What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-03-26 compared with 2023-03-28 · 132 added, 85 removed, 520 unchanged (29% of the section changed)

10 unchanged sentences

• We have a limited operating history at the current scale of our business, which makes it difficult to predict our future operating results, and we may not achieve our expected operating results in the future.

• We have a history of operating losses and may not achieve or sustain profitability on a generally accepted accounting principles in the United States of America ("GAAP") basis in the future.

• We have a history of losses and while we have achieved profitability in a quarterly period, we may not be able to achieve or sustain profitability on a generally accepted accounting principles in the United States of America ("GAAP") basis in the future.

• If we are unable to attract new customers or continue to broaden our existing customers’ use of our solutions, our revenue growth will be adversely affected.

7 unchanged sentences

• The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies, or other competitive dynamics could adversely affect our business and results of operations.

• Our increased focus on the development and use of artificial intelligence and machine learning technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.

• We depend on data centers operated by or on behalf of Salesforce, AWS and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability.

3 unchanged sentences

Our failure to comply with laws and regulations applicable to us as a technology provider to FIs could adversely affect our business and results of operations, increase costs and impose constraints on the way we conduct our business.

• We are presently subject to a putative class action civil suit involving alleged violations of antitrust laws relating to our hiring and wage practices and a purported stockholder derivative lawsuit alleging violation of fiduciary duties with the series of mergers in which we became the parent of nCino OpCo and SimpleNexus.

These matters or future litigation against us could adversely affect our operations and prospects, damage our reputation, and be costly and time consuming to defend.

• We are presently subject to a purported stockholder derivative lawsuit alleging violation of fiduciary duties with the series of mergers in which we became the parent of nCino OpCo and SimpleNexus.

The court dismissed these claims and that decision is currently under appeal.

This matter or future litigation against us could adversely affect our operations and prospects, damage our reputation, and be costly and time consuming to defend.

Risks Relating to Our Business and Industry

1 unchanged sentence

All of our revenues are derived from FIs whose industry has experienced significant pressure in recent years due to economic uncertainty, fluctuating interest rates, liquidity concerns and increased regulation.

In the past, FIs have experienced

consolidation, distress and failure, including as recently as March 2023 when the FDIC took control of Silicon Valley Bank and Signature Bank due to liquidity concerns and a number of other FIs experienced turbulence and a precipitous decline in market value.

In the past, FIs have experienced consolidation, distress and failure, including in March 2023 when the FDIC took control of Silicon Valley Bank and Signature Bank due to liquidity concerns and a number of other FIs experienced turbulence and a precipitous decline in market value.

It is possible these conditions may persist, deteriorate or reoccur.

If any of our customers merge with or are acquired by other entities, such as FIs that have internally developed banking technology solutions or that are not our customers or use our solutions less, we may lose business.

If as a result of these or other factors any of our customers merge with or are acquired by other entities, such as FIs that have internally developed banking technology solutions or that are not our customers or use our solutions less, we may lose business.

Additionally, changes in management of our customers could result in delays or cancellations of the implementation of our solutions.

It is also possible that the larger FIs that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions.

It is also possible that the larger FIs that result from

business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions.

Our business may also be materially and adversely affected by weak economic conditions in the financial services industry.

4 unchanged sentences

As a result of our limited operating history at the current scale of our business, our ability to forecast our future operating results, including revenues, cash flows, and profitability, is limited and subject to a number of uncertainties.

We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in the technology industry, such as the risks and uncertainties described in this Annual Report on Form 10-K.

If our assumptions regarding these risks and uncertainties are incorrect or change due to changes in our markets, or if we do not address these risks successfully, our operating and financial results may differ materially from our expectations and our business may suffer.

We have a history of operating losses and may not achieve or sustain profitability on a GAAP basis in the future.

We have a history of losses and while we have achieved profitability in a quarterly period, we may not be able to achieve or sustain profitability on a GAAP basis in the future.

We began operations in late 2011 and have experienced net losses since inception.

2 unchanged sentences

We had an accumulated deficit of $352.8 million at January 31, 2024.

Even if we become profitable on a GAAP basis, we may not be able to maintain or increase our level of profitability.

While we have been profitable on a GAAP basis for a quarter, we may not be able to maintain or increase our level of profitability.

We intend to continue to support further growth and extend the functionality of our solutions in future periods.

1 unchanged sentence

Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses.

We expect to incur losses on a GAAP basis for the foreseeable future as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability on a GAAP basis.

We expect, depending on a number of factors, to continue to incur losses on a GAAP basis as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability on a GAAP basis.

If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.

8 unchanged sentences

If we are unable to sign new customers or retain or attract new business from current customers, our business and results of operations may be materially and adversely affected.

If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate, our sales would suffer and our results of operations would be adversely affected.

Use of, and reliance on, cloud-based banking technology is still at an early stage and we do not know whether FIs will continue to adopt cloud-based banking technology such as the nCino Bank Operating System in the future, or whether the market will change in ways we do not anticipate.

Many FIs have invested substantial personnel and financial resources in legacy software, and these FIs may be reluctant, unwilling, or unable to convert from their existing systems to our solutions.

If the market for cloud-based banking technology develops more slowly than we expect or changes in a way that we fail to anticipate or we fail to market our solutions effectively, our sales would suffer and our results of operations would be adversely affected.

Use of, and reliance on, cloud-based banking technology continues to evolve and we do not know whether FIs will continue to adopt cloud-based banking technology such as the nCino Bank Operating System in the future, or whether the market will change in ways we do not anticipate.

Many FIs have invested substantial personnel and financial resources in

legacy software, and these FIs may be reluctant, unwilling, or unable to convert from their existing systems to our solutions.

Furthermore, these FIs may be reluctant, unwilling, or unable to use cloud-based banking technology due to various concerns, such as the security of their data and reliability of the delivery model.

These concerns or other considerations may cause FIs to choose not to adopt cloud-based banking technology such as ours or to adopt them more slowly than we anticipate, either of which would adversely affect us.

Our future success also depends on our ability to sell additional applications and functionality, such as nIQ and SimpleNexus, to our current and prospective customers.

Our future success also depends on our ability to sell additional applications and functionality to our current and prospective customers.

As we create new applications and enhance our existing solutions, these applications and enhancements may not be attractive to customers.

4 unchanged sentences

Our revenues include the revenues of SimpleNexus from the date of acquisition on January 7, 2022.

We may not be able to sustain revenue growth consistent with our recent history, if at all.

However, we may not be able to sustain revenue growth consistent with our recent history, if at all.

Our revenue growth in recent periods may not be indicative of our future performance.

1 unchanged sentence

Our revenue growth may also slow or even reverse in future periods due to a number of factors, which may include slowing demand for our solutions, our ability to successfully sell and implement new applications, such as our retail applications, increasing competition, decreasing growth of our overall market, our inability to attract and retain a sufficient number of FI customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions.

If we are unable to maintain consistent revenue growth, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability.

If we are unable to maintain consistent revenue growth, our business could be adversely affected, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability.

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

24 unchanged sentences

Our customers have no obligation to renew their subscriptions for our solutions after the expiration of the initial or current subscription term, and our customers, if they choose to renew at all, may renew for fewer users or on less favorable pricing terms.

The average initial term of our customer agreements is three to five years for the nCino Bank Operating System and one to three years for SimpleNexus.

We have a limited operating history at the current scale of our business with respect to rates of customer subscription renewals and cannot be certain of anticipated renewal rates.

The average initial term of our customer agreements is three to five years for the nCino Bank Operating System and one to three years for nCino Mortgage.

We have a limited operating history at the current scale of our business with respect to rates of customer subscription renewals and cannot be certain of how actual renewal rates will compare to what we anticipate.

Our renewal rates may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our pricing or our solutions or their ability to continue their operations or spending levels.

3 unchanged sentences

As a result, we may in the future be required to change our pricing model, reduce our prices, or accept other unfavorable contract terms, any of which could adversely affect our revenues, gross margin, profitability, financial position, and/or cash flow.

Our business faces significant risks from diverse security threats.

A breach of our security measures or those we rely on could result in unauthorized access to customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.

Certain elements of our solutions, particularly our analytics applications, process and store personally identifiable information (“PII”) such as banking and personal information of our customers’ clients, and we may also have access to PII during various stages of the implementation process or during the course of providing customer support.

Furthermore, as we develop or acquire additional functionality, such as SimpleNexus, we may gain greater access to PII.

Furthermore, as we develop or acquire additional functionality, such as nCino Mortgage, we may gain greater access to PII.

We maintain policies, procedures, and technological safeguards designed to protect the confidentiality, integrity, and availability of this information and our information technology systems.

1 unchanged sentence

We cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of PII or other security events that impact the integrity or availability of PII or our systems and operations, or the related costs we may incur to mitigate the consequences from such events.

Further, our products are flexible and complex software solutions and

there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches.

Further, our products are flexible and complex software solutions and there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches.

There may be continued unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations.

In addition, because we leverage third-party providers, including cloud, software, data center, and other critical technology vendors to deliver our solutions to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers.

A vulnerability in a third-party provider’s software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions.

Cyberattacks and other malicious internet-based activity continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted.

A vulnerability in a third-party provider’s software or systems, a failure of our third-party

providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our solutions.

Cyberattacks and other malicious internet-based activity, including increased threats from the use of artificial intelligence, continue to increase and evolve, and cloud-based providers of products and services have been and are expected to continue to be targeted.

In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, employee theft or misuse, and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions.

13 unchanged sentences

The successful assertion of one or more claims against us, the inadequacy or denial of coverage under our insurance policies, litigation to pursue claims under our policies, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could materially and adversely affect our business and results of operations.

As cyber threats have evolved and continue to evolve, vulnerabilities in our solutions and information technology systems have been and will in the future be detected, and we expect to expend additional resources to continue to modify or enhance our layers of defense to remediate such vulnerabilities.

System enhancements and updates create risks associated with implementing new systems and integrating them with existing ones, including risks associated with the effectiveness of our, our customers' and our third-party providers' software development lifecycles.

Due to the complexity and interconnectedness of our systems and solutions, the process of enhancing our layers of defense, including addressing hardware-based vulnerabilities, can itself create a risk of systems disruptions and security issues.

Customer utilization of older versions of our solutions can increase the risk and complexity of security vulnerabilities and the resources and time required to address them.

Fundamental elements of the nCino Bank Operating System are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.

Fundamental elements of the nCino Bank Operating System, including our client onboarding, loan origination, and deposit account opening applications, are built on the Salesforce Platform and we rely on the Salesforce Agreement to use the Salesforce Platform in conjunction with this solution, including for hosting infrastructure and data center operations.

the Salesforce Platform in conjunction with this solution, including for hosting infrastructure and data center operations.

Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model.

The Salesforce Agreement expires on June 19, 2027, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and automatically renews for additional one-year periods thereafter unless notice of non-renewal is provided.

Our agreement with Salesforce expires on January 31, 2031, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and automatically renews for additional one-year periods thereafter unless notice of non-renewal is provided.

If we are unable to renew our agreement with Salesforce, there would be, absent a termination for cause, a wind-down period during which existing customers would be able to continue using the nCino Bank Operating System in conjunction with the Salesforce Platform, but we would be unable to provide this solution to new customers and could be limited in our ability to allow current customers to add additional users.

1 unchanged sentence

This could cause a significant delay in the time required to enter into agreements with customers, place us and our customers at a disadvantage in negotiating with Salesforce, and lead customers not to renew or enter into agreements with us.

We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if not, our business and operating results may be materially and adversely affected.

In addition, Salesforce has the right to terminate its agreement with us in certain circumstances, including in the event of a material breach of the Salesforce Agreement by us.

We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if they are not, our business and operating results may be materially and adversely affected.

In addition, Salesforce has the right to terminate their agreement with us in certain circumstances, including in the event of a material breach by us.

If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above.

We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Bank Operating System infringes the intellectual property rights of such third party.

An expiration or termination of the Salesforce Agreement would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Bank Operating System to become obsolete.

An expiration or termination of our agreement with Salesforce would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Bank Operating System to become obsolete.

Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different product.

3 unchanged sentences

Privacy and data security concerns, data collection and transfer restrictions and related domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business and results of operations.

Personal privacy, information security, and data protection are significant issues in the U.S., the European Union (“EU”), and a number of other jurisdictions where we offer our solutions.

Personal privacy, information security, and data protection are significant issues in the U.S., the European Union (“EU”), the United Kingdom ("UK") and a number of other jurisdictions where we offer our solutions.

The regulatory framework governing the collection, processing, storage, and use of certain information, particularly financial and other PII, is rapidly evolving.

4 unchanged sentences

The CCPA provides for potential civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

Although the CCPA’s implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, the CCPA may increase our compliance costs and potential legal privacy and cybersecurity risks.

The California Privacy Rights Act (the "CPRA"), which expands the CCPA, passed in November 2020 and went into effect on January 1, 2023, potentially requiring still to be determined additional compliance investment and potential business process changes.

1 unchanged sentence

It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement.

Following the CPRA, Virginia (effective January 1, 2023), Colorado (effective July 1, 2023), Connecticut (effective July 1, 2023), and Utah (effective December 1, 2023) have enacted similar, but not completely consistent, comprehensive privacy legislation that go into effect throughout 2023.

Many other states are considering similar

legislation in addition to the consideration of comprehensive privacy legislation at the federal level.

If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.

Similarly, the European Economic Area (the "EEA") (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the "EU GDPR") in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 (known as the "UK GDPR", and together with the "EU GDPR", the "GDPR").

Additionally, other U.S.

states are proposing and enacting laws and regulations that impose obligations similar to the CCPA or that otherwise involve significant obligations and restrictions.

If passed, such laws will

require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.

Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination and security of personally identifiable information, including financial information.

Actual, potential, or perceived violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies and processing of personal data, as well as civil claims including class actions, reputational damage and ongoing compliance costs, any of which could harm our business, results of operations and financial condition.

Moreover, federal, and state regulation around artificial intelligence may be expected in the near future, including developments in response to the recent Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence issued on October 30, 2023.

Similarly, the European Economic Area (the "EEA") (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the "EU GDPR") in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 which sits alongside the UK Data Protection Act 2018 (known as the "UK GDPR", and together with the "EU GDPR", the "GDPR").

The GDPR has a direct effect where an entity is established in the EEA or the UK and has extra-territorial effect where an entity established outside of the EEA or UK processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the UK or the monitoring of their behavior.

The GDPR imposes a number of obligations on controllers, including, among others:

(i) accountability and transparency requirements which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects regarding processing;

(ii) enhanced requirements for obtaining valid consent;

(ii) enhanced requirements for obtaining valid consent where consent is the lawful basis for processing;

(iii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed;

(iv) obligations to comply with data protection rights of data subjects including a right of access to and rectification of personal data, a right to obtain restriction of processing or to object to processing of personal data and a right to ask for a copy of personal data to be provided to a third party in a useable format and erasing personal data in certain circumstances;

(v) obligations to implement appropriate technical and organizational security measures to safeguard personal data;

and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible).

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism in accordance with the EU GDPR has been put in place.

and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible) and affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms.

Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

In July 2020, the Court of Justice of the European Union (the "CJEU") in its Schrems II ruling invalidated the EU-U.S.

Privacy Shield framework, a self-certification mechanism that facilitated the lawful transfer of personal data from the EEA to the U.S., with immediate effect.

The CJEU upheld the validity of standard contractual clauses ("SCCs") as a legal mechanism to transfer personal data but companies relying on SCCs will need to carry out a transfer privacy impact assessment which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

The CJEU upheld the validity of standard contractual clauses ("SCCs") as a legal mechanism to transfer personal data but companies relying on SCCs will need to carry out a transfer privacy impact assessment ("TIA") which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

The EU and U.S.

4 unchanged sentences

The UK GDPR imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK does not consider adequate.

The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs.

The UK Information Commissioner's Office ("ICO") has also published its own version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK-style TIA.

Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S.

data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S.

data bridge ("UK Adequacy Regulations").

Personal data may now be transferred from the UK under the UK-U.S.

data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF.

This may have implications for our cross-border data flows and may result in additional compliance costs.

3 unchanged sentences

Complying with the GDPR may cause us to incur substantial operational and compliance costs or require us to change our business practices.

Despite our efforts to bring practices into compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation.

Despite our efforts to bring practices into compliance with the GDPR, we

may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation.

Non-compliance could result in proceedings against us by governmental entities, regulators, customers, data subjects, suppliers, vendors or other parties.

5 unchanged sentences

Such regulations may have a negative effect on businesses, including ours, that collect, process, and use personal data in the EU and UK, including online usage information for consumer acquisition and marketing and may increase the potential civil liability and cost of operating a business that collects, processes, or uses such information and undertakes online marketing.

From a cybersecurity perspective, the GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented, but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

The GDPR however does explicitly require that controllers notify personal data breaches as described above.

On January 17, 2023, the EU Network and Information Systems Security 2 Directive (“NISD2”) entered into force and will take full effect following implementation into EU Member State law (i.e., by October 17, 2024).

Under the NISD2, more stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers.

NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned.

Other sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications);

(ii) an order to make public certain elements of the infringement and/or inform customers;

and (iii) injunctions to immediately cease infringing conduct.

Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

On January 16, 2023, the EU Digital Operational Resilience Act (“DORA”) entered into force and will apply from January 17, 2025.

DORA imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers.

DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered ‘critical’ within the meaning of DORA.

Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with ICT third-party service providers.

DORA does not provide for minimum or maximum monetary sanctions but empowers EU Member State competent authorities to enforce DORA and determine the appropriate sanction on the basis of the factors set out in DORA, including the gravity and duration of the infringement.

Sanctions may be administrative or criminal in nature, and DORA also provides that individual members of the management body can be held personally liable for any non-compliance.

We cannot yet fully determine the impact these or future laws, rules, and regulations may have on our business or operations.

Any such laws, rules, and regulations may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices.

Additionally, we may be bound by contractual requirements

applicable to our collection, use, processing, and disclosure of various types of information including financial and PII, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve.

Any failure or perceived failure by us, or any third parties with which we do business, to comply with these laws, rules, and regulations, or with other obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time, and other resources, or the incurrence of fines, penalties, or other liabilities.

Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of information including financial and PII, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve.

resources, or the incurrence of fines, penalties, or other liabilities.

There is also a risk that we could be impacted by a cybersecurity incident that results in loss or unauthorized disclosure of personal data, potentially resulting in us facing harms similar to those described above.

In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business and results of operations.

4 unchanged sentences

However, such a decline will negatively affect our subscription revenues in future quarters.

Accordingly, the effect of significant downturns in sales or market acceptance of our solutions may not be reflected in our results of operations until future periods.

Accordingly, the effect of significant downturns in sales or market acceptance of our solutions may not be apparent in our current-quarter revenues or reflected in our results of operations until future periods.

The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies or other competitive dynamics could adversely affect our business and results of operations.

7 unchanged sentences

With the introduction of new technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability.

Our increased focus on the development and use of artificial intelligence and machine learning technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.

We envision a future where artificial intelligence and machine learning is embedded throughout nCino’s platform to help our customers maximize their productivity.

We have incorporated and may continue to incorporate AI/ML solutions and features into our solutions, and otherwise within our business, and these solutions and features may become more important to our operations or to our future growth over time.

There can be no assurance that we will realize the desired or anticipated benefits from AI/ML, or at all, and we may fail to properly implement or market our AI/ML solutions and features.

Our competitors may incorporate AI/ML into their products, offerings, and solutions more quickly or more successfully than we do, which could impair our ability to compete effectively, and adversely affect our results of operations.

Additionally, our AI/ML solutions and features may expose us to additional claims, demands, and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

The legal, regulatory, and policy environments around AI/ML are evolving rapidly, and we may become subject to new legal and other obligations in connection with our use of AI/ML, which could require us to make significant changes to our policies and practices, necessitating expenditure of significant time, expense, and other resources.

For example, in the EU/UK, laws and regulation regarding AI are developing at a fast pace.

On March 13, 2024 the EU adopted its standalone law to govern the offering and use of AI systems in the EU (the "AI Act") and the UK intends to regulate AI via a sector-specific, principle-centered approach.

We depend on data centers operated by or on behalf of Salesforce, Amazon Web Services ("AWS"), and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability.

4 unchanged sentences

From time to time, we consider potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions, and other assets.

For example, in fiscal 2022 we acquired SimpleNexus, our

largest acquisition to date.

For example, in March 2024 we announced our acquisition of DocFox and in fiscal 2022, we acquired SimpleNexus, our largest acquisition to date.

We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing, or investments in other companies.

2 unchanged sentences

In addition, nCino has limited experience in acquiring other businesses.

If an acquired business, including SimpleNexus, fails to meet our expectations, our operating results, business, and financial position may suffer.

If an acquired business fails to meet our expectations, our operating results, business, and financial position may suffer.

We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target, and we may not be successful in entering into an agreement with any particular target.

If we are successful in acquiring additional businesses, such as SimpleNexus, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

If we are successful in acquiring additional businesses we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

• our inability to integrate or benefit from acquired technologies or services;

14 unchanged sentences

In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations.

Because one of our stockholders holds a substantial amount of our total outstanding common stock, the influence of our public stockholders over significant corporate actions is limited and sales by this stockholder could adversely affect the value of our common stock.

Based on the total number of shares of our common stock outstanding as of January 31, 2023, entities affiliated with Insight Partners (“Insight Partners”) holds approximately 35% of our total outstanding common stock.

As a result, Insight Partners has the ability to influence the outcome of corporate actions requiring stockholder approval, including the election of directors, the approval of mergers, or other changes of corporate control, any of which may be in opposition to the best interests of our other stockholders and may adversely impact our results of operations and the value of our common stock.

Sales of our common stock by Insight Partners could have an immediate and substantial adverse effect on the value of our common stock.

Our customers are highly regulated and subject to a number of challenges and risks.

3 unchanged sentences

In addition, while much of our operations are not directly subject to the same regulations applicable to FIs, we are generally obligated to our customers to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them.

For example, as a result of obligations under some of our customer contracts, we are required to comply with certain provisions of the Gramm-Leach-Bliley Act related to the privacy of consumer information and may be subject to other privacy and data security laws because of the solutions we provide to FIs.

For example, as a result of obligations under some of our customer contracts, we are required to comply with certain provisions of the Gramm-Leach-Bliley Act ("GLBA") related to the privacy of consumer information and may be subject to other privacy and data security laws because of the solutions we provide to FIs.

The GLBA includes limitations on FI's disclosure of nonpublic personal information about a consumer to nonaffiliated third parties, in certain circumstances requiring FIs to limit the use and further disclosure of nonpublic personal information to nonaffiliated third parties and requiring FIs to safeguard nonpublic personal information.

Banking regulations for information security and breach notification also impose obligations on us due to our relationships with customers that increase our information security obligations and customers may impose additional information security standards upon us, such as those relating to the New York Department of Financial Services Cybersecurity Regulation.

Matters subject to review and examination by federal and state FI regulatory agencies and external auditors include our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities, and the design of our solutions.

4 unchanged sentences

Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend.

We are presently subject to a putative class action civil suit involving alleged violations of antitrust laws and a purported stockholder derivative lawsuit alleging violation of fiduciary duties with the series of mergers in which we became the parent of nCino OpCo and SimpleNexus.

We are presently subject to a purported stockholder derivative lawsuit alleging violation of fiduciary duties with the series of mergers in which we became the parent of nCino OpCo and SimpleNexus.

The court dismissed these claims and that decision is currently under appeal.

We may, in the future, become subject, from time to time, to other legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes or employment claims made by current or former employees.

5 unchanged sentences

We believe our corporate culture is one of our fundamental strengths, as we believe it enables us to attract and retain top talent and deliver superior results for our customers.

As we grow, we may find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively.

As we grow, we may find it difficult to preserve our corporate

culture, which could reduce our ability to innovate and operate effectively.

In turn, the failure to preserve our culture could negatively affect our ability to attract, recruit, integrate and retain employees, continue to perform at current levels and effectively execute our business strategy.

2 unchanged sentences

Implementation of our solutions may be delayed or expenses may increase when customers have unexpected data, software, or technology challenges, or unanticipated business requirements, which could adversely affect our relationship with customers and our operating results.

In general, the revenues related to implementation and other professional services we

provide are recognized on a proportional performance basis, and delays and difficulties in these engagements could result in losses on these contracts.

In general, the revenues related to implementation and other professional services we provide are recognized on a proportional performance basis, and delays and difficulties in these engagements could result in losses on these contracts.

In addition, our customers often require complex acceptance testing related to the implementation of our solutions.

30 unchanged sentences

The success of any new solution depends on several factors, including timely completion, adequate quality testing, and market acceptance.

not be able to enhance aspects of our solutions successfully or introduce and gain market acceptance of new applications or improvements in a timely manner, or at all.

We may not be able to enhance aspects of our solutions successfully or introduce and gain market acceptance of new applications or improvements in a timely manner, or at all.

Additionally, we must continually modify and enhance our solutions to keep pace with changes in software applications, database technology, and evolving technical standards and interfaces.

27 unchanged sentences

Bribery Act, as well as other similar anti-bribery and anti-kickback laws and regulations.

These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes.

These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing

improper payments or benefits to officials and other recipients for improper purposes.

Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as our international presence expands and as we increase sales and operations in foreign jurisdictions.

30 unchanged sentences

Increasing our customer base and expanding customer adoption within and across business lines will depend, to a significant extent, on our ability to effectively expand our sales and marketing operations and activities.

We plan to continue to expand our direct sales force both domestically and internationally for the foreseeable future.

We plan to continue to

expand our direct sales force both domestically and internationally for the foreseeable future.

We believe that there is significant competition for experienced sales professionals with the sales skills and technical knowledge that we require.

4 unchanged sentences

Effective customer training and high-quality, ongoing customer support are critical to the successful marketing, sale, and adoption of our solutions and for the renewal of existing customer contracts.

As we grow our customer base, we will

need to further invest in and expand our customer support and training organization, which could strain our team and infrastructure and reduce profit margins.

As we grow our customer base, we will need to further invest in and expand our customer support and training organization, which could strain our team and infrastructure and reduce profit margins.

If we do not help our customers adopt our solutions, quickly resolve any post-implementation matters, and provide effective ongoing customer support and training, our ability to expand sales to existing and future customers and our reputation would be adversely affected.

24 unchanged sentences

We cannot assure you that such third parties will maintain such software or continue to make it available.

We also rely on confidentiality agreements, consulting agreements, work-for-hire agreements, and invention assignment agreements with our employees, consultants, and others.

We also rely on confidentiality

agreements, consulting agreements, work-for-hire agreements, and invention assignment agreements with our employees, consultants, and others.

Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer, or otherwise obtain and use them.

2 unchanged sentences

Moreover, policing unauthorized use of our technologies, trade secrets, and intellectual property is difficult, expensive, and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the U.S.

and where mechanisms for enforcement of intellectual

property rights may be weak.

and where mechanisms for enforcement of intellectual property rights may be weak.

We may be unable to determine the extent of any unauthorized use or infringement of our solutions, technologies, or intellectual property rights.

33 unchanged sentences

During our fiscal year 2023, we supplemented our liquidity with a revolving credit facility of up to $50.0 million (the "Credit Facility").

As of January 31, 2023 we had $30.0 million outstanding under our Credit Facility.

As of January 31, 2024, we had no amounts outstanding under our Credit Facility.

In March 2024, we amended our Credit Facility and increased our borrowing availability to $100.0 million.

We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business.

We intend to continue to make investments to support our business and may require additional funds.

Moreover, we do not expect to be profitable for the foreseeable future on a GAAP basis.

Additional financing may not be available on favorable terms, if at all.

13 unchanged sentences

The rules of Section 382 are regularly being evaluated to determine any potential limitations.

If we experience one or more ownership changes as a result of future transactions in our stock, then we may be limited in our ability to use our NOL carryforwards, pre-change tax attributes or deductions to offset our future taxable income, if any.

If we experience one or more ownership changes as a result of future transactions in our stock, then we may be

limited in our ability to use our NOL carryforwards, pre-change tax attributes or deductions to offset our future taxable income, if any.

Amendments to existing tax laws, rules, or regulations, or enactment of new unfavorable tax laws, rules, or regulations could have an adverse effect on our business and operating results.

8 unchanged sentences

economy in light of the COVID-19 pandemic, including temporary beneficial changes to the treatment of net operating losses, interest deductibility limitations, and payroll tax matters.

Many of the provisions of the Tax Cuts and Jobs Act still require

guidance through the issuance and/or finalization of regulations by the U.S.

Many of the provisions of the Tax Cuts and Jobs Act still require guidance through the issuance and/or finalization of regulations by the U.S.

Treasury Department in order to fully assess their effects, and there may be substantial delays before such regulations are promulgated and/or finalized, increasing the uncertainty as to the ultimate effects of the Tax Cuts and Jobs Act on us and our stockholders.

21 unchanged sentences

This variability and unpredictability could also result in our failing to meet the expectations of industry or financial analysts or investors for any period.

If our revenues or operating results fall below the expectations of analysts or investors or below any forecasts we may provide to the market, or if the forecasts we provide to the market are below the expectations of analysts or investors, the price

of our common stock could decline substantially.

Such a stock price decline could occur even when we have met any previously publicly stated revenue or earnings forecasts that we may provide.

Based on the total number of shares of our common stock outstanding as of January 31, 2024, entities affiliated with Insight Partners (“Insight Partners”) holds approximately 34% of our total outstanding common stock.

Sales of our common stock by Insight Partners could have an immediate and substantial adverse effect on the value of our common stock.

We do not intend to pay dividends for the foreseeable future and, as a result, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock.

3 unchanged sentences

Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Future securities issuances could result in significant dilution to our stockholders and impair the market price of our common stock.

Future securities issuances could result in significant dilution to our existing stockholders and impair the market price of our common stock.

Future issuances of shares of our common stock, or the perception that these sales may occur, could depress the market price of our common stock and result in dilution to existing holders of our common stock.

30 unchanged sentences

Financial developments, monetary and other developments seemingly unrelated to us or our industry may adversely affect us.

For example, the current rising interest rate environment in the U.S., undertaken as a means to manage inflation, has had an impact on the real estate market in the U.S.

and specifically, the demand for mortgage and mortgage-related products and services, which has had a negative impact on our SimpleNexus business and may continue to adversely impact that business to the extent the rising interest rate environment persists.

Moreover, domestic and international economies have from time-to-time been impacted by falling demand for a variety of goods and services, tariffs and other trade issues, threatened sovereign defaults and ratings downgrades, restricted credit, threats to major multinational companies, poor liquidity, reduced corporate profitability, volatility in credit, equity and foreign exchange markets, bankruptcies, and overall uncertainty.

For example, the higher interest rate environment in the U.S., undertaken as a means to manage inflation, has had an impact on the real estate market in the U.S.

and specifically, the demand for mortgage and mortgage-related products and services, which has had a negative impact on our nCino Mortgage business and may continue to adversely impact that business to the extent the higher interest rate environment persists.

We cannot predict the timing, strength, or duration of the current or any future potential economic slowdown in the U.S.

25 unchanged sentences

Operating as a public company requires us to incur substantial costs and requires substantial management attention.

As a public company, we have incurred and will continue to incur substantial legal, accounting, and other expenses that we did not incur as a private company.

As a public company, we have incurred and will continue to incur substantial legal, accounting, and other expenses.

For example, we are subject to the reporting requirements of the Exchange Act, the applicable requirements of the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act, the rules and regulations of the SEC, and the rules and regulations of The Nasdaq Global Select Market.

As part of these requirements, we established and maintain effective disclosure and financial controls and make changes to our corporate

governance practices.

As part of these requirements, we established and maintain effective disclosure and financial controls and make changes to our corporate governance practices.

Compliance with these requirements has and will continue to increase our legal and financial compliance costs and will make some activities more time-consuming.

3 unchanged sentences

On February 11, 2022, we entered into Credit Agreement by and among the Company, nCino OpCo, Inc., certain subsidiaries of the Company as guarantors, and Bank of America, N.A.

as lender, pursuant to which we received access to a revolving Credit Facility of up to $50.0 million.

As of January 31, 2023, we had $30.0 million outstanding under our Credit Facility.

as lender, as amended by that certain First Amendment, dated February 9, 2024, pursuant to which we received access to a revolving Credit Facility of up to $50.0 million.

As of January 31, 2024, we had no amounts outstanding under our Credit Facility.

In March 2024, we amended our Credit Facility and increased our borrowing availability to $100.0 million.

The Credit Facility contains affirmative and restrictive covenants that limit our operating ability including to, among other things, dispose of assets, merge with other companies, incur additional indebtedness and liens, engage in new businesses, acquire certain other companies and modify organizational documents.

In addition, the Credit Facility is secured by substantially all of our personal property, and the Credit Facility requires us to satisfy certain covenants, including maintaining a minimum amount of liquidity under the Credit Facility.

In addition, the Credit Facility is secured by substantially all of our personal property, and the Credit Facility requires us to satisfy certain covenants, including maintaining certain senior secured leverage and interest coverage ratios under the Credit Facility.

As a result of these restrictions, we will be limited as to how we conduct our business and we may be unable to raise additional debt or equity financing to compete effectively or to take advantage of new business opportunities.

3 unchanged sentences

Further, at any time, if we violate the terms of the Credit Facility or otherwise fail to meet our covenants, we may not be able to obtain a waiver from the lenders under satisfactory terms, if at all, which would limit our operating flexibility and/or liquidity and which would have an adverse effect on our business and prospects.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors