nCino, Inc. 10-K

Item 1A. Risk Factors You should consider and read carefully all of the risks and uncertainties described below, as well as other information included in this Annual Report on Form 10-K, including the section titled "Management's Discussion and Analysis of Financial Condition and Results of Operations" and our consolidated financial statements and related notes before making an investment decision with respect to our common stock. The risks described below are not the only ones we face. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition, or results of operations. In such case, the trading price of our common stock could decline, and you may lose all or part of your investment. Summary Risk Factors The below summary of risk factors provides an overview of many of the risks we are exposed to in the normal course of our business activities. As a result, the below summary risks do not contain all of the information that may be important to you, and you should read the summary risks together with the more detailed discussion of risks set forth following this section under the heading “Risk Factors,” as well as elsewhere in this Annual Report on Form 10-K. Additional risks, beyond those summarized below or discussed elsewhere in this Annual Report on Form 10-K, may apply to our activities or operations as currently conducted or as we may conduct them in the future or in the markets in which we operate or may in the future operate. Consistent with the foregoing, we are exposed to a variety of risks, including risks associated with the following: • We have a limited operating history, which makes it difficult to predict our future operating results, and we may not achieve our expected operating results in the future. • We have a history of operating losses and may not achieve or sustain profitability in the future. • If we are unable to attract new customers or continue to broaden our existing customers’ use of our solutions, our revenue growth will be adversely affected. • If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate, our sales would suffer and our results of operations would be adversely affected. • We may not be able to sustain our revenue growth rate in the future. • Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business. • We may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results. • A breach of our security measures or those we rely on could result in unauthorized access to customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations. • Fundamental elements of the nCino Bank Operating System are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers. • Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods. 12 Table of Contents • We derive all of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business. • The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies, or other competitive dynamics could adversely affect our business and results of operations. • We depend on data centers operated by or on behalf of Salesforce, Amazon Web Services ("AWS") and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability. • We may acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments or partnerships. • Because one of our stockholders holds a substantial amount of our total outstanding common stock, the influence of our public stockholders over significant corporate actions is limited and sales by this stockholder could adversely affect the value of our common stock. • Our customers are highly regulated and subject to a number of challenges and risks. Our failure to comply with laws and regulations applicable to us as a technology provider to financial institutions could adversely affect our business and results of operations, increase costs and impose constraints on the way we conduct our business. • We are presently subject to a government investigation and a civil suit involving alleged violations of antitrust laws relating to our hiring and wage practices. These matters or future litigation against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend. Risks Relating to Our Business and Industry We have a limited operating history, which makes it difficult to predict our future operating results, and we may not achieve our expected operating results in the future. As a result of our limited operating history, our ability to forecast our future operating results, including revenues, cash flows, and profitability, is limited and subject to a number of uncertainties. We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in the technology industry, such as the risks and uncertainties described in this Annual Report on Form 10-K. If our assumptions regarding these risks and uncertainties are incorrect or change due to changes in our markets, or if we do not address these risks successfully, our operating and financial results may differ materially from our expectations and our business may suffer. We have a history of operating losses and may not achieve or sustain profitability in the future. We began operations in late 2011 and have experienced net losses since inception. We generated net losses attributable to nCino of $27.6 million, $40.5 million, and $49.4 million for the fiscal years ended January 31, 2020, 2021, and 2022, respectively. Our net loss for fiscal 2022 includes the results of operations of SimpleNexus from the Acquisition Date. We had an accumulated deficit of $209.6 million at January 31, 2022. We will need to generate and sustain increased revenue levels in future periods in order to become profitable, and, even if we do, we may not be able to maintain or increase our level of profitability. We intend to continue to expend significant resources to support further growth and extend the functionality of the nCino Bank Operating System, expand our sales and product development headcount, increase our marketing activities, and grow our international operations. We will also face increased costs associated with growth and the expansion of our customer base and have seen increased costs in becoming a public company. Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses. We expect to incur losses for the foreseeable future as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease. 13 Table of Contents If we are unable to attract new customers or continue to broaden our existing customers’ use of our solutions, our revenue growth will be adversely affected. To increase our revenues, we will need to continue to attract new customers and succeed in having our current customers expand the use of our solutions across their institution. For example, our revenue growth strategy includes increased penetration of markets outside the United States as well as selling our retail applications to existing and new customers, and failure in either respect would adversely affect our revenue growth. In addition, for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions with us on the same or more favorable terms to us when their existing subscription term expires. Our revenue growth rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction with our solutions, decreases in the number of users at our customers, changes in the type and size of our customers, pricing changes, competitive conditions, the loss of our customers to other companies, and general economic conditions. Our customers may also require fewer subscriptions for our solutions as their use may enable them to operate more efficiently over time. Therefore, we cannot assure you that our current customers will renew or expand their use of our solutions. If we are unable to sign new customers or retain or attract new business from current customers, our business and results of operations may be materially and adversely affected. If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate, our sales would suffer and our results of operations would be adversely affected. Use of, and reliance on, cloud-based banking technology is still at an early stage and we do not know whether financial institutions will continue to adopt cloud-based banking technology such as the nCino Bank Operating System in the future, or whether the market will change in ways we do not anticipate. Many financial institutions have invested substantial personnel and financial resources in legacy software, and these institutions may be reluctant, unwilling, or unable to convert from their existing systems to our solutions. Furthermore, these financial institutions may be reluctant, unwilling, or unable to use cloud-based banking technology due to various concerns such as the security of their data and reliability of the delivery model. These concerns or other considerations may cause financial institutions to choose not to adopt cloud-based banking technology such as ours or to adopt them more slowly than we anticipate, either of which would adversely affect us. Our future success also depends on our ability to sell additional applications and functionality, such as nIQ and SimpleNexus, to our current and prospective customers. As we create new applications and enhance our existing solutions, these applications and enhancements may not be attractive to customers. In addition, promoting and selling new and enhanced functionality may require increasingly costly sales and marketing efforts and if customers choose not to adopt this functionality, our business and results of operations could suffer. If financial institutions are unwilling or unable to transition from their legacy systems, or if the demand for our solutions does not meet our expectations, our results of operations and financial condition will be adversely affected. We may not be able to sustain our revenue growth rate in the future. Our revenues increased from $138.2 million for fiscal 2020 to $204.3 million for fiscal 2021 to $273.9 million for fiscal 2022. Our revenues for fiscal 2022 include the revenues of SimpleNexus from the Acquisition Date. We may not be able to sustain revenue growth consistent with our recent history, if at all. Our revenue growth in recent periods may not be indicative of our future performance. Furthermore, to the extent we grow in future periods, maintaining consistent rates of revenue growth may be difficult. Our revenue growth may also slow or even reverse in future periods due to a number of factors, which may include slowing demand for our solutions, our ability to successfully sell and implement new applications, such as our retail applications, increasing competition, decreasing growth of our overall market, the impact of COVID-19, our inability to attract and retain a sufficient number of financial institution customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions. If we are unable to maintain consistent revenue growth, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability. Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business. Our quarterly results of operations, including the levels of our revenues, gross margin, profitability, cash flow, and deferred revenue, may vary significantly in the future and, accordingly, period-to-period comparisons of our results of operations may not be meaningful. Thus, the results of any one quarter should not be relied upon as an indication of future performance. Our quarterly financial results may fluctuate as a result of a variety of factors, many of which are outside of our control, and may not fully or accurately reflect the underlying performance of our business. For example, purchases of our Paycheck Protection Program ("PPP") solution during the COVID pandemic may have had the effect of accelerating demand that might have otherwise materialized as new business in later periods as well as accelerating the activation of the licenses and 14 Table of Contents recognition of subscription revenues associated with the PPP solution. Further, while subscriptions with our customers generally include multi-year non-cancellable terms, in a limited number of contracts, customers have an option to buy out of the contract for a specified termination fee. If such customers exercise this buy-out option, or if we negotiate an early termination of a contract at a customer’s request, any termination fee would be recognized in full at the time of termination, which would favorably affect subscription revenues in that period and unfavorably affect subscription revenues in subsequent periods. Fluctuation in quarterly results may negatively impact the value of our common stock. Factors that may cause fluctuations in our quarterly financial results include, without limitation, those listed below: • our ability to retain current customers or attract new customers; • the activation, delay in activation, or cancellation of large blocks of users by customers; • the timing of recognition of professional services revenues; • the amount and timing of operating expenses related to the maintenance and expansion of our business, operations, and infrastructure; • acquisitions of our customers, to the extent the acquirer elects not to continue using our solutions or reduces subscriptions to our solutions; • customer renewal rates; • increases or decreases in the number of users licensed or pricing changes upon renewals of customer contracts; • network outages or security breaches; • general economic, industry, and market conditions (particularly those affecting financial institutions); • changes in our pricing policies or those of our competitors; • seasonal variations in sales of our solutions, which have historically been highest in the fourth quarter of our fiscal year; • the timing and amount of litigation and litigation-related expenses; • the timing and success of new product introductions by us or our competitors or any other change in the competitive dynamics of our industry, including consolidation among competitors, customers, or strategic partners; and • the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill from acquired companies. We may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results. Our customers have no obligation to renew their subscriptions for our solutions after the expiration of the initial or current subscription term, and our customers, if they choose to renew at all, may renew for fewer users or on less favorable pricing terms. Since the average initial term of our customer agreements is three to five years, and we only began selling the nCino Bank Operating System in 2012, we have limited historical data with respect to rates of customer subscription renewals and cannot be certain of anticipated renewal rates. Our renewal rates may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels. If our customers do not renew their subscriptions for our solutions on similar pricing terms, our revenues may decline and our business could suffer. Additionally, as the markets for our solutions develop, we may be unable to attract new customers based on the same subscription model we have used historically. Moreover, large or influential financial institution customers may demand more favorable pricing or other contract terms from us. As a result, we may in the future be required to change our pricing 15 Table of Contents model, reduce our prices, or accept other unfavorable contract terms, any of which could adversely affect our revenues, gross margin, profitability, financial position, and/or cash flow. A breach of our security measures or those we rely on could result in unauthorized access to customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations. Certain elements of our solutions, particularly our analytics applications, process and store personally identifiable information (“PII”) such as banking and personal information of our customers’ clients, and we may also have access to PII during various stages of the implementation process or during the course of providing customer support. Furthermore, as we develop or acquire additional functionality, such as SimpleNexus, we may gain greater access to PII. We maintain policies, procedures, and technological safeguards designed to protect the confidentiality, integrity, and availability of this information and our information technology systems. However, we and our third party service providers, frequently defend against and respond to data security incidents. We cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of PII or other security events that impact the integrity or availability of PII or our systems and operations, or the related costs we may incur to mitigate the consequences from such events. Further, our products are flexible and complex software solutions and there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches. There may be continued unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations. In addition, because we leverage third-party providers, including cloud, software, data center, and other critical technology vendors to deliver our solutions to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers. A vulnerability in a third-party provider’s software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions. Cyberattacks and other malicious internet-based activity continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, employee theft or misuse, and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, discovery of existing or new vulnerabilities, and attempts to exploit those vulnerabilities or other developments, may compromise or breach our systems or solutions. In the event our or our third-party providers’ protection efforts are unsuccessful and our systems or solutions are compromised, we could suffer substantial harm. A security breach could result in operational disruptions, loss, compromise or corruption of customer or client data or data we rely on to provide our solutions, including our analytics initiatives and offerings that impair our ability to provide our solutions and meet our customers’ requirements resulting in decreased revenues and otherwise materially negatively impacting our financial results. Also, our reputation could suffer irreparable harm, causing our current and prospective customers to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and protection technologies, and defending against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations. Federal and state regulations may require us or our customers to notify individuals of data security incidents involving certain types of personal data or information technology systems, and those laws and regulations continue to evolve to add more reporting requirements on faster timelines. Security compromises experienced by others in our industry, our customers, or us may lead to public disclosures and widespread negative publicity. Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew or expand their use of our solutions, or subject us to third-party lawsuits, regulatory fines, or other actions or liabilities, which could materially and adversely affect our business and results of operations. In addition, some of our customers contractually require notification of data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meets certain service levels. In certain of our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a customer’s right to terminate their contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent customers from potentially terminating their contracts with us. Furthermore, although our customer contracts typically include limitations on our potential liability, there can be no assurance that such limitations of liability would be adequate. We also cannot be sure that our existing general 16 Table of Contents liability insurance coverage and coverage for errors or omissions will be available on acceptable terms or will be available in sufficient amounts to cover one or more claims, or that our insurers will not deny or attempt to deny coverage as to any future claim. The successful assertion of one or more claims against us, the inadequacy or denial of coverage under our insurance policies, litigation to pursue claims under our policies, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could materially and adversely affect our business and results of operations. Fundamental elements of the nCino Bank Operating System are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers. Fundamental elements of the nCino Bank Operating System, including our client onboarding, loan origination, and deposit account opening applications, are built on the Salesforce Platform and we rely on the Salesforce Agreement to use the Salesforce Platform in conjunction with this solution, including for hosting infrastructure and data center operations. Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model. The Salesforce Agreement expires on June 19, 2027, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and automatically renews for additional one-year periods thereafter unless notice of non-renewal is provided. If we are unable to renew our agreement with Salesforce, there would be, absent a termination for cause, a wind-down period during which existing customers would be able to continue using the nCino Bank Operating System in conjunction with the Salesforce Platform, but we would be unable to provide this solution to new customers and could be limited in our ability to allow current customers to add additional users. In addition, if we are unable to renew our agreement with Salesforce, our customers would need to obtain a separate subscription from Salesforce in order to access the nCino Bank Operating System. This could cause a significant delay in the time required to enter into agreements with customers, place us and our customers at a disadvantage in negotiating with Salesforce, and lead customers not to renew or enter into agreements with us. We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if not, our business and operating results may be materially and adversely affected. In addition, Salesforce has the right to terminate its agreement with us in certain circumstances, including in the event of a material breach of the Salesforce Agreement by us. If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above. We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Bank Operating System infringes the intellectual property rights of such third party. An expiration or termination of the Salesforce Agreement would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Bank Operating System to become obsolete. Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different product. If we were unsuccessful in acquiring or developing a replacement solution or acquire or develop a replacement solution that our customers do not adopt, our business, results of operations, and brand would be materially and adversely affected. Furthermore, there are no exclusivity arrangements in place with Salesforce that would prevent them from developing their own offerings that compete directly with ours, acquiring a company with offerings similar to ours, or investing greater resources in our competitors. While we believe our relationship with Salesforce is strong, Salesforce competing with us could materially and adversely affect our business and results of operations. Privacy and data security concerns, data collection and transfer restrictions and related domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business and results of operations. Personal privacy, information security, and data protection are significant issues in the United States, the European Union (“EU”), and a number of other jurisdictions where we offer our solutions. The regulatory framework governing the collection, processing, storage, and use of certain information, particularly financial and other PII, is rapidly evolving. Any failure or perceived failure by us to comply with applicable privacy, security, or data protection laws, regulations, or industry standards may materially and adversely affect our business and results of operations. We expect that there will continue to be new proposed and adopted laws, regulations, and industry standards concerning privacy, data protection, and information security in the United States, the EU, and other jurisdictions in which we operate. For instance, the California Consumer Privacy Act (the "CCPA") became effective on January 1, 2020. The CCPA 17 Table of Contents gives California residents expanded rights to access and delete their personal information, receive detailed information about how their personal information is used and shared by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined), and provide such consumers rights to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Although there are exemptions for certain personal information and the CCPA’s implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, the CCPA may increase our compliance costs and potential legal privacy and cybersecurity risks. The California Privacy Rights Act (the "CPRA"), which expands the CCPA, passed in November 2020. The CPRA will, among other things, impose additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement. The majority of the CPRA provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Following the CPRA, Virginia and Colorado have enacted similar, but not completely consistent, comprehensive privacy legislation that will also go into effect in January and July 2023, respectively. Many other states are considering similar legislation in addition to the consideration of comprehensive privacy legislation at the federal level. If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging. Similarly, the European Economic Area (the "EEA") (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the "EU GDPR") in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 (known as the "UK GDPR", and together with the "EU GDPR", the "GDPR"). The GDPR imposes a number of obligations on controllers, including, among others: (i) accountability and transparency requirements which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects regarding processing; (ii) enhanced requirements for obtaining valid consent; (iii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed; (iv) obligations to comply with data protection rights of data subjects including a right of access to and rectification of personal data, a right to obtain restriction of processing or to object to processing of personal data and a right to ask for a copy of personal data to be provided to a third party in a useable format and erasing personal data in certain circumstances; (v) obligations to implement appropriate technical and organizational security measures to safeguard personal data; and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible). In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism in accordance with the EU GDPR has been put in place. In July 2020, the Court of Justice of the European Union (the "CJEU") in its Schrems II ruling invalidated the EU-U.S. Privacy Shield framework, a self-certification mechanism that facilitated the lawful transfer of personal data from the EEA to the United States, with immediate effect. The CJEU upheld the validity of standard contractual clauses ("SCCs") as a legal mechanism to transfer personal data but companies relying on SCCs will need to carry out a transfer privacy impact assessment which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA. The UK GDPR imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK does not consider adequate. This may have implications for our cross-border data flows and may result in additional compliance costs. The GDPR also introduces fines of up to €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, for serious violations of certain of the GDPR’s requirements. The GDPR identifies a list of points to consider when determining the level of fines to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to compensation for financial or non-financial losses (e.g., distress). Complying with the GDPR may cause us to incur substantial operational and compliance costs or require us to change our business practices. Despite our efforts to bring practices into compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, regulators, customers, data subjects, suppliers, vendors or other parties. Further, there is a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the new procedures. If there are breaches of these measures, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects. 18 Table of Contents The E.U. has also proposed the draft ePrivacy Regulation which, once finalized and in effect, will replace both the ePrivacy Directive and all the national laws implementing this Directive. The ePrivacy Regulation, as proposed in its current form, would impose strict opt-in marketing rules, change rules about the use of cookies, web beacons, and related technologies, and significantly increase penalties for violations. It would also retain the additional consent standards as required under the EU GDPR. Such regulations may have a negative effect on businesses, including ours, that collect, process, and use personal data in the EU and UK, including online usage information for consumer acquisition and marketing and may increase the potential civil liability and cost of operating a business that collects, processes, or uses such information and undertakes online marketing. We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations. Any such laws, rules, and regulations may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of information including financial and PII, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve. Any failure or perceived failure by us, or any third parties with which we do business, to comply with these laws, rules, and regulations, or with other obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time, and other resources, or the incurrence of fines, penalties, or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business and results of operations. Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods. We generally recognize subscription revenues ratably over the terms of our customer contracts, which typically range from three to five years. Most of the subscription revenues we report each quarter are derived from the recognition of deferred revenue relating to subscriptions activated in previous quarters. Consequently, a reduction in activated subscriptions in any single quarter may only have a small impact on our subscription revenues for that quarter. However, such a decline will negatively affect our subscription revenues in future quarters. Accordingly, the effect of significant downturns in sales or market acceptance of our solutions may not be reflected in our results of operations until future periods. We derive all of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business. All of our revenues are derived from financial institutions whose industry has experienced significant pressure in recent years due to economic uncertainty, low interest rates, liquidity concerns and increased regulation. In the past, financial institutions have experienced consolidation, distress and failure. It is possible these conditions may reoccur. If any of our customers merge with or are acquired by other entities, such as financial institutions that have internally developed banking technology solutions or that are not our customers or use our solutions less, we may lose business. Additionally, changes in management of our customers could result in delays or cancellations of the implementation of our solutions. It is also possible that the larger financial institutions that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions. Our business may also be materially and adversely affected by weak economic conditions in the financial services industry. Any downturn in the financial services industry may cause our customers to reduce their spending on technology or cloud-based banking applications or to seek to terminate or renegotiate their contracts with us. Moreover, even if the overall economy is robust, economic fluctuations caused by things such as the U.S. Federal Reserve changing interest rates may cause potential new customers and existing customers to forego or delay purchasing our solutions or reduce the amount of spend with us, which would materially and adversely affect our business. The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies or other competitive dynamics could adversely affect our business and results of operations. We currently compete with providers of technology and services in the financial services industry, primarily point solution vendors that focus on building functionality that competes with specific components of our solutions. From time to time, we also compete with systems internally developed by financial institutions. Many of our competitors have significantly more financial, technical, marketing and other resources than we have, may devote greater resources to the development, 19 Table of Contents promotion, sale and support of their systems than we can, have more extensive customer bases and broader customer relationships than we have and have longer operating histories and greater name recognition than we do. We may also face competition from new companies entering our markets, which may include large established businesses that decide to develop, market or resell cloud-based banking technology, acquire one of our competitors or form a strategic alliance with one of our competitors or with Salesforce. In addition, new companies entering our markets may choose to offer cloud-based banking applications at little or no additional cost to the customer by bundling them with their existing applications, including adjacent banking technologies. Competition from these new entrants may make attracting new customers and retaining our current customers more difficult, which may adversely affect our results of operations. If we are unable to compete in this environment, sales and renewals of the nCino Bank Operating System could decline and adversely affect our business and results of operations. With the introduction of new technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability. We depend on data centers operated by or on behalf of Salesforce, Amazon Web Services ("AWS"), and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability. Our solutions are primarily hosted in data centers operated by or on behalf of Salesforce, AWS, and other third parties and we do not control the operation of these data centers. Problems associated with these data centers could adversely affect the experience of our customers. Any disruptions or other operational performance problems with these data centers could result in material interruptions in our services, adversely affect our reputation and results of operations, and subject us to liability. We may acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments, or partnerships. From time to time, we consider potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions, and other assets. For example, in fiscal 2022 we acquired SimpleNexus, our largest acquisition to date. We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing, or investments in other companies. Negotiating these transactions can be time-consuming, difficult, and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control. For instance, we incurred significant costs in connection with the SimpleNexus acquisition. In addition, nCino has limited experience in acquiring other businesses. If an acquired business, including SimpleNexus, fails to meet our expectations, our operating results, business, and financial position may suffer. We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target, and we may not be successful in entering into an agreement with any particular target. If we are successful in acquiring additional businesses, such as SimpleNexus, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including: • our inability to integrate or benefit from acquired technologies or services; • unanticipated costs or liabilities associated with the acquisition; • incurrence of acquisition-related costs; • difficulty integrating the technology, accounting systems, operations, control environments, and personnel of the acquired business and integrating the acquired business or its employees into our culture; • difficulties and additional expenses associated with supporting legacy solutions and infrastructure of the acquired business; • difficulty converting the customers of the acquired business to our solutions and contract terms, including disparities in licensing terms; • additional costs for the support or professional services model of the acquired company; 20 Table of Contents • diversion of management’s attention and other resources; • adverse effects to our existing business relationships with business partners and customers; • the issuance of additional equity securities that could dilute the ownership interests of our stockholders; • incurrence of debt on terms unfavorable to us or that we are unable to repay; • incurrence of substantial liabilities; • difficulties retaining key employees of the acquired business; and • adverse tax consequences, substantial depreciation, or deferred compensation charges. In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations. Because one of our stockholders holds a substantial amount of our total outstanding common stock, the influence of our public stockholders over significant corporate actions is limited and sales by this stockholder could adversely affect the value of our common stock. Based on the total number of shares of our common stock outstanding as of January 31, 2022, entities affiliated with Insight Partners (“Insight Partners”) holds approximately 36% of our total outstanding common stock. As a result, Insight Partners has the ability to influence the outcome of corporate actions requiring stockholder approval, including the election of directors, the approval of mergers, or other changes of corporate control, any of which may be in opposition to the best interests of our other stockholders and may adversely impact our results of operations and the value of our common stock. Sales of our common stock by Insight Partners could have an immediate and substantial adverse effect on the value of our common stock. Our customers are highly regulated and subject to a number of challenges and risks. Our failure to comply with laws and regulations applicable to us as a technology provider to financial institutions could adversely affect our business and results of operations, increase costs, and impose constraints on the way we conduct our business. Our customers and prospective customers are highly regulated and are generally required to comply with stringent regulations in connection with performing business functions that our solutions address. As a provider of technology to financial institutions, we have been, and expect to continue to be, examined on a periodic basis by various regulatory agencies and may be required to review certain of our suppliers and partners. In addition, while much of our operations are not directly subject to the same regulations applicable to financial institutions, we are generally obligated to our customers to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them. For example, as a result of obligations under some of our customer contracts, we are required to comply with certain provisions of the Gramm-Leach-Bliley Act related to the privacy of consumer information and may be subject to other privacy and data security laws because of the solutions we provide to financial institutions. Matters subject to review and examination by federal and state financial institution regulatory agencies and external auditors include our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities, and the design of our solutions. Any inability to satisfy these examinations and maintain compliance with applicable regulations could adversely affect our ability to conduct our business, including attracting and maintaining customers. If we have to make changes to our internal processes and solutions as result of these regulations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency. The evolving, complex, and often unpredictable regulatory environment in which our customers operate could result in our failure to provide compliant solutions, which could result in customers not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible. In addition, federal, state, and/or foreign agencies may attempt to further regulate our activities in the future which could adversely affect our business and results of operations. 21 Table of Contents Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend. We are presently subject to a government investigation and a putative class action civil suit involving alleged violations of antitrust laws. We may, in the future, become subject, from time to time, to other legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes or employment claims made by current or former employees. Legal proceedings might result in damages and harm to our operations and prospects, reputational damage, substantial costs, and may divert management’s attention and resources, which might adversely impact our business, overall financial condition, and results of operations. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us. Moreover, any negative impact to our reputation will not be adequately covered by any insurance recovery. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our results of operations and leading analysts or potential investors to reduce their expectations of our performance, which could reduce the value of our common stock. Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be adversely affected. We believe our corporate culture is one of our fundamental strengths, as we believe it enables us to attract and retain top talent and deliver superior results for our customers. As we grow, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively. In turn, the failure to preserve our culture could negatively affect our ability to attract, recruit, integrate and retain employees, continue to perform at current levels and effectively execute our business strategy. We may encounter implementation challenges, including in situations in which we rely on SIs, which would materially and adversely affect our business and results of operations. We may face unexpected challenges related to the complexity of our customers’ implementation and configuration requirements. Implementation of our solutions may be delayed or expenses may increase when customers have unexpected data, software, or technology challenges, or unanticipated business requirements, which could adversely affect our relationship with customers and our operating results. In general, the revenues related to implementation and other professional services we provide are recognized on a proportional performance basis, and delays and difficulties in these engagements could result in losses on these contracts. In addition, our customers often require complex acceptance testing related to the implementation of our solutions. We also leverage the services of SIs, including Accenture, Deloitte, PwC, and West Monroe Partners, among others, to implement and configure the nCino Bank Operating System for our larger financial institution customers, and we are increasingly using other SIs for smaller engagements as we continue to scale our business. While SIs generally contract directly with our customers, any failure or delay by the SIs we work with in providing adequate service and support would likely adversely affect our brand and reputation. For implementations we conduct ourselves, project delays may result in recognizing revenues later than expected. Further, because we do not fully control our customers’ implementation schedules, if our customers do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties, our ability to take customers live and the overall customer experience could be adversely affected. We rely on existing customers to act as references for prospective customers, and difficulties in implementation and configuration could therefore adversely affect our ability to attract new customers. Any difficulties or delays in implementation processes could cause customers to delay or forego future purchases of our solutions. We have experienced rapid growth, and if we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction, or adequately address competitive challenges, any of which may materially and adversely affect our business and results of operations. Since our inception, our business has grown rapidly, which has resulted in a large increase in our employee headcount, expansion of our infrastructure, enhancement of our internal systems, and other significant changes and additional complexities. Our revenues increased from $138.2 million for fiscal 2020 to $204.3 million for fiscal 2021 to $273.9 million for fiscal 2022. Our revenues for fiscal 2022 include the revenues of SimpleNexus from the Acquisition Date. Our total number of employees increased from 436 as of January 31, 2018 to 1,681 as of January 31, 2022, which includes SimpleNexus. Managing and sustaining a growing workforce and customer base geographically-dispersed in the United States and internationally will require substantial management effort, infrastructure, and operational capabilities. To support our growth, we must continue to improve our management resources and our operational and financial controls and systems, and these improvements may increase our expenses more than anticipated and result in a more complex business. We will also have to expand and enhance 22 Table of Contents the capabilities of our sales, relationship management, implementation, customer service, research and development, and other personnel to support our growth and continue to achieve high levels of customer service and satisfaction. Our success will depend on our ability to plan for and manage this growth effectively. If we fail to anticipate and manage our growth or are unable to continue to provide high levels of customer service, our reputation, as well as our business and results of operations, could be materially and adversely affected. Defects, errors, or other performance problems in our solutions could harm our reputation, result in significant costs to us, impair our ability to sell our solutions, and subject us to substantial liability. Our solutions are complex and may contain defects or errors when implemented or when new functionality is released. Despite extensive testing, from time to time we have discovered and may in the future discover defects or errors in our solutions. Any performance problems or defects in our solutions may materially and adversely affect our business and results of operations. Defects, errors, or other performance problems or disruptions in service to provide bug fixes or upgrades, whether in connection with day-to-day operations or otherwise, could be costly for us, damage our customers’ businesses, and harm our reputation. In addition, if we have any such errors, defects, or other performance problems, our customers could seek to terminate their contracts, elect not to renew their subscriptions, delay or withhold payment, or make claims against us. Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation, or adverse publicity. Errors, defects, or other problems could also result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. If we fail to accurately anticipate and respond to rapid changes in the industry in which we operate, our ability to attract and retain customers could be impaired and our competitive position could be harmed. The financial services industry is subject to rapid change and the introduction of new technologies to meet the needs of this industry will continue to have a significant effect on competitive conditions in our market. If we are unable to successfully expand our product offerings beyond our current solutions, our customers could migrate to competitors who may offer a broader or more attractive range of products and services. For example, we recently launched our Commercial Pricing and Profitability solution, powered by nIQ, and we may fail to achieve market acceptance of this offering. Unexpected delays in releasing new or enhanced versions of our solutions, or errors following their release, could result in loss of sales, delay in market acceptance, or customer claims against us, any of which could adversely affect our business. The success of any new solution depends on several factors, including timely completion, adequate quality testing, and market acceptance. We may not be able to enhance aspects of our solutions successfully or introduce and gain market acceptance of new applications or improvements in a timely manner, or at all. Additionally, we must continually modify and enhance our solutions to keep pace with changes in software applications, database technology, and evolving technical standards and interfaces. Uncertainties related to our ability to introduce and improve functionality, announcements or introductions of a new or updated solution, or modifications by our competitors could adversely affect our business and results of operations. We leverage third-party software, content, and services for use with our solutions. Performance issues, errors and defects, or failure to successfully integrate or license necessary third-party software, content, or services, could cause delays, errors, or failures of our solutions, increases in our expenses, and reductions in our sales, which could materially and adversely affect our business and results of operations. We use software and content licensed from, and services provided by, a variety of third parties in connection with the operation of our solutions. Any performance issues, errors, bugs, or defects in third-party software, content, or services could result in errors or a failure of our solutions, which could adversely affect our business and results of operations. In the future, we might need to license other software, content, or services to enhance our solutions and meet evolving customer demands and requirements. Any limitations in our ability to use third-party software, content, or services could significantly increase our expenses and otherwise result in delays, a reduction in functionality, or errors or failures of our solutions until equivalent technology or content is either developed by us or, if available, identified, obtained through purchase or license, and integrated into our solutions. In addition, third-party licenses may expose us to increased risks, including risks associated with the integration of new technology, the diversion of resources from the development of our own proprietary technology, and our inability to generate revenues from new technology sufficient to offset associated acquisition and maintenance costs, all of which may increase our expenses and materially and adversely affect our business and results of operations. 23 Table of Contents We may fail to successfully expand internationally. In addition, sales to customers outside the United States or with international operations expose us to risks inherent in international sales, which may include a marked increase in expenses. For the fiscal years ended January 31, 2021 and 2022, sales to customers outside the United States accounted for 11.4% and 15.9%, respectively, of our total revenues. A key element of our growth strategy is to further expand our international operations and worldwide customer base. We have begun expending significant resources to build out our sales and professional services organizations outside of the United States and we may not realize a suitable return on this investment in the near future, if at all. We have limited operating experience in international markets, and we cannot assure you that our international expansion efforts will be successful. Our experience in the United States may not be relevant to our ability to expand in any international market. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States. Export control regulations in the United States may increasingly be implicated in our operations as we expand internationally. These regulations may limit the export of our solutions and provision of our solutions outside of the United States, or may require export authorizations, including by license, a license exception, or other appropriate government authorizations, including annual or semi-annual reporting and the filing of an encryption registration. Changes in export or import laws, or corresponding sanctions, may delay the introduction and sale of our solutions in international markets, or, in some cases, prevent the export or import of our solutions to certain countries, regions, governments, persons, or entities altogether, which could adversely affect our business, financial condition, and results of operations. We are also subject to various domestic and international anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, as well as other similar anti-bribery and anti-kickback laws and regulations. These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes. Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as our international presence expands and as we increase sales and operations in foreign jurisdictions. In addition, we face risks in doing business internationally that could adversely affect our business, including: • unanticipated costs; • the need to localize and adapt our solutions for specific countries; • complying with varying and sometimes conflicting data privacy laws and regulations; • difficulties in staffing and managing foreign operations, including employment laws and regulations; • unstable regional, economic, or political conditions; • different pricing environments, longer sales cycles, and collections issues; • new and different sources of competition; • weaker protection for intellectual property and other legal rights than in the United States and practical difficulties in enforcing intellectual property and other rights outside of the United States; • laws and business practices favoring local competitors; • compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, and anti-bribery laws and regulations; • increased financial accounting and reporting burdens and complexities; • restrictions on the transfer of funds; and • adverse tax consequences. 24 Table of Contents Our international contracts often provide for payment denominated in local currencies, and the majority of our local costs are denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may impact our results of operations when translated into U.S. dollars. We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy. We must attract and retain highly qualified personnel. In particular, we are dependent upon the services of our senior leadership team, and the loss of any member of this team could adversely affect our business. Competition for executive officers, software developers, sales personnel, and other key employees in our industry is intense. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software, as well as for skilled sales and operations professionals. Our principal operations are in Wilmington, North Carolina, where the pool of potential employees with the skills we need is more limited than it may be in larger markets, and we are sometimes required to induce prospective employees to relocate. Many of the companies with which we compete for experienced personnel have greater resources than we do. If we fail to attract new personnel or fail to retain and motivate our current personnel, our growth prospects could be severely harmed. In addition, job candidates and existing employees often consider the actual and potential value of the equity awards they receive as part of their overall compensation. Thus, if the perceived value or future value of our stock declines, our ability to attract and retain highly skilled employees may be adversely affected. Failure to effectively expand our sales capabilities could harm our ability to increase our customer base. Increasing our customer base and expanding customer adoption within and across business lines will depend, to a significant extent, on our ability to effectively expand our sales and marketing operations and activities. From January 31, 2021 to January 31, 2022, our sales and marketing teams increased from 258 to 418 employees, which includes SimpleNexus. We plan to continue to expand our direct sales force both domestically and internationally for the foreseeable future. We believe that there is significant competition for experienced sales professionals with the sales skills and technical knowledge that we require. Newly hired employees require significant training and time before they achieve full productivity and they may not become as productive as quickly as we expect, if at all. Further, we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the markets where we do business. Our business will be adversely affected if our sales expansion efforts do not generate a significant increase in revenues. If we fail to provide effective customer training on our solutions and high-quality customer support, our business and reputation would suffer. Effective customer training and high-quality, ongoing customer support are critical to the successful marketing, sale, and adoption of our solutions and for the renewal of existing customer contracts. As we grow our customer base, we will need to further invest in and expand our customer support and training organization, which could strain our team and infrastructure and reduce profit margins. If we do not help our customers adopt our solutions, quickly resolve any post-implementation matters, and provide effective ongoing customer support and training, our ability to expand sales to existing and future customers and our reputation would be adversely affected. If we are unable to effectively integrate our solutions with other systems used by our customers, or if there are performance issues with such third-party systems, our solutions will not operate effectively and our business and reputation will be adversely affected. Our solutions integrate with other third-party systems used by our customers, including core processing systems. We do not have formal arrangements with many of these third-party providers regarding our access to their application program interfaces to enable these customer integrations. If we are unable to effectively integrate with third-party systems, our customers’ operations may be disrupted, which may result in disputes with customers, negatively impact customer satisfaction and harm our business. If the software of such third-party providers has performance or other problems, such issues may reflect poorly on us and the adoption and renewal of our solutions, and our business and reputation may be harmed. Our sales cycle can be unpredictable, time-consuming and costly. Our sales process involves educating prospective customers and existing customers about the benefits and technical capabilities of our solutions. Prospective customers often undertake a prolonged evaluation process, which typically involves not only our solutions, but also those of our competitors. Our sales cycles are typically lengthy, generally ranging from six to 25 Table of Contents nine months for smaller financial institutions and twelve to eighteen months or more for larger financial institutions. We may spend substantial time, effort and money on our sales and marketing efforts without any assurance that our efforts will produce any sales. Events affecting our customers’ businesses may occur during the sales cycle that could affect the size or timing of a purchase, contributing to more unpredictability in our business and results of operations. As a result of these factors, we may face greater costs, longer sales cycles and less predictability in the future. Failure to protect our proprietary technology and intellectual property rights could adversely affect our business and results of operations. Our future success and competitive position depend in part on our ability to protect our intellectual property and proprietary technologies. To safeguard these rights, we rely on a combination of patent, trademark, copyright, and trade secret laws and contractual protections in the United States and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage. As of January 31, 2022, we had 12 issued patents and one patent application pending relating to the nCino Bank Operating System in the United States. We cannot assure you that any patents will issue from any patent applications, that patents that may be issued from such applications will give us the protection we seek or that any such patents will not be challenged, invalidated, or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. We have registered the “nCino” name and logo in the United States and certain other countries and we have registrations and/or pending applications for additional marks including the “Bank Operating System” and “nIQ” in the United States and certain other countries. However, we cannot assure you that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. We also license software from third parties for integration into our solutions, including open source software and other software available on commercially reasonable terms. We cannot assure you that such third parties will maintain such software or continue to make it available. We also rely on confidentiality agreements, consulting agreements, work-for-hire agreements, and invention assignment agreements with our employees, consultants, and others. Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer, or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets, and intellectual property is difficult, expensive, and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our solutions, technologies, or intellectual property rights. We use “open source” software in our solutions, which may restrict how we use or distribute our solutions, require that we release the source code of certain software subject to open source licenses, or subject us to litigation or other actions that could adversely affect our business. We currently use in our solutions, and may use in the future, software that is licensed under “open source,” “free,” or other similar license, where the licensed software is made available to the general public on an “as-is” basis under the terms of a specific non-negotiable license. Some open source software licenses require that software subject to the license be made available to the public and that any modifications or derivative works based on the open source code be licensed in source code form under the same open source licenses. Although we monitor our use of open source software, we cannot assure you that all open source software is reviewed prior to use in our solutions, that our programmers have not incorporated open source software into our solutions, or that they will not do so in the future. In addition, our solutions may incorporate third-party software under commercial licenses. We cannot be certain whether such third-party software incorporates open source software without our knowledge. In the past, companies that incorporate open source software into their products have faced claims alleging noncompliance with open source license terms or infringement or misappropriation of proprietary software. Therefore, we could be subject to suits by parties claiming noncompliance with open source licensing terms or infringement or misappropriation of proprietary software. Because few courts have interpreted open source licenses, the manner in which these licenses may be interpreted and enforced is subject to some uncertainty. There is a risk that open source software licenses could be construed in a manner that imposes unanticipated 26 Table of Contents conditions or restrictions on our ability to market or provide our solutions. As a result of using open source software subject to such licenses, we could be required to release proprietary source code, pay damages, re-engineer our solutions, limit or discontinue sales, or take other remedial action, any of which could adversely affect our business. Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and adversely affect our business and results of operations. Patent and other intellectual property disputes are common in our industry. We may be subject to claims in the future alleging that we have misappropriated, misused, or infringed other parties’ intellectual property rights. Some companies, including certain of our competitors, own a larger number of patents, copyrights, and trademarks than we do, which they may use to assert claims against us. This disparity may also increase the risk that third parties may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses. In addition, future assertions of patent rights by third parties, and any resulting litigation, may involve patent holding companies, non-practicing entities, or other adverse patent owners who have no relevant product revenues and against whom our own patents may provide little or no deterrence or protection. Our solutions utilize third-party licensed software, and any failure to comply with the terms of one or more of these licenses could adversely affect our business. Third parties may also assert claims of intellectual property rights infringement against our customers, whom we are typically required to indemnify. As competition increases, claims of infringement, misappropriation, and other violations of intellectual property rights may increase. Any claim of infringement, misappropriation, or other violation of intellectual property rights by a third party, even those without merit, could cause us to incur substantial costs defending against the claim, could distract our management from our business, and could deter customers or potential customers from purchasing our solutions. There can be no assurance that we will successfully defend third-party intellectual property claims. An adverse outcome of a dispute may require us to: • pay substantial damages, including treble damages, if we are found to have willfully infringed a third party’s patents or copyrights; • cease developing or selling any elements of our solutions that rely on technology that is alleged to infringe or misappropriate the intellectual property of others; • enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or intellectual property rights; • expend additional development resources to attempt to redesign our solutions or otherwise develop non-infringing technology, which may not be successful; and • indemnify our customers and other third parties. Any license we may enter into as a result of litigation may be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. Any of the foregoing events could adversely affect our business and results of operations. Our ability to raise capital in a timely manner if needed in the future may be limited, or such capital may be unavailable on acceptable terms, if at all. Our failure to raise capital if needed could adversely affect our business and results of operations, and any debt or equity issued to raise additional capital may reduce the value of our common stock. We have funded our operations since inception primarily through equity financings and receipts generated from customers. We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business. We intend to continue to make investments to support our business and may require additional funds. Moreover, we do not expect to be profitable for the foreseeable future. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could adversely affect our business and results of operations. If we incur debt, the lenders would have rights senior to holders of common stock to make claims on our assets, the terms of any debt could restrict our operations, and we may be unable to service or repay the debt. Furthermore, if we issue additional equity securities, stockholders may experience dilution, and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in a future offering will depend on numerous considerations, including factors beyond our control, we cannot 27 Table of Contents predict or estimate the impact any future incurrence of debt or issuance of equity securities will have on us. Any future incurrence of debt or issuance of equity securities could adversely affect the value of our common stock. Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited. We have incurred substantial net operating losses (“NOLs”), during our history. U.S. federal and certain state NOLs generated in taxable years beginning after December 31, 2017 are not subject to expiration. Federal NOLs generally may not be carried back to prior taxable years except that, under the Coronavirus Aid, Relief and Economic Security (CARES) Act, federal NOLs generated in tax years 2018, 2019, and 2020 may be carried back to each of the five taxable years preceding the taxable year in which the loss arises. Additionally, for taxable years beginning after December 31, 2020, the deductibility of federal NOLs is limited to 80% of our taxable income in such taxable year. NOLs generated in tax years before 2018 may still be used to offset future taxable income without regard to the 80% limitation, although they have the potential to expire without being utilized if we do not achieve profitability in the future. However, under the rules of Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its NOLs, pre-change tax attributes and any net unrealized built-in losses to offset its post-change taxable income or taxes may be limited. The applicable rules generally operate by focusing on changes in ownership among stockholders considered by the rules as owning, directly or indirectly, 5% or more of the stock of a company, as well as changes in ownership arising from new issuances of stock by the company. The rules of Section 382 are regularly being evaluated to determine any potential limitations. If we experience one or more ownership changes as a result of future transactions in our stock, then we may be limited in our ability to use our NOL carryforwards, pre-change tax attributes or deductions to offset our future taxable income, if any. Amendments to existing tax laws, rules, or regulations, or enactment of new unfavorable tax laws, rules, or regulations could have an adverse effect on our business and operating results. The rules dealing with U.S. federal, state, and local income taxation are constantly under review by persons involved in the legislative process and by the Internal Revenue Service and the U.S. Treasury Department. Changes to tax laws (which changes may have retroactive application) could adversely affect us or holders of our common stock. In recent years, many such changes have been made and changes are likely to continue to occur in the future. For example, the Tax Cuts and Jobs Act was enacted in 2017 and made a number of significant changes to the current U.S. federal income tax rules, including reducing the generally applicable corporate tax rate from 35% to 21%, imposing additional limitations on the deductibility of interest, placing limits on the utilization of NOLs, and making substantial changes to the international tax rules. In addition, on March 27, 2020, the CARES Act was signed into law, which included certain changes in tax law intended to stimulate the U.S. economy in light of the COVID-19 pandemic, including temporary beneficial changes to the treatment of net operating losses, interest deductibility limitations, and payroll tax matters. Many of the provisions of the Tax Cuts and Jobs Act and CARES Act still require guidance through the issuance and/or finalization of regulations by the U.S. Treasury Department in order to fully assess their effects, and there may be substantial delays before such regulations are promulgated and/or finalized, increasing the uncertainty as to the ultimate effects of the Tax Cuts and Jobs Act and CARES Act on us and our stockholders. There also may be technical corrections legislation or other legislative changes proposed with respect to the Tax Cuts and Jobs Act and CARES Act, the effects of which cannot be predicted and may be adverse to us or our stockholders. Risks Relating to Ownership of Our Common Stock The market price of our common stock may be volatile or may decline steeply or suddenly regardless of our operating performance and we may not be able to meet investor or analyst expectations and you may lose all or part of your investment. The market price of our common stock may fluctuate or decline significantly in response to numerous factors, many of which are beyond our control, including: • variations between our actual operating results and the expectations of securities analysts, investors, and the financial community; • any forward-looking financial or operating information we may provide to the public or securities analysts, any changes in this information, or our failure to meet expectations based on this information; 28 Table of Contents • actions of securities analysts who initiate or maintain coverage of us, changes in financial estimates by any securities analysts who follow us, or our failure to meet these estimates or the expectations of investors; • additional shares of our common stock being sold into the market by us or our existing stockholders, or the anticipation of such sales; • hedging activities by market participants; • announcements by us or our competitors of significant products or features, technical innovations, acquisitions, strategic partnerships, joint ventures, or capital commitments; • changes in operating performance and stock market valuations of companies in our industry, including our competitors; • price and volume fluctuations in the overall stock market, including as a result of trends in the economy as a whole; • lawsuits threatened or filed against us; • developments in new legislation and pending lawsuits or regulatory actions, including interim or final rulings by judicial or regulatory bodies; and • other events or factors, including those resulting from COVID-19, political conditions, election cycles, war or incidents of terrorism, or responses to these events. In addition, extreme price and volume fluctuations in the stock markets have affected and continue to affect many technology companies’ stock prices. Stock prices often fluctuate in ways unrelated or disproportionate to a company’s operating performance. In the past, stockholders have filed securities class action litigation following periods of market volatility. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and seriously harm our business. Moreover, because of these fluctuations, comparing our operating results on a period-to-period basis may not be meaningful. You should not rely on our past results as an indication of our future performance. This variability and unpredictability could also result in our failing to meet the expectations of industry or financial analysts or investors for any period. If our revenues or operating results fall below the expectations of analysts or investors or below any forecasts we may provide to the market, or if the forecasts we provide to the market are below the expectations of analysts or investors, the price of our common stock could decline substantially. Such a stock price decline could occur even when we have met any previously publicly stated revenue or earnings forecasts that we may provide. We do not intend to pay dividends for the foreseeable future and, as a result, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock. We have never declared or paid any cash dividends on our common stock and do not intend to pay any cash dividends in the foreseeable future. We anticipate that we will retain all of our future earnings for use in the development of our business and for general corporate purposes. Any determination to pay dividends in the future will be at the discretion of our board of directors. Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments. Future securities issuances could result in significant dilution to our stockholders and impair the market price of our common stock. Future issuances of shares of our common stock, or the perception that these sales may occur, could depress the market price of our common stock and result in dilution to existing holders of our common stock. Also, to the extent outstanding options to purchase shares of our common stock are exercised or options, restricted stock units, or other stock-based awards are issued or become vested, there will be further dilution. The amount of dilution could be substantial depending upon the size of the issuances or exercises. Furthermore, we may issue additional equity securities that could have rights senior to those of our common stock. As a result, purchasers of our common stock bear the risk that future issuances of debt or equity securities may reduce the value of our common stock and further dilute their ownership interest. 29 Table of Contents Delaware law and provisions in our amended and restated certificate of incorporation and bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the trading price of our common stock. Our amended and restated certificate of incorporation and bylaws contain provisions that could depress the trading price of our common stock by acting to discourage, delay, or prevent a change of control of our company or changes in our management that the stockholders of our company may deem advantageous. These provisions include the following: • establish a classified board of directors so that not all members of our board of directors are elected at one time; • permit the board of directors to establish the number of directors and fill any vacancies and newly-created directorships; • provide that directors may only be removed for cause; • require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and bylaws; • authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan; • prohibit stockholders from calling special meetings of stockholders; • prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders; • provide that the board of directors is expressly authorized to make, alter, or repeal our bylaws; • restrict the forum for certain litigation against us to Delaware; and • establish advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon by stockholders at annual stockholder meetings. Any provision of our amended and restated certificate of incorporation or bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock. Our amended and restated certificate of incorporation designates a state or federal court located within the State of Delaware as the exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees. Our amended and restated certificate of incorporation provides that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf under Delaware law, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, (3) any action arising pursuant to any provision of the Delaware General Corporation Law (“DGCL”), our amended and restated certificate of incorporation or bylaws, (4) any other action asserting a claim that is governed by the internal affairs doctrine, or (5) any other action asserting an “internal corporate claim,” as defined in Section 115 of the DGCL, shall be the Court of Chancery of the State of Delaware (or, if the Court of Chancery does not have jurisdiction, the federal district court for the District of Delaware) in all cases subject to the court having jurisdiction over indispensable parties named as defendants. These exclusive-forum provisions do not apply to claims under the Securities Act or the Exchange Act. To the extent that any such claims may be based upon federal law claims, Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder. However, our amended and 30 Table of Contents restated certificate of incorporation contains a federal forum provision which provides that unless the Company consents in writing to the selection of an alternative forum, the federal district courts of the United States of America will be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act. Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. This exclusive-forum provision may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. If a court were to find the exclusive-forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations. General Risks Uncertain or weakened economic conditions, including as a result of COVID-19, may adversely affect our industry, business, and results of operations. Our overall performance depends on economic conditions, which may be challenging at various times in the future. Financial developments seemingly unrelated to us or our industry may adversely affect us. Domestic and international economies have from time-to-time been impacted by falling demand for a variety of goods and services, tariffs and other trade issues, threatened sovereign defaults and ratings downgrades, restricted credit, threats to major multinational companies, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, bankruptcies, and overall uncertainty. For example, COVID-19 has created and may continue to create significant uncertainty in global financial markets and the long-term economic impact of COVID-19 is highly uncertain. We cannot predict the timing, strength, or duration of the current or any future potential economic slowdown in the United States or globally. These conditions affect the rate of technology spending generally and could adversely affect our customers’ ability or willingness to purchase our solutions, delay prospective customers’ purchasing decisions, reduce the value or duration of their subscriptions, or affect renewal rates, any of which could adversely affect our results of operations. Natural or man-made disasters and other similar events, including the COVID-19 pandemic, may significantly disrupt our business, and negatively impact our business, financial condition, and results of operations. A significant portion of our employee base, operating facilities, and infrastructure are centralized in Wilmington, North Carolina. Any of our facilities may be harmed or rendered inoperable by natural or man-made disasters, including hurricanes, tornadoes, wildfires, floods, earthquakes, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks or pandemic events, including the COVID-19 pandemic, power outages, and other infrastructure failures, which may render it difficult or impossible for us to operate our business for some period of time. Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time. Any disruptions in our operations could adversely affect our business and results of operations and harm our reputation. Moreover, although we have disaster recovery plans, they may prove inadequate. We may not carry sufficient business insurance to compensate for losses that may occur. Any such losses or damages could have a material adverse effect on our business and results of operations. In addition, the facilities of our third-party providers, including Salesforce and AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties, or otherwise materially and adversely affect our business. Additionally, to the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this ‘‘Risk Factors’’ section, such as our ability to achieve profitability in the future, our ability to attract new customers or continue to broaden our existing customers’ use of our solutions, and the impact of any decrease in technology spend by customers and potential customers in the financial services industry where we derive all of our revenues. If securities or industry analysts either do not publish research about us or publish inaccurate or unfavorable research about us, our business, or our market, or if they change their recommendations regarding our common stock adversely, the trading price or trading volume of our common stock could decline. The trading market for our common stock is influenced in part by the research and reports that securities or industry analysts may publish about us, our business, our market, or our competitors. If one or more analysts initiate research with an unfavorable rating or downgrade our common stock, provide a more favorable recommendation about our competitors, or publish inaccurate or unfavorable research about our business, our common stock price would likely decline. If any analyst who covers us or may cover us were to cease coverage of us or fail to regularly publish reports on us, we could lose visibility in the financial markets, which in turn could cause the trading price or trading volume of our common stock to decline. 31 Table of Contents Failure to maintain the adequacy of internal controls over financial reporting may adversely affect investor confidence in our company and, as a result, the value of our common stock. We are required, pursuant to Section 404 of the Sarbanes-Oxley Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting. On an annual basis this assessment includes disclosure of any material weaknesses identified by our management in our internal controls over financial reporting. Because we are no longer an “emerging growth company”, as defined in the JOBS Act, as of January 31, 2022, our independent registered public accounting firm is required to annually attest to the effectiveness of our internal controls over financial reporting. We will be required to disclose significant changes made in our internal controls procedure on a quarterly basis. Our compliance with Section 404 has required, and will continue to require, that we incur substantial accounting expense and expend significant management efforts. We currently do not have an internal audit group, and we may need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge to comply with Section 404. During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our internal controls over financial reporting, we will be unable to assert that our internal controls over financial reporting are effective. We cannot assure you that there will not be material weaknesses or significant deficiencies in our internal controls over financial reporting in the future. Any failure to maintain internal controls over financial reporting could severely inhibit our ability to accurately report our financial condition and operating results. If we are unable to conclude that our internal controls over financial reporting are effective, or if our independent registered public accounting firm determines we have a material weakness or significant deficiency in our internal controls over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our common stock could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal controls over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets. Operating as a public company requires us to incur substantial costs and requires substantial management attention. As a public company, we have incurred and will continue to incur substantial legal, accounting, and other expenses that we did not incur as a private company. For example, we are subject to the reporting requirements of the Exchange Act, the applicable requirements of the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act, the rules and regulations of the SEC, and the rules and regulations of The Nasdaq Global Select Market. As part of the new requirements, we have established and maintain effective disclosure and financial controls and made changes to our corporate governance practices. Compliance with these requirements has and will continue to increase our legal and financial compliance costs and will make some activities more time-consuming. Our management and other personnel divert attention from other business matters to devote substantial time to the reporting and other requirements of being a public company. In particular, we incur significant expense and devote substantial management effort to complying with the requirements of Section 404 of the Sarbanes-Oxley Act. We are in the process of hiring additional accounting and financial staff with appropriate public company experience and technical accounting knowledge. The terms of our Credit Facility contain restrictive covenants that may limit our operating flexibility. On February 11, 2022, we entered into Credit Agreement by and among the Company, nCino Opco, Inc., certain subsidiaries of the Company as guarantors, and Bank of America, N.A. as lender, pursuant to which we received access to a revolving credit facility of up to $ 50.0 million (the “Credit Facility”). The Credit Facility contains affirmative and restrictive covenants that limit our operating ability including to, among other things, dispose of assets, merge with other companies, incur additional indebtedness and liens, engage in new businesses, acquire certain other companies and modify organizational documents. In addition, the Credit Facility is secured by substantially all of our personal property, and the Credit Facility requires us to satisfy certain covenants, including maintaining a minimum amount of liquidity under the Credit Facility. As a result of these restrictions, we will be limited as to how we conduct our business and we may be unable to raise additional debt or equity financing to compete effectively or to take advantage of new business opportunities. There is no guarantee that we will be able to meet our covenants or pay the principal and interest on any such debt. Furthermore, there is no guarantee that future working capital, borrowings or equity financing will be available to repay or refinance any such debt. Any inability to make scheduled payments, meet the financial or other covenants in our Credit Facility would adversely affect our business. Further, at any time, if we violate the terms of the Credit Facility or otherwise fail to meet our covenants, we may not be able to 32 Table of Contents obtain a waiver from the lenders under satisfactory terms, if at all, which would limit our operating flexibility and/or liquidity and which would have an adverse effect on our business and prospects. Item 1B. Unresolved Staff Comments None.