ALKAMI TECHNOLOGY INC

Previous wording

•defects, errors or performance problems associated with our solutions;

Current wording

•defects, errors or other performance problems associated with our solutions;

Previous wording

•using open-source software in our solutions or risks resulting in the disclosure our proprietary source code to our clients;

Current wording

•using open-source software in our solutions or risks resulting in the disclosure of our proprietary source code to our clients;

Previous wording

•our limited operating history, our history of operating losses and our ability to use our net operating loss (“NOL”) carryforwards;

Current wording

•our limited operating history, our history of operating losses and our ability to use our net operating loss carryforwards;

Previous wording

•future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders;

Current wording

•future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders; and

Previous wording

We primarily serve our clients from third-party data center hosting facilities provided by Amazon Web Services (“AWS”). We rely upon AWS to operate certain aspects of our solutions, and any disruption of or interference with our use of AWS has in the past and could in the future impair our ability to deliver our solutions to our clients, resulting in client dissatisfaction, damage to our reputation, loss of clients and harm to our business. We have architected our solutions and computer systems to use data processing, storage capabilities and other services provided by AWS. Given this, we cannot easily switch our AWS operations to another cloud provider, so any disruption of or interference with our use of AWS could increase our operating costs and materially and adversely affect our business, financial condition and results of operations, and we might not be able to secure service from an alternative provider on similar terms.

Current wording

We primarily serve our clients from third-party data center hosting facilities provided by AWS. We rely upon AWS to operate certain aspects of our solutions, and any disruption of or interference with our use of AWS has in the past and could in the future impair our ability to deliver our solutions to our clients, resulting in client dissatisfaction, damage to our reputation, loss of clients and harm to our business. We have architected our solutions and computer systems to use data processing, storage capabilities and other services provided by AWS. Given this, we cannot easily switch our AWS operations to another cloud provider, so any disruption of or interference with our use of AWS could increase our operating costs and materially and adversely affect our business, financial condition and results of operations, and we might not be able to secure service from an alternative provider on similar terms.

Previous wording

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, Stephen Bohanon, our co-founder and Chief Strategy Officer, W. Bryan Hill, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. We also are dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients. We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause; however, our employment agreements with our named executive officers provide for the payment of severance under certain circumstances. We have also entered into employment agreements with our other executive officers which provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements. The loss of one or more of our key employees could harm our business.

Current wording

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, W. Bryan Hill, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. We are also dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients. We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause; however, our employment agreements with our named executive officers provide for the payment of severance under certain circumstances. We have also entered into employment agreements with our other executive officers that provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements. The loss of one or more of our key employees could harm our business.

Previous wording

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets. We also may enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies. Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control. In addition, we have limited experience in acquiring other businesses and the market reaction to our acquisitions may be unfavorable, which may impact our stock price. If an acquired business fails to meet our expectations, our business, financial condition and results of operations could be materially and adversely affected. We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target and we may not be successful in entering into an agreement with any particular target. If we are successful in acquiring an additional business, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

Current wording

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets. We may also enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies. Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control. In addition, we have limited experience in acquiring other businesses and the market reaction to our acquisitions may be unfavorable, which may impact our stock price. If an acquired business fails to meet our expectations, our business, financial condition and results of operations could be materially and adversely affected. We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target and we may not be successful in entering into an agreement with any particular target. If we are successful in acquiring an additional business, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

Previous wording

Any of our operating facilities or infrastructure may be harmed or rendered inoperable by natural or man-made disasters, including hurricanes, tornadoes, wildfires, floods, earthquakes, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks or pandemic events, such as the COVID-19 pandemic, power outages and other infrastructure failures, which may render it difficult or impossible for us to operate our business for some period of time. Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time. Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations. Moreover, although we have disaster recovery plans, they may prove inadequate. We may not carry sufficient business insurance to compensate for losses that may occur, and if such events become more frequent it may adversely impact the cost or availability of insurance going forward. Any such losses or damages could have a material adverse effect on our business and results of operations. In addition, the facilities of our third-party providers, including AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which could cause disruptions, difficulties or otherwise materially and adversely affect our business, financial condition and results of operations.

Current wording

Any of our operating facilities or infrastructure may be harmed or rendered inoperable by natural or man-made disasters, including hurricanes, tornadoes, wildfires, floods, earthquakes, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks or pandemic events, such as the COVID-19 pandemic, power outages and other infrastructure failures, which may render it difficult or impossible for us to operate our business for some period of time. Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time. Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations, and our disaster recovery plans may prove inadequate. We may not carry sufficient business insurance to compensate for losses that may occur, and if such events become more frequent it may adversely impact the cost or availability of insurance going forward. Any such losses or damages could have a material adverse effect on our business and results of operations. In addition, the facilities of our third-party providers, including AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which could cause disruptions, difficulties or otherwise materially and adversely affect our business, financial condition and results of operations.

Previous wording

A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients’ customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations.

Current wording

A breach or other compromise of our security measures or those of third parties we rely on could materially and adversely impact our reputation, business, financial condition and results of operations.

Previous wording

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely for on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third partners service providers, vendors, and business partners. In addition certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support. We, like other organizations, particularly in the financial technology sector, routinely are subject to and vulnerable to cybersecurity threats, privacy breaches, insider threats, data breaches or other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and may either result in threatened or actual exposure resulting in unauthorized access, disclosure and misuse of PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business, and our technologies, IT Systems and networks have been subject to attempted cybersecurity attacks. Information security risks for banking and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks. Additionally, geopolitical events and resulting government activity could also lead to information security threats and attacks by affected jurisdictions and their sympathizers.

Current wording

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third-party service providers, vendors, and business partners. In addition, certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support. We, like other organizations, particularly in the financial technology sector, are vulnerable to and have experienced cybersecurity attacks, insider threats and other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business. While to date no attacks or incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Information security risks for banking and technology companies such as ours have significantly increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks. Additionally, geopolitical events and resulting government activity also heighten information security threats and attacks by affected jurisdictions and their sympathizers.

Previous wording

Although we maintain policies, procedures and technological safeguards and administrative controls designed to protect our information technology system and applications, violations of such policies, procedures and safeguards have occurred in the past and, despite the security measures we have in place, there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations. Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, our technology may fail to adequately secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs we may incur to mitigate the consequences from such events. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Current wording

Violations of our policies, procedures and technological safeguards and administrative controls designed to protect our IT Systems and applications have occurred in the past, and there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations. Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, it is impossible to comprehensively secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs of mitigating the consequences from such events. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Previous wording

Further, the Alkami Digital Banking Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities that can lead to security breaches or incidents. We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations. We may be unable to anticipate or prevent techniques used to obtain unauthorized access or to sabotage systems, react in a timely manner or implement adequate preventative measures. Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients which may have access to PI and other data about our clients. Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information. Any of the foregoing could result in a material adverse effect on our business, reputation, financial condition and results of operations.

Current wording

Further, the Alkami Digital Banking Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities. And, given the scanning tools we deploy in our broader network environment, we regularly identify, track and patch security vulnerabilities but are unable to comprehensively apply patches or mitigating measures or ensure that patches or measures will be applied before vulnerabilities can be exploited by a threat actor. We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations. We cannot anticipate or prevent all techniques used by threat actors to obtain unauthorized access or to sabotage systems or implement adequate preventative measures. Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients, which have access to PI and other data about our clients. Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information. Any of the foregoing could result in a material adverse effect on our business, reputation, financial condition and results of operations.

Previous wording

In addition, because we leverage third-party providers, including cloud, software, data center and other critical technology vendors to deliver our solutions to our clients and their customers, we rely heavily on the data security technology practices and policies adopted by these third-party providers. Such third-party providers have access to PI and other data about our clients and employees, and some of these providers in turn subcontract with other third-party providers. Our ability to monitor our third-party providers’ data security is limited. A vulnerability in our third-party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions. Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are potentially vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Current wording

In addition, because we leverage third-party providers, including cloud, software, data center and other critical technology vendors to deliver our solutions to our clients and their customers, we rely heavily on the data security technology practices and policies adopted by these third-party providers. Such third-party providers have access to PI and other data about our clients and employees, and some of these providers in turn subcontract with other third-party providers. Our ability to monitor our third-party providers’ data security is limited. A vulnerability in our third- party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in a material compromise to the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions. Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Previous wording

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted. Furthermore, the use of generative artificial intelligence has made it easier for threat actors to develop and evolve attacks. Threats to our IT Systems and those of our third-party providers or clients may result from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. Current or future criminal capabilities, including by the use of generative artificial intelligence, discovery of existing or new vulnerabilities and attempts to exploit those vulnerabilities or other developments, may compromise or breach our IT Systems or solutions. In the event our or our third-party providers’ protection efforts are unsuccessful and our IT Systems or solutions are compromised, we could suffer substantial harm.

Current wording

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted. We have incorporated and may continue to incorporate artificial intelligence/machine learning solutions and features within our business, which may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents. Furthermore, the use of generative artificial intelligence has made it easier for threat actors to develop and evolve attacks. Threats to our IT Systems and those of our third-party providers or clients include those resulting from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. We have acquired and will likely continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to additional cybersecurity, operational, and financial risks.

Previous wording

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in operational disruptions and the loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations. Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations. Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating and remediating any information security vulnerabilities and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition and results of operations.

Current wording

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in material operational disruptions and the material loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations. Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations. Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating and remediating any information security vulnerabilities and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition and results of operations.

Previous wording

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or client customers could suffer harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes. In such cases, we could face exposure to legal claims, particularly if the client and/or client customer suffered actual harm. We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim. We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation and our business, financial condition and results of operations.

Current wording

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or clients’ customers could suffer material harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes. In such cases, we could face exposure to legal claims, particularly if the client and/or client customer suffered actual harm. We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim. We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation and our business, financial condition and results of operations.

Previous wording

In addition, our clients contractually require notification of certain data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meet certain service levels. In our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a client’s right to terminate its contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent clients from potentially terminating their contracts with us. Furthermore, although our client contracts typically include limitations on our potential liability, we cannot ensure that such limitations of liability would be adequate. We also cannot be sure that our existing general liability insurance coverage and coverage for errors or omissions will be available on acceptable terms or will be available in sufficient amounts to cover one or more claims, or that our insurers will not deny or attempt to deny coverage as to any future claim. The successful assertion of one or more claims against us, the inadequacy or denial of coverage under our insurance policies, litigation to pursue claims under our policies or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or coinsurance requirements, could materially and adversely affect our business, financial condition and results of operations.

Current wording

In addition, our clients contractually require notification of certain data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meet certain service levels. In our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a client’s right to terminate its contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent clients from potentially terminating their contracts with us.

Previous wording

Privacy and data security concerns, data collection and transfer restrictions, contractual obligations and U.S. and foreign laws, regulations and industry standards related to data privacy, security and protection could limit the use and adoption of the Alkami Digital Banking Platform and materially and adversely affect our business, financial condition and results of operations.

Current wording

Privacy and data security concerns, data collection and transfer restrictions, contractual obligations and U.S. and foreign laws, regulations and industry standards related to data privacy, security and protection could materially and adversely affect our business, financial condition and results of operations.

Previous wording

Data privacy, information security, and data protection are significant issues in the United States and globally. The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other PI, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. The occurrence of unanticipated events and development of evolving technologies often rapidly drives the adoption of legislation or regulation affecting the use, collection or other processing of data and manner in which we conduct our business. We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of information. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so. Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer protection-related laws, regulations, orders or industry standards in one or more jurisdictions could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations. The publication of our privacy policy and other documentation that provide promises and assurances about data privacy and security can subject us to potential global or U.S. state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices, which could materially and adversely affect our business, financial condition and results of operations.

Current wording

Data privacy, information security, and data protection are significant issues in the United States and globally. The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other PI, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. The occurrence of unanticipated events and development of evolving technologies often rapidly drives the adoption of legislation or regulation affecting the use, collection or other processing of data and manner in which we conduct our business. We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of information. We may at times fail to comply with our published policies and documents or be alleged to have failed to do so. Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer protection-related laws, regulations, orders or industry standards in one or more jurisdictions could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations. The publication of our privacy policy and other documentation that provide promises and assurances about data privacy and security can subject us to potential global or U.S. state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices, which could materially and adversely affect our business, financial condition and results of operations.

Previous wording

In addition, every state in which we operate (and the District of Columbia) has laws that protect the privacy and security of sensitive and personal information. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, California enacted the California Consumer Privacy Act of 2018 (“CCPA”) which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, the California Privacy Rights Act (“CPRA”), passed in November 2020, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also created a new state agency vested with authority to implement and enforce the CCPA and the CPRA. The effects of existing state legislation, including the CCPA and the CPRA, are significant and has required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

Current wording

In addition, every state in which we operate (and the District of Columbia) has laws that protect the privacy and security of sensitive and personal information. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, California enacted CCPA which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA also created a new state agency vested with authority to implement and enforce the CCPA. The effects of existing state legislation, including the CCPA, are significant and have required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

Previous wording

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns, the rapid and sustained increase in interest rates, exposure to loan assets and lending policies and the value, if any, of underlying collateral and increased regulation. In the recent past, FIs have experienced consolidation, distress and failure, and very few new FIs are being created. It is possible these conditions may continue into the future, and even if conditions improve for FIs, there can be no guarantee that these conditions will not reoccur. If any of our clients fail or merge with, or are acquired by, other entities, such as FIs that have internally developed banking technology solutions or that are not our clients or use our solutions less, our business, financial condition and results of operations could be materially and adversely affected. Additionally, changes in management of our clients could result in delays or cancellations of the implementation of our solutions. It is also possible that consolidation among FIs could decrease the number of registered users by causing registered users to opt for fewer and deeper FI relationships, and larger FIs that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions.

Current wording

We derive all of our revenues from FIs, whose industry has experienced significant pressure in recent years due to economic and political uncertainty, liquidity concerns, the rapid and sustained increase in interest rates, inflation, exposure to loan assets and lending policies and the value, if any, of underlying collateral and increased regulation. In the recent past, FIs have experienced consolidation, distress and failure, and very few new FIs are being created. It is possible these conditions may continue into the future, and even if conditions improve for FIs, there can be no guarantee that these conditions will not reoccur. If any of our clients fail or merge with, or are acquired by, other entities, such as FIs that have internally developed banking technology solutions or that are not our clients or use our solutions less, our business, financial condition and results of operations could be materially and adversely affected. Additionally, changes in management of our clients could result in delays or cancellations of the implementation of our solutions. It is also possible that consolidation among FIs could decrease the number of registered users by causing registered users to opt for fewer and deeper FI relationships, and larger FIs that result from business combinations could have greater leverage in negotiating price or other terms with us or could decide to replace some or all of the elements of our solutions.

Previous wording

The market for our solutions is characterized by rapid technological advancements, changes in client requirements and technologies, frequent new product introductions and enhancements and changing regulatory requirements. The life cycles of our solutions are difficult to estimate. Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our current market position. Other means of digital banking may be developed or adopted in the future, and our solutions may not be compatible with these new technologies. In addition, the technological needs of and services provided by, FIs may change if they or their competitors offer new services to account holders. Maintaining adequate research and development resources to meet the demands of the market is essential. The process of developing new technologies and solutions is complex and expensive. The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective.

Current wording

The market for our solutions is characterized by rapid technological advancements, changes in client requirements and technologies, frequent new product introductions and enhancements and changing regulatory requirements. The life cycles of our solutions are difficult to estimate. Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our current market position. Other means of digital banking may be developed or adopted in the future, and our solutions may not be compatible with these new technologies. In addition, the technological needs of and services provided by, FIs may change if they or their competitors offer new services to account holders. Maintaining adequate research and development resources to meet the demands of the market is essential. The process of developing new technologies and solutions is complex and expensive. The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies, such as artificial intelligence and machine learning technologies, or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective.

Previous wording

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address. As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the Federal Financial Institutions Examination Council (“FFIEC”), and we are also required to review and perform due diligence on certain of our third-party providers. Matters subject to review and examination by the FFIEC, federal and state regulatory agencies and external auditors include, but are not limited to, our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities and the design of our solutions, as well as our systems and technical infrastructure, our cybersecurity posture, our business recovery planning, our management and our financial condition. In addition, while we are not regulated by the National Credit Union Administration (“NCUA”), as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA. In addition, the Dodd-Frank Act granted the CFPB authority to promulgate rules and interpret certain federal consumer financial protection laws, some of which apply to the solutions we offer to our clients. In certain circumstances, the CFPB also has examination and supervision powers with respect to service providers who provide a material service to an FI offering consumer financial products and services. While many of our operations are not directly subject to the same regulations applicable to FIs, we are legally and contractually obligated to our clients to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them. Compliance with current or future digital accessibility, privacy, data protection and information security laws to which we or our FI clients are subject could result in higher compliance and technology costs and could restrict our ability to fully exploit our capabilities or provide certain products and services, which could materially and adversely affect our ability to operate profitably. Our failure to offer products and solutions that directly or indirectly comply with such laws, including as interpreted and applied by courts and regulators, could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions and damage to our reputation and our brand. In recent years, there has been increasing enforcement activity in the areas of digital accessibility, privacy, data protection and information security in various markets in which our customers operate.

Current wording

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address. As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the FFIEC, and we are also required to review and perform due diligence on certain of our third-party providers. Matters subject to review and examination by the FFIEC, federal and state regulatory agencies and external auditors include, but are not limited to, our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities and the design of our solutions, as well as our systems and technical infrastructure, our cybersecurity posture, our business recovery planning, our management and our financial condition. In addition, while we are not regulated by the NCUA, as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA. In addition, the Dodd-Frank Act granted the CFPB authority to promulgate rules and interpret certain federal consumer financial protection laws, some of which apply to the solutions we offer to our clients. In certain circumstances, the CFPB also has examination and supervision powers with respect to service providers who provide a material service to an FI offering consumer financial products and services. While many of our operations are not directly subject to the same regulations applicable to FIs, we are legally and contractually obligated to our clients to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them. Compliance with current or future digital accessibility, privacy, data protection and information security laws to which we or our FI clients are subject could result in higher compliance and technology costs and could restrict our ability to fully exploit our capabilities or provide certain products and services, which could materially and adversely affect our ability to operate profitably. Our failure to offer products and solutions that directly or indirectly comply with such laws, including as interpreted and applied by courts and regulators, could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions and damage to our reputation and our brand. In recent years, there has been increasing enforcement activity in the areas of digital accessibility, privacy, data protection and information security in various markets in which our customers operate.

Previous wording

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the Gramm-Leach-Bliley Act (“GLBA”) related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs. We may also be subject to other laws because of the solutions we provide to FIs. Any inability to satisfy regulatory or contractual expectations in connection with applicable regulations and guidance could adversely affect our ability to conduct our business, including attracting and maintaining clients, require significant costs to correct, harm our reputation, or lead to liability to third parties, including our customers or their consumers. Further, if we have to make changes to our internal processes and solutions as result of applicable regulations or guidance or findings from examinations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency or gap.

Current wording

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs. We may also be subject to other laws because of the solutions we provide to FIs. Any inability to satisfy regulatory or contractual expectations in connection with applicable regulations and guidance could adversely affect our ability to conduct our business, including attracting and maintaining clients, require significant costs to correct, harm our reputation, or lead to liability to third parties, including our customers or their consumers. Further, if we have to make changes to our internal processes and solutions as result of applicable regulations or guidance or findings from examinations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency or gap.

Previous wording

In addition, individual claimants and other third parties, including advocates for the blind or other persons with disabilities, have filed lawsuits or issued cease and desist requests to FIs, including our clients, on grounds that websites or mobile applications offered to consumers do not meet the needs of individuals with a disability within the meaning of Section 3(2) of the Americans with Disabilities Act of 1990, 42 U.S.C. §§ 12101, 12102(2) (“ADA”) and the Title III regulations implementing the ADA contained in 28 C.F.R. §§ 36.101, et seq. Third-party advocates and individuals with disabilities seek changes to existing law and regulation, or advocate for novel legal rulings in court, against FIs when desktop websites or mobile applications do not meet or exceed the Web Content Accessibility Guidelines 2.1 digital accessibility standard, which was developed in part to help ensure that the content developed for banks, credit unions and other financial institutions can be accessed and used by people with or without disabilities. The evolving, complex and often unpredictable regulatory and litigation environment in which our clients operate could result in our failure to provide compliant solutions, which could result in clients not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible or for which our clients may seek indemnity from us. In addition, federal, state and/or foreign agencies may attempt to further regulate our activities in the future which could materially and adversely affect our business, financial condition and results of operations. For example, existing laws, regulations and guidance could be amended or interpreted differently by regulators in a manner that imposes additional costs and has a negative impact on our existing operations or that limits our future growth. In addition, new regulations could require costly changes in our processes, infrastructure or personnel. Finally, actions by regulatory authorities could influence both the decisions our clients make concerning the purchase of our solutions and the timing and implementation of these decisions. Substantial research and development and other corporate resources have been and will continue to be applied to adapt our solutions to this evolving, complex and often unpredictable regulatory environment.

Current wording

In addition, individual claimants and other third parties, including advocates for the blind or other persons with disabilities, have filed lawsuits or issued cease and desist requests to FIs, including our clients, on grounds that websites or mobile applications offered to consumers do not meet the needs of individuals with a disability within the meaning of Section 3(2) of the Americans with Disabilities Act of 1990, 42 U.S.C. §§ 12101, 12102(2) (“ADA”) and the Title III regulations implementing the ADA contained in 28 C.F.R. §§ 36.101, et seq. Third-party advocates and individuals with disabilities seek changes to existing law and regulation, or advocate for novel legal rulings in court, against FIs when desktop websites or mobile applications do not meet or exceed the Web Content Accessibility Guidelines 2.1 digital accessibility standard, which was developed in part to help ensure that the content developed for banks, credit unions and other FIs can be accessed and used by people with or without disabilities. The evolving, complex and often unpredictable regulatory and litigation environment in which our clients operate could result in our failure to provide compliant solutions, which could result in clients not purchasing our solutions or terminating their contracts with us or the imposition of fines or other liabilities for which we may be responsible or for which our clients may seek indemnity from us. In addition, federal, state and/or foreign agencies may attempt to further regulate our activities in the future which could materially and adversely affect our business, financial condition and results of operations. For example, existing laws, regulations and guidance could be amended or interpreted differently by regulators in a manner that imposes additional costs and has a negative impact on our existing operations or that limits our future growth. In addition, new regulations could require costly changes in our processes, infrastructure or personnel. Finally, actions by regulatory authorities could influence both the decisions our clients make concerning the purchase of our solutions and the timing and implementation of these decisions. Substantial research and development and other corporate resources have been and will continue to be applied to adapt our solutions to this evolving, complex and often unpredictable regulatory environment.

Previous wording

Additionally, various factors outside our control pose a threat to our intellectual property rights, as well as to our products, services and technologies. For example, we may fail to obtain effective intellectual property protection, or the efforts we have taken to protect our intellectual property rights may not be sufficient or effective, and any of our intellectual property rights may be challenged, which could result in them being narrowed in scope or declared invalid or unenforceable. Despite our efforts to protect our proprietary rights, there can be no assurance our intellectual property rights will be sufficient to protect against others offering products or services that are substantially similar to ours and compete with our business or that unauthorized parties may attempt to copy aspects of our technology and use information that we consider proprietary. For example, it is possible that third parties, including our competitors, may obtain patents relating to technologies that overlap or compete with our technology. If third parties obtain patent protection with respect to such technologies, they may assert, and have in the past asserted, that our technology infringes their patents and seek to charge us a licensing fee or otherwise preclude the use of our technology or file suit against us. Additionally, unauthorized third parties may try to copy or reverse engineer portions of our products or otherwise obtain and use our intellectual property and other information that we regard as proprietary to create products and services that compete with ours.

Current wording

Additionally, various factors outside our control pose a threat to our intellectual property rights, as well as to our products, services and technologies. For example, we may fail to obtain effective intellectual property protection, or the efforts we have taken to protect our intellectual property rights may not be sufficient or effective, and any of our intellectual property rights may be challenged, which could result in them being narrowed in scope or declared invalid or unenforceable. There can be no assurance our intellectual property rights will be sufficient to protect against others offering products or services that are substantially similar to ours and compete with our business or that unauthorized parties may attempt to copy aspects of our technology and use information that we consider proprietary. For example, it is possible that third parties, including our competitors, may obtain patents relating to technologies that overlap or compete with our technology. If third parties obtain patent protection with respect to such technologies, they may assert, and have in the past asserted, that our technology infringes their patents and seek to charge us a licensing fee or otherwise preclude the use of our technology or file suit against us. Additionally, unauthorized third parties may try to copy or reverse engineer portions of our products or otherwise obtain and use our intellectual property and other information that we regard as proprietary to create products and services that compete with ours.

Previous wording

Additionally, in certain of our agreements with clients and licensors of software we use internally or license to our clients, we agree to indemnify them for losses related to, among other things, claims by third parties that our intellectual property infringes upon, misappropriates or violates the intellectual property of such third party. From time to time, clients or licensors have required, and may in the future require, us to indemnify them for such infringement, misappropriation or violation, breach of confidentiality or violation of applicable law, among other things. Although we normally seek to contractually limit our liability with respect to such obligations, some of these indemnity agreements may provide for uncapped liability and some indemnity provisions survive termination or expiration of the applicable agreement. Any legal claims from clients or other third parties could result in substantial liabilities, reputational harm, the delay or loss of market acceptance of our products, and could have adverse effects on our relationships with such clients and other third parties.

Current wording

Additionally, in certain of our agreements with clients and licensors of software we use internally or license to our clients, we agree to indemnify them for losses related to, among other things, claims by third parties that our intellectual property infringes upon, misappropriates or violates the intellectual property of such third party. From time to time, clients or licensors have required, and may in the future require, us to indemnify them for such infringement, misappropriation or violation, breach of confidentiality or violation of applicable law, among other things. Some of our indemnity agreements may provide for uncapped liability and some indemnity provisions survive termination or expiration of the applicable agreement. Any legal claims from clients or other third parties could result in substantial liabilities, reputational harm, the delay or loss of market acceptance of our products, and could have adverse effects on our relationships with such clients and other third parties.

Previous wording

We are subject to federal, state, and local income taxes. Our future effective tax rate could be affected by changes in the valuation of our deferred tax assets and liabilities, certain non-deductible expenses related to acquisitions, and changes in federal, state, or local tax laws or their interpretation. If such changes take place, there is a risk that our effective tax rate may be favorably or unfavorably affected, impacting our result of operations. Additionally, an increasing number of states have adopted laws or administrative practices that impose new taxes on all or a portion of gross revenue or impose additional tax collection obligations on out-of-state companies. Each jurisdiction has different rules and regulations governing sales and use, consumption, and similar taxes. These rules are subject to varying interpretation and could be changed, modified, or applied adversely to us as a result of factors outside of our control. One or more states where we do not collect taxes may successfully assert that such taxes are applicable, which could result in material tax assessments, including for past sales, as well as penalties and interest.

Current wording

We are subject to federal, state, and local income taxes. Our future effective tax rate could be affected by changes in the valuation of our deferred tax assets and liabilities, certain non-deductible expenses related to acquisitions, and changes in federal, state, or local tax laws or their interpretation. If such changes take place, there is a risk that our effective tax rate may be favorably or unfavorably affected, impacting our result of operations. The Trump administration has proposed a number of changes to the U.S. tax system. Many aspects of these proposals are unclear or undeveloped, and we are unable to predict which, if any, U.S. tax reform proposals will be enacted into law, and what effects any enacted legislation might have on our tax liabilities. Additionally, an increasing number of states have adopted laws or administrative practices that impose new taxes on all or a portion of gross revenue or impose additional tax collection obligations on out-of-state companies. Each jurisdiction has different rules and regulations governing sales and use, consumption, and similar taxes. These rules are subject to varying interpretation and could be changed, modified, or applied adversely to us as a result of factors outside of our control. One or more states where we do not collect taxes may successfully assert that such taxes are applicable, which could result in material tax assessments, including for past sales, as well as penalties and interest.

Previous wording

On June 27, 2023, the Company entered into a First Amendment (the “First Amendment”) to the Company’s Amended and Restated Credit Agreement dated as of April 29, 2022 (as amended by the First Amendment, the “Amended Credit Agreement”), with Silicon Valley Bank (“SVB”), Comerica Bank, and Canadian Imperial Bank of Commerce. The First Amendment, among other things, extended the maturity date of the Amended Credit Agreement to April 29, 2026. Our payment obligations under the Amended Credit Agreement reduce cash available to fund working capital, capital expenditures, research and development and other corporate purposes, and limit our ability to obtain additional financing for working capital, capital expenditures, expansion plans and other investments, which may in turn limit our ability to implement our business strategy, heighten our vulnerability to downturns in our business, the industry, or in the general economy, limit our flexibility in planning for, or reacting to, changes in our business and the industry and prevent us from taking advantage of business opportunities as they arise. In addition, indebtedness under the Amended Credit Agreement bears interest at a variable rate, making us vulnerable to increases in market interest rates. If market rates continue to increase, we will have to pay additional interest on this indebtedness, which would further reduce cash available for our other business needs.

Current wording

On July 1, 2024, the Company entered into a Second Amendment (the “Second Amendment”) to the Company’s Amended and Restated Credit Agreement dated as of April 29, 2022 (as amended, the “Amended Credit Agreement”), with Silicon Valley Bank (“SVB”), a division of First-Citizens Bank & Trust Company, as Administrative Agent, and the other lenders party thereto. The Second Amendment, among other things, extended the maturity date of the Amended Credit Agreement to April 29, 2027. Our payment obligations under the Amended Credit Agreement reduce cash available to fund working capital, capital expenditures, research and development and other corporate purposes, and limit our ability to obtain additional financing for working capital, capital expenditures, expansion plans and other investments, which may in turn limit our ability to implement our business strategy, heighten our vulnerability to downturns in our business, the industry, or in the general economy, limit our flexibility in planning for, or reacting to, changes in our business and the industry and prevent us from taking advantage of business opportunities as they arise. In addition, indebtedness under the Amended Credit Agreement bears interest at a variable rate, making us vulnerable to increases in market interest rates. If market rates continue to increase, we will have to pay additional interest on this indebtedness, which would further reduce cash available for our other business needs.

Previous wording

•our status as an emerging growth company;

Current wording

As a large accelerated filer, we are subject to certain disclosure and compliance requirements that apply to other public companies but did not previously apply to us due to our status as an emerging growth company. These requirements include, but are not limited to:

Previous wording

We are an “emerging growth company” as defined in the Jumpstart Our Business Startups Act (the “JOBS Act”). Under the JOBS Act, emerging growth companies can delay adopting new or revised accounting standards until such time as those standards apply to private companies. We have elected to use this extended transition period for complying with new or revised accounting standards that have different effective dates for public and private companies until the earlier of the date we (i) are no longer an emerging growth company or (ii) affirmatively and irrevocably opt out of the extended transition period provided in the JOBS Act. As a result, our consolidated financial statements may not be comparable to companies that comply with new or revised accounting pronouncements as of public company effective dates.

Current wording

•compliance with the required public company effective dates for any new or revised accounting standards;

Previous wording

Sales of a substantial number of shares of our common stock, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales might occur, could depress the market price of our common stock and impair our ability to raise capital through the sale of additional equity securities. We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

Current wording

Sales of a substantial number of shares of our common stock, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales might occur, could depress the market price of our common stock and impair our ability to raise capital through the sale of additional equity securities. For example, certain significant stockholders sold 5.0 million and 7.5 million shares of our common stock in separate underwritten secondary offerings in August 2024 and November 2024, respectively. We are unable to predict the effect that future sales may have on the prevailing market price of our common stock.

Previous wording

Our directors, officers and other principal stockholders, in the aggregate, beneficially owned approximately 56% of the outstanding shares of Alkami as of December 31, 2023. These stockholders currently have, and likely will continue to have, significant influence with respect to the election of our board of directors and approval or disapproval of all significant corporate actions. The concentrated voting power of these stockholders could have the effect of delaying or preventing a significant corporate transaction, including an acquisition, divestiture, or merger. This influence over our affairs could, under some circumstances, be adverse to the interests of the other stockholders.

Current wording

Our directors, officers and other principal stockholders, in the aggregate, beneficially owned approximately 32% of the outstanding shares of Alkami as of December 31, 2024. These stockholders currently have, and likely will continue to have, significant influence with respect to the election of our board of directors and approval or disapproval of all significant corporate actions. The concentrated voting power of these stockholders could have the effect of delaying or preventing a significant corporate transaction, including an acquisition, divestiture, or merger. This influence over our affairs could, under some circumstances, be adverse to the interests of the other stockholders.