ACI WORLDWIDE, INC.

Previous wording

As part of our business, we electronically receive, process, store, and transmit information, including personal information and sensitive business information of our customers. Cybersecurity incidents vary in their form and can include the deployment of harmful malware or ransomware, denial-of-services attacks, and other attacks, which may affect business continuity and threaten the availability, confidentiality and integrity of our systems and information. Cybersecurity incidents can also include employee or personnel failures, fraud, phishing or other social engineering attempts or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient. Cybersecurity threat actors also may attempt to exploit vulnerabilities in software including software commonly used by companies in cloud-based services and bundled software. Like many other companies, we detect attempts by threat actors to gain access to our systems and networks on a frequent basis, and the frequency of such attempts could increase in the future. Unauthorized access, use, or disruptions to our data, computer systems or databases or other cybersecurity incidents or similar attacks could result in the theft or publication of confidential information or the deletion or modification of records or could otherwise cause interruptions in our operations. These concerns about security are increased when we transmit information over the Internet. Security breaches and cybersecurity incidents in connection with the delivery of our products and services, including products and services utilizing the Internet, or well-publicized security breaches, and the trend toward broad consumer and general public notification of such incidents, could significantly harm our business, financial condition, cash flows and/or results of operations. We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology protecting our networks and confidential information. Computer viruses have also been distributed and have rapidly spread over the Internet. Computer viruses could infiltrate our systems, disrupting our delivery of services and making our applications unavailable. Any inability to prevent security breaches or computer viruses could also cause existing customers to lose confidence in our systems and terminate their agreements with us, and could inhibit our ability to attract new customers. A cybersecurity incident or failure or disruption relating to our information or systems or that of our third-party business partners, or any failure by us or our third-party business partners to effectively address, enforce and maintain our information technology infrastructure, systems, or security measures m…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As part of our business, we electronically receive, process, store, and transmit information, including personal information and sensitive business information of our customers. Cybersecurity incidents vary in their form and can include the deployment of harmful malware or ransomware, denial-of-services attacks, and other attacks, which may affect business continuity and threaten the availability, confidentiality and integrity of our systems and information. Cybersecurity incidents can also include employee or personnel failures, fraud, phishing or other social engineering attempts, AI deep fakes, zero-day sophistication, supply chain threats, AI created malware or ransomware, or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient. Cybersecurity threat actors also may attempt to exploit vulnerabilities in both ACI and cloud provider infrastructure along with vulnerabilities in software including software commonly used by companies in cloud-based services and bundled software. Like many other companies, we detect attempts by threat actors to gain access to our systems and networks on a frequent basis, and the frequency of such attempts could increase in the future. Unauthorized access, use, or disruptions to our data, computer systems or databases or other cybersecurity incidents or similar attacks could result in the theft or publication of confidential information, including intellectual property and consumer information, or the deletion or modification of records or could otherwise cause interruptions in our operations. These concerns about security are increased when we transmit information over the Internet. Security breaches and cybersecurity incidents in connection with the delivery of our products and services, including products and services utilizing the Internet, or well-publicized security breaches, and the trend toward broad consumer and general public notification of such incidents, could significantly harm our business, financial condition, cash flows and/or results of operations. We cannot be certain that advances in criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology protecting our networks and confidential information. Computer viruses have also been distributed and have rapidly spread over the Internet. Computer viruses could infiltrate our systems, disrupting our delivery of services and making our applications unavailable. Any inability to prevent security breaches or computer viruses could also cause existing customers to lose confidence in our systems and terminate their agreements with us, and could inhibit our ability to attract new customers. A cybersecurity incident or failure or disruption relating to our information or sy…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

From time to time, we may divest of all or a portion of certain businesses. Divestitures involve risk, including, potential increased expense associated with the divestitures, and potential issues with the acquirers, customers or suppliers of the divested business, or products. Occasionally, we may wind down certain business activities and perform other organizational restructuring projects in an effort to reduce costs and streamline operations. For example, we divested our corporate online banking solutions related assets and liabilities to One Equity Partners on September 1, 2022. Divestiture activities involve risks as they may divert management's attention from our core businesses, increase expenses on a short‑term basis and lead to potential issues with employees or customers. If we do not complete these activities in a timely manner, or do not realize anticipated cost savings, synergies and efficiencies, business disruption occurs during or following such activities, or we incur unanticipated charges, this may negatively impact our business, financial condition, operating results, and cash flows.

Current wording

From time to time, we may divest of all or a portion of certain businesses. Divestitures involve risk, including, potential increased expense associated with the divestitures, and potential issues with the acquirers, customers or suppliers of the divested business, or products. Occasionally, we may wind down certain business activities and perform other organizational restructuring projects in an effort to reduce costs and streamline operations. Divestiture activities involve risks as they may divert management's attention from our core businesses, increase expenses on a short‑term basis and lead to potential issues with employees or customers. If we do not complete these activities in a timely manner, or do not realize anticipated cost savings, synergies and efficiencies, business disruption occurs during or following such activities, or we incur unanticipated charges, this may negatively impact our business, financial condition, operating results, and cash flows.

Previous wording

The crises in eastern Europe and the Middle East continue to be a challenge to global companies, including us. We currently have one employee in Russia, a dormant customer in Russia, and customers located in the Middle East. The U.S. and other global governments have placed restrictions on how companies may transact with, and provide services or solutions to, parties in these regions, particularly Russia, Belarus and restricted areas in Ukraine. No assurances can be given that additional developments in the impacted regions, and responses thereto from the U.S. and other global governments, would not have a material adverse effect on our business, results of operations and financial condition.

Current wording

Current and potential conflicts continue to challenge global companies, including us. We currently have one employee in Russia, a dormant customer in Russia, and customers located in the Middle East. The U.S. and other global governments have placed restrictions on how companies may transact with, and provide services or solutions to certain countries, including Russia.

Previous wording

In addition, our customers must ensure that our services comply with the government regulations, including the EU GDPR, and industry standards that apply to their businesses. Federal, state, foreign or industry authorities could adopt laws, rules, or regulations affecting our customers’ businesses that could lead to increased operating costs that may lead to reduced market acceptance. In addition, action by regulatory authorities relating to credit availability, data usage, privacy, or other related regulatory developments could have an adverse effect on our customers and, therefore, could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

In addition, our customers must ensure that our services comply with the government regulations, including the EU GDPR, DORA, and industry standards that apply to their businesses. Federal, state, foreign or industry authorities could adopt laws, rules, or regulations affecting our customers’ businesses that could lead to increased operating costs that may lead to reduced market acceptance. In addition, action by regulatory authorities relating to credit availability, data usage, privacy, or other related regulatory developments could have an adverse effect on our customers and, therefore, could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

As a provider of services to financial institutions, we may be bound by the same limitations on disclosure of the information we receive from our customers as apply to the financial institutions themselves. The processing of personal data and other types of information subjects us to a number of domestic and international laws that govern and regulate the processing of personal information and other types of protected data. These laws regulate and address a range of issues including data privacy (e.g., restrictions or technological or process requirements regarding the processing of data), cybersecurity (e.g., requirements for the protection of personal information against compromise of the confidentiality, integrity, or availability of personal information), breach notification, and data governance. These laws can vary substantially from jurisdiction to jurisdiction, and are rapidly evolving. We are subject to laws and regulations relating to the collection, use, retention, privacy, protection, security, and transfer of information, including personal information of our employees and customers. These laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. These laws and other developments relating to cross-border data transfer could result in increased costs of compliance and limitations on our customers and us. If we fail to comply with applicable laws and regulations, including the EU GDPR, CCPA, and other laws, we could be exposed to regulatory investigations and actions, lawsuits for breach of contract or to governmental or consumer claims, our customer relationships and reputation could be harmed, and we could be inhibited in our ability to obtain new customers. Compliance with these and new laws could involve substantial expenses and divert resources from other initiatives and projects. More restrictive privacy, data protection and cybersecurity laws adopted in the future could have an adverse impact on our business.

Current wording

As a provider of services to financial institutions, we may be bound by the same limitations on disclosure of the information we receive from our customers as apply to the financial institutions themselves. The processing of personal data and other types of information subjects us to a number of domestic and international laws that govern and regulate the processing of personal information and other types of protected data. These laws regulate and address a range of issues including data privacy (e.g., restrictions or technological or process requirements regarding the processing of data), cybersecurity (e.g., requirements for the protection of personal information against compromise of the confidentiality, integrity, or availability of personal information), breach notification, and data governance. These laws can vary substantially from jurisdiction to jurisdiction, and are rapidly evolving. We are subject to laws and regulations relating to the collection, use, retention, privacy, protection, security, and transfer of information, including personal information of our employees and customers. These laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. These laws and other developments relating to cross-border data transfer could result in increased costs of compliance and limitations on our customers and us. If we fail to comply with applicable laws and regulations, including the EU GDPR, DORA, CCPA, and other laws, we could be exposed to regulatory investigations and actions, lawsuits for breach of contract or to governmental or consumer claims, our customer relationships and reputation could be harmed, and we could be inhibited in our ability to obtain new customers. Compliance with these and new laws could involve substantial expenses and divert resources from other initiatives and projects. More restrictive privacy, data protection and cybersecurity laws adopted in the future could have an adverse impact on our business.

Previous wording

The U.S. Congress, the Organization for Economic Co-operation and Development (the “OECD”) and other government agencies in jurisdictions in which we do business remain focused on the taxation of multinational corporations. Under the OECD Inclusive Framework, over 140 countries have agreed to implement a two-pillar solution to address the challenges posed by the digitalization of the economy. The Pillar Two Framework (“Pillar Two”) introduces a 15% global minimum effective tax rate for certain multinational groups. Although the U.S. has not yet adopted Pillar Two into law, several countries in which we operate have enacted tax legislation based on the Pillar Two framework. We continue to evaluate the impact of these legislative changes as additional guidance becomes available. While Pillar Two did not significantly impact us in 2024, uncertainty remains regarding the implementation and impact of these initiatives, which could adversely affect our business or financial results in future years. Furthermore, our implementation of new practices and processes designed to comply with changing tax laws and regulations could require us to make substantial changes to our business practices, allocate additional resources, and increase our costs, which could negatively affect our business, results of operations, and financial condition.

Current wording

The U.S. Congress, the Organization for Economic Co-operation and Development (the “OECD”) and other government agencies in jurisdictions in which we do business remain focused on the taxation of multinational corporations. Under the OECD Inclusive Framework, over 140 countries have agreed to implement a two-pillar solution to address the challenges posed by the digitalization of the economy. The Pillar Two Framework (“Pillar Two”) introduces a 15% global minimum effective tax rate for certain multinational groups. Based on legislation enacted to date and currently available guidance, we have not recorded a material tax liability related to Pillar Two. However, these global minimum tax rules are new and technically complex, and governments continue to issue updates on how they should be interpreted and applied. Differences in how jurisdictions implement the rules, as well as future guidance from the OECD or taxing authorities, could change our tax obligations in future periods. We continue to evaluate the impact of these legislative changes as additional guidance becomes available. While Pillar Two did not significantly impact us in 2025, uncertainty remains regarding the implementation and impact of these initiatives, which could adversely affect our business or financial results in future years. Furthermore, our implementation of new practices and processes designed to comply with changing tax laws and regulations could require us to make substantial changes to our business practices, allocate additional resources, and increase our costs, which could negatively affect our business, results of operations, and financial condition.

Previous wording

Our credit facility and the indenture governing our 5.750% Senior Notes due 2026 (“2026 Notes”) contain customary affirmative and negative covenants for debt of these types that limit our ability to engage in specified types of transactions. If an event of default occurs, the lenders, trustee, or holders of the 2026 Notes will be entitled to take various actions, including, but not limited to, demanding payment for all amounts outstanding. If adverse global economic conditions persist or worsen, we could experience decreased revenues from our operations attributable to reduced demand for our products and services and as a result, we could fail to satisfy the financial and other restrictive covenants to which we are subject under our existing debt, resulting in an event of default. If we are unable to cure the default or obtain a waiver, we will not be able to access our credit facility and there can be no assurance that we would be able to obtain alternative financing. See Note 4, Debt, to our Notes to Consolidated Financial Statements in Part IV, Item 15 of this Form 10-K for additional information.

Current wording

Our credit facility contains customary affirmative and negative covenants for debt of these types that limit our ability to engage in specified types of transactions. If an event of default occurs, the lenders or trustees will be entitled to take various actions, including, but not limited to, demanding payment for all amounts outstanding. If adverse global economic conditions persist or worsen, we could experience decreased revenues from our operations attributable to reduced demand for our products and services and as a result, we could fail to satisfy the financial and other restrictive covenants to which we are subject under our existing debt, resulting in an event of default. If we are unable to cure the default or obtain a waiver, we will not be able to access our credit facility and there can be no assurance that we would be able to obtain alternative financing. See Note 3, Debt, to our Notes to Consolidated Financial Statements in Part IV, Item 15 of this Form 10-K for additional information.

Previous wording

Our level of debt could have adverse consequences for our business, financial condition, operating results and operational flexibility, including the following: (i) the debt level may cause us to have difficulty borrowing money in the future for working capital, capital expenditures, acquisitions or other purposes; (ii) our debt level may limit operational flexibility and our ability to pursue business opportunities and implement certain business strategies; (iii) we use a large portion of our operating cash flow to pay principal and interest on our credit facility and the 2026 Notes, which reduces the amount of money available to finance operations, acquisitions and other business activities; (iv) we have a higher level of debt than some of our competitors or potential competitors, which may cause a competitive disadvantage and may reduce flexibility in responding to changing business and economic conditions, including increased competition and vulnerability to general adverse economic and industry conditions; (v) some of our debt has a variable rate of interest, which exposes us to the risk of increased interest rates; (vi) there are significant maturities on our debt that we may not be able to fulfill or that may be refinanced at higher rates; and (vii) if we fail to satisfy our obligations under our outstanding debt or fail to comply with the financial or other restrictive covenants required under our credit facility and the 2026 Notes, an event of default could result that could cause all of our debt to become due and payable and could permit the lenders under our credit facility to foreclose on the assets securing such debt.

Current wording

Our level of debt could have adverse consequences for our business, financial condition, operating results and operational flexibility, including the following: (i) the debt level may cause us to have difficulty borrowing money in the future for working capital, capital expenditures, acquisitions or other purposes; (ii) our debt level may limit operational flexibility and our ability to pursue business opportunities and implement certain business strategies; (iii) we use a large portion of our operating cash flow to pay principal and interest on our credit facility, which reduces the amount of money available to finance operations, acquisitions and other business activities; (iv) we have a higher level of debt than some of our competitors or potential competitors, which may cause a competitive disadvantage and may reduce flexibility in responding to changing business and economic conditions, including increased competition and vulnerability to general adverse economic and industry conditions; (v) some of our debt has a variable rate of interest, which exposes us to the risk of increased interest rates; (vi) there are significant maturities on our debt that we may not be able to fulfill or that may be refinanced at higher rates; and (vii) if we fail to satisfy our obligations under our outstanding debt or fail to comply with the financial or other restrictive covenants required under our credit facility, an event of default could cause all of our debt to become due and payable and could permit the lenders under our credit facility to foreclose on the assets securing such debt.

Previous wording

Although the agreements governing our credit facility and our 2026 Notes include restrictions on our ability to incur additional debt, those agreements do not prohibit us from incurring additional debt or pursuing other financing arrangements. As a result, the amount of additional debt and other obligations that we could incur could be substantial. Accordingly, to the extent permitted under our credit agreement or indenture, we could incur significant additional debt, liabilities or similar obligations in the future. In addition, if we form or acquire any subsidiaries in the future, those subsidiaries also could incur debt or similar liabilities. If new debt or similar liabilities are added to our current debt levels, the related risks that we now face could increase.

Current wording

Although the agreements governing our credit facility include restrictions on our ability to incur additional debt, those agreements do not prohibit us from incurring additional debt or pursuing other financing arrangements. As a result, the amount of additional debt and other obligations that we could incur could be substantial. Accordingly, to the extent permitted under our credit agreement, we could incur significant additional debt, liabilities or similar obligations in the future. In addition, if we form or acquire any subsidiaries in the future, those subsidiaries also could incur debt or similar liabilities. If new debt or similar liabilities are added to our current debt levels, the related risks that we now face could increase.