with such clients and other third parties.

17 unchanged sentences

Even if such licenses are available, we may be required to pay the licensor substantial royalties based on sales of our products and services.

Such royalties are a component of the cost of our products or services

and may affect the margins on our products and services.

Such royalties are a component of the cost of our products or services and may affect the margins on our products and services.

In addition, such licenses may be non-exclusive, which could give our competitors access to the same intellectual property licensed to us.

42 unchanged sentences

We intend to continue to expend significant resources to support further growth and extend the functionality of our solutions, expand our sales and product development headcount and increase our marketing activities.

We will also face

increased costs associated with growth, the expansion of our client base, regulatory compliance and information security and the costs of being a public company.

We will also face increased costs associated with growth, the expansion of our client base, regulatory compliance and information security and the costs of being a public company.

Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses.

29 unchanged sentences

If such changes take place, there is a risk that our effective tax rate may be favorably or unfavorably affected, impacting our result of operations.

The Trump administration has proposed a number of changes to the U.S.

Many aspects of these proposals are unclear or undeveloped, and we are unable to predict which, if any, U.S.

tax reform proposals will be enacted into law, and what effects any enacted legislation might have on our tax liabilities.

Additionally, an increasing number of states have adopted laws or administrative practices that impose new taxes on all or a portion of gross revenue or impose additional tax collection obligations on out-of-state companies.

4 unchanged sentences

If we raise additional capital through debt financing, the terms of any new debt could further restrict our ability to operate our business.

On June 27, 2023, the Company entered into a First Amendment (the “First Amendment”) to the Company’s Amended and Restated Credit Agreement dated as of April 29, 2022 (as amended by the First Amendment, the “Amended Credit Agreement”), with Silicon Valley Bank (“SVB”), Comerica Bank, and Canadian Imperial Bank of Commerce.

The First Amendment, among other things, extended the maturity date of the Amended Credit Agreement to April 29, 2026.

On July 1, 2024, the Company entered into a Second Amendment (the “Second Amendment”) to the Company’s Amended and Restated Credit Agreement dated as of April 29, 2022 (as amended, the “Amended Credit Agreement”), with Silicon Valley Bank (“SVB”), a division of First-Citizens Bank & Trust Company, as Administrative Agent, and the other lenders party thereto.

The Second Amendment, among other things, extended the maturity date of the Amended Credit Agreement to April 29, 2027.

Our payment obligations under the Amended Credit Agreement reduce cash available to fund working capital, capital expenditures, research and development and other corporate purposes, and limit our ability to obtain additional financing for working capital, capital expenditures, expansion plans and other investments, which may in turn limit our ability to implement our business strategy, heighten our vulnerability to downturns in our business, the industry, or in the general economy, limit our flexibility in planning for, or reacting to, changes in our business and the industry and prevent us from taking advantage of business opportunities as they arise.

16 unchanged sentences

If that were to happen, we may not be able to repay all of the amounts that would become due under our indebtedness or refinance our debt, which could materially harm our business and force us to seek bankruptcy protection.

Any future indebtedness, combined with our other financial obligations, could increase our vulnerability to adverse changes in general economic, industry and market conditions, limit our flexibility in planning for, or reacting to, changes in our business and the industry and impose a competitive disadvantage compared to our competitors that have less debt or better debt servicing options.

Risks Related to Being a Newly Public Company

We are an “emerging growth company,” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.

We are an “emerging growth company” as defined in the Jumpstart Our Business Startups Act (the “JOBS Act”).

Under the JOBS Act, emerging growth companies can delay adopting new or revised accounting standards until such time as those standards apply to private companies.

We have elected to use this extended transition period for complying with new or revised accounting standards that have different effective dates for public and private companies until the earlier of the date we (i) are no longer an emerging growth company or (ii) affirmatively and irrevocably opt out of the extended transition period provided in the JOBS Act.

As a result, our consolidated financial statements may not be comparable to companies that comply with new or revised accounting pronouncements as of public company effective dates.

For as long as we continue to be an emerging growth company, we also intend to take advantage of certain other exemptions from various reporting requirements that are applicable to other public companies, including, but not limited to, not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act of 2002, as amended (the “Sarbanes-Oxley Act”), reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved.

We cannot predict if investors will find our common stock less attractive because we will rely on these exemptions.

If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock, and our stock price may be more volatile.

We will remain an emerging growth company until the earliest of (i) the last day of the year in which we have total annual gross revenues of $1.235 billion or more;

(ii) December 31, 2026;

(iii) the date on which we have issued more than $1.0 billion in non-convertible debt during the previous three years;

or (iv) the date on which we are deemed to be a large accelerated filer under the rules of the SEC.

competitive disadvantage compared to our competitors that have less debt or better debt servicing options.

We no longer qualify as an emerging growth company as of December 31, 2024 and, as a result, we will no longer be able to avail ourselves of certain reduced reporting requirements applicable to emerging growth companies.

As a result of the aggregate market value of our common stock held by non-affiliates as of June 28, 2024 (the last business day of our most recently completed second quarter) exceeding $700.0 million, we became a large accelerated filer under the Exchange Act as of December 31, 2024, and no longer qualify as an “emerging growth company.”

As a large accelerated filer, we are subject to certain disclosure and compliance requirements that apply to other public companies but did not previously apply to us due to our status as an emerging growth company.

These requirements include, but are not limited to:

• the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act of 2002;

• the requirement that we provide three years of audited financial statements and “Management’s Discussion and Analysis of Financial Condition and Results of Operations;”

• compliance with any requirements that may be adopted by the Public Company Accounting Oversight Board regarding mandatory audit firm rotation or supplement to the auditors’ report providing additional information about the audit and the financial statements;

• the requirement that we provide more detailed disclosures regarding executive compensation;

• compliance with the required public company effective dates for any new or revised accounting standards;

• the requirement that we hold a non-binding advisory vote on executive compensation and obtain stockholder approval of any golden parachute payments not previously approved;

• the requirement that annual reports on Form 10-K shall be filed within 60 days after the fiscal year end covered by the report.

We expect that compliance with these additional requirements will substantially increase our legal and financial compliance costs.

In addition, any failure to comply with these additional requirements in a timely manner, or at all, could have an adverse effect on our business and results of operations and could cause a decline in the price of our common stock.

Future strategic initiatives, including acquisitions of businesses and strategic investments, could negatively affect our business, financial condition and results of operations if we fail to integrate the acquired businesses and their employees successfully into our existing operations or achieve the desired results of our initiatives.

We have acquired several businesses since our inception and we may acquire additional businesses in the future.

Future acquisitions may require additional debt or equity financing, which could be dilutive to our existing stockholders or negatively affect our financial metrics.

Even if we complete acquisitions, there are many factors that could affect whether such acquisition will be beneficial to our business, including, without limitation:

• payment of above-market prices for acquisitions and higher than anticipated acquisition costs;

• issuance of common stock as part of the acquisition price or a need to issue stock options or other equity-based compensation to newly-hired employees of target companies, resulting in dilution of ownership to our existing stockholders;

• reduced profitability if an acquisition is not accretive to our business over either the short term or the long term;

• difficulties in integrating any acquired companies, personnel, products or other assets into our existing business;

• delays in realizing the benefits of the acquired company, products or other assets;

• regulatory challenges and becoming subject to additional regulatory requirements;

• cybersecurity and compliance-related issues;

• diversion of our management’s time and attention from other business concerns;

• limited or no direct prior experience in new markets or countries we may enter;

• unanticipated issues dealing with unfamiliar vendors, service providers or other collaborators of the acquired company;

• higher costs of integration than we anticipated;

• write-downs or impairments of goodwill or other intangible assets associated with the acquired company;

• difficulties in retaining key employees of the acquired business who are necessary to manage the acquired business;

• negative impacts on our relationships with our employees, clients, customers or collaborators;

• intellectual property and other litigation, other claims or liabilities in connection with the acquisition;

• changes in the overall financial model as certain acquired companies may have a different revenue, gross profit margin or operating expense profile.

Further, our ability to benefit from future acquisitions and/or external strategic investments depends on our ability to successfully conduct due diligence, negotiate acceptable terms, evaluate prospective opportunities and bring acquired technologies and/or products to market at acceptable margins and operating expense levels.

We may also discover deficiencies in internal controls, data adequacy and integrity, product quality, regulatory compliance, product liabilities or other undisclosed liabilities that we did not uncover prior to our acquisition or investment, which could result in us becoming subject to penalties, other liabilities or asset impairments.

In addition, if we do not achieve the anticipated benefits of an acquisition or other external investment as rapidly as expected, or at all, investors or analysts may downgrade our stock.

If these risks materialize, our stock price could be materially adversely affected.

Any difficulties in the integration of acquired businesses or unexpected penalties, liabilities or asset impairments in connection with such acquisitions or investments could have a material adverse effect on our business, financial condition and results of operations.

Risks Related to Ownership of Our Common Stock

1 unchanged sentence

Sales of a substantial number of shares of our common stock, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales might occur, could depress the market price of our common stock and impair our ability to raise capital through the sale of additional equity securities.

We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

For example, certain significant stockholders sold 5.0 million and 7.5 million shares of our common stock in separate underwritten secondary offerings in August 2024 and November 2024, respectively.

We are unable to predict the effect that future sales may have on the prevailing market price of our common stock.

We are currently restricted in our ability, and for the foreseeable future do not intend, to pay dividends on our common stock and, consequently, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock.

24 unchanged sentences

(i) unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware (or, if such court does not have subject matter jurisdiction thereof, the federal district court of the State of Delaware) will, to the fullest extent permitted by law, be the sole and exclusive forum for:

(A) any derivative action or proceeding brought on behalf of the Company, (B) any action asserting a claim for or based on a breach of a fiduciary duty owed by any of our current or former director, officer, other employee, agent or stockholder to the Company or our stockholders, including, without limitation, a claim alleging the aiding and abetting of such a breach of fiduciary duty, (C) any action asserting a claim against the Company or any of our current or former directors, officers, other employees, agents or stockholders arising pursuant to any provision of the Delaware General Corporation Law or our certificate of incorporation or bylaws or as to which the Delaware General Corporation Law confers jurisdiction on the Court of Chancery of the State of Delaware, or (D) any action asserting a claim related to or involving the Company that is governed by the internal affairs doctrine;

limitation, a claim alleging the aiding and abetting of such a breach of fiduciary duty, (C) any action asserting a claim against the Company or any of our current or former directors, officers, other employees, agents or stockholders arising pursuant to any provision of the Delaware General Corporation Law or our certificate of incorporation or bylaws or as to which the Delaware General Corporation Law confers jurisdiction on the Court of Chancery of the State of Delaware, or (D) any action asserting a claim related to or involving the Company that is governed by the internal affairs doctrine;

(ii) unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States of America will, to the fullest extent permitted by law, be the sole and exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act and the rules and regulations promulgated thereunder;

4 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors