What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-31 compared with 2025-04-01 · 238 added, 216 removed, 451 unchanged (50% of the section changed)

1 unchanged sentence

The risks described below are not the only ones we face.

The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently

believe to be immaterial could materially and adversely affect our business, financial condition, or results of operations.

The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition, or results of operations.

In such case, the trading price of our common stock could decline, and you may lose all or part of your investment.

4 unchanged sentences

Consistent with the foregoing, we are exposed to a variety of risks, including risks associated with the following:

• We derive most of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.

• Our growth strategy increasingly depends on the adoption and effective use of our AI capabilities by our customers, and if customer adoption rates or usage do not meet our expectations, our business, results of operations, and competitive position could be adversely affected.

• Our increased focus on the development and use of AI/ML technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.

• The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, rapidly evolving technologies, including the increasing adoption of AI/ML offerings by our competitors, or other competitive dynamics could adversely affect our business and results of operations.

• We derive most of our revenues from customers in the cloud-based financial services industry, and any downturn or consolidation or decrease in technology spend in the cloud-based financial services industry could adversely affect our business.

• Our future operating results are difficult to predict, in part because we do not have an extensive operating history at the current scale of our business, and we may not achieve our expected operating results in the future.

• We have a history of losses and while we have achieved profitability in a quarterly period, we may not be able to achieve or sustain profitability on a generally accepted accounting principles in the United States of America ("GAAP") basis in the future.

• We have a history of losses, and while we have achieved profitability, we may not be able to sustain profitability on a generally accepted accounting principles in the United States of America (“GAAP”) basis in the future.

• If we are unable to attract new customers or continue to broaden our existing customers’ use of our solutions, our revenue growth will be adversely affected.

• As the market for cloud-based banking technology continues to develop, it may do so more slowly than we expect or changes in a way that we fail to anticipate, in which case our sales would suffer and our results of operations would be adversely affected.

• We may not be able to sustain our revenue growth rate in the future.

• If we fail to accurately anticipate and respond to rapid technological changes in the cloud-based financial services industry in which we operate, including AI/ML developments, our ability to attract and retain customers could be impaired and our competitive position could be harmed.

• We may not be able to sustain or increase our revenue growth rate in the future.

• Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

• We have recently changed our pricing model, and that and other factors may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results.

• The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy.

• We may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results.

• Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods.

• Our business faces significant risks from diverse and evolving cybersecurity threats, including increased threats from the use of AI/ML.

A breach of our security or privacy measures or those we rely on could result in unauthorized access to, or disclosure of, customer or their clients’ data, which may materially and adversely impact our reputation, business, and results of operations.

• Privacy and data security concerns, data collection and transfer restrictions and related domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business and results of operations.

• Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.

• Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods.

• The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies, including the increasing adoption of artificial intelligence and machine learning ("AI/ML") offerings by our competitors, or other competitive dynamics could adversely affect our business and results of operations.

• We depend on data centers operated by or on behalf of Salesforce, AWS, and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability.

• We have and may continue to acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments or partnerships.

• Our customers are highly regulated.

Our failure to comply with laws and regulations applicable to us as a technology provider to FIs could adversely affect our business and results of operations, increase costs, and impose constraints on the way we conduct our business.

• Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend.

• We have and may continue to acquire or invest in companies, pursue business partnerships or divest products or assets, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments, partnerships, or divestitures.

Risks Relating to Our Business and Industry

We derive most of our revenues from customers in the financial services industry, and any downturn or consolidation or decrease in technology spend in the financial services industry could adversely affect our business.

Our growth strategy increasingly depends on the adoption and effective use of our AI capabilities by our customers, and if customer adoption rates or usage do not meet our expectations, our business, results of operations, and competitive position could be adversely affected.

We have invested, and expect to continue to invest, significant resources in developing and integrating AI-driven features and functionality into our platform.

The success of these investments depends in part on our customers’ willingness and ability to adopt, implement, and utilize our AI capabilities in a manner that generates measurable operational efficiencies, enhanced decision-making, and other tangible benefits.

If customers are slow to adopt our AI offerings, choose not to enable or fully deploy AI features, or limit their usage to pilot programs or narrow use cases, we may not realize the anticipated return on our investments.

Even where customers adopt our AI capabilities, they may not use them in ways that generate meaningful value.

Customers may lack the internal expertise, data quality, governance frameworks, management processes, or risk tolerance necessary to effectively leverage AI-driven tools.

Regulatory uncertainty, data privacy concerns, model risk management requirements, or internal compliance policies may also restrict how customers use AI functionality.

If customers fail to achieve expected productivity gains, cost savings, revenue enhancements, or other benefits from our AI offerings, they may reduce usage, decline to expand deployments, delay renewals, negotiate lower pricing, or elect not to purchase additional AI-enabled solutions.

If we are unable to effectively quantify and communicate the benefits of our AI capabilities, our sales cycles may lengthen, expansion opportunities may decrease, and our ability to justify pricing or drive incremental AI-related revenue may be adversely affected .

Our revenue growth and competitive positioning increasingly depend on our ability to differentiate our platform through AI-enabled innovation.

If customers do not broadly embrace our AI capabilities, or if competing solutions offer AI features that are perceived as more effective, easier to deploy, more transparent, more compliant, less expensive, or better aligned with customer needs, we may experience reduced demand for our solutions.

Competitors, including established financial technology providers, may be able to devote greater resources to AI research and development, respond more quickly to evolving customer expectations, or offer more compelling pricing models.

Failure to achieve widespread, value-generating adoption of our AI offerings could diminish our brand perception as an innovation leader and negatively impact customer acquisition, retention, and expansion .

Moreover, if anticipated AI-driven efficiencies do not materialize at the pace or scale we expect, our operating margins may be adversely affected, particularly if we continue to incur significant research and development, infrastructure, and compliance costs associated with AI initiatives without corresponding revenue growth.

Any of the foregoing could materially and adversely affect our business, financial condition, results of operations, and long-term growth prospects.

Our increased focus on the development and use of AI/ML technologies in our solutions and our business, as well as our potential failure to effectively implement, use, and market these technologies, may result in reputational harm or liability, or could otherwise adversely affect our business.

AI/ML is being embedded throughout nCino’s platform to help our customers maximize their productivity.

We increasingly have incorporated and may continue to incorporate AI/ML solutions and features into our solutions, and otherwise within our business, and these solutions and features continue to become more vital to our operations and to our future growth over time.

There can be no assurance that we will realize the desired or anticipated benefits from AI/ML, or at all, and we may fail to properly implement or market our AI/ML solutions and features.

The legal, regulatory, and policy environments around AI/ML are evolving rapidly, and we may become subject to new legal and other obligations in connection with our use of AI/ML, which could require us to make significant changes to our policies and practices, necessitating expenditure of significant time, expense, and other resources.

For example, in the EU/UK, laws and regulations regarding AI are developing at a fast pace.

On August 1, 2024, the EU’s standalone law to govern the offering and use of AI systems in the EU (the “AI Act”) entered into force - which becomes enforceable in a gradual manner between 2025 and 2027 depending on the specific requirements.

has not to date adopted dedicated AI legislation, instead looking to rely on a principles-based, sector-specific approach to AI regulation.

In the United States, several states, such as Colorado, Utah, and California, have passed or are considering legislation or regulation governing development or use of AI technologies, or supplementing the existing privacy, consumer protection and other regulatory guidance that may apply to the use of AI technologies in our business, and which may impact our use of technology.

More generally, our use of AI/ML technologies may present additional risks and challenges that could affect their adoption and therefore our business.

For example, the development of our AI/ML solutions may present ethical or social issues.

If we enable or offer solutions that draw controversy due to their perceived or actual impact in privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially in the context of an environment with heightened geopolitical volatility.

Inadequate or ineffective AI/ML development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI/ML solutions or result in unintended performance of the services.

This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI/ML solutions produce, subjecting us to competitive harm, legal liability and brand or reputational harm.

The rapid evolution of AI/ML will require the application of resources to develop, test and maintain our products and services to help ensure that AI/ML is implemented ethically and compliantly in order to minimize unintended, harmful impact.

Uncertainty around new and emerging AI/ML applications such as generative AI content creation and AI/ML agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, safety, security, bias and other variables, which are often complex, may be costly and could impact our results of operations and financial condition.

Moreover, the development of generative AI/ML solutions brings additional risks and responsibility.

Known risks of generative AI/ML currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance.

For example, AI/ML technologies, including generative AI, may create content that appears correct but may be factually inaccurate or flawed, or contain copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability.

Developing, testing and deploying AI/ML systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed.

The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, rapidly evolving technologies, including the increasing adoption of AI/ML offerings by our competitors, or other competitive dynamics could adversely affect our business and results of operations.

We currently compete with providers of technology and services in the cloud-based financial services industry, primarily point solution vendors that focus on building functionality that competes with specific components of our solutions.

From time to time, we also compete with systems internally developed by FIs.

Many of our competitors have significantly more financial, technical, marketing and other resources than we have, may devote greater resources to the development, promotion, sale and support of their systems than we can, have more extensive customer bases and broader customer relationships than we have and have longer operating histories and greater name recognition than we do.

We may also face competition from systems internally developed by FIs leveraging large language models as well as new companies entering our markets, which may include large established businesses that decide to develop, market or resell competitive technology, acquire one of our competitors or form a strategic alliance with one of our competitors or with Salesforce.

In addition, new companies entering our markets may choose to offer cloud-based banking solutions at little or no additional cost to the customer by bundling them with their existing solutions, including adjacent banking technologies.

Competition from these new entrants may make attracting new customers and retaining our current customers more difficult, which may adversely affect our results of operations.

Additionally, as we continue to increase building AI/ML into many of our solutions, we face more competition as AI/ML technologies are increasingly integrated into the markets in which we compete.

New AI/ML offerings may disrupt workforce needs and negatively impact demand for our solutions, or our competitors may be able to incorporate AI/ML into their offerings more efficiently or successfully than we are able to incorporate it into our solutions, and thereby achieve greater and faster adoption.

Even if our AI/ML solutions are more effective than the products and services that our competitors offer, potential customers might select competitive products and services in lieu of purchasing our services.

If we are unable to compete in this environment, sales and renewals of the nCino Platform could decline and adversely affect our business and results of operations.

With the introduction of rapidly evolving technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and maintain profitability.

We derive most of our revenues from customers in the cloud-based financial services industry, and any downturn or consolidation or decrease in technology spend in the cloud-based financial services industry could adversely affect our business.

Most of our revenues are derived from FIs whose industry has experienced significant pressure in recent years due to economic uncertainty, fluctuating interest rates, liquidity concerns and increased regulation.

In the past, FIs have experienced consolidation, distress and failure, including notably recently in March 2023 when the FDIC took control of Silicon Valley Bank and Signature Bank due to liquidity concerns and a number of other FIs experienced turbulence and a precipitous decline in market value.

In recent years, some FIs have experienced consolidation, distress and failure and a number of other FIs experienced turbulence and a precipitous decline in market value.

It is possible these conditions may persist, deteriorate or reoccur.

9 unchanged sentences

We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in the technology industry, such as the risks and uncertainties described in this Annual Report on Form 10-K and others we may not be able to presently identify.

If our assumptions regarding these risks and uncertainties are incorrect or change due to changes in our markets, or if we do not address these risks successfully, our operating and financial results may differ materially from our expectations and our business may suffer.

We have a history of losses, and while we have achieved profitability in a quarterly period, we may not be able to achieve or sustain profitability on a GAAP basis in the future.

We began operations in late 2011 and have experienced net losses since inception.

We generated net losses attributable to nCino of $102.7 million, $42.3 million, and $37.9 million for the fiscal years ended January 31, 2023, 2024, and 2025, respectively.

If our assumptions regarding these risks and uncertainties are incorrect or change due to changes in our

markets, or if we do not address these risks successfully, our operating and financial results may differ materially from our expectations and our business may suffer.

We have a history of losses, and while we have achieved profitability, we may not be able to sustain profitability on a GAAP basis in the future.

We began operations in late 2011 and experienced net losses until fiscal 2026.

We generated net income (loss) attributable to nCino of $(42.3) million, $(37.9) million, and $5.2 million for the fiscal years ended January 31, 2024, 2025, and 2026, respectively.

We had an accumulated deficit of $375.8 million at January 31, 2026.

While we have been profitable on a GAAP basis for a quarter, we may not be able to maintain or increase our level of profitability.

We intend to continue to

support further growth and extend the functionality of our solutions in future periods.

While we have been profitable on a GAAP basis, we may not be able to maintain or increase our level of profitability.

We intend to continue to support further growth and extend the functionality of our solutions in future periods.

We will also continue to face increased costs associated with growth and the expansion of our customer base and the costs of being a public company.

Our continuing efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenues enough to offset our increased operating expenses.

We expect, depending on a number of factors, to continue to incur losses on a GAAP basis as we continue to invest in product development, and we cannot predict whether or when we will achieve or sustain profitability on a GAAP basis.

If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.

We may, depending on a number of factors, continue to incur losses on a GAAP basis as we continue to invest in product development, and we cannot predict whether we will sustain profitability on a GAAP basis.

If we are unable to sustain profitability, the value of our business and common stock may significantly decrease.

If we are unable to attract new customers or continue to broaden our existing customers’ use of our solutions, our revenue growth will be adversely affected.

7 unchanged sentences

If we are unable to sign new customers or retain or attract new business from current customers, our business and results of operations may be materially and adversely affected.

As the market for cloud-based banking technology continues to develop, it may do so more slowly than we expect or changes in a way that we fail to anticipate.

If that occurs, or we fail to market our solutions effectively, our sales would suffer and our results of operations would be adversely affected.

Use of, and reliance on, cloud-based banking technology continues to evolve and we do not know whether FIs will continue to adopt cloud-based banking technology such as the nCino Platform in the future, or whether the market will change in ways we do not anticipate.

Many FIs have invested substantial personnel and financial resources in legacy software, and these FIs may be reluctant, unwilling, or unable to convert from their existing systems to our solutions.

Furthermore, these FIs may be reluctant, unwilling, or unable to use cloud-based banking technology due to various concerns, such as the security of their data and reliability of the delivery model.

These concerns or other considerations may cause FIs to choose not to adopt cloud-based banking technology such as ours or to adopt them more slowly than we anticipate, either of which would adversely affect us.

Our future success also depends on our ability to sell additional solutions and functionality to our current and prospective customers.

As we create new solutions and enhance our existing solutions, these solutions and enhancements may not be attractive to customers.

In addition, promoting and selling new and enhanced functionality may require increasingly costly sales and marketing efforts and if customers choose not to adopt this functionality, our business and results of operations could suffer.

If FIs are unwilling or unable to transition from their legacy systems, or if the demand for our solutions does not meet our expectations, our results of operations and financial condition will be adversely affected.

We may not be able to sustain our revenue growth rate in the future.

Our revenues increased from $408.3 million for fiscal 2023 to $476.5 million for fiscal 2024 and to $540.7 million for fiscal 2025.

However, we may not be able to sustain revenue growth consistent with our recent history, if at all.

Our revenue growth in recent periods may not be indicative of our future performance.

If we fail to accurately anticipate and respond to rapid technological changes in the cloud-based financial services industry in which we operate, including AI/ML developments, our ability to attract and retain customers could be impaired and our competitive position could be harmed.

The cloud-based financial services industry is subject to rapid change and the introduction of new technologies to meet the needs of this industry will continue to have a significant effect on competitive conditions in our market.

The introduction of new technologies, including AI/ML, continues to significantly affect competitive conditions.

Competitors may introduce new or alternative solutions, particularly AI-enabled offerings, that reduce demand for our platform or render aspects of our solutions less competitive.

If we are unable to successfully expand our product offerings, enhance existing functionality or develop and commercialize new technologies in a timely and cost-effective manner, our customers could migrate to competitors who may offer a broader or more attractive range of products and services.

For example, in fiscal 2025, we launched our Commercial Onboarding and Account Opening solution and we may fail to achieve the market acceptance we expect of this or other new offerings.

Developing and integrating new technologies, particularly AI/ML-enabled capabilities, is complex, costly, and time-consuming and may require significant investment in specialized personnel, data, infrastructure, and third-party technology.

If we fail to keep pace with industry and technological developments, our business, financial condition, and results of operations could be adversely affected.

We may not be able to sustain or increase our revenue growth rate in the future.

Our revenues increased from $476.5 million for fiscal 2024 to $540.7 million for fiscal 2025 and to $594.8 million for fiscal 2026 which represents a declining rate of growth year over year.

We may not be able to sustain absolute revenue growth.

Furthermore, to the extent we grow in future periods, maintaining consistent rates of revenue growth may be difficult.

Our revenue growth may also slow or even reverse in future periods due to a number of factors, which may include slowing demand for our solutions, our ability to successfully sell and implement new solutions, such as our retail solutions, increasing competition, decreasing growth of our overall market, the adoption of our new asset-based pricing model, our inability to attract and retain a sufficient number of FI customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions.

If we are unable to maintain consistent revenue growth, our business could be adversely affected, the price of our common stock could decline or otherwise be volatile and it may be difficult for us to achieve and maintain profitability.

fiscal 2025, our inability to attract and retain a sufficient number of FI customers, concerns over data security, our failure, for any reason, to capitalize on growth opportunities, or general economic conditions.

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

2 unchanged sentences

Our quarterly financial results may fluctuate as a result of a variety of factors, many of which are outside of our control, and may not fully or accurately reflect the underlying performance of our business.

Further, while subscriptions with our customers generally include multi-year non-cancellable terms, in a limited number of contracts, customers have an option to buy out of the contract for a specified termination fee.

Further, while subscriptions with our customers generally include multi-year non-cancelable terms, in a limited number of contracts, customers have an option to buy out of the contract for a specified termination fee.

If such customers exercise this buy-out option, or if we negotiate an early termination of a contract at a customer’s request, any termination fee would be recognized in full at the time of termination, which would favorably affect subscription revenues in that period and unfavorably affect subscription revenues in subsequent periods.

8 unchanged sentences

• customer renewal rates;

• increases or decreases in the number of users licensed or pricing changes upon renewals of customer contracts (including as a result of our new asset-based pricing model);

• increases or decreases in usage of our solutions or pricing changes upon renewals of customer contracts (including as a result of our asset-based pricing model we began implementing in fiscal 2025);

• network outages or security breaches;

5 unchanged sentences

• the timing of expenses related to the development or acquisition of technologies or businesses and potential future charges for impairment of goodwill or intangible assets from acquired companies.

The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy.

We must attract and retain highly qualified personnel.

In particular, we are dependent upon the services of our senior leadership team, and the loss of any member of this team could adversely affect our business.

Competition for executive officers, software developers, sales personnel, and other key employees in our industry is intense, particularly with AI/ML expertise.

In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software, as well as for skilled sales and operations professionals.

As we continue to incorporate AI/ML capabilities into our platform, we face heightened competition for personnel with specialized expertise in AI and competition for such talent is intense not only within the financial technology industry but also across large technology companies, financial institutions, and emerging AI-focused companies, many of which have substantially greater financial resources and brand recognition than we do.

Our principal operations are in Wilmington, North Carolina, where the pool of potential employees with the skills we need is more limited than it may be in larger markets, and we are sometimes required to induce prospective employees to relocate.

Many of the companies with which we compete for experienced personnel have greater resources than we do.

Compensation levels for AI/ML professionals have increased significantly in recent years, and we may be required to offer higher levels of cash compensation, equity awards, or other incentives to attract and retain such personnel, which could increase our operating expenses and adversely affect our margins.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our growth prospects could be severely harmed.

In addition, job candidates and existing employees often consider the actual and potential value of the equity awards they receive as part of their overall compensation.

Thus, if the perceived value or future value of our stock declines, our ability to attract and retain highly skilled employees may be adversely affected.

We may not accurately predict the long-term rate of customer subscription renewals or adoption of our solutions, or any resulting impact on our revenues or operating results.

We have recently adopted a new pricing model, which sets the pricing for our solutions primarily on the asset size of the FI customer, and began implementing it in fiscal 2025.

While we believe this new model responds to how we have observed customers using our solutions and evolving market conditions, there is no assurance that our existing customers will

react favorably to it, or that potential new customers will adopt it.

It is also possible that the new pricing model will not generate the revenues we expect from it for other reasons.

We have, and may in the future, be required to change our pricing model.

For example, in fiscal 2025, we introduced a new pricing model, which sets the pricing for our solutions primarily on the asset size of the FI customer.

While we believe this new model responds to how we have observed customers using our solutions and evolving market conditions, there is no assurance that our existing customers will react favorably to it, or that potential new customers will adopt it.

It is also possible that the pricing model we began implementing in fiscal 2025 will not generate the revenues we expect from it for other reasons.

Any of these factors could lead to an adverse effect on our results of operations or financial conditions and have a negative impact on the price of our common stock.

1 unchanged sentence

The historic average initial term of our customer agreements has been generally three to five years in length, billed annually in advance, and our fees and services have generally been non-cancelable and have not contained refund-type provisions.

mortgage contracts are generally billed monthly in advance.

mortgage contracts are generally billed monthly.

Subscription arrangements that are cancelable generally have penalty clauses.

3 unchanged sentences

As a result, we may in the future be required to implement further changes to our pricing model, reduce our prices, or accept other unfavorable contract terms, any of which could adversely affect our revenues, gross margin, profitability, financial position, and/or cash flow.

Our business faces significant risks from diverse security threats.

Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods.

We generally recognize subscription revenues ratably over the terms of our customer contracts.

Most of the subscription revenues we report each quarter are derived from the recognition of deferred revenue relating to subscriptions activated in previous quarters.

Consequently, a reduction in activated subscriptions in any single quarter may only have a small impact on our subscription revenues for that quarter.

However, such a decline will negatively affect our subscription revenues

in future quarters.

Accordingly, the effect of significant downturns in sales or market acceptance of our solutions may not be apparent in our current-quarter revenues or reflected in our results of operations until future periods.

Our business faces significant risks from diverse and evolving cybersecurity threats, including increased threats from the use of AI/ML.

5 unchanged sentences

Further, our products are flexible and complex software solutions and there is a risk that configurations of, or defects in, our solutions or errors in implementation could create vulnerabilities to security breaches.

There may be continued unlawful attempts to disrupt or gain access to our information technology systems or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations.

There may be continued unlawful attempts to disrupt or gain access to our information technology systems or those of our third-party service providers or the PII or other data of our customers or their clients that may disrupt our or our customers’ operations.

In addition, because we leverage third-party providers, including cloud, software, data center, and other critical technology vendors to deliver our solutions to our customers and their clients, we rely heavily on the data security technology practices and policies adopted by these third-party providers.

6 unchanged sentences

Also, our reputation could suffer irreparable harm, causing our current and prospective customers to decline to use our solutions in the future.

against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations.

Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and protection technologies, and defending against and resolving legal and regulatory claims, all of which could be costly and divert resources and the attention of our management and key personnel away from our business operations.

Federal and state regulations may require us or our customers to notify individuals of data security or privacy incidents involving certain types of personal data or information technology systems, and those laws and regulations continue to evolve to add more reporting requirements on faster timelines.

1 unchanged sentence

Any security compromise in our industry, whether actual or perceived, could erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, cause existing customers to elect not to renew or expand their use of our solutions, or subject us to third-party lawsuits, regulatory fines, or other actions or liabilities, which could materially and adversely affect our business and results of operations.

In addition, some of our customers contractually require notification of data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meets certain service levels.

In certain of our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a customer’s right to terminate their contract with us.

In certain of our contracts, a data security compromise or

operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a customer’s right to terminate their contract with us.

In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent customers from potentially terminating their contracts with us.

2 unchanged sentences

The successful assertion of one or more claims against us, the inadequacy or denial of coverage under our insurance policies, litigation to pursue claims under our policies, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could materially and adversely affect our business and results of operations.

As cyber threats have evolved and continue to evolve, vulnerabilities in our solutions and information technology systems have been and will in the future be detected, and we expect to expend additional resources to continue to modify or enhance our layers of defense to remediate such vulnerabilities.

As cyber threats have evolved and continue to evolve, vulnerabilities in our solutions and information technology systems have been and will in the future be identified, and we expect to expend additional resources to remediate such vulnerabilities and continue to modify or enhance our layers of defense.

System enhancements and updates create risks associated with implementing new systems and integrating them with existing ones, including risks associated with the effectiveness of our, our customers’ and our third-party providers’ software development lifecycles.

1 unchanged sentence

Customer utilization of older versions of our solutions can increase the risk and complexity of security vulnerabilities and the resources and time required to address them.

Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.

Fundamental elements of the nCino Platform, including our client onboarding, loan origination, and deposit account opening solutions, are built on the Salesforce Platform and we rely on our agreement with Salesforce to use the Salesforce Platform in conjunction with these solutions, including for hosting infrastructure and data center operations.

Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model.

Our agreement with Salesforce expires on January 31, 2031, unless earlier terminated by either party in the event of the other party’s material breach, bankruptcy, change in control in favor of a direct competitor, or intellectual property infringement, and thereafter automatically renews for additional one-year periods unless notice of non-renewal is provided by either party.

If we are unable to renew our agreement with Salesforce, there would be, absent a termination for cause, a wind-down period during which existing customers would be able to continue using the nCino Platform in conjunction with the Salesforce Platform, but we would be unable to provide this solution to new customers and could be limited in our ability to allow current customers to add additional users.

In addition, if we are unable to renew our agreement with Salesforce upon its expiration, our customers would need to obtain a separate subscription from Salesforce in order to access the nCino Platform.

This could cause a significant delay in the time required to enter into agreements with customers, place us and our customers at a disadvantage in negotiating with Salesforce, and lead customers not to renew or enter into agreements with us.

We also cannot assure you that the pricing or other terms in any renewal with Salesforce would be favorable to us, and if they are not, our business and operating results may be materially and adversely affected.

In addition, Salesforce has the right to terminate their agreement with us in certain circumstances, including in the event of a material breach by us.

If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above.

We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Platform infringes the intellectual property rights of such third party.

An expiration or termination of our agreement with Salesforce would cause us to incur significant time and expense to acquire rights to, or develop, a replacement solution and we may not be successful in these efforts, which could cause the nCino Platform to become obsolete.

Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different solution.

If we were unsuccessful in acquiring or developing a replacement solution or acquire or develop a replacement solution that our customers do not adopt, our business, results of operations, and brand would be materially and adversely affected.

Furthermore, there are no exclusivity arrangements in place with Salesforce that would prevent them from developing their own offerings that compete directly with ours, acquiring a company with offerings similar to ours, or investing greater resources in our competitors.

While we believe our relationship with Salesforce is strong, Salesforce competing with us could materially and adversely affect our business and results of operations.

For more information on our current cybersecurity risk management practices, see Part I, Item 1C of this Annual Report on Form 10-K, “Cybersecurity.”

Privacy and data security concerns, data collection and transfer restrictions and related domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business and results of operations.

Personal privacy, information security, and data protection are significant issues in the U.S., the European Union (“EU”), the United Kingdom ("UK") and a number of other jurisdictions where we offer our solutions.

Personal privacy, information security, and data protection, including with respect to the use of AI technologies, are significant issues in the U.S., the European Union (“EU”), the United Kingdom (“UK”) and a number of other jurisdictions where we offer our solutions.

The regulatory framework governing the collection, processing, storage, and use of certain information, particularly financial and other PII, is rapidly evolving.

3 unchanged sentences

The CCPA gives California residents expanded rights to access and delete their personal information, receive detailed information about how their personal information is used and shared by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined), and provide such consumers rights to opt-out of certain sales of personal information.

The CCPA provides for potential civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

The California Privacy Rights Act (the "CPRA"), which expands the CCPA, passed in November 2020 and went into effect on January 1, 2023, potentially requiring still to be determined additional compliance investment and potential business process changes.

The CCPA provides for potential civil penalties for violations, as well as a limited private right of action for data breaches caused as a result of unreasonable information security practices that can heighten post-incident litigation risk.

The California Privacy Rights Act (the “CPRA”), which expands the CCPA, passed in November 2020 and went into effect on January 1, 2023, expands privacy rights further and expands compliance requirements.

Among other things, the CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data.

It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement.

The CCPA includes a number of limited exceptions, including an exception for data that is collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley-Act (“GLBA”) and an exemption that includes some types of data covered by the Fair Credit Recording Act (“FCRA”).

These exceptions, however, do not apply to the private cause of action afforded to individuals for negligent information security incidents.

In 2025, new CCPA regulations were approved, going into effect starting in 2026.

These regulations impose new requirements including with respect to automated decision-making technologies (“ADMT”).

These exceptions, however, do not apply to the limited private cause of action afforded to individuals for incidents caused by a company’s failure to implement and maintain reasonable security measures to protect consumers’ personal information.

Additionally, the CCPA applies to the personal information of California residents collected in the employment, job applicant and business-to-business settings.

states have enacted comprehensive privacy laws and several others are proposing and enacting laws and regulations that impose obligations similar to the CCPA or that otherwise involve significant obligations and restrictions.

Although many such state laws do not apply to FIs (or to data) subject to the GLBA, and some exempt all commercial- and employment-related data, these are evolving laws and regulations that add layers of complexity to compliance in the U.S.

If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.

GLBA and FCRA impose privacy and information security requirements on FIs, including obligations to protect and safeguard consumers’ nonpublic personal information and creditworthiness information, respectively, and limitations on the use and disclosure of such information.

These laws and regulations are constantly evolving and add layers of complexity to compliance in the U.S.

The CCPA and similar new state laws and regulations will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.

The GLBA and FCRA impose privacy and information security requirements on FIs, including obligations to protect and safeguard consumers’ nonpublic personal information and creditworthiness information, respectively, and limitations on the use and disclosure of such information.

The GLBA requires appropriate administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity, availability, and the proper disposal of nonpublic personal information, and the FCRA imposes similar information security requirements regarding the protection of creditworthiness information.

The Federal Trade Commission (“FTC”) and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information and in particular health information.

Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access.

2 unchanged sentences

Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act.

Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination and security of personally identifiable information, including financial information.

Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination, security, transfer and localization of personally identifiable information, including financial information.

Actual, potential, or perceived violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies and processing of personal data, as well as civil claims including class actions, reputational damage and ongoing compliance costs, any of which could harm our business, results of operations and financial condition.

Moreover, federal, and state regulation around AI may be enacted in the near future.

Similarly, the European Economic Area (the "EEA") (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the "EU GDPR") in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 which sits alongside the UK Data Protection Act 2018 (known as the "UK GDPR", and together with the "EU GDPR", the "GDPR").

Moreover, several states have enacted or are considering AI-specific regulations, which could increase compliance burdens and heighten the risks associated with the training, development, deployment, and use of AI technologies.

Similarly, the European Economic Area (the “EEA”) (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the “EU GDPR”) in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 which sits alongside the UK Data Protection Act 2018 (as amended by the U.K.

Data (Use and Access) Act 2025) (known as the “UK GDPR,” and together with the “EU GDPR,” the “GDPR”).

The GDPR has a direct effect where an entity is established in the EEA or the UK and has extra-territorial effect where an entity established outside of the EEA or UK processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the UK or the monitoring of their behavior.

The GDPR imposes a number of obligations on controllers, including, among others:

(i) accountability and transparency requirements which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects regarding processing;

(ii) enhanced requirements for obtaining valid consent where consent is the lawful basis for processing;

(iii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed;

(iv) obligations to comply with data protection rights of data subjects including a right of access to and rectification of personal data, a right to obtain restriction of processing or to object to processing of personal data and a right to ask for a copy of personal data to be provided to a third party in a useable format and erasing personal data in certain circumstances and the right not to be subject to solely automated decision-making;

(i) accountability and transparency requirements which require controllers to demonstrate and record compliance with the GDPR and to provide detailed information to data subjects regarding processing;

(ii) requirements for obtaining valid consent where consent is the lawful basis for processing;

(iii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed in relation to the purpose for which they are processed;

(iv) obligations to comply with data protection rights of data subjects including a right of access to and rectification of personal data, a right to obtain restriction of processing or to object to processing of personal data and a right to ask for a copy of personal data to be provided to a third party in a usable format and erasing personal data in certain circumstances and the right not to be subject to solely automated decision-making;

(v) obligations to implement appropriate technical and organizational security measures to safeguard personal data;

and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible) and affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms.

and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible) and to affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms, without undue delay.

Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

1 unchanged sentence

In certain cases (e.g.

where transfers are made in reliance on SCCs) it is also necessary to carry out a transfer impact assessment ("TIA") which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

where transfers are made in reliance on SCCs) it is also necessary to carry out a transfer impact assessment (“TIA”) which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections

additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the U.S.

8 unchanged sentences

data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S.

Personal data may now be transferred from the UK under the UK-U.S.

Personal data may be transferred from the UK under the UK-U.S.

data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF.

11 unchanged sentences

Member States had until October 17, 2024 to transpose NISD2 into EU Member State law.

The European Commission initiated infringement procedures, by sending letters of formal notice to 23 Member States for failing to fully transpose NISD2 by this deadline.

Under the NISD2, stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers.

As of February 2026, most Member States have now implemented NISD2.

The European Commission initiated infringement procedures, in November 2024, by sending letters of formal notice to 23 Member States for failing to fully transpose NISD2 by this deadline.

Under NISD2, stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, which include information and communication technology (“ICT”) managed service providers.

NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned.

3 unchanged sentences

Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

The EU Digital Operational Resilience Act (“DORA”), which applied from January 17, 2025, imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers.

The EU Digital Operational Resilience Act (“DORA”), which took effect on January 17, 2025, imposes regulatory obligations to reinforce the digital operational resilience of regulated entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers.

DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered ‘critical’ within the meaning of DORA.

8 unchanged sentences

In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business and results of operations.

Because we recognize subscription revenues over the term of the contract, downturns or upturns in our business may not be reflected in our results of operations until future periods.

We generally recognize subscription revenues ratably over the terms of our customer contracts.

Most of the subscription revenues we report each quarter are derived from the recognition of deferred revenue relating to subscriptions activated in previous quarters.

Consequently, a reduction in activated subscriptions in any single quarter may only have a small impact on our subscription revenues for that quarter.

However, such a decline will negatively affect our subscription revenues in future quarters.

The markets in which we participate are intensely competitive and highly fragmented, and pricing pressure, new technologies or other competitive dynamics could adversely affect our business and results of operations.

We currently compete with providers of technology and services in the financial services industry, primarily point solution vendors that focus on building functionality that competes with specific components of our solutions.

From time to time, we also compete with systems internally developed by FIs.

We may also face competition from new companies entering our markets, which may include large established businesses that decide to develop, market or resell cloud-based banking technology, acquire one of our competitors or form a strategic alliance with one of our competitors or with Salesforce.

Competition from these new entrants may make attracting new customers and retaining our current customers more difficult, which may adversely affect our results of operations.

Additionally, as we continue to increase building AI/ML into many of our solutions, we face more competition as AI/ML technologies are increasingly integrated into the markets in which we compete.

If we are unable to compete in this environment, sales and renewals of the nCino Platform could decline and adversely affect our business and results of operations.

With the introduction of new technologies and potential new entrants into the cloud-based banking technology market, we expect competition to intensify in the future, which could harm our ability to increase sales and achieve profitability.

We envision a future where AI/ML is embedded throughout nCino’s platform to help our customers maximize their productivity.

There can be no assurance that we will realize the desired or anticipated benefits from AI/ML, or at all, and we may fail to properly implement or market our AI/ML solutions and features.

For example, in the EU/UK, laws and regulation regarding AI are developing at a fast pace.

On August 1, 2024 the EU's standalone law to govern the offering and use of AI systems in the EU (the "AI Act") entered into force - it will become enforceable in a gradual manner between 2025-2027 depending on the specific requirement and the UK has not to date adopted dedicated AI legislation instead looking to rely on a principles-based, sector-specific approach to AI regulation.

However, in July 2024 it was announced that new AI regulation would in fact be introduced for certain AI.

Moreover, states such as Colorado, Utah, and California, have passed or are considering legislation or regulation governing development or use of AI technologies, supplementing the existing consumer

protection and other regulatory guidance that may apply to the use of AI technologies in our business, and which may impact our use of technology.

More generally, our use of AI/ML technologies may present additional risks and challenges that could affect their adoption and therefore our business.

For example, the development of our AI/ML solutions may present ethical or social issues.

If we enable or offer solutions that draw controversy due to their perceived or actual impact privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially in the context of an environment with heightened geopolitical volatility.

Uncertainty around new and emerging AI/ML applications such as generative AI content creation and AI/ML agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our results of operations and financial condition.

Moreover, the development of generative AI/ML solutions brings additional risks and responsibility.

Known risks of generative AI/ML currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance.

For example, AI/ML technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability.

Developing, testing and deploying AI/ML systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed .

We depend on data centers operated by or on behalf of Salesforce, Amazon Web Services ("AWS"), and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability.

Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to provide this solution to our customers.

Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to use the Salesforce Platform in conjunction with these solutions, including for hosting infrastructure and data center operations.

Any termination of our relationship with Salesforce would result in a materially adverse impact on our business model.

In addition, Salesforce has the right to terminate their agreement with us in certain circumstances, including in the event of a material breach by us.

If Salesforce terminates our agreement for cause, it would not be required to provide the wind-down period described above.

We are also required to indemnify Salesforce for claims made against Salesforce by a third party alleging that the nCino Platform infringes the intellectual property rights of such third party.

Even if we were to successfully acquire or develop a replacement solution, some customers may decide not to adopt such solution and may, as a result, decide to use a different solution.

While we believe our relationship with Salesforce is strong, Salesforce competing with us could materially and adversely affect our business and results of operations.

We depend on data centers operated by or on behalf of Salesforce, AWS, and other third parties, and any disruption in the operation of these facilities could adversely affect our business and subject us to liability.

Our solutions are primarily hosted in data centers operated by or on behalf of Salesforce, AWS, and other third parties, and we do not control the operation of these data centers.

1 unchanged sentence

Any disruptions or other operational performance problems with these data centers could result in material interruptions in our services, adversely affect our reputation and results of operations, and subject us to liability.

We have and may acquire or invest in companies, or pursue business partnerships, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments, or partnerships.

From time to time, we consider potential strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions, and other assets.

For example, in fiscal 2025 we completed three acquisitions and have already announced one in fiscal 2026.

In addition to serving as a data center provider, AWS provides cloud infrastructure and platform services that are integral to the operation of certain of our products.

AWS also serves as the primary infrastructure layer for certain of our products including our U.S.

mortgage business and our artificial intelligence and machine learning capabilities, including the cloud platform services that power our AI-driven features and our agentic AI platform.

Any disruption to these services, including a prolonged outage or termination of our agreement with AWS, could impair our ability to deliver those products and AI capabilities to customers and could adversely affect our business and results of operations.

Our customers are highly regulated.

Our customers and prospective customers are highly regulated and are generally required to comply with stringent regulations in connection with performing business functions that our solutions address.

As a provider of technology to FIs, we have been, and expect to continue to be, examined on a periodic basis by various regulatory agencies and may be required to review certain of our suppliers and partners.

In addition, while much of our operations are not directly subject to the same regulations applicable to FIs, we are generally obligated to our customers to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them.

For example, as a result of obligations under some of our customer contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy and data security laws because of the solutions we provide to FIs.

The GLBA includes limitations on FI’s disclosure of nonpublic personal information about a consumer to nonaffiliated third parties, in certain circumstances requiring FIs to limit the use and further disclosure of nonpublic personal information to nonaffiliated third parties and requiring FIs to safeguard nonpublic personal information.

Banking regulations for information security and breach notification also impose obligations on us due to our relationships with customers that increase our information security obligations and customers may impose additional information security standards upon us, such as those relating to the New York Department of Financial Services Cybersecurity Regulation (“Cybersecurity Regulation”) or the National Association of Insurance Commissioner’s Insurance Data Security Model Law, which are both intended to establish standards for data security and standards for the investigation and notification of data breaches applicable to insurance licensees.

As of February 1, 2026, a version of the Insurance Data Security Model law has been adopted in more than 25 jurisdictions.

Both the Cybersecurity Regulation and Insurance Data Security Model Law require oversight of third-party service providers with respect to information security, among other things.

Matters subject to review and examination by federal and state FI regulatory agencies and external auditors include our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities, and the design of our solutions.

Any inability to satisfy these examinations and maintain compliance with applicable regulations could adversely affect our ability to conduct our business, including attracting and maintaining customers.

If we have to make changes to our internal processes and solutions as result of these regulations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency.

The evolving, complex, and often unpredictable regulatory environment in which our customers operate could result in our failure to provide compliant solutions, which could result in customers not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible.

In addition, federal, state, and/or foreign agencies may attempt to further regulate our activities in the future which could adversely affect our business and results of operations.

We have and may continue to acquire or invest in companies, pursue business partnerships or divest products or assets, which may divert our management’s attention or result in dilution to our stockholders, and we may be unable to integrate

acquired businesses and technologies successfully or achieve the expected benefits of such acquisitions, investments, partnerships, or divestitures.

From time to time, we consider potential strategic transactions, including acquisitions or divestitures of, or investments in, businesses, technologies, services, solutions, and other assets.

For example, we completed three acquisitions in fiscal 2025 and one acquisition in fiscal 2026.

We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing, or investments in other companies.

Negotiating these transactions can be time-consuming, difficult, and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control.

For instance, we have incurred significant costs in connection with our fiscal 2025 acquisitions.

In addition, nCino has limited experience in acquiring other businesses.

For instance, we incurred significant costs in connection with our prior acquisitions.

If an acquired business fails to meet our expectations, our operating results, business, and financial position may suffer.

We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target, and we may not be successful in entering into an agreement with any particular target.

If we are successful in acquiring additional businesses, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

1 unchanged sentence

• unanticipated costs or liabilities associated with the acquisition;

• incurrence of acquisition-related costs;

• incurrence of transaction-related costs;

• difficulty integrating the technology, accounting systems, operations, control environments, and personnel of the acquired business and integrating the acquired business or its employees into our culture;

3 unchanged sentences

• diversion of management’s attention and other resources;

• adverse effects to our existing business relationships with business partners and customers;

• adverse effects to our existing business relationships with business partners and customers as a result of the acquisition or divestiture;

• the issuance of additional equity securities that could dilute the ownership interests of our stockholders;

5 unchanged sentences

In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations.

Our customers are highly regulated.

The GLBA includes limitations on FI's disclosure of nonpublic personal information about a consumer to nonaffiliated third parties, in certain circumstances requiring FIs to limit the use and further disclosure of nonpublic personal information to nonaffiliated third parties and requiring FIs to safeguard nonpublic personal information.

Banking regulations for information security and breach notification also impose obligations on us due to our relationships with customers that increase our information security obligations and customers may impose additional information security standards upon us, such as those relating to the New York Department of Financial Services Cybersecurity Regulation (“Cybersecurity Regulation) or the National Association of Insurance Commissioner’s Insurance Data Security Model Law, which are both intended to establish standards for data security and standards for the investigation and notification of data breaches applicable to insurance licensees.

As of February 1, 2025, a version of the Insurance Data Security Model law has been adopted in more than 25 jurisdictions.

Both the Cybersecurity Regulation and Insurance Data Security Model Law require oversight of third-party service providers with respect to information security, among other things.

If we have to make changes to our

internal processes and solutions as result of these regulations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency.

In addition, federal, state, and/or foreign agencies may attempt to further regulate our activities in the future which could adversely affect our business and results of operations.

Any legal proceedings against us could adversely affect our operations and prospects, damage our reputation, and be costly and time-consuming to defend.

In the future, we may become subject, from time to time, to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial disputes or employment claims made by current or former employees.

Legal proceedings might result in damages and harm to our operations and prospects, reputational damage, substantial costs, and may divert management’s attention and resources, which might adversely impact our business, overall financial condition, and results of operations.

Legal proceedings might result in damages and harm to our operations and prospects,

reputational damage, substantial costs, and may divert management’s attention and resources, which might adversely impact our business, overall financial condition, and results of operations.

Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us.

1 unchanged sentence

A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our results of operations and leading analysts or potential investors to reduce their expectations of our performance, which could reduce the value of our common stock.

Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, particularly given our recent transition to a new Chief Executive Officer, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be adversely affected.

Our corporate culture has contributed to our success, and if we cannot maintain it as we grow, we could lose the innovation, creativity and teamwork fostered by our culture, and our business may be adversely affected.

We believe our corporate culture is one of our fundamental strengths, as we believe it enables us to attract and retain top talent and deliver superior results for our customers.

1 unchanged sentence

In turn, the failure to preserve our culture could negatively affect our ability to attract, recruit, integrate and retain employees, continue to perform at current levels and effectively execute our business strategy.

Our board appointed Sean Desmond as our new Chief Executive Officer, effective February 1, 2025, and Pierre Naudé resigned as Chief Executive Officer, a position he had held since nCino's inception.

Naudé continues to serve as Executive Chairman.

As with any other company transitioning from a long-serving Chief Executive Officer, it will be important to maintain the innovation, creativity, teamwork and other elements essential to the continued growth of our business under new leadership.

Any failure to do so may have an adverse impact on our results of operations and financial condition.

We may encounter implementation challenges, including in situations in which we rely on SIs, which would materially and adversely affect our business and results of operations.

7 unchanged sentences

Further, because we do not fully control our customers’ implementation schedules, if our customers do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties, our ability to take customers live and the overall customer experience could be adversely affected.

We rely on existing customers to act as references for prospective customers, and difficulties in implementation and configuration could therefore adversely

affect our ability to attract new customers.

We rely on existing customers to act as references for prospective customers, and difficulties in implementation and configuration could therefore adversely affect our ability to attract new customers.

Any difficulties or delays in implementation processes could cause customers to delay or forego future purchases of our solutions.

12 unchanged sentences

Despite extensive testing, from time to time we have discovered, and may in the future discover, defects or errors in our solutions.

As we rapidly develop and deploy AI-powered features, the risk of unexpected behaviors, inaccuracies, or performance issues increases.

Any performance problems or defects in our solutions may materially and adversely affect our business and results of operations.

3 unchanged sentences

Errors, defects, or other problems could also result in reduced sales or a loss of, or delay in, the market acceptance of our solutions.

If we fail to accurately anticipate and respond to rapid changes in the industry in which we operate, our ability to attract and retain customers could be impaired and our competitive position could be harmed.

The financial services industry is subject to rapid change and the introduction of new technologies to meet the needs of this industry will continue to have a significant effect on competitive conditions in our market.

If we are unable to successfully expand our product offerings beyond our current solutions, our customers could migrate to competitors who may offer a broader or more attractive range of products and services.

For example, in fiscal 2025, we launched our Commercial Onboarding and Account Opening solution and we may fail to achieve market acceptance of this offering.

Unexpected delays in releasing new or enhanced versions of our solutions, or errors following their release, could result in loss of sales, delay in market acceptance, or customer claims against us, any of which could adversely affect our business.

The success of any new solution depends on several factors, including timely completion, adequate quality testing, and market acceptance.

We may not be able to enhance aspects of our solutions successfully or introduce and gain market acceptance of new solutions or improvements in a timely manner, or at all.

Additionally, we must continually modify and enhance our solutions to keep pace with changes in software solutions, database technology, and evolving technical standards and interfaces.

Uncertainties related to our ability to introduce and improve functionality, announcements or introductions of a new or updated solution, or modifications by our competitors could adversely affect our business and results of operations.

We leverage third-party software, content, and services for use with our solutions.

Performance issues, errors and defects, or failure to successfully integrate or license necessary third-party software, content, or services, could cause delays, errors, or

failures of our solutions, increases in our expenses, and reductions in our sales, which could materially and adversely affect our business and results of operations.

Performance issues, errors and defects, or failure to successfully integrate or license necessary third-party software, content, or services, could cause delays, errors, or failures of our solutions, increases in our expenses, and reductions in our sales, which could materially and adversely affect our business and results of operations.

We use software and content licensed from, and services provided by, a variety of third parties in connection with the operation of our solutions.

23 unchanged sentences

These laws and regulations generally prohibit companies and their employees and intermediaries from authorizing, offering, or providing improper payments or benefits to officials and other recipients for improper purposes.

Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as our international presence expands and as we increase sales and operations in foreign jurisdictions.

Our precautions to prevent violations of

these laws may prove ineffective, and our potential exposure for violating these laws increases as our international presence and sales expand.

In addition, we face risks in doing business internationally that could adversely affect our business, including:

17 unchanged sentences

We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations.

The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy.

We must attract and retain highly qualified personnel.

In particular, we are dependent upon the services of our senior leadership team, and the loss of any member of this team could adversely affect our business.

Competition for executive officers, software developers, sales personnel, and other key employees in our industry is intense.

Many of the companies with which we compete for experienced personnel have greater resources than we do.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our growth prospects could be severely harmed.

In addition, job candidates and existing employees often consider the actual and potential value of the equity awards they receive as part of their overall compensation.

Thus, if the perceived value or future value of our stock declines, our ability to attract and retain highly skilled employees may be adversely affected.

Failure to effectively expand our sales capabilities could harm our ability to increase our customer base.

17 unchanged sentences

Prospective customers often undertake a prolonged evaluation process, which typically involves not only our solutions, but also those of our competitors.

Our sales cycles are typically lengthy, generally ranging from 6 to 9 for smaller FIs and 12 to 18 months or more for larger FIs.

Our sales cycles are typically lengthy, generally ranging from six to nine months for smaller FIs and 12 to 18 months or more for larger FIs.

We may spend substantial time, effort and money on our sales and marketing efforts without any assurance that our efforts will produce any sales.

8 unchanged sentences

We have registered the “nCino” name and logo in the U.S.

and certain other countries and we have registrations and/or pending applications for additional marks including “nIQ” in the U.S.

and certain other countries and we have registrations and/or pending applications for additional marks in the U.S.

and certain other countries.

13 unchanged sentences

Some open source software licenses require that software subject to the license be made available to the public and that any modifications or derivative works based on the open source code be licensed in source code form under the same open source licenses.

Although we monitor our use of open source software, we cannot assure you that all open source software is reviewed prior to use in our solutions, that our programmers have not incorporated open source software into our solutions, or that they will not do so in the future.

Our monitoring of our use of open source software may fail to prevent the risk of licensing such software.

We cannot assure you that all open source software is reviewed prior to use in our solutions, that our programmers have not incorporated open source software into our solutions, or that they will not do so in the future.

In addition, our solutions may incorporate third-party software under commercial licenses.

26 unchanged sentences

Our failure to raise capital if needed could adversely affect our business and results of operations, and any debt or equity issued to raise additional capital may reduce the value of our common stock.

We have funded our operations since inception primarily through equity financings and receipts generated from customers.

During our fiscal year 2024, we supplemented our liquidity with a revolving credit facility of up to $250.0 million (the "Credit Facility").

We have funded our operations since inception primarily through equity financings, receipts generated from customers, and a revolving credit facility of up to $250.0 million (the “2024 Credit Facility”).

As of January 31, 2026, we had $213.5 million outstanding under our 2024 Credit Facility.

In March 2024, we amended our then-existing revolving credit facility and increased our borrowing availability from $50.0 million to $100.0 million and, in October 2024, we terminated our then-existing revolving credit facility and obtained the Credit Facility.

In March 2024, we amended our then-existing revolving credit facility (the “2022 Credit Facility”) and increased our borrowing availability from $50.0 million to $100.0 million and, in October 2024, we terminated our 2022 Credit Facility and obtained the 2024 Credit Facility.

We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business.

9 unchanged sentences

federal and certain state NOLs generated in taxable years beginning after December 31, 2017 are not subject to expiration.

Federal NOLs generally may not be carried back to prior taxable years except that, under the Coronavirus Aid, Relief and Economic Security (CARES) Act, federal NOLs generated in tax years 2018, 2019, and 2020 may be carried back to each of the five taxable years preceding the taxable year in which the loss arises.

Federal NOLs generally may not be carried back to prior taxable years.

Additionally, for taxable years beginning after December 31, 2017, the deductibility of federal NOLs is limited to 80% of our taxable income in such taxable year.

NOLs generated in tax years before 2018 may still be used to offset future taxable income without regard to the 80% limitation, although they have the potential to expire without being utilized if we do not achieve profitability in the future.

However, under the rules of Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its NOLs, pre-change tax attributes and any net unrealized built-in losses to offset its post-change taxable income or taxes may be limited.

In addition, under the rules of Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its NOLs and other pre-change tax attributes to offset its post-change taxable income or taxes may be limited.

The applicable rules generally operate by focusing on changes in ownership among stockholders considered by the rules as owning, directly or indirectly, 5% or more of the stock of a company, as well as changes in ownership arising from new issuances of stock by the company.

The rules of Section 382 are regularly being evaluated to determine any potential limitations.

If we experience one or more ownership changes as a result of future transactions in our stock, then we may be limited in our ability to use our NOL carryforwards, pre-change tax attributes or deductions to offset our future taxable income, if any.

If we experience one or more ownership changes as a result of future transactions in our stock, then we may be limited in our ability to use our NOL carryforwards or pre-change tax attributes to offset our future taxable income, if any.

Amendments to existing tax laws, rules, or regulations, or enactment of new unfavorable tax laws, rules, or regulations could have an adverse effect on our business and operating results.

2 unchanged sentences

Treasury Department.

Changes to tax laws (which changes may have retroactive application) could adversely affect us or holders of our common stock.

Changes to tax laws (which changes may have retroactive application) and new regulations or interpretations could adversely affect us or holders of our common stock.

In recent years, many such changes have been made and changes are likely to continue to occur in the future.

For example, the Tax Cuts and Jobs Act was enacted in 2017 and made a number of significant changes to the current U.S.

federal income tax rules, including reducing the generally applicable corporate tax rate from 35% to 21%, imposing additional limitations on the deductibility of interest, placing limits on the utilization of NOLs, and making substantial changes to the international tax rules.

In addition, on March 27, 2020, the CARES Act was signed into law, which included certain changes in tax law intended to stimulate the U.S.

economy in light of the COVID-19 pandemic, including temporary beneficial changes to the treatment of net operating losses, interest deductibility limitations, and payroll tax matters.

Many of the provisions of the Tax Cuts and Jobs Act still require guidance through the issuance and/or finalization of regulations by the U.S.

Treasury Department in order to fully assess their effects, and there may be substantial delays before such regulations are promulgated and/or finalized, increasing the uncertainty as to the ultimate effects of the Tax Cuts and Jobs Act on us and our stockholders.

There also may be technical corrections

legislation or other legislative changes proposed with respect to the Tax Cuts and Jobs Act, the effects of which cannot be predicted and may be adverse to us or our stockholders.

For example, the United States Inflation Reduction Act, among other changes, introduced a 15% corporate minimum tax on certain United States corporations and a 1% excise tax on certain stock redemptions by certain publicly traded corporations.

More recently, in July 2025, the U.S.

enacted the One Big Beautiful Bill Act (“OBBBA”), which made significant changes to the Code.

Among other provisions, the OBBBA restored the immediate deductibility of domestic research and experimental (“R&E”) expenditures for tax years beginning after December 31, 2024, while retaining the requirement to capitalize and amortize foreign R&E expenditures.

The OBBBA also introduced other complex tax provisions, including changes to provisions relating to income from non-U.S.

subsidiaries.

Although the full impact of the OBBBA will depend on future regulatory guidance and implementation, these changes may materially affect our effective tax rate, deferred tax balances, and cash taxes.

We continue to evaluate the impacts of these and other recent tax law changes on our business.

Changes in or interpretations under the OBBBA or other existing or future tax legislation may increase our tax liabilities or compliance costs.

Furthermore, future guidance from the IRS and other tax authorities, or judicial decisions interpreting these laws, could materially impact our provision for income taxes.

Additionally, if the U.S.

or other foreign tax authorities change applicable tax laws or practices, our overall tax liability could increase, and our business, financial condition and results of operations may be adversely impacted.

Risks Relating to Ownership of Our Common Stock

7 unchanged sentences

• announcements by us or our competitors of significant products or features, technical innovations, acquisitions, strategic partnerships, joint ventures, or capital commitments;

• repurchases of our common stock under our stock repurchase programs or the decision to terminate or suspend any repurchases;

• changes in operating performance and stock market valuations of companies in our industry, including our competitors;

2 unchanged sentences

• developments in new legislation and pending lawsuits or regulatory actions, including interim or final rulings by judicial or regulatory bodies;

• volatility in the trading prices and trading volumes of financial technology and other technology stocks;

• other events or factors, political conditions, election cycles, war or incidents of terrorism, or responses to these events.

19 unchanged sentences

As a result, purchasers of our common stock bear the risk that future issuances of debt or equity securities may reduce the value of our common stock and further dilute their ownership interest.

We cannot guarantee that any stock repurchase program will be fully consummated or that it will enhance stockholder value, and stock repurchases could affect the price of our common stock.

In March 2025, our Board of Directors authorized a program under which we were authorized to repurchase up to $100.0 million of our outstanding common stock which we completed in the third quarter of fiscal 2026.

In December 2025, our Board of Directors authorized another stock repurchase program of up to $100.0 million of our outstanding common stock (the “December 2025 Stock Repurchase Program”).

The Company may make repurchases, from time to time, through open market purchases, block trades, in privately negotiated transactions, accelerated stock repurchase transactions, or by other means.

Open market repurchases will be structured to occur in accordance with applicable federal securities laws.

The Company may also, from time to time, enter into Rule 10b5-1 plans to facilitate repurchases under this authorization.

The volume, price, timing, and manner of any repurchases will be determined at the Company’s discretion, subject to general market conditions, as well as the Company’s management of capital, general business conditions, other investment opportunities, regulatory requirements and other factors.

The December 2025 Stock Repurchase Program does not obligate the Company to repurchase any specific amount of common stock, has no time limit, and may be modified, suspended, or discontinued at any time without notice at the discretion of our Board of Directors.

The timing, pricing, and size of these repurchases will depend on a number of factors, including the market price of our common stock and general market and economic conditions.

The stock repurchase program does not obligate us to repurchase any dollar amount or number of shares, and the program may be suspended or discontinued at any time, which may result in a decrease in the price of our common stock.

The stock repurchase program could affect the price of our common stock, increase volatility, and diminish our cash reserves.

Delaware law and provisions in our amended and restated certificate of incorporation and bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the trading price of our common stock.

1 unchanged sentence

These provisions include the following:

• establish a classified board of directors so that not all members of our board of directors are elected at one time;

• permit the board of directors to establish the number of directors and fill any vacancies and newly created directorships;

• provide that directors may only be removed for cause;

• require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and bylaws;

32 unchanged sentences

Any disruptions in our operations could adversely affect our business and results of operations and harm our reputation.

Moreover, although we have disaster recovery plans, they may prove inadequate.

Moreover, our disaster recovery plans may prove inadequate.

We may not carry sufficient business insurance to compensate for losses that may occur.

16 unchanged sentences

Failure to remedy any material weakness in our internal controls over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Operating as a public company requires us to incur substantial costs and requires substantial management attention.

As a public company, we have incurred and will continue to incur substantial legal, accounting, and other expenses.

For example, we are subject to the reporting requirements of the Exchange Act, the applicable requirements of the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act, the rules and regulations of the SEC, and the rules and regulations of The Nasdaq Global Select Market.

As part of these requirements, we established and maintain effective disclosure and financial controls and make changes to our corporate governance practices.

Compliance with these requirements has and will continue to increase our legal and financial compliance costs and will make some activities more time-consuming.

Our management and other personnel divert attention from other business matters to devote substantial time to the reporting and other requirements of being a public company.

In particular, we incur significant expense and devote substantial management effort to complying with the requirements of Section 404 of the Sarbanes-Oxley Act.

The terms of our Credit Facility contain restrictive covenants that may limit our operating flexibility.

7 unchanged sentences

Furthermore, there is no guarantee that future working capital, borrowings or equity financing will be available to repay or refinance any such debt.

Any inability to make scheduled payments, meet the financial or other covenants in our Credit Facility would adversely affect our business.

Any inability to make scheduled payments or meet the financial or other covenants in our 2024 Credit Facility would adversely affect our business.

Further, at any time, if we violate the terms of the 2024 Credit Facility or otherwise fail to meet our covenants, we may not be able to obtain a waiver from the lenders under satisfactory terms, if at all, which would limit our operating flexibility and/or liquidity and which would have an adverse effect on our business and prospects.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors