ALKAMI TECHNOLOGY, INC.

Previous wording

•the unpredictable and time-consuming nature of our sales cycles;

Current wording

•the unpredictable, time-consuming and costly nature of our sales cycles;

Previous wording

•privacy and data security concerns, laws, regulations and standards and our processing and use of the PI of end users;

Current wording

•privacy and data security concerns, data collection and transfer restrictions, contractual obligations, laws, regulations and standards and our processing and use of the PI of end users;

Previous wording

•regulations and laws applicable to us, our clients and our solutions;

Current wording

•regulations and laws applicable to us, our clients and our solutions, including the impact of tariffs and trade policies on us and our clients;

Previous wording

•the way we recognize revenue, which has the effect of delaying changes in the subscriptions for our solutions from being reflected in our operating results;

Current wording

•the way we recognize revenue, beginning from the live use of the service, which causes changes in client subscriptions to not be immediately apparent in our reported operating results;

Previous wording

•our ability to raise sufficient capital and the resulting dilution and the terms of our Amended Credit Agreement (as defined below);

Current wording

•our ability to raise sufficient capital in a timely manner and the resulting dilution and the terms of our Amended Credit Agreement (as defined below);

Previous wording

•future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders; and

Current wording

•future sales of shares of our common stock, our lack of an intention to pay dividends and significant influence of our principal stockholders;

Previous wording

•anti-takeover and exclusive forum provisions in our governing documents.

Current wording

•provisions in the Indenture (as defined below) delaying or preventing beneficial takeover and anti-takeover and exclusive forum provisions in our governing documents;

Previous wording

To increase our revenues, we will need to continue to attract new clients and succeed in having our current clients expand the use of our solutions across their institutions. In addition, for us to maintain or improve our results of operations, it is important that our clients renew their subscriptions with us on similar or more favorable terms to us when their existing subscription term expires. Our revenue growth rates may decline or fluctuate as a result of a number of factors, including client spending levels, client dissatisfaction with our solutions, decreases in the number of client customers, changes in the type and size of our clients, pricing changes, competitive conditions, the loss of our clients to other competitors and general economic conditions. We cannot assure you that our current clients will renew or expand their use of our solutions. If we are unable to attract new clients or retain or attract new business from current clients, our business, financial condition and results of operations may be materially and adversely affected. The growth of our business also depends on our ability to develop and maintain resale agreements with favorable terms for third-party solutions through our digital banking platform agreements. If we are unable to develop and maintain such resale agreements, our business, financial condition and results of operations may be materially and adversely affected.

Current wording

To increase our revenues, we will need to continue to attract new clients and succeed in having our current clients expand the use of our solutions across their institutions. In addition, for us to maintain or improve our results of operations, it is important that our clients renew their subscriptions with us on similar or more favorable terms to us when their existing subscription term expires. Our revenue growth rates may decline or fluctuate as a result of a number of factors, including client spending levels, client dissatisfaction with our solutions, decreases in the number of client customers or members, changes in the type and size of our clients, pricing changes, competitive conditions, the loss of our clients to other competitors and general economic conditions. We cannot assure you that our current clients will renew or expand their use of our solutions. If we are unable to attract new clients or retain or attract new business from current clients, our business, financial condition and results of operations may be materially and adversely affected. The growth of our business also depends on our ability to develop and maintain resale agreements with favorable terms for third-party solutions through our Digital Sales and Service Platform agreements. If we are unable to develop and maintain such resale agreements, our business, financial condition and results of operations may be materially and adversely affected.

Previous wording

We believe that a strong brand is necessary to continue to attract and retain clients. We need to maintain, protect and enhance our brand in order to expand our base of clients. This will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable services that continue to meet the needs of our clients at competitive prices, our ability to maintain our clients’ trust, our ability to continue to develop new functionality and use cases, and our ability to successfully differentiate our services and platform capabilities from competitive products and services, which we may not be able to do effectively. While we may choose to engage in a broader marketing campaign to further promote our brand, this effort may not be successful or cost effective. Our brand promotion activities may not generate customer awareness or yield increased revenues, and even if they do, any increased revenues may not offset the expenses we incur in building our brand. If we are unable to maintain or enhance client awareness in a cost-effective manner, our brand and our business, financial condition and results of operations could be materially and adversely affected.

Current wording

We believe that a strong brand is necessary to continue to attract and retain clients. We need to maintain, protect and enhance our brand in order to expand our base of clients. This will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable services that continue to meet the needs of our clients at competitive prices, our ability to maintain our clients’ trust, our ability to continue to develop new functionality and use cases, and our ability to successfully differentiate our services and platform capabilities from competitive products and services, which we may not be able to do effectively. While we may choose to engage in a broader marketing campaign to further promote our brand, this effort may not be successful or cost effective. Our brand promotion activities may not generate client awareness or yield increased revenues, and even if they do, any increased revenues may not offset the expenses we incur in building our brand. If we are unable to maintain or enhance client awareness in a cost-effective manner, our brand and our business, financial condition and results of operations could be materially and adversely affected.

Previous wording

The Alkami Digital Banking Platform integrates with other third-party systems used by our clients, including core processing and payment systems. We do not have formal arrangements with many of these third-party providers regarding our access to their application program interfaces to enable these client integrations. If we are unable to effectively integrate with third-party systems, our clients’ operations may be disrupted, which could result in disputes with clients, negatively impact client satisfaction and materially and adversely affect our business, financial condition and results of operations. Additionally, if we are unable to address our clients’ needs or preferences in a timely fashion or further develop and enhance our solutions, or if a client is not satisfied with the quality of work performed by us or with the technical support services rendered, we could incur additional costs to address the situation, and clients’ dissatisfaction with our solutions could damage our ability to maintain or expand our client base. If the software of such third-party providers has performance or other problems, such issues may reflect poorly on us and the adoption and renewal of our solutions, which could significantly harm our reputation. Moreover, any negative publicity related to our solutions, regardless of its accuracy or whether the ultimate cause of any poor performance actually results from our products or from the systems of our clients, may further damage our business by affecting our reputation and may materially and adversely affect our business, financial condition and results of operations.

Current wording

The Alkami Digital Sales & Service Platform integrates with other third-party systems used by our clients, including core processing and payment systems. We do not have formal arrangements with many of these third-party providers regarding our access to their application program interfaces to enable these client integrations. If we are unable to effectively integrate with third-party systems, our clients’ operations may be disrupted, which could result in disputes with clients, negatively impact client satisfaction and materially and adversely affect our business, financial condition and results of operations. Additionally, if we are unable to address our clients’ needs or preferences in a timely fashion or further develop and enhance our solutions, or if a client is not satisfied with the quality of work performed by us or with the technical support services rendered, we could incur additional costs to address the situation, and clients’ dissatisfaction with our solutions could damage our ability to maintain or expand our client base. If the software of such third-party providers has performance or other problems, such issues may reflect poorly on us and the adoption and renewal of our solutions, which could significantly harm our reputation. Moreover, any negative publicity related to our solutions, regardless of its accuracy or whether the ultimate cause of any poor performance actually results from our products or from the systems of our clients, may further damage our business by affecting our reputation and may materially and adversely affect our business, financial condition and results of operations.

Previous wording

Our business, financial condition and results of operations could be materially and adversely affected if our clients are not satisfied with our digital banking solutions or our systems and infrastructure fail to meet their needs.

Current wording

If our clients are not satisfied with our digital banking solutions or our systems and infrastructure fail to meet their needs, our business, financial condition and results of operations could be materially and adversely affected.

Previous wording

Our business depends on our ability to satisfy our clients and meet their digital banking needs. Our clients use a variety of network infrastructure, hardware and software, and our digital banking solutions must support the specific configuration of our clients’ existing systems, including in many cases the solutions of third-party providers. Our implementation expenses increase when clients have unexpected data, network infrastructure, hardware or software technology challenges, or complex or unanticipated business or regulatory requirements. In addition, our clients typically require complex acceptance testing related to the implementation of our solutions. Implementation delays may also require us to delay revenue recognition under the related sales agreement longer than expected. Further, because we do not fully control our clients’ implementation schedules, if our clients do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties as a result of expansions of project scope or otherwise, our revenue recognition may be delayed.

Current wording

Our business depends on our ability to satisfy our clients and meet their digital banking needs. Our clients use a variety of network infrastructure, hardware and software, and our digital banking solutions must support the specific configuration of our clients’ existing systems, including in many cases the solutions of third-party providers.

Previous wording

Further, any failure of or delays in our systems could cause service interruptions or impaired system performance. Some of our client agreements require us to issue credits for downtime in excess of certain thresholds and in some instances give our clients the ability to terminate their agreements with us in the event of significant amounts of downtime. If sustained or repeated, these performance issues could reduce the attractiveness of our solutions to new and existing clients, cause us to lose clients, decrease our revenues and lower our renewal rates by existing clients, each of which could materially and adversely affect our business, financial condition and results of operations. In addition, negative publicity resulting from issues related to our client relationships, regardless of accuracy, may adversely affect our ability to attract new clients and maintain and expand our relationships with existing clients.

Current wording

Any failure of or delays in our systems could cause service interruptions or impaired system performance. Some of our client agreements require us to issue credits for downtime in excess of certain thresholds and in some instances give our clients the ability to terminate their agreements with us in the event of significant amounts of downtime. If sustained or repeated, these performance issues could reduce the attractiveness of our solutions to new and existing clients, cause us to lose clients, decrease our revenues and lower our renewal rates by existing clients, each of which could materially and adversely affect our business, financial condition and results of operations. In addition, negative publicity resulting from issues related to our client relationships, regardless of accuracy, may adversely affect our ability to attract new clients and maintain and expand our relationships with existing clients.

Previous wording

Defects, errors or other performance problems in the Alkami Digital Banking Platform could harm our reputation, result in significant costs to us, impair our ability to sell our solutions and subject us to substantial liability.

Current wording

Defects, errors or other performance problems in the Alkami Digital Sales & Service Platform could harm our reputation, result in significant costs to us, impair our ability to sell our solutions and subject us to substantial liability.

Previous wording

The Alkami Digital Banking Platform is complex and may contain defects or errors when implemented or when new functionality is released, or when we modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends. From time to time, we have discovered, and may in the future discover, defects or errors in our solutions. Any performance problems or defects in our solutions could materially and adversely affect our business, financial condition and results of operations. Defects, errors or other similar performance problems or disruptions, whether in connection with day-to-day operations or otherwise, could be costly for us, damage our clients’ businesses, harm our reputation and result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. In addition, if we have any such errors, defects or other performance problems, our clients could seek to terminate their contracts, elect not to renew their subscriptions, delay or withhold payment or make claims against us. Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations. Additionally, our software utilizes open-source software and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, financial condition and results of operations.

Current wording

The Alkami Digital Sales & Service Platform is complex and may contain defects or errors when implemented or when new functionality is released, or when we modify, enhance, upgrade and implement new systems, procedures and controls to reflect changes in our business, technological advancements and changing industry trends. From time to time, we have discovered, and may in the future discover, defects or errors in our solutions. Any performance problems or defects in our solutions could materially and adversely affect our business, financial condition and results of operations. Defects, errors or other similar performance problems or disruptions, whether in connection with day-to-day operations or otherwise, could be costly for us, damage our clients’ businesses, harm our reputation and result in reduced sales or a loss of, or delay in, the market acceptance of our solutions. In addition, if we have any such errors, defects or other performance problems, our clients could seek to terminate their contracts, elect not to renew their subscriptions, delay or withhold payment or make claims against us. Any of these actions could result in liability, lost business, increased insurance costs, difficulty in collecting accounts receivable, costly litigation or adverse publicity, which could materially and adversely affect our business, financial condition and results of operations. Additionally, our software utilizes open-source software and any defects or security vulnerabilities in such open-source software could materially and adversely affect our business, financial condition and results of operations.

Previous wording

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, W. Bryan Hill, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. We are also dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients. We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause; however, our employment agreements with our named executive officers provide for the payment of severance under certain circumstances. We have also entered into employment agreements with our other executive officers that provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements. The loss of one or more of our key employees could harm our business.

Current wording

Our success and future growth depend upon the continued services of our management team, in particular Alex Shootman, our Chief Executive Officer, Cassandra Hudson, our Chief Financial Officer, and other key employees, including in the areas of research and development, marketing, sales, services and general and administrative functions. From time to time, there may be changes in our management team resulting from the hiring or departure of executives, which could disrupt our business. We are also dependent on the continued service of our existing development professionals because of the complexity of our solutions, including complexity arising as a result of the regulatory requirements that are applicable to our clients and, to a lesser extent, us, and the pace of technology changes impacting our clients. We may terminate any employee’s employment at any time, with or without cause, and any employee may resign at any time, with or without cause; however, our employment agreements with our named executive officers provide for the payment of severance under certain circumstances. We have also entered into employment agreements with our other executive officers that provide for the payment of severance under similar circumstances as in our named executive officers’ employment agreements. The loss of one or more of our key employees could harm our business.

Previous wording

From time to time we face unexpected challenges related to the complexity of our clients’ integration and functionality requirements. Our expenses increase when clients have unexpected data, hardware or software technology challenges, or complex or unanticipated functionality requirements. In addition, our clients typically require complex acceptance testing related to the implementation of our solutions. Implementation delays may also require us to delay revenue recognition under the related client agreement longer than expected. Further, because we do not fully control our clients’ implementation schedules, if our clients do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties as a result of expansions of project scope or otherwise, our revenue recognition may be delayed and in certain circumstances, we may never recognize the revenue. Losses of registered users or any difficulties or delays in implementation processes could cause clients to delay or forego the implementation or future purchases of our solutions, which could materially and adversely affect our business, financial condition and results of operations.

Current wording

From time to time we face unexpected challenges related to the complexity of our clients’ integration and functionality requirements. Our expenses increase when clients have unexpected data, hardware or software technology challenges, or complex or unanticipated functionality requirements. In addition, our clients typically require complex acceptance testing related to the implementation of our solutions. Implementation delays, whether from implementation challenges or our strategic decisions, may also require us to delay revenue recognition under the related client agreement longer than expected. Further, because we do not fully control our clients’ implementation schedules, if our clients do not allocate the internal resources necessary to meet implementation timelines or if there are unanticipated implementation delays or difficulties as a result of expansions of project scope or otherwise, our revenue recognition may be delayed and in certain circumstances, we may never recognize the revenue. Losses of registered users or any difficulties or delays in implementation processes could cause clients to delay or forego the implementation or future purchases of our solutions, which could materially and adversely affect our business, financial condition and results of operations.

Previous wording

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets. We may also enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies. Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to approvals that are beyond our control. In addition, we have limited experience in acquiring other businesses and the market reaction to our acquisitions may be unfavorable, which may impact our stock price. If an acquired business fails to meet our expectations, our business, financial condition and results of operations could be materially and adversely affected. We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target and we may not be successful in entering into an agreement with any particular target. If we are successful in acquiring an additional business, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

Current wording

We have in the past executed and we may in the future consider executing, strategic transactions, including acquisitions of, or investments in, businesses, technologies, services, solutions and other assets. We may also enter into relationships with other businesses to expand our solutions, which could involve preferred or exclusive licenses, additional channels of distribution, discount pricing or investments in other companies. Negotiating these transactions can be time-consuming, difficult and expensive, and our ability to close these transactions may be subject to conditions that are beyond our control. In addition, we have limited experience in acquiring other businesses, and the market reaction to our acquisitions may be unfavorable, which may impact our stock price. If an acquired business fails to meet our expectations, our business, financial condition and results of operations could be materially and adversely affected. We may not be able to find and identify desirable acquisition targets, we may incorrectly estimate the value of an acquisition target, and we may not be successful in entering into an agreement with any particular target. If we are successful in acquiring an additional business, we may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

Previous wording

•our inability to integrate or benefit from acquired technologies or services;

Current wording

•an inability to integrate or benefit from acquired technologies or services;

Previous wording

Any of our operating facilities or infrastructure may be harmed or rendered inoperable by natural or man-made disasters, including hurricanes, tornadoes, wildfires, floods, earthquakes, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks or pandemic events, such as the COVID-19 pandemic, power outages and other infrastructure failures, which may render it difficult or impossible for us to operate our business for some period of time. Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time. Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations, and our disaster recovery plans may prove inadequate. We may not carry sufficient business insurance to compensate for losses that may occur, and if such events become more frequent it may adversely impact the cost or availability of insurance going forward. Any such losses or damages could have a material adverse effect on our business and results of operations. In addition, the facilities of our third-party providers, including AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which could cause disruptions, difficulties or otherwise materially and adversely affect our business, financial condition and results of operations.

Current wording

Any of our operating facilities or infrastructure may be harmed or rendered inoperable by natural or man-made disasters, including hurricanes, tornadoes, wildfires, floods, earthquakes, nuclear disasters, acts of terrorism or other criminal activities, infectious disease outbreaks or pandemic events, such as the COVID-19 pandemic, power outages and other infrastructure failures, which may render it difficult or impossible for us to operate our business for some period of time. Various environmental and social pressures, including climate change, may increase the frequency or intensity of such disasters or contribute to chronic changes that may have similar impacts. Our facilities would likely be costly to repair or replace, and any such efforts would likely require substantial time. Any disruptions in our operations could harm our reputation and materially and adversely affect our business, financial condition and results of operations, and our disaster recovery plans may prove inadequate. We may not carry sufficient business insurance to compensate for losses that may occur, and if such events become more frequent it may adversely impact the cost or availability of insurance going forward. Any such losses or damages could have a material adverse effect on our business and results of operations. In addition, the facilities of our third-party providers, including AWS, may be harmed or rendered inoperable by such natural or man-made disasters, which could cause disruptions, difficulties or otherwise materially and adversely affect our business, financial condition and results of operations.

Previous wording

We have expanded our presence abroad by establishing a subsidiary in India during 2024. While its operations are currently immaterial, we may face challenges related to regulatory compliance, tax implications, labor laws, currency fluctuations, and operational scaling in the future. Our current and potential future operations in India are subject to certain risks, including:

Current wording

We have expanded our presence abroad by establishing a subsidiary in India during 2024. We may face challenges related to regulatory compliance, tariffs, tax implications, labor laws, currency fluctuations, and operational scaling in the future. Our current and potential future operations in India are subject to certain risks, including:

Previous wording

There is increased scrutiny from investors, customers, policymakers, and other stakeholders regarding companies’ management of climate change, human capital, and various other environmental and social matters. While we may from time to time engage in initiatives to manage such matters and address stakeholder expectations, such initiatives can be costly and may not have the desired effect. For example, many environmental and social initiatives leverage methodologies, standards, and data that are complex and continue to evolve. Moreover, various stakeholders have different, and at times conflicting, expectations. Regulatory expectations are likewise not uniform, which may increase the cost or complexity of compliance. Addressing stakeholder expectations can result in a diversion of resources and management attention, and any failure to successfully navigate such expectations, as well as evolving interpretations of any existing governmental laws or requirements, may result in reputational harm, issues attracting and retaining employees or customers, regulatory or investor engagement, or other adverse impacts to our business.

Current wording

There is increased scrutiny from investors, clients, policymakers, and other stakeholders regarding companies’ management of climate change, human capital, and various other environmental and social matters. While we may from time to time engage in initiatives to manage such matters and address stakeholder expectations, such initiatives can be costly and may not have the desired effect. For example, many environmental and social initiatives leverage methodologies, standards, and data that are complex and continue to evolve. Moreover, various stakeholders have different, and at times conflicting, expectations. Regulatory expectations are likewise not uniform, which may increase the cost or complexity of compliance. Addressing stakeholder expectations can result in a diversion of resources and management attention, and any failure to successfully navigate such expectations, as well as evolving interpretations of any existing governmental laws or requirements, may result in reputational harm, issues attracting and retaining employees or clients, regulatory or investor engagement, or other adverse impacts to our business.

Previous wording

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third-party service providers, vendors, and business partners. In addition, certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support. We, like other organizations, particularly in the financial technology sector, are vulnerable to and have experienced cybersecurity attacks, insider threats and other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and PI or other information regarding clients, client customers, vendors, employees, third-party providers, or our company and business. While to date no attacks or incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Information security risks for banking and technology companies such as ours have significantly increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks. Additionally, geopolitical events and resulting government activity also heighten information security threats and attacks by affected jurisdictions and their sympathizers.

Current wording

We rely heavily on hardware, software, technology infrastructure, digital networks and a range of other information technology systems for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on IT Systems and related services that are operated, managed, integrated or otherwise provided by a host of third-party service providers, vendors, and business partners. In addition, certain elements of our solutions process and store PI, including banking and payment data and other PI regarding our clients’ customers or members, such as social security numbers, and we may also have access to PI during various stages of the implementation process or during the course of providing client support. We, like other organizations, particularly in the financial technology sector, are vulnerable to and have experienced cybersecurity attacks, insider threats and other incidents that threaten the confidentiality, integrity and availability of critical IT Systems and PI or other information regarding clients, client customers or members, vendors, employees, third-party providers, or our company and business. While to date no attacks or incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Information security risks for banking and technology companies such as ours have significantly increased in recent years, in part because of the proliferation of new technologies, such as AI, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Because of our position in the financial services industry, we expect to continue to be a target of such threats and attacks. Additionally, geopolitical events and resulting government activity also heighten information security threats and attacks by affected jurisdictions and their sympathizers.

Previous wording

Violations of our policies, procedures and technological safeguards and administrative controls designed to protect our IT Systems and applications have occurred in the past, and there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations. Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, it is impossible to comprehensively secure IT Systems or the data and PI we maintain in our databases, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs of mitigating the consequences from such events. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Current wording

Violations of our policies, procedures and technological safeguards and administrative controls designed to protect our IT Systems and applications have occurred in the past, and there can be no assurance that our cybersecurity risk management program and processes (or those of our third-party providers or partners) will prevent damage to, or interruption or breach of, our IT Systems and operations. Given the unpredictability of the timing, nature and scope of cybersecurity attacks and other security-related incidents, it is impossible to comprehensively secure IT Systems or the data and PI we maintain or use in our business, and we cannot entirely eliminate the risk of improper or unauthorized access to or disclosure of data or PI, other security events that impact the confidentiality, integrity or availability of data, PI or our IT Systems, or the related costs of mitigating the consequences from such events. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover all losses or that relevant insurance will be available in the future on economic terms or at all.

Previous wording

Further, the Alkami Digital Banking Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities. And, given the scanning tools we deploy in our broader network environment, we regularly identify, track and patch security vulnerabilities but are unable to comprehensively apply patches or mitigating measures or ensure that patches or measures will be applied before vulnerabilities can be exploited by a threat actor. We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer PI or other data and disruption of our or our clients’ operations. We cannot anticipate or prevent all techniques used by threat actors to obtain unauthorized access or to sabotage systems or implement adequate preventative measures. Additionally, we and client customers integrate our solutions with certain third-party systems used by our clients, which have access to PI and other data about our clients. Our ability to monitor such third parties’ security measures is limited, and a vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ PI and other data, including our business information. Any of the foregoing could result in a material adverse effect on our business, reputation, financial condition and results of operations.

Current wording

Further, the Alkami Digital Sales & Service Platform involves flexible and complex software solutions, which by their very nature are subject to misconfigurations, implementation errors, “bugs,” defects or other security vulnerabilities. And, given the scanning tools we deploy in our broader network environment, we regularly identify, track and patch security vulnerabilities but are unable to comprehensively apply patches or mitigating measures or ensure that patches or measures will be applied before vulnerabilities can be exploited by a threat actor. We have experienced unlawful attempts to disrupt or gain access to our IT Systems, and we are vulnerable to future attacks that may result in unauthorized access to or disclosure of client customer or member PI or other data and disruption of our or our clients’ operations. We cannot anticipate or prevent all techniques used by threat actors to obtain unauthorized access or to sabotage systems or implement adequate preventative measures. Additionally, we and client customers or members integrate our solutions with certain third-party systems used by our clients, which have access to PI and other data about our clients. Our ability to monitor such third parties’ security measures is limited, and an exploited vulnerability in a third-party system with which we integrate could result in a disruption to our IT Systems or unauthorized access to or disclosure, modification, misuse, loss or destruction of our clients’ and client customers’ or members’ PI and other data, including our business information. Any of the foregoing could result in a material adverse effect on our business, reputation, financial condition and results of operations.

Previous wording

In addition, because we leverage third-party providers, including cloud, software, data center and other critical technology vendors to deliver our solutions to our clients and their customers, we rely heavily on the data security technology practices and policies adopted by these third-party providers. Such third-party providers have access to PI and other data about our clients and employees, and some of these providers in turn subcontract with other third-party providers. Our ability to monitor our third-party providers’ data security is limited. A vulnerability in our third- party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in a material compromise to the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions. Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations.

Current wording

In addition, because we leverage third-party providers, including cloud, software, data center and other critical technology vendors to deliver our solutions to our clients and their customers or members, we rely heavily on the data security technology practices and policies adopted by these third-party providers. Such third-party providers have access to PI and other data about our clients and employees, and some of these providers in turn subcontract with other third-party providers. Our ability to monitor our third-party providers’ data security is limited. An exploited vulnerability in our third-party providers’ software or systems, a failure of our third-party providers’ safeguards, policies or procedures, or a breach of a third-party provider’s software or systems could result in a material compromise to the confidentiality, integrity or availability of our IT Systems or the data housed in our third-party solutions. Due to the size and complexity of our technology platform and services, the amount of PI and other data that we store and the number of clients, employees and third-party providers with access to PI and other data, we are vulnerable to a variety of cybersecurity attacks and other security-related incidents and threats, which could result in a material adverse effect on our business, financial condition and results of operations. In addition, we have acquired and continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to significant cybersecurity risks.

Previous wording

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted. We have incorporated and may continue to incorporate artificial intelligence/machine learning solutions and features within our business, which may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents. Furthermore, the use of generative artificial intelligence has made it easier for threat actors to develop and evolve attacks. Threats to our IT Systems and those of our third-party providers or clients include those resulting from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. We have acquired and will likely continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to additional cybersecurity, operational, and financial risks.

Current wording

Cybersecurity attacks and other malicious internet-based activity continue to increase, evolve in nature and become more sophisticated, and providers of digital products and services have been and are expected to continue to be targeted. We have incorporated and will likely continue to incorporate AI/machine learning solutions and features within our business, which gives rise to additional and evolving cybersecurity risks. Furthermore, the use of generative AI has made it easier for threat actors to develop and evolve attacks. Threats to our IT Systems and those of our third-party providers or clients include those resulting from human error, fraud or malice on the part of employees or third parties, including state-sponsored organizations with significant financial and technological resources, or from accidental technological failure. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing, ransomware, social engineering attacks, employee theft, unauthorized access or misuse and denial-of-service attacks, sophisticated criminal networks as well as nation-state and nation-state supported actors now engage in attacks, including advanced persistent threat intrusions. We have acquired and will likely continue to acquire companies with cybersecurity vulnerabilities and/or unsophisticated security measures, which exposes us to additional cybersecurity, operational, and financial risks.

Previous wording

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in material operational disruptions and the material loss, compromise or corruption of client or client customer data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations. Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations. Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating and remediating any information security vulnerabilities and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition and results of operations.

Current wording

Any cybersecurity attacks, security breaches, phishing attacks, ransomware attacks, computer malware, computer viruses, computer hacking attacks, unauthorized access, coding or configuration errors or similar incidents experienced by us or our third-party providers could result in material operational disruptions and the material loss, compromise or corruption of client or client customer or member data (including PI) or data we rely on to provide our solutions, including our analytics initiatives and offerings, and impair our ability to provide our solutions and meet our clients’ requirements, resulting in decreased revenues and otherwise adversely affecting our business, financial condition and results of operations. Any such incidents may also result in regulatory investigations and orders, litigation (including class actions), disputes, investigations, indemnity obligations, damages for contract breach or penalties for violation of applicable laws or regulations. Also, our reputation could suffer irreparable harm, causing our current and prospective clients to decline to use our solutions in the future. Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs by deploying additional personnel and modifying or enhancing our protection technologies, investigating and remediating any information security vulnerabilities and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition and results of operations.

Previous wording

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or clients’ customers could suffer material harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes. In such cases, we could face exposure to legal claims, particularly if the client and/or client customer suffered actual harm. We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim. We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation and our business, financial condition and results of operations.

Current wording

If we are not able to detect and identify activity on our platform that might be nefarious in nature or design processes or systems to reduce the impact of similar activity at a third-party provider, our clients and/or clients’ customers or members could suffer material harm, including because many of our products and services are integrated with or connected to our clients’ systems and processes. In such cases, we could face exposure to legal claims, particularly if the client and/or client customer or member suffered actual harm. We cannot ensure that any limitations of liability provisions in our client and user agreements, contracts with third-party providers and other contracts for a security lapse or breach or other security-related matter would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim. We also cannot ensure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident or breach, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation and our business, financial condition and results of operations.

Previous wording

In addition, our clients contractually require notification of certain data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meet certain service levels. In our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a client’s right to terminate its contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent clients from potentially terminating their contracts with us.

Current wording

In addition, our clients contractually require notification of certain data security compromises and include representations and warranties in their contracts with us that our solutions comply with certain legal and technical standards related to data security and privacy and meet certain service levels. In our contracts, a data security compromise or operational disruption impacting us or one of our critical vendors, or system unavailability or damage due to other circumstances, may constitute a material breach and give rise to a client’s right to terminate its contract with us. In these circumstances, it may be difficult or impossible to cure such a breach in order to prevent clients from terminating their contracts with us.

Previous wording

In operating our business and providing services and solutions to our clients, we collect, use, store, transmit and otherwise process sensitive employee and client data, including PI regarding client customers and other individuals, in and across multiple jurisdictions, including at times, across national borders. As a result, we are subject to a variety of laws and regulations in the United States, Europe and around the world, as well as contractual obligations and industry standards, regarding data privacy, security and protection. In many cases, these laws, regulations and industry standards apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiary and other parties with which we have commercial relationships.

Current wording

In operating our business and providing services and solutions to our clients, we collect, use, store, transmit and otherwise process sensitive employee and client data, including PI regarding client customers or members and other individuals, in and across multiple jurisdictions, including at times, across national borders. As a result, we are subject to a variety of laws and regulations in the United States, Europe and around the world, as well as contractual obligations and industry standards, regarding data privacy, security and protection. In many cases, these laws, regulations and industry standards apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiary and other parties with which we have commercial relationships.

Previous wording

In addition, every state in which we operate (and the District of Columbia) has laws that protect the privacy and security of sensitive and personal information. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, California enacted CCPA which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA also created a new state agency vested with authority to implement and enforce the CCPA. The effects of existing state legislation, including the CCPA, are significant and have required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

Current wording

In addition, every state in which we operate (and the District of Columbia) has laws that protect the privacy and security of sensitive and personal information. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, California enacted CCPA which, among other things, requires companies covered by the legislation to provide new disclosures to California consumers and afford such consumers new rights, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches involving defined categories of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA also created a new state agency vested with authority to implement and enforce the CCPA. The effects of existing state legislation, including the CCPA, are significant and have required and may require us in the future to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. In addition, new privacy and security legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies

Previous wording

Internationally, many jurisdictions have established their own data privacy and security legal framework with which we or our clients may need to comply as client customers travel outside of the United States, including, but not limited to, the European Union (“EU”). The EU’s data protection landscape is currently evolving, resulting in possible significant operational costs for internal compliance and risk to our business. The EU has adopted the General Data Protection Regulation (“GDPR”), which contains numerous requirements and changes from previously existing EU law, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies. In particular, under the GDPR, fines of up to 20 million euros or up to 4% of the annual global revenues of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements. Such penalties are in addition to any civil litigation claims by clients and data subjects.

Current wording

Internationally, many jurisdictions have established their own data privacy and security legal framework with which we or our clients may need to comply as client customers or members travel outside of the United States, including, but not limited to, the United Kingdom (“UK”) and the European Union (“EU”). The UK’s and EU’s data protection landscape is continuing to evolve, resulting in possible significant operational costs for internal compliance and risk to our business. The UK and EU have adopted a General Data Protection Regulation (“GDPR”), which contains numerous requirements and changes from existing law, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies. In particular, under the EU GDPR, fines of up to 20 million euros or up to 4% of the annual global revenues of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements. Such penalties are in addition to any civil litigation claims by clients and data subjects.

Previous wording

Potential clients may also prefer to continue their relationship with their existing partner rather than change to a new partner regardless of product performance or features. As a result, even if the features of the Alkami Digital Banking Platform are superior, clients may not purchase our solution. In addition, innovative start-up companies, and larger companies that are making significant investments in research and development, may develop similar or superior products and technologies that compete with our solutions. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their market position. As a result, our current or potential competitors might be able to adapt more quickly to new technologies and client customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisitions or other opportunities more readily, or develop and expand their product and service offerings more quickly than we can. Further, conditions in our industry could change rapidly and significantly as a result of technological advancements. These competitive pressures in our market or our failure to compete effectively may result in price reductions, reduced revenues and gross margins and loss of market share. If our clients do not renew their subscriptions for our solutions on similar or more favorable terms to us, our revenues may decline and it could have a material and adverse effect on our business, financial condition and results of operations.

Current wording

Potential clients may also prefer to continue their relationship with their existing partner rather than change to a new partner regardless of product performance or features. As a result, even if the features of the Alkami Digital Sales & Service Platform are superior, clients may not purchase our solution. In addition, innovative start-up companies, and larger companies that are making significant investments in research and development, may develop similar or superior products and technologies that compete with our solutions. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their market position. As a result, our current or potential competitors might be able to adapt more quickly to new technologies and client customer or member needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisitions or other opportunities more readily, or develop and expand their product and service offerings more quickly than we can. Further, conditions in our industry could change rapidly and significantly as a result of technological advancements. These competitive pressures in our market or our failure to compete effectively may result in price reductions, reduced revenues and gross margins and loss of market share. If our clients do not renew their subscriptions for our solutions on similar or more favorable terms to us, our revenues may decline and it could have a material and adverse effect on our business, financial condition and results of operations.

Previous wording

The market for our solutions is characterized by rapid technological advancements, changes in client requirements and technologies, frequent new product introductions and enhancements and changing regulatory requirements. The life cycles of our solutions are difficult to estimate. Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our current market position. Other means of digital banking may be developed or adopted in the future, and our solutions may not be compatible with these new technologies. In addition, the technological needs of and services provided by, FIs may change if they or their competitors offer new services to account holders. Maintaining adequate research and development resources to meet the demands of the market is essential. The process of developing new technologies and solutions is complex and expensive. The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies, such as artificial intelligence and machine learning technologies, or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective.

Current wording

The market for our solutions is characterized by rapid technological advancements, changes in client requirements and technologies, frequent new product introductions and enhancements and changing regulatory requirements. The life cycles of our solutions are difficult to estimate. Rapid technological changes and the introduction of new products and enhancements by new or existing competitors or large FIs could undermine our current market position. Other means of digital banking may be developed or adopted in the future, and our solutions may not be compatible with these new technologies. In addition, the technological needs of and services provided by, FIs may change if they or their competitors offer new services to account holders. Maintaining adequate research and development resources to meet the demands of the market is essential. The process of developing new technologies and solutions is complex and expensive. The introduction of new solutions by our competitors, the market acceptance of competitive solutions based on new or alternative technologies, such as AI and machine learning technologies, or the emergence of new technologies or solutions in the broader financial services industry could render our solutions obsolete or less effective. Advances in AI may allow FIs to develop solutions internally rather than license third-party platforms such as ours, which could further reduce demand for our solutions.

Previous wording

Our products are marketed to and used by FIs, who are subject to extensive laws and regulations regarding the business functions and activities performed on our software solutions. Changes to any applicable statutes, regulations, rules or policies, including the interpretation or implementation of statutes, regulations, rules or policies could affect us in substantial and unpredictable ways, including limiting the types of software products we may offer and increasing the ability of third parties to offer competing services and products to FIs. Assuring that our products adapt to changes in the compliance obligations or expectations of our customers requires significant expense and devotion of resources on our part, which may adversely affect our ability to operate profitably.

Current wording

Our products are marketed to and used by FIs, who are subject to extensive laws and regulations regarding the business functions and activities performed on our software solutions. Changes to any applicable statutes, regulations, rules or policies, including the interpretation or implementation of statutes, regulations, rules or policies could affect us in substantial and unpredictable ways, including limiting the types of software products we may offer and increasing the ability of third parties to offer competing services and products to FIs. Assuring that our products adapt to changes in the compliance obligations or expectations of our clients requires significant expense and devotion of resources on our part, which may adversely affect our ability to operate profitably.

Previous wording

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address. As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the FFIEC, and we are also required to review and perform due diligence on certain of our third-party providers. Matters subject to review and examination by the FFIEC, federal and state regulatory agencies and external auditors include, but are not limited to, our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities and the design of our solutions, as well as our systems and technical infrastructure, our cybersecurity posture, our business recovery planning, our management and our financial condition. In addition, while we are not regulated by the NCUA, as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA. In addition, the Dodd-Frank Act granted the CFPB authority to promulgate rules and interpret certain federal consumer financial protection laws, some of which apply to the solutions we offer to our clients. In certain circumstances, the CFPB also has examination and supervision powers with respect to service providers who provide a material service to an FI offering consumer financial products and services. While many of our operations are not directly subject to the same regulations applicable to FIs, we are legally and contractually obligated to our clients to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them. Compliance with current or future digital accessibility, privacy, data protection and information security laws to which we or our FI clients are subject could result in higher compliance and technology costs and could restrict our ability to fully exploit our capabilities or provide certain products and services, which could materially and adversely affect our ability to operate profitably. Our failure to offer products and solutions that directly or indirectly comply with such laws, including as interpreted and applied by courts and regulators, could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions and damage to our reputation and our brand. In recent years, there has been increasing enforcement activity in the areas of digital accessibility, privacy, data protection and information security in various markets in which our customers operate.

Current wording

Our clients and prospective clients, as FIs, are highly regulated and are generally required to comply with stringent regulations in connection with managing their vendors, in particular those that are performing business functions that our solutions address. As a provider of technology services to such FIs, we may in the future be subject to examination by various federal and state regulatory agencies, including those agencies that comprise the FFIEC, and we are also required to review and perform due diligence on certain of our third-party providers. Matters subject to review and examination by the FFIEC, federal and state regulatory agencies and external auditors include, but are not limited to, our internal information technology controls in connection with our performance of data processing services, the agreements giving rise to those processing activities and the design of our solutions, as well as our systems and technical infrastructure, our information security and notification obligations, our cybersecurity posture, our business recovery planning, our management and our financial condition. In addition, while we are not regulated by the NCUA, as a result of our registration as a CUSO, we are subject to disclosure, annual reporting and other requirements imposed by the NCUA. In addition, the Dodd-Frank Act granted the CFPB authority to promulgate rules and interpret certain federal consumer financial protection laws, some of which apply to the solutions we offer to our clients. In certain circumstances, the CFPB also has examination and supervision powers with respect to service providers who provide a material service to an FI offering consumer financial products and services. While many of our operations are not directly subject to the same regulations applicable to FIs, we are legally and contractually obligated to our clients to provide software solutions and maintain internal systems and processes that comply with certain federal and state regulations applicable to them. Changes to any applicable statutes, regulations, rules or policies, including the interpretation or implementation of statutes, regulations, rules or policies, could affect us in substantial and unpredictable ways, including limiting the types of software products we may offer and increasing the ability of third parties to offer competing services and products to FIs. Compliance with current or future digital accessibility, privacy, data protection and information security laws to which we or our FI clients are subject could result in higher compliance and technology costs and could restrict our ability to fully exploit our capabilities or provide certain products and services, which could materially and adversely affect our ability to operate profitably. Our failure to offer products and solutions that directly or indirectly comply with such laws, including as interpreted and applied by courts and regulators, could result in potentially significant regulatory and/…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs. We may also be subject to other laws because of the solutions we provide to FIs. Any inability to satisfy regulatory or contractual expectations in connection with applicable regulations and guidance could adversely affect our ability to conduct our business, including attracting and maintaining clients, require significant costs to correct, harm our reputation, or lead to liability to third parties, including our customers or their consumers. Further, if we have to make changes to our internal processes and solutions as result of applicable regulations or guidance or findings from examinations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency or gap.

Current wording

For example, as a result of obligations under our client contracts, we are required to comply with certain provisions of the GLBA related to the privacy of consumer information and may be subject to other privacy, security and digital accessibility requirements because of the solutions we provide to FIs. We may also be subject to other laws because of the solutions we provide to FIs. Any inability to satisfy regulatory or contractual expectations in connection with applicable regulations and guidance could adversely affect our ability to conduct our business, including attracting and maintaining clients, require significant costs to correct, harm our reputation, or lead to liability to third parties, including our clients or their consumers. Further, if we have to make changes to our internal processes and solutions as result of applicable regulations or guidance or findings from examinations, we could be required to invest substantial additional time and funds and divert time and resources from other corporate purposes to remedy any identified deficiency or gap.

Previous wording

To counter infringement or unauthorized use of our intellectual property, we may deem it necessary to file infringement claims, which can be expensive, time-consuming and distracting to management. Our efforts to enforce our intellectual property rights in this manner may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. An adverse result of such litigation could require us to pay monetary damages or enter into royalty and licensing agreements that we would not normally find acceptable, cause a delay to the development of our products and services, require us to stop selling all or a portion of our products and services, require us to redesign certain components of our platform using alternative non-infringing technology or practices, which could require significant effort and expense. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation. An adverse outcome in such litigation or proceedings may expose us to a loss of our competitive position, expose us to significant liabilities or require us to seek licenses that may not be available on commercially acceptable terms, if at all.

Current wording

To counter infringement or unauthorized use of our intellectual property, we may deem it necessary to file infringement claims, which can be expensive, time-consuming and distracting to management. Our efforts to enforce our intellectual property rights in this manner may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. An adverse result of such litigation could require us to pay monetary damages or enter into royalty and licensing agreements that we would not normally find acceptable, cause a delay to the development of our products and services, require us to stop selling all or a portion of our products and services, require us to redesign certain components of our platform using alternative non-infringing technology or practices, which could require significant effort and expense.

Previous wording

From time to time, third parties may assert, and in the past have asserted, claims of infringement, misappropriation or other violation of intellectual property rights against us and FIs with whom we do business. Recently, for instance, a large financial services company has been successfully enforcing certain patents related to the use of remote deposit capture technology--a process that virtually every FI offers to its end users. Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit and regardless of the outcome, could cause us to incur substantial costs defending against the claim, distract our management from our business, require us to redesign or cease use of such intellectual property, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships. The outcome of any allegation is often uncertain. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation.

Current wording

From time to time, third parties may assert, and in the past have asserted, claims of infringement, misappropriation or other violation of intellectual property rights against us and FIs with whom we do business. For instance, a large financial services company successfully enforced certain patents related to the use of remote deposit capture technology--a process that virtually every FI offers to its end users. Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit and regardless of the outcome, could cause us to incur substantial costs defending against the claim, distract our management from our business, require us to redesign or cease use of such intellectual property, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships. The outcome of any allegation is often uncertain. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation.