What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-03-01 compared with 2021-02-23 · 105 added, 98 removed, 254 unchanged (44% of the section changed)

15 unchanged sentences

We may need to create new or additional equity incentive programs and/or compensation packages to remain competitive, which could be dilutive to our existing stockholders and/or adversely affect our results of operations.

More rapid than expected success in implementing our strategic shift from a license-based and one-time services business model to a cloud subscription business model could negatively impact our total revenue growth and financial performance.

More rapid than expected success in implementing our strategic shift from a license-based and one-time services business model to a cloud subscription business model with partners delivering some of our services could negatively impact our total revenue growth and financial performance.

We continue to intentionally shift our focus towards selling cloud subscription solutions, which generally require less customization services.

Also, our cloud solution contracts now frequently include subscription-based professional, analytic and training services.

This strategic shift to migrate our existing customers and sell new customers our cloud subscription solutions results in a decrease in our one-time services contracts and revenue.

Although our business model seeks to anticipate the rate of migration and resulting negative impact on our total revenue growth, more rapid than

Also, our cloud solution contracts now frequently include subscription-based professional, analytic and training services or those services can be delivered through our partner program.

This strategic shift to migrate our existing customers, sell new customers our cloud subscription solutions and have some services delivered by our partners results in a decrease in our one-time services contracts and revenue.

Although our business model seeks to anticipate the rate of migration and resulting negative impact on our total revenue growth, more rapid than expected success in implementing this strategic shift could negatively impact our total revenue growth and financial performance.

2021 Form 10-K

Blackbaud, Inc.

expected success in implementing this strategic shift could negatively impact our total revenue growth and financial performance.

The market for software and services for the social good community might not grow and the organizations in that community might not continue to adopt our solutions and services.

41 unchanged sentences

• potential loss of key employees of the acquired company;

• difficulty implementing effective internal controls over financial reporting and disclosure controls and procedures;

• difficulty implementing effective internal controls over financial reporting, disclosure controls and procedures and data protection procedures;

• impairment of relationships with customers or suppliers;

• issues not discovered in due diligence, which may include product quality issues or legal or other contingencies.

Acquisitions may also result in potentially dilutive issuances of equity securities, the incurrence of debt and contingent liabilities, the expenditure of available cash, and amortization expenses or write-downs related to intangible assets such as goodwill, any of which could have a material adverse effect on our operating results or financial condition.

Acquisitions, including for example our recent acquisition of EVERFI, Inc.

(as further described in Note 3), may also result in potentially dilutive issuances of equity securities, the incurrence of debt and contingent liabilities, the expenditure of available cash, and amortization expenses or write-downs related to intangible assets such as goodwill, any of which could have a material adverse effect on our operating results or financial condition.

We may experience risks relating to the challenges and costs of closing a business combination and the risk that an announced business combination may not close.

8 unchanged sentences

Our failure to obtain licenses for, or our use of, third-party technologies could harm our business.

We expect to continue licensing technologies from third parties, including applications used in our research and development activities, technologies which are integrated into our solutions and solutions that we resell.

We expect to continue licensing technologies from third parties, including applications used in our research and development activities, technologies that are integrated into our solutions and solutions that we resell.

We believe that the loss of any third-party technologies currently integrated into our solutions could have a material adverse effect on our business.

3 unchanged sentences

The U.K.'s departure from the European Union ("E.U.") could adversely affect us.

held a referendum on June 23, 2016 on its membership in the E.U., in which a majority of U.K.

voters voted to exit the E.U.

(commonly referred to as "Brexit").

Thereafter, the E.U.

engaged in extensive negotiations designed to reach agreement regarding the future terms of the U.K.'s relationship with the E.U.

Effective January 31, 2020, the U.K.

is no longer a member of the E.U., and an agreed post-Brexit transition period expired on December 31, 2020.

is no longer a member of the E.U.

Effective January 1, 2021, the relationship between the U.K.

is governed primarily by the new Trade and Cooperation Agreement (the “TCA”), which sets forth, among other things, terms regarding the trade of goods and services, workers’ rights and social and environmental matters.

Separate negotiations are expected to continue regarding, among other things, data sharing, data privacy and financial services, and certain terms of the TCA contain agreed expiration dates.

is governed primarily by the Trade and Cooperation Agreement, which sets forth, among other things, terms regarding the trade of goods and services, workers’ rights and social and environmental matters, while separate negotiations have continued and agreements have been entered into regarding, among other things, data sharing, data privacy and financial services.

Because we currently conduct business in the U.K.

1 unchanged sentence

under such circumstances creates uncertainty and could affect the business of and/or our relationships with our customers and partners as well as the value of the British Pound and the Euro relative to the U.S.

The ultimate effects of Brexit on us, including those mentioned above and others we cannot now anticipate, are difficult to predict and could adversely affect our business, business opportunities, results of operations or financial condition in both the short-term and thereafter.

The effects of Brexit on us, including those mentioned above and others we cannot now anticipate, are difficult to predict and could adversely affect our business, business opportunities, results of operations or financial condition in both the short-term and thereafter.

Operational Risks

If the security of our software is breached, we fail to securely collect, store and transmit customer information, or we fail to safeguard confidential donor data, we could be exposed to liability, litigation, penalties and remedial costs and our reputation and business could suffer.

Fundamental to the use of our solutions is the secure collection, storage and transmission of confidential donor and end user data and transaction data, including in our payment services.

Despite the network, application and physical security procedures and internal control measures we employ to safeguard our systems, we have been and in the future may be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which has in the past harmed and may in the future harm our business, reputation and future financial results.

Furthermore, our reliance on remote access to information systems and global disruptions in response to COVID-19, as described above, increases our exposure to potential cybersecurity incidents.

Like many major businesses, we are, from time to time, a target of cyberattacks, phishing and social engineering schemes, such as the Security Incident (as described below and in Note 11 to our consolidated financial statements in this report), and we expect these threats to continue, some of which have been, and in the future may be, successful to varying degrees.

Because the numerous and evolving cybersecurity threats used to obtain unauthorized access, disable, degrade or sabotage systems have become increasingly more complex and sophisticated, it may be difficult to anticipate these acts or to detect them for periods of time, as with the Security Incident, and we may be unable to respond adequately or timely.

As these threats continue to evolve and increase, we have already devoted and expect to continue to devote significant resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities.

2021 Form 10-K

Blackbaud, Inc.

A compromise of our data security, such as the Security Incident, that results in customer or customer constituent personal or payment card data being obtained by unauthorized persons could adversely affect our reputation with our customers and others, as well as our operations, results of operations, financial condition and liquidity and could result in litigation against us or the imposition of fines and penalties.

We might be required to expend significant additional capital and other resources to rectify problems caused by a security breach, including notification under data privacy laws and regulations, and incur expenses related to remediating our information security systems.

Even though we may carry cyber-technology insurance policies that provide insurance coverage under certain circumstances, we have in the past suffered losses and may in the future suffer losses as a result of a security breach that exceed the coverage available under our insurance policies or for which we do not have coverage.

(See Note 11 to our consolidated financial statements in this report for expense and insurance coverage information related to the Security Incident.) Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

A security breach and any efforts we make to address such breach could also result in a disruption of our operations, particularly our online sales operations.

The occurrence of actual cyber security events, such as the Security Incident, could magnify the severity of the adverse effects of future incidents on our business.

The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems can be difficult to detect for long periods of time and can involve difficult or prolonged assessment or remediation periods even once detected.

We, therefore, cannot assure you that all potential causes of past significant incidents, including the Security Incident, have been fully identified and remediated.

The steps we take may not be sufficient to prevent future significant incidents and, as a result, such incidents may occur again.

The Security Incident has had, and may continue to have, numerous adverse effects on our business, results of operations, financial condition and cash flows.

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack.

Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment.

Although the nature of the incident, our research and third party (including law enforcement) investigation have provided no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly, our investigation into the Security Incident remains ongoing and may provide additional information.

To date, we have received approximately 260 specific requests for reimbursement of expenses ("Customer Reimbursement Requests") and approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K.

and Canada related to the Security Incident (none of which have as yet been filed in court) and are in the process of assessing what liability may exist pursuant to such claims.

In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us.

Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident.

In addition, presently, we are a defendant in 19 putative consumer class action cases [17 in U.S.

federal courts (which have been consolidated under multi district litigation to a single federal court) and 2 in Canadian courts] alleging harm from the Security Incident.

The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief.

To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 48 state Attorneys General and the District of Columbia and separate Civil Investigative Demands from the offices of the Illinois Attorney General and the California Attorney General relating to the Security Incident.

In addition, we are subject to governmental actions or investigations by the U.S.

Federal Trade Commission, the U.S.

Department of Health and Human Services, the U.S.

Securities and Exchange Commission, the Information Commissioner’s Office in the United Kingdom (the “ICO”) under the U.K.

Data Protection Act 2018, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada, the Spanish Data Protection Authority and the Data Protection Commission of Ireland.

(See Note 11 to our consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

2021 Form 10-K

Blackbaud, Inc.

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations.

Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance.

Governmental authorities also may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business.

Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs.

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident.

For example, we currently expect net cash outlays of $25 million to $35 million for ongoing legal fees related to the Security Incident for full year 2022.

Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage during the first quarter of 2022.

As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgements) or all types of claims that may arise in connection with t he Security Incident, which could materially and adversely affect our liquidity and results of operations .

(See Note 11 to our consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under our credit facility, we may be forced to renegotiate or obtain a waiver under our credit facility and/or seek additional debt or equity financing.

Such renegotiation or financing may not be available on acceptable terms, or at all.

In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material.

The COVID-19 pandemic has disrupted, and is expected to continue to disrupt, our business, which is likely to adversely affect our operations and financial performance.

17 unchanged sentences

• further declines in our customers' ability to pay for our solutions and services;

• reduced workforce availability and productivity due to working remotely using different technologies and potential health effects and concerns;

• reduced workforce availability and productivity due to potential health effects and concerns;

• risks associated with our indebtedness (including available borrowing capacity, compliance with financial covenants and ability to refinance or repay indebtedness on favorable terms);

31 unchanged sentences

All Blackbaud products in scope for PCI DSS compliance meet applicable PCI DSS security requirements.

In addition, we routinely subject our various data protection processes and controls to voluntary third-party review, audit or reporting, including, for example, the American Institute of Certified Public Accountants’ System and Organization Controls (“SOC”) reporting.

Failure to conduct these voluntary data protection process and control reviews or to obtain and maintain unqualified audits or reports covering our data protection processes and controls may harm our reputation or our business prospects and our ability to market our solutions to our customers.

Fundamental to the use of our solutions is the secure collection, storage and transmission of confidential donor and end user data and transaction data, including in our payment services.

Despite the network, application and physical security procedures and internal control measures we employ to safeguard our systems, we may still be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which may harm our business, reputation and future financial results.

Furthermore, our increased reliance on remote access to information systems and global disruptions in response to COVID-19, as described above, increase our exposure to potential cybersecurity incidents.

Like many major businesses, we are, from time to time, a target of cyberattacks, phishing and social engineering schemes, such as the Security Incident (as described in Note 11 to our consolidated financial statements in this report), and we expect these threats to continue, some of which may be successful to varying degrees.

As these threats continue to evolve and increase, we may be required to devote significant additional resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities.

(See Note 11 to our consolidated financial statements in this report for such information related to the Security Incident.) Even though we carry cyber-technology insurance policies that may provide insurance coverage under certain circumstances, we might

2020 Form 10-K

Blackbaud, Inc.

suffer losses as a result of a security breach that exceed the coverage available under our insurance policies or for which we do not have coverage.

A security breach and any efforts we make to address such breach could also result in a disruption of our operations, particularly our online sales operations.

The occurrence of actual cyber security events, such as the Security Incident, could magnify the severity of the adverse effects of future incidents on our business.

We, therefore, cannot assure you that all potential causes of past significant incidents, including the Security Incident, have been fully identified and remediated.

The steps we take may not be sufficient to prevent future significant incidents and, as a result, such incidents may occur again.

The Security Incident could have numerous adverse effects on our business.

As previously disclosed, on July 16, 2020, we first contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack.

To date, we have received approximately 570 claims for reimbursement of expenses from customers or their attorneys related to the Security Incident (none of which have as yet been filed in court or in arbitration) and are in the process of assessing what, if any, liability may exist pursuant to such claims.

Possible exposure could result from our customers’ costs and expenses associated with notifying their own constituents of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident.

In addition, presently, we are a defendant in 30 putative consumer class action cases [27 in U.S.

federal courts (some of which have been consolidated under multi district litigation to a single federal court), 1 in a U.S.

state court and 2 in Canadian courts] alleging harm from the Security Incident.

To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 44 state Attorneys General and the District of Columbia relating to the Security Incident.

In addition, we have received communications, inquires and requests from the U.S.

Federal Trade Commission, the U.S.

Department of Health and Human Services, the U.S.

Securities and Exchange Commission, the Information Commissioner’s Office in the United Kingdom (the “ICO”) under the U.K.

Data Protection Act 2018, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada.

(See Note 11 to our consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that may not be covered by insurance.

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident.

(See Note 11 to our consolidated financial statements included in this report.) Although we carry cyber-technology insurance designed to protect us against certain losses related to cybersecurity events, that insurance coverage may not be sufficient to cover all expenses or other losses (including fines) or all types of claims that may arise in connection with cyberattacks, security compromises and other related incidents.

Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

2020 Form 10-K

Blackbaud, Inc.

Future publicity or developments related to the Security Incident could have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties.

Failure to conduct these voluntary data protection process and control reviews or to obtain and maintain audits or reports covering our data protection processes and controls may harm our reputation or our business prospects and our ability to market our solutions to our customers.

Our operations might be affected by the occurrence of a natural disaster or other catastrophic event.

6 unchanged sentences

We rely extensively on information systems and technology to manage our business and summarize our operating results.

We are in the process of a multi-year implementation of a new ERP system, which will replace our existing core financial systems.

Such an implementation is a major undertaking, both financially and from a management and personnel perspective.

The new ERP system is designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team.

We may not be able to successfully implement the ERP system without experiencing delays, unexpected additional costs and other difficulties.

Failure to successfully design and implement the new ERP system as planned could harm our business, financial condition and operating results.

Additionally, if we do not effectively implement the ERP system as planned or the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be negatively affected.

We have implemented a new ERP system, which replaced our previous core financial systems.

The new ERP system was designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team.

Failure in the design and implementation of the new ERP system could harm our business, financial condition and operating results.

Additionally, failure in the design or implementation of the new ERP system as planned or if the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be negatively affected.

2021 Form 10-K

Blackbaud, Inc.

Financial Risks

12 unchanged sentences

Our customers' renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our solutions and services and their ability to continue their operations and spending levels due to COVID-19 or otherwise.

2020 Form 10-K

Blackbaud, Inc.

We significantly increased our leverage in connection with acquisitions.

We incurred a substantial amount of indebtedness in connection with acquisitions and the purchase of our Global Headquarters Facility.

We incurred a substantial amount of indebtedness in connection with acquisitions, including our recent acquisition of EVERFI, Inc.

(as described in Note 3) and the purchase of our global headquarters facility in 2020.

As a result of this indebtedness, our interest payment obligations have increased.

In addition, we have been named as a party in various lawsuits in connection with the Security Incident, other claims may be asserted by or on behalf of our customers or their constituents, and we are subject to various governmental inquires, requests or investigations.

Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses.

(See Note 11 to our consolidated financial statements in this report for additional information regarding the Security Incident.)

The degree to which we are leveraged could have adverse effects on our business, including the following:

3 unchanged sentences

• Placing us at a competitive disadvantage compared to our competitors that have less debt;

• Limiting our ability to borrow additional funds;

• Reducing our currently available borrowing capacity or limiting our ability to borrow additional funds;

• Decreasing our ability to compete effectively or operate successfully under adverse economic and industry conditions.

1 unchanged sentence

Our ability to meet our debt service obligations will depend upon our future performance, which will be subject to the financial, business and other factors affecting our operations, many of which are beyond our control.

2021 Form 10-K

Blackbaud, Inc.

Our balance sheet includes significant amounts of goodwill and intangible assets.

The impairment of a significant portion of these assets could negatively affect our operating results.

As of December 31, 2020, we had $635.9 million and $277.5 million of goodwill and intangible assets, respectively.

As of December 31, 2021, we had $1.1 billion and $698.1 million of goodwill and intangible assets, respectively, which reflects an increase of $422.8 million and $457.4 million, respectively, as a result of our recent acquisition of EVERFI.

On at least an annual basis, we assess whether there have been impairments in the carrying value of goodwill and intangible assets.

9 unchanged sentences

Any such default could have a material adverse effect on our ability to operate, including allowing lenders under the credit facility to enforce guarantees of our subsidiaries, if any, or exercise their rights with respect to the shares pledged as collateral.

2020 Form 10-K

Blackbaud, Inc.

We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance long-term stockholder value.

3 unchanged sentences

The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock.

In addition, this program will diminish our cash reserves, which may impact our ability to finance future growth and to pursue possible future strategic opportunities and acquisitions.

In addition, this program will diminish our cash reserves, which may impact our ability to finance future growth, to pursue possible future strategic opportunities and acquisitions and fund liabilities and expenses related to the Security Incident.

(See Note 14 to our consolidated financial statements in this report for additional information related to our stock repurchase program.)

4 unchanged sentences

A charge against our earnings would result if, based on the available evidence, it is more likely than not that some portion of the deferred tax asset will not be realized beyond our existing valuation allowance.

This could be caused by, among other things, deterioration in performance, adverse market conditions, adverse changes in applicable laws or regulations, including changes that restrict the activities of or affect the solutions sold by our business and a variety of other factors.

For example, during 2020, we recorded an increase in our valuation allowance attributable to state tax credit carryforwards for which we do not expect to realize benefit.

(See Note 12 to our consolidated financial statements in this report for additional details.) If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, the charge to earnings would be recognized as an expense in our results of operations in the period the determination is made.

2021 Form 10-K

Blackbaud, Inc.

Additionally, if we are unable to utilize our deferred tax assets, our cash flow available to fund operations could be adversely affected.

6 unchanged sentences

For example, our custom modeling and analytical services rely heavily on processing and using of data we gather from customers and various sources.

Privacy and data protection laws could add restrictions or regulatory burdens, which could limit to our ability to market and profit from those services.

Privacy and data protection laws could add restrictions or regulatory burdens, which could limit our ability to market and profit from those services.

Governments in some jurisdictions have enacted or are considering enacting consumer data privacy or data protection legislation, including laws and regulations applying to the solicitation, collection, transfer, processing and use of personal data.

1 unchanged sentence

Moreover, we may be exposed to liability under existing or new consumer privacy or data protection legislation.

For example, when providing our solutions to certain customers in the healthcare industry, we must comply with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and might be subject to similar provisions of other legislation, including, without limitation, the Gramm-Leach-Bliley Act and related regulations, and

2020 Form 10-K

Blackbaud, Inc.

the California Consumer Privacy Act of 2018, which became effective January 1, 2020, and may apply to some of our customers and areas of business.

Even technical violations of these laws may result in penalties that are assessed for each non-compliant transaction.

Blackbaud, and some of our customers, may be subject to the E.U.

Blackbaud, and some of our customers, are subject to the E.U.

General Data Protection Regulation (“GDPR”), which became effective in the E.U.

1 unchanged sentence

after Brexit by virtue of legislation incorporating the GDPR into U.K.

data protection law, known as the "UK GDPR." The law requires companies to meet requirements regarding the handling of personal data, including rights such as the portability of personal data.

data protection law, known as the "U.K.

GDPR." The law requires companies to meet requirements regarding the handling of personal data, including rights such as the portability of personal data.

We completed an extensive program of product and operational changes to address GDPR requirements and all future solutions sold to customers subject to GDPR must include GDPR features.

4 unchanged sentences

(See Note 11 to our consolidated financial statements included in this report for a description of the Security Incident and related legal proceedings and regulatory matters.)

2021 Form 10-K

Blackbaud, Inc.

We are in the information technology business, and our solutions and services store, retrieve, transfer, manipulate and manage our customers’ information and data.

3 unchanged sentences

Claims that we or our technologies infringe upon the intellectual property or other proprietary rights of a third party may require us to incur significant costs, enter into royalty or licensing agreements or develop or license substitute technology.

We may be subject to claims that the technologies in our solutions and services infringe upon the intellectual property or other proprietary rights of a third party.

We have been, and may in the future be subject to claims that the technologies in our solutions and services infringe upon the intellectual property or other proprietary rights of a third party.

In addition, the vendors providing us with technology that we use in our own solutions could become subject to similar infringement claims.

5 unchanged sentences

Infringement claims asserted against us, our vendors or our customers may have a material adverse effect on our business, prospects, financial condition and results of operations.

2020 Form 10-K

Blackbaud, Inc.

Our solutions utilize open source software, which may subject us to litigation, require us to re-engineer our solutions, or otherwise divert resources away from our development efforts.

6 unchanged sentences

While we monitor our use of open source software and try to ensure that none is used in a manner that would require us to disclose the source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur and we may be required to release proprietary source code, pay damages for breach of contract, re-engineer our applications, discontinue sales in the event re-engineering cannot be accomplished on a timely basis, or take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business.

2021 Form 10-K

Blackbaud, Inc.

We rely upon trademark, copyright, patent and trade secret laws to protect our proprietary rights, which might not provide us with adequate protection.

2 unchanged sentences

To protect our core proprietary technology, we rely on a combination of patent, trademark, copyright and trade secret laws, as well as nondisclosure agreements, each of which affords only limited protection.

Increasing and evolving domestic and international government financial regulation could adversely affect our business and operating results.

Certain of our solutions, in particular, our financial management and payment services solutions, relate to activity heavily regulated in the U.S.

by federal and state government regulatory agencies and in other countries in which we operate by local regulatory agencies.

The laws and regulations enforced by these agencies are proposed or enacted to deter fraud and other illicit financial transactions and to protect consumers and the financial system.

Changing domestic and international laws, government regulations and policies could adversely affect our business and operating results by increasing compliance costs, reducing customer demand for our solutions or damaging our reputation.

Certain of our solutions, in particular, our financial management and payment services solutions, relate to activity heavily regulated by government agencies in the U.S., the U.K.

and other countries in which we operate.

The laws and regulations enforced by these agencies are proposed or enacted to deter fraud and other illicit financial transactions and to protect consumers and the financial system and are often revised or increased in scope.

We have procedures and controls in place to monitor compliance with numerous federal, state and foreign laws and regulations.

3 unchanged sentences

If we do not successfully comply with laws, regulations, or policies, we could incur fines or penalties, be subject to litigation, lose existing or new customer contracts or other business, and suffer damage to our reputation.

Changes in these laws and regulations can alter our business environment, limit business operations, require substantial investments to achieve compliance and increase costs of doing business, and we cannot predict the impact such changes would have on our operating results and financial condition.

In addition, changes in certain laws, regulations or policies could impact our customers, alter our business environment and limit our operations.

For example, various financial institutions subscribe to our EVERFI training solution, which they may then provide free of charge to schools in low-income and moderate-income communities as a means of satisfying their obligations under the Community Reinvestment Act of 1977, as amended (the “CRA”).

Repeal or significant modification of the CRA or the many government agency regulations and policies implementing its provisions could cause financial institutions to limit or eliminate their purchases of these EVERFI solutions and thereby negatively impact our operating results and financial condition.

Anti-takeover provisions in our charter documents and Delaware law may delay or prevent an acquisition of our Company.

1 unchanged sentence

Our certificate of incorporation authorizes “blank check” preferred stock, which could be issued by the board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock.

Stockholder approval is not necessary to issue preferred stock in this

2020 Form 10-K

Blackbaud, Inc.

Stockholder approval is not necessary to issue preferred stock in this manner.

Issuance of these shares of preferred stock could have the effect of making it more difficult and more expensive for a person or group to acquire control of us, and could effectively be used as an anti-takeover device.

4 unchanged sentences

UNRESOLVED STAFF COMMENTS

2021 Form 10-K

Blackbaud, Inc.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors