BLACKBAUD INC 10-K

ITEM 1A. RISK FACTORS Our business operations face a number of risks. These risks should be read and considered with other information provided in this report. Strategic Risks Our failure to compete successfully could cause our revenue or market share to decline. Our market is highly competitive and rapidly evolving, and there are limited barriers to entry for many segments of this market. The companies we compete with and other potential competitors may have greater financial, technical and marketing resources and generate greater revenue and better name recognition than we do. Also, a large diversified software enterprise could decide to enter the market directly, including through acquisitions. Competitive pressures can adversely impact our business by limiting the prices we can charge our customers and making the adoption and renewal of our solutions more difficult. Our competitors might also establish or strengthen cooperative relationships with resellers and third-party consulting firms or other parties with whom we have had relationships, thereby limiting our ability to promote our solutions. These competitive pressures could cause our revenue and market share to decline. Because competition for highly qualified personnel is intense, we might not be able to attract and retain key personnel needed to support our planned growth. To meet our objectives successfully, we must attract and retain highly qualified personnel with specialized skill sets. If we are unable to attract and retain suitably qualified management, there could be a material adverse impact on our business. Further, we use equity incentive programs and equity awards in lieu of cash as part of our overall employee compensation agreements to both attract and retain personnel. A decline in our stock price could negatively impact the value of these equity incentive and related compensation programs as retention and recruiting tools. We may need to create new or additional equity incentive programs and/or compensation packages to remain competitive, which could be dilutive to our existing stockholders and/or adversely affect our results of operations. More rapid than expected success in implementing our strategic shift from a license-based and one-time services business model to a cloud subscription business model with partners delivering some of our services could negatively impact our total revenue growth and financial performance. We continue to intentionally shift our focus towards selling cloud subscription solutions, which generally require less customization services. Also, our cloud solution contracts now frequently include subscription-based professional, analytic and training services or those services can be delivered through our partner program. This strategic shift to migrate our existing customers, sell new customers our cloud subscription solutions and have some services delivered by our partners results in a decrease in our one-time services contracts and revenue. Although our business model seeks to anticipate the rate of migration and resulting negative impact on our total revenue growth, more rapid than expected success in implementing this strategic shift could negatively impact our total revenue growth and financial performance. 2021 Form 10-K 17 Table of Contents Blackbaud, Inc. The market for software and services for the social good community might not grow and the organizations in that community might not continue to adopt our solutions and services. Many organizations in the social good community, including nonprofits, foundations, companies, education institutions and healthcare organizations, have not traditionally used integrated and comprehensive software and services for their specific needs. We cannot be certain that the market for such solutions and services will continue to develop and grow or that these organizations will elect to adopt our solutions and services rather than continue to use traditional, less automated methods, attempt to develop software internally, rely upon legacy software systems, or use software solutions not specifically designed for this market. Organizations that have already invested substantial resources in other fundraising methods or other non-integrated software solutions might be reluctant to adopt our solutions and services to supplement or replace their existing systems or methods. In addition, the implementation of one or more of our software solutions can involve significant capital commitments by our customers, which they may be unwilling or unable to make, especially due to disruption in the social good community due to COVID-19. If demand for and market acceptance of our solutions and services does not increase, we might not grow our business as we expect. If we fail to respond to technological changes or successfully introduce new and improved solutions, our competitive position may be harmed and our business may suffer. The introduction of solutions encompassing new technologies can render existing solutions obsolete and unmarketable. As a result, our future success will depend, in part, upon our ability to continue to enhance existing solutions and develop and introduce in a timely manner or acquire new solutions that keep pace with technological developments, satisfy increasingly sophisticated customer requirements and achieve market acceptance. If we are unable to develop or acquire on a timely and cost-effective basis new software solutions or enhancements to existing solutions or if such new solutions or enhancements do not achieve market acceptance, our business, results of operations and financial condition may be materially adversely affected. If we do not successfully address the risks inherent in the expansion of our international operations, our business could suffer. We currently have non-U.S. operations primarily in the U.K., Canada, Australia and Costa Rica, and we intend to expand further into international markets. Expansion of our international operations will require a significant amount of attention from our management and substantial financial resources and might require us to add qualified management in these markets. Our direct sales model requires us to attract, retain and manage qualified sales personnel capable of selling into markets outside the United States. In some cases, our costs of sales might increase if our customers require us to sell through local distributors. If we are unable to grow our international operations in a cost-effective and timely manner, our business and operating results could be harmed. We expect that an increasing portion of our international revenues will be denominated in foreign currencies, subjecting us to fluctuations in foreign currency exchange rates. If we expand our international operations, exposures to gains and losses on foreign currency transactions may increase. Doing business internationally involves additional risks that could harm our operating results. Along with risks similar to those faced by our U.S. operations, our international operations are also subject to risks related to differing legal, political, social and regulatory requirements and economic conditions, including: • the imposition of additional withholding taxes or other tax on our foreign income, tariffs or restrictions on foreign trade or investment, including currency exchange controls; • greater risk of a failure of our employees and partners to comply with both U.S. and foreign laws, including antitrust regulations, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act of 2010, and any trade regulations ensuring fair trade practices; and • the imposition of, or unexpected adverse changes in, foreign laws or regulatory requirements, including those pertaining to export restrictions, privacy and data protection, trade and employment restrictions and intellectual protections. 18 2021 Form 10-K Table of Contents Blackbaud, Inc. Unfavorable media coverage related to peer-to-peer fundraising campaigns on our social platforms could negatively impact our business. Our online social giving platforms receive a high degree of media coverage for particularly news-worthy or controversial fundraising campaigns, as well as for our fee-based business model. Although our terms of service provide express limitations on the platforms' user-initiated fundraising campaigns and reserve our right to remove content that violates our terms of service, it may not always be possible to remove such content prior to it receiving attention in the media. Negative publicity related to our online social giving platforms could have an adverse effect on the size, engagement and loyalty of our user base and could result in decreased revenue, which could adversely affect our business and financial results. Acquisitions could be difficult to consummate and integrate into our operations, and they could disrupt our business, dilute stockholder value or impair our financial results. As part of our business strategy, we will continue from time to time to seek to grow our business through acquisitions of new or complementary businesses, technologies or products that we believe can improve our ability to compete in our existing customer markets or allow us to enter new markets. The potential risks associated with acquisitions and investment transactions include, but are not limited to: • failure to realize anticipated returns on investment, cost savings and synergies; • difficulty in assimilating the operations, policies and personnel of the acquired company; • unanticipated costs associated with acquisitions; • challenges in combining product offerings and entering into new markets in which we may not have experience; • distraction of management’s attention from normal business operations; • potential loss of key employees of the acquired company; • difficulty implementing effective internal controls over financial reporting, disclosure controls and procedures and data protection procedures; • impairment of relationships with customers or suppliers; and • issues not discovered in due diligence, which may include product quality issues or legal or other contingencies. Acquisitions, including for example our recent acquisition of EVERFI, Inc. (as further described in Note 3), may also result in potentially dilutive issuances of equity securities, the incurrence of debt and contingent liabilities, the expenditure of available cash, and amortization expenses or write-downs related to intangible assets such as goodwill, any of which could have a material adverse effect on our operating results or financial condition. We may experience risks relating to the challenges and costs of closing a business combination and the risk that an announced business combination may not close. There can be no assurance that we will be successful in making additional acquisitions in the future or in integrating or executing on our business plan for existing or future acquisitions. A reduction in the growth or amount of charitable giving could adversely affect our operating results and financial condition. A large percentage of our customers are nonprofits, foundations, education institutions, healthcare organizations and other members of the social good community that fully or partially rely on charitable donations. If charitable giving, including online giving, does not continue to grow or declines, it could limit our current and potential customers' ability to use and pay for our solutions and services, which could adversely affect our operating results and financial condition. In addition, we derive a significant portion of our revenue from transaction-based payment processing fees that we collect from our customers through our Blackbaud Merchant Services solution, which enables our customers' donors to make donations and purchase goods and services using various payment options. A reduction in the growth of, or a decline in, charitable giving to these customers, whether due to deteriorating general economic conditions, the impact of recent or future changes to applicable tax laws, or otherwise, could negatively impact the volume and size of such payment processing transactions and thereby adversely affect our operating results and financial condition. 2021 Form 10-K 19 Table of Contents Blackbaud, Inc. Our failure to obtain licenses for, or our use of, third-party technologies could harm our business. We expect to continue licensing technologies from third parties, including applications used in our research and development activities, technologies that are integrated into our solutions and solutions that we resell. We believe that the loss of any third-party technologies currently integrated into our solutions could have a material adverse effect on our business. Our inability in the future to obtain any third-party licenses on commercially reasonable terms, or at all, could delay future solution development until equivalent technology can be identified, licensed or developed and integrated. This inability in turn could harm our business and operating results. Our use of third-party technologies also exposes us to increased risks including, but not limited to, risks associated with the integration of new technology into our solutions, the diversion of our resources from development of our own proprietary technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. The U.K.'s departure from the European Union ("E.U.") could adversely affect us. Effective January 31, 2020, the U.K. is no longer a member of the E.U. Effective January 1, 2021, the relationship between the U.K. and the E.U. is governed primarily by the Trade and Cooperation Agreement, which sets forth, among other things, terms regarding the trade of goods and services, workers’ rights and social and environmental matters, while separate negotiations have continued and agreements have been entered into regarding, among other things, data sharing, data privacy and financial services. Because we currently conduct business in the U.K. and in Europe, the U.K.’s exit from the E.U. under such circumstances creates uncertainty and could affect the business of and/or our relationships with our customers and partners as well as the value of the British Pound and the Euro relative to the U.S. dollar. The effects of Brexit on us, including those mentioned above and others we cannot now anticipate, are difficult to predict and could adversely affect our business, business opportunities, results of operations or financial condition in both the short-term and thereafter. Operational Risks If the security of our software is breached, we fail to securely collect, store and transmit customer information, or we fail to safeguard confidential donor data, we could be exposed to liability, litigation, penalties and remedial costs and our reputation and business could suffer. Fundamental to the use of our solutions is the secure collection, storage and transmission of confidential donor and end user data and transaction data, including in our payment services. Despite the network, application and physical security procedures and internal control measures we employ to safeguard our systems, we have been and in the future may be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which has in the past harmed and may in the future harm our business, reputation and future financial results. Furthermore, our reliance on remote access to information systems and global disruptions in response to COVID-19, as described above, increases our exposure to potential cybersecurity incidents. Like many major businesses, we are, from time to time, a target of cyberattacks, phishing and social engineering schemes, such as the Security Incident (as described below and in Note 11 to our consolidated financial statements in this report), and we expect these threats to continue, some of which have been, and in the future may be, successful to varying degrees. Because the numerous and evolving cybersecurity threats used to obtain unauthorized access, disable, degrade or sabotage systems have become increasingly more complex and sophisticated, it may be difficult to anticipate these acts or to detect them for periods of time, as with the Security Incident, and we may be unable to respond adequately or timely. As these threats continue to evolve and increase, we have already devoted and expect to continue to devote significant resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities. 20 2021 Form 10-K Table of Contents Blackbaud, Inc. A compromise of our data security, such as the Security Incident, that results in customer or customer constituent personal or payment card data being obtained by unauthorized persons could adversely affect our reputation with our customers and others, as well as our operations, results of operations, financial condition and liquidity and could result in litigation against us or the imposition of fines and penalties. We might be required to expend significant additional capital and other resources to rectify problems caused by a security breach, including notification under data privacy laws and regulations, and incur expenses related to remediating our information security systems. Even though we may carry cyber-technology insurance policies that provide insurance coverage under certain circumstances, we have in the past suffered losses and may in the future suffer losses as a result of a security breach that exceed the coverage available under our insurance policies or for which we do not have coverage. (See Note 11 to our consolidated financial statements in this report for expense and insurance coverage information related to the Security Incident.) Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all. A security breach and any efforts we make to address such breach could also result in a disruption of our operations, particularly our online sales operations. The occurrence of actual cyber security events, such as the Security Incident, could magnify the severity of the adverse effects of future incidents on our business. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems can be difficult to detect for long periods of time and can involve difficult or prolonged assessment or remediation periods even once detected. We, therefore, cannot assure you that all potential causes of past significant incidents, including the Security Incident, have been fully identified and remediated. The steps we take may not be sufficient to prevent future significant incidents and, as a result, such incidents may occur again. The Security Incident has had, and may continue to have, numerous adverse effects on our business, results of operations, financial condition and cash flows. As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment. Although the nature of the incident, our research and third party (including law enforcement) investigation have provided no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly, our investigation into the Security Incident remains ongoing and may provide additional information. To date, we have received approximately 260 specific requests for reimbursement of expenses ("Customer Reimbursement Requests") and approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident (none of which have as yet been filed in court) and are in the process of assessing what liability may exist pursuant to such claims. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us. Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident. In addition, presently, we are a defendant in 19 putative consumer class action cases [17 in U.S. federal courts (which have been consolidated under multi district litigation to a single federal court) and 2 in Canadian courts] alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 48 state Attorneys General and the District of Columbia and separate Civil Investigative Demands from the offices of the Illinois Attorney General and the California Attorney General relating to the Security Incident. In addition, we are subject to governmental actions or investigations by the U.S. Federal Trade Commission, the U.S. Department of Health and Human Services, the U.S. Securities and Exchange Commission, the Information Commissioner’s Office in the United Kingdom (the “ICO”) under the U.K. Data Protection Act 2018, the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada, the Spanish Data Protection Authority and the Data Protection Commission of Ireland. (See Note 11 to our consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.) 2021 Form 10-K 21 Table of Contents Blackbaud, Inc. We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. Governmental authorities also may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations. In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs. Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, we currently expect net cash outlays of $25 million to $35 million for ongoing legal fees related to the Security Incident for full year 2022. Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage during the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgements) or all types of claims that may arise in connection with t he Security Incident, which could materially and adversely affect our liquidity and results of operations . (See Note 11 to our consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under our credit facility, we may be forced to renegotiate or obtain a waiver under our credit facility and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due. In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material. The COVID-19 pandemic has disrupted, and is expected to continue to disrupt, our business, which is likely to adversely affect our operations and financial performance. The outbreak of COVID-19 in countries across the globe, including each country in which we currently operate, has adversely impacted the U.S. and global economies. We have experienced disruptions to our business thus far from COVID-19, and the pandemic continues to impact each of our markets. Governmental authorities have taken, and continue to take, countermeasures to slow the outbreak, including shelter-in-place and business closure orders and large-scale restrictions on travel. Furthermore, because the pandemic is a rapidly evolving situation, we cannot anticipate with certainty the length, scope or severity of such restrictions in the jurisdictions in which we operate. Certain vertical markets we serve are especially vulnerable to the ongoing global business disruption. For example: • Many arts and cultural organizations, including museums, zoos, performing arts centers and theaters, among others, have had to cancel events or have seen a significant decline in attendance due to COVID-19. Many of these organizations have also suspended their operations temporarily. • We believe that a number of K-12 private schools, that would have ordinarily considered purchasing our cloud solutions for the 2021-2022 academic school year, have delayed their expenditure decisions due to the uncertainty of COVID-19. • A number of our nonprofit customers have also been negatively impacted by the postponement or cancellation of mass-participation events, such as marathons and other endurance sporting events, galas, auctions and other fundraisers. 22 2021 Form 10-K Table of Contents Blackbaud, Inc. We believe that COVID-19 has impacted and will continue to impact all of our vertical markets across all of our geographies to some degree, but the significance and duration of the impact on our business cannot be determined at this time due to numerous uncertainties, including the duration of the outbreak, travel restrictions and business closures, the effectiveness of vaccination programs and other actions taken to contain the disease and other unforeseeable consequences. This impact could include: • further declines in customer demand and our ability to build pipeline of new customer contracts; • continued elongated sales cycles; • our relationship with, and the financial and operational capacities of, our service providers, suppliers and business partners, including their ability to fulfill their obligations to us; • further declines in our customers' ability to pay for our solutions and services; • reduced workforce availability and productivity due to potential health effects and concerns; • risks associated with our indebtedness (including available borrowing capacity, compliance with financial covenants and ability to refinance or repay indebtedness on favorable terms); • the adequacy of our cash flows and earnings and other conditions that may affect our liquidity; • disruptions to our technology network and other critical systems; and • impairment charges against our goodwill and other intangible assets, operating lease right-of-use assets and other long-lived assets. We believe that business disruption relating to COVID-19 will continue to negatively impact the U.S. and global economies and may continue to materially adversely impact our business, financial condition and results of operations. Defects, delays or interruptions in our cloud solutions and hosting services could diminish demand for these services and subject us to substantial liability. We currently utilize data center hosting facilities to provide cloud solutions to most of our subscription customers and hosting services to our on-premise license customers. Any damage to, or failure of, these data center systems generally could result in interruptions in service to our customers, notwithstanding any business continuity or disaster recovery agreements that may currently be in place at these facilities. Because our cloud solutions and hosting service offerings are complex and we have incorporated a variety of new computer hardware and software systems at our data centers, our services might have errors or defects that users identify after they begin using our services. This could result in unanticipated downtime for our customers and harm to our reputation and business results. Internet-based services sometimes contain undetected errors when first introduced or when new versions or enhancements are released. We have from time to time found defects in our web-based services and new errors might again be detected in the future. In addition, our customers might use our Internet-based offerings in unanticipated ways that cause a disruption in service for other customers attempting to access their data. Because our customers use these services for important aspects of their businesses, any defects, delays or disruptions in service or other performance problems with our services could hurt our reputation and damage our customers' businesses. If that occurs, customers could elect to cancel their service, delay or withhold payment to us, not purchase from us in the future or make claims against us, which could result in an increase in our provision for credit losses, an increase in collection cycles for accounts receivable or the expense and risk of litigation. Any of these could harm our business and reputation. Material defects or errors in the software we use to deliver our services could harm our reputation, result in significant costs to us and impair our ability to sell our services. The software applications underlying our services are inherently complex and may contain material defects or errors, particularly when first introduced or when new versions or enhancements are released. We have from time to time found defects in our software, and new errors in our existing software may be detected in the future. 2021 Form 10-K 23 Table of Contents Blackbaud, Inc. After the release of our software, defects or errors may also be identified from time to time by our internal team and our customers. The costs incurred in correcting any material defects or errors in our software may be substantial and could harm our operating results. Furthermore, our customers may use our software together with solutions from other companies. As a result, when problems occur, it might be difficult to identify the source of the problem. Even when our software does not cause these problems, the existence of these errors might cause us to incur significant costs, divert the attention of our technical personnel from our solution development efforts, impact our reputation and cause significant customer relations problems. If we are unable, or our customers believe we may be unable, to detect and prevent unauthorized use of payment card or other private financial or personal information, we could be subject to financial liability, our reputation could be harmed and customers may be reluctant to use our solutions and services. The rules of payment card associations in which we participate require that we comply with Payment Card Industry Data Security Standard ("PCI DSS") in order to preserve security of payment card data. Under PCI DSS, we are required to adopt and implement internal controls over the use, storage and security of payment card data to help prevent card fraud. Conforming our solutions and services to PCI DSS or other payment services related regulations or requirements imposed by payment networks or our customers or payment processing partners is expensive and time-consuming. However, failure to comply may subject us to fines, penalties, damages and civil liability, may impair the security of payment card data in our possession, and may harm our reputation and our business prospects, including by limiting our ability to process transactions. All Blackbaud products in scope for PCI DSS compliance meet applicable PCI DSS security requirements. In addition, we routinely subject our various data protection processes and controls to voluntary third-party review, audit or reporting, including, for example, the American Institute of Certified Public Accountants’ System and Organization Controls reporting. Failure to conduct these voluntary data protection process and control reviews or to obtain and maintain audits or reports covering our data protection processes and controls may harm our reputation or our business prospects and our ability to market our solutions to our customers. Our operations might be affected by the occurrence of a natural disaster or other catastrophic event. We depend on our principal executive offices and other facilities for the continued operation of our business. Although we have contingency plans in effect for natural disasters or other catastrophic events, these events, including terrorist attacks, computer hacker attacks and natural disasters such as hurricanes, flooding and earthquakes, could disrupt one or more of these facilities and adversely affect our operations. Our principal executive offices are located in a coastal region that has experienced hurricanes and earthquakes in the past. Even though we carry business interruption insurance policies and typically have provisions in our commercial contracts that protect us in certain events, we might suffer losses as a result of business interruptions that exceed the coverage available under our insurance policies or for which we do not have coverage. Any natural disaster or catastrophic event affecting us could have a significant negative impact on our operations. Complications with the design or implementation of our new global enterprise resource planning ("ERP") system could adversely affect our operations and operating results We rely extensively on information systems and technology to manage our business and summarize our operating results. We have implemented a new ERP system, which replaced our previous core financial systems. The new ERP system was designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team. Failure in the design and implementation of the new ERP system could harm our business, financial condition and operating results. Additionally, failure in the design or implementation of the new ERP system as planned or if the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be negatively affected. 24 2021 Form 10-K Table of Contents Blackbaud, Inc. Financial Risks Because a significant portion of our revenue is recognized over time on a ratable basis over the contract term, downturns in sales may not be immediately reflected in our revenue. We generally recognize our subscription and maintenance revenue ratably over time over the contract term. Our subscription arrangements are generally for a term of three years at contract inception with one to three-year renewals thereafter. Most of our maintenance arrangements are for a one-year term. As a result, much of the revenue we report in each quarter is attributable to arrangements entered into during previous quarters. Consequently, a decline in sales to new customers, renewals by existing customers or market acceptance of our solutions in any one quarter will not necessarily be fully reflected in the revenues in that quarter and could negatively affect our revenues and profitability in future quarters. If our customers do not renew their subscriptions for our solutions or annual maintenance and support arrangements or if they do not renew them on terms that are favorable to us, our business might suffer. Our subscription arrangements are generally for a term of three years at contract inception with one to three-year renewals thereafter. Most of our maintenance arrangements are for a one-year term. As the end of the contract term approaches, we seek the renewal of the agreement with the customer. Historically, subscription and maintenance renewals have represented a significant portion of our total revenue. Because of this characteristic of our business, if our customers choose not to renew their subscriptions or maintenance and support arrangements with us on beneficial terms or at all, our business, operating results and financial condition could be harmed. Our customers' renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our solutions and services and their ability to continue their operations and spending levels due to COVID-19 or otherwise. We significantly increased our leverage in connection with acquisitions. We incurred a substantial amount of indebtedness in connection with acquisitions, including our recent acquisition of EVERFI, Inc. (as described in Note 3) and the purchase of our global headquarters facility in 2020. As a result of this indebtedness, our interest payment obligations have increased. In addition, we have been named as a party in various lawsuits in connection with the Security Incident, other claims may be asserted by or on behalf of our customers or their constituents, and we are subject to various governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations, which could require that we incur additional indebtedness to fund. (See Note 11 to our consolidated financial statements in this report for additional information regarding the Security Incident.) The degree to which we are leveraged could have adverse effects on our business, including the following: • Requiring us to dedicate a substantial portion of our cash flow from operations to payments on our indebtedness, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, acquisitions, dividends, share repurchases and other general corporate purposes; • Limiting our flexibility in planning for, or reacting to, changes in our business and the industries in which we operate; • Restricting us from making additional strategic acquisitions or exploiting business opportunities; • Placing us at a competitive disadvantage compared to our competitors that have less debt; • Reducing our currently available borrowing capacity or limiting our ability to borrow additional funds; and • Decreasing our ability to compete effectively or operate successfully under adverse economic and industry conditions. If we incur additional debt, these risks may intensify. Our ability to meet our debt service obligations will depend upon our future performance, which will be subject to the financial, business and other factors affecting our operations, many of which are beyond our control. 2021 Form 10-K 25 Table of Contents Blackbaud, Inc. Our balance sheet includes significant amounts of goodwill and intangible assets. The impairment of a significant portion of these assets could negatively affect our operating results. As of December 31, 2021, we had $1.1 billion and $698.1 million of goodwill and intangible assets, respectively, which reflects an increase of $422.8 million and $457.4 million, respectively, as a result of our recent acquisition of EVERFI. On at least an annual basis, we assess whether there have been impairments in the carrying value of goodwill and intangible assets. If the carrying value of an asset is determined to be impaired, then it is written down to fair value by a non-cash charge to operating earnings. Changes in circumstances that could indicate that the carrying value of goodwill or intangible assets may not be recoverable include declines in our stock price, market capitalization, cash flows and slower growth rates in our industry. We cannot accurately predict the likelihood or potential amount and timing of any impairment of goodwill or other intangible assets. An impairment of a significant portion of goodwill or intangible assets could materially and negatively affect our results of operations and financial condition. Restrictions in our credit facility may limit our activities, including dividend payments, share repurchases and acquisitions. Our credit facility contains restrictions, including covenants limiting our ability to incur additional debt, grant liens, make acquisitions and other investments, prepay specified debt, consolidate, merge or acquire other businesses, sell assets, pay dividends and other distributions, repurchase stock and enter into transactions with affiliates. There can be no assurance that we will be able to remain in compliance with the covenants to which we are subject in the future and, if we fail to do so, that we will be able to obtain waivers from our lenders or amend the covenants. In the event of a default under our credit facility, we could be required to immediately repay all outstanding borrowings, which we might not be able to do. In addition, certain of our material domestic subsidiaries are required to guarantee amounts borrowed under the credit facility, and we have pledged the shares of certain of our subsidiaries as collateral for our obligations under the credit facility. Any such default could have a material adverse effect on our ability to operate, including allowing lenders under the credit facility to enforce guarantees of our subsidiaries, if any, or exercise their rights with respect to the shares pledged as collateral. We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance long-term stockholder value. Share repurchases could also increase the volatility of the trading price of our stock and will diminish our cash reserves. Although our board of directors has authorized a stock repurchase program that does not have an expiration date, the program does not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares of our common stock. We cannot guarantee that the program will be fully consummated or that it will enhance long-term stockholder value. The program could affect the trading price of our stock and increase volatility, and any announcement of a termination of this program may result in a decrease in the trading price of our stock. In addition, this program will diminish our cash reserves, which may impact our ability to finance future growth, to pursue possible future strategic opportunities and acquisitions and fund liabilities and expenses related to the Security Incident. (See Note 14 to our consolidated financial statements in this report for additional information related to our stock repurchase program.) We have recorded significant deferred tax assets, and we might never realize their full value, which would result in a charge against our earnings. As of December 31, 2021, we had deferred tax assets of $137.4 million . Realization of our deferred tax assets is dependent upon our generating sufficient taxable income in future years to realize the tax benefit from those assets. Deferred tax assets are reviewed at least annually for realizability. A charge against our earnings would result if, based on the available evidence, it is more likely than not that some portion of the deferred tax asset will not be realized beyond our existing valuation allowance. This could be caused by, among other things, deterioration in performance, adverse market conditions, adverse changes in applicable laws or regulations, including changes that restrict the activities of or affect the solutions sold by our business and a variety of other facto rs. For example, during 2020, we recorded an increase in our valuation allowance attributable to state tax credit carryforwards for which we do not expect to realize benefit. (See Note 12 to our consolidated financial statements in this report for additional details.) If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, the charge to earnings would be recognized as an expense in our results of operations in the period the determination is made. 26 2021 Form 10-K Table of Contents Blackbaud, Inc. Additionally, if we are unable to utilize our deferred tax assets, our cash flow available to fund operations could be adversely affected. Depending on future circumstances, it is possible that we might never realize the full value of our deferred tax assets. Any future impairment charges related to a significant portion of our deferred tax assets would have an adverse effect on our financial condition and results of operations. Legal and Compliance Risks Privacy and data protection concerns, including evolving domestic and international government regulation in the area of consumer data privacy or data protection, could adversely affect our business and operating results. The effectiveness of our software solutions relies on our customers' storage and use of data concerning their customers, including financial, personally identifying or other sensitive data. Our customers' collection and use of this data for donor profiling, data analytics or communications outreach might raise privacy and data protection concerns and negatively impact the demand for our solutions and services. For example, our custom modeling and analytical services rely heavily on processing and using of data we gather from customers and various sources. Privacy and data protection laws could add restrictions or regulatory burdens, which could limit our ability to market and profit from those services. Governments in some jurisdictions have enacted or are considering enacting consumer data privacy or data protection legislation, including laws and regulations applying to the solicitation, collection, transfer, processing and use of personal data. This legislation could reduce the demand for our software solutions if we fail to design or enhance our solutions to enable our customers to comply with the privacy and data protection measures required by the legislation. Moreover, we may be exposed to liability under existing or new consumer privacy or data protection legislation. For example, when providing our solutions to certain customers in the healthcare industry, we must comply with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and might be subject to similar provisions of other legislation, including, without limitation, the Gramm-Leach-Bliley Act and related regulations, and the California Consumer Privacy Act of 2018, which became effective January 1, 2020, and may apply to some of our customers and areas of business. Even technical violations of these laws may result in penalties that are assessed for each non-compliant transaction. Blackbaud, and some of our customers, are subject to the E.U. General Data Protection Regulation (“GDPR”), which became effective in the E.U. in May 2018 and its provisions continue to apply in the U.K. after Brexit by virtue of legislation incorporating the GDPR into U.K. data protection law, known as the "U.K. GDPR." The law requires companies to meet requirements regarding the handling of personal data, including rights such as the portability of personal data. We completed an extensive program of product and operational changes to address GDPR requirements and all future solutions sold to customers subject to GDPR must include GDPR features. The implementation of GDPR has affected our ability to offer some features and services to customers in the E.U. and U.K. Furthermore, actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase, which could impact us through increased costs or restrictions on our business, and noncompliance could result in significant regulatory penalties and legal liability. If our customers or we were found to be subject to and in violation of any privacy or data protection laws or regulations, our business may be materially and adversely impacted and we and/or our customers would likely have to change our business practices. In addition, these laws and regulations could impose significant costs on our customers and us and make it more difficult for donors to make online donations. (See Note 11 to our consolidated financial statements included in this report for a description of the Security Incident and related legal proceedings and regulatory matters.) 2021 Form 10-K 27 Table of Contents Blackbaud, Inc. We are in the information technology business, and our solutions and services store, retrieve, transfer, manipulate and manage our customers’ information and data. The effectiveness of our software solutions relies on our customers’ storage and use of data concerning their donors, including financial, personally identifying and other sensitive data and our business uses similar systems that require us to store and use data with respect to our customers and personnel. Our collection and our customers’ collection and use of this data might raise privacy and data protection concerns and negatively impact our business or the demand for our solutions and services. If a breach of data security, such as the Security Incident, were to occur, or other violation of privacy or data protection laws and regulations were to be alleged, our business may be materially and adversely impacted and solutions may be perceived as less desirable, which would negatively affect our business and operating results. Claims that we or our technologies infringe upon the intellectual property or other proprietary rights of a third party may require us to incur significant costs, enter into royalty or licensing agreements or develop or license substitute technology. We have been, and may in the future be subject to claims that the technologies in our solutions and services infringe upon the intellectual property or other proprietary rights of a third party. In addition, the vendors providing us with technology that we use in our own solutions could become subject to similar infringement claims. Although we believe that our solutions and services do not infringe any intellectual property or other proprietary rights, we cannot be certain that our solutions and services do not, or that they will not in the future, infringe intellectual property or other proprietary rights held by others. Any claims of infringement could cause us to incur substantial costs to defend against the claim, even if the claim is without merit, and could distract our management from our business. Moreover, any settlement or adverse judgment resulting from the claim could require us to pay substantial amounts, or obtain a license to continue to use the technology and services that are the subject of the claim, and/or otherwise restrict or prohibit our use of the same. There can be no assurance that we would be able to obtain a license on commercially reasonable terms from the third party asserting any particular claim, or that we would be able to successfully develop alternative technology on a timely basis, or that we would be able to obtain a license from another provider of suitable alternative technology to permit us to continue offering, and our customers to continue using, the solutions and services. In addition, we generally provide in our customer arrangements for certain solutions and services that we will indemnify our customers against third-party infringement claims relating to technology we provide to those customers, which could obligate us to pay damages if the solutions and services were found to be infringing. Infringement claims asserted against us, our vendors or our customers may have a material adverse effect on our business, prospects, financial condition and results of operations. Our solutions utilize open source software, which may subject us to litigation, require us to re-engineer our solutions, or otherwise divert resources away from our development efforts. We use open source software in connection with certain of our solutions. Such open source software is generally licensed by its authors or other third parties under open source licenses, including, for example, the GNU General Public License, the GNU Lesser General Public License, “Apache-style” licenses, “BSD-style” licenses and other open source licenses. There is little legal precedent governing the interpretation of many of the terms of some of these licenses and, therefore, the potential impact of these terms on our business is currently unable to be determined and may result in unanticipated obligations regarding our solutions and technologies. From time to time, companies that incorporate open source software into their products have faced claims challenging the ownership of open source software and/or compliance with open source license terms. Therefore, we could be subject to litigation by parties claiming ownership of open source software or noncompliance with open source licensing terms. Some open source software licenses require users who distribute open source software as part of their own software to publicly disclose all or part of the source code to such software and/or make available any derivative works of the open source code on unfavorable terms or at no cost. While we monitor our use of open source software and try to ensure that none is used in a manner that would require us to disclose the source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur and we may be required to release proprietary source code, pay damages for breach of contract, re-engineer our applications, discontinue sales in the event re-engineering cannot be accomplished on a timely basis, or take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business. 28 2021 Form 10-K Table of Contents Blackbaud, Inc. We rely upon trademark, copyright, patent and trade secret laws to protect our proprietary rights, which might not provide us with adequate protection. Our success and ability to compete depends to a significant degree upon the protection of our proprietary technology rights. We might not be successful in protecting our proprietary technology and our proprietary rights might not provide us with a meaningful competitive advantage. To protect our core proprietary technology, we rely on a combination of patent, trademark, copyright and trade secret laws, as well as nondisclosure agreements, each of which affords only limited protection. Changing domestic and international laws, government regulations and policies could adversely affect our business and operating results by increasing compliance costs, reducing customer demand for our solutions or damaging our reputation. Certain of our solutions, in particular, our financial management and payment services solutions, relate to activity heavily regulated by government agencies in the U.S., the U.K. and other countries in which we operate. The laws and regulations enforced by these agencies are proposed or enacted to deter fraud and other illicit financial transactions and to protect consumers and the financial system and are often revised or increased in scope. We have procedures and controls in place to monitor compliance with numerous federal, state and foreign laws and regulations. However, because these laws and regulations are complex, differ between jurisdictions, and are often subject to interpretation, or as a result of unintended errors, we may, from time to time, inadvertently violate these laws and regulations. Compliance with these laws and regulations is expensive and requires the time and attention of management. These costs divert capital and focus away from efforts intended to grow our business. If we do not successfully comply with laws, regulations, or policies, we could incur fines or penalties, be subject to litigation, lose existing or new customer contracts or other business, and suffer damage to our reputation. In addition, changes in certain laws, regulations or policies could impact our customers, alter our business environment and limit our operations. For example, various financial institutions subscribe to our EVERFI training solution, which they may then provide free of charge to schools in low-income and moderate-income communities as a means of satisfying their obligations under the Community Reinvestment Act of 1977, as amended (the “CRA”). Repeal or significant modification of the CRA or the many government agency regulations and policies implementing its provisions could cause financial institutions to limit or eliminate their purchases of these EVERFI solutions and thereby negatively impact our operating results and financial condition. Anti-takeover provisions in our charter documents and Delaware law may delay or prevent an acquisition of our Company. Provisions of Delaware law, our certificate of incorporation and bylaws may have the effect of delaying or preventing a change in control of our company or deterring tender offers for our common stock that other stockholders may consider in their best interests. Our certificate of incorporation authorizes “blank check” preferred stock, which could be issued by the board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock. Stockholder approval is not necessary to issue preferred stock in this manner. Issuance of these shares of preferred stock could have the effect of making it more difficult and more expensive for a person or group to acquire control of us, and could effectively be used as an anti-takeover device. Currently there are no shares of our preferred stock issued or outstanding. Our bylaws provide for an advance notice procedure for stockholders to nominate director candidates for election or to bring business before an annual meeting of stockholders, including proposed nominations of persons for election to our board of directors, and limit the persons who may call special meetings of stockholders. The anti-takeover provisions of Delaware law and provisions in our organizational documents may prevent our stockholders from receiving the benefit from any premium to the market price of our common stock offered by a bidder in a takeover context. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future. ITEM 1B. UNRESOLVED STAFF COMMENTS None. 2021 Form 10-K 29 Table of Contents Blackbaud, Inc.