MICROSTRATEGY Inc

Overview

MicroStrategy® recently announced that it considers itself the world’s first Bitcoin development company. We are a publicly-traded operating company committed to the continued development of the Bitcoin network through our activities in the financial markets, advocacy and technology innovation. As an operating business, we are able to use cash flows as well as proceeds from equity and debt financings to accumulate bitcoin, which serves as our primary treasury reserve asset. We also develop and provide industry-leading AI-powered enterprise analytics software that promotes our vision of Intelligence Everywhere™, and are using our software development capabilities to develop bitcoin applications. Our software business, which we have operated for over 30 years, is our predominant operational focus, providing cash flows and enabling us to pursue our bitcoin strategy. We believe that the combination of our operating structure, bitcoin strategy and focus on technology innovation differentiates us in the digital assets industry.

Bitcoin Strategy

Our bitcoin strategy includes (i) acquiring bitcoin using cash flows from operations and proceeds from equity and debt financings, (ii) developing product innovations that leverage Bitcoin blockchain technology, and (iii) periodically engaging in advocacy and educational activities regarding the continued acceptance and value of bitcoin as an open, secure protocol for an internet-native digital asset and the Lightning Network.

Bitcoin Acquisition Strategy

We believe that bitcoin is an attractive asset because it can serve as a store of value, supported by a robust and public open-source architecture, that is untethered to sovereign monetary policy. We also believe that, due to its limited supply, bitcoin offers the potential to serve as a hedge against inflation in the long-term and, if its adoption increases, the opportunity for appreciation in value.

In September 2020, our Board of Directors adopted a Treasury Reserve Policy (as amended to date, the “Treasury Reserve Policy”) that updated our treasury management and capital allocation strategies, under which our treasury reserve assets will consist of:

•

cash and cash equivalents and short-term investments (“Cash Assets”) held by us that exceed working capital requirements; and

•

bitcoin heldby us, with bitcoin serving as the primary treasury reserve asset on an ongoing basis, subject to market conditions and anticipated needs of the business for Cash Assets.

In the first quarter of 2021, we adopted, in addition to and in conjunction with our Treasury Reserve Policy, a corporate strategy of acquiring and holding bitcoin, and from time to time, subject to market conditions, issuing debt or equity securities or engaging in other capital raising transactions with the objective of using the proceeds to purchase bitcoin.

Our bitcoin acquisition strategy generally involves acquiring bitcoin with our liquid assets that exceed working capital requirements, and from time to time, subject to market conditions, issuing debt or equity securities or engaging in other capital raising transactions with the objective of using the proceeds to purchase bitcoin. We view our bitcoin holdings as long-term holdings and expect to continue to accumulate bitcoin. We have not set any specific target for the amount of bitcoin we seek to hold, and we will continue to monitor market conditions in determining whether to engage in additional financings to purchase additional bitcoin. This overall strategy also contemplates that we may (i) periodically sell bitcoin for general corporate purposes, including to generate cash for treasury management (which may include debt repayment), or in connection with strategies that generate tax benefits in accordance with applicable law, (ii) enter into additional capital raising transactions that are collateralized by our bitcoin holdings, and (iii) consider pursuing strategies to create income streams or otherwise generate funds using our bitcoin holdings.

Bitcoin-Related Innovations

We believe the Bitcoin network provides the infrastructure and opportunity for the development of financial and technological innovations, such as the Lighting Network (a decentralized second-layer payment protocol built on top of the Bitcoin blockchain that is intended to enable fast and less costly transactions). We are working to develop software products and service offerings that leverage the Lightning Network and exploring additional opportunities to develop offerings that leverage Bitcoin blockchain-based technology.

Bitcoin Advocacy and Education

Through various initiatives, such as our Bitcoin for Corporations sessions at MicroStrategy World, we seek to engage with and educate others about the opportunities available if they adopt bitcoin as a treasury reserve asset and to develop tools that leverage the Bitcoin blockchain and Lightning Network. In 2023, we also provided comments to the Financial Accounting Standards Board (“FASB”) on their published proposal with respect to the accounting treatment of digital assets. The FASB published the final standard in December 2023.

Our Bitcoin Holdings

During 2023, we purchased a total of approximately 56,650 bitcoins at an aggregate purchase price of approximately $1.902 billion for an average purchase price of approximately $33,580 per bitcoin, inclusive of fees and expenses. We did not sell any bitcoin during 2023. During 2022, we purchased a total of approximately 8,813 bitcoins at an aggregate purchase price of approximately $287.9 million for an average purchase price of approximately $32,670 per bitcoin, inclusive of fees and expenses, and sold a total of approximately 704 bitcoins for cash proceeds of approximately $11.8 million at an average sale price of approximately $16,786 per bitcoin, net of fees and expenses. During the period between January 1, 2024 and February 14, 2024, we purchased a total of approximately 850 bitcoins at an aggregate purchase price of approximately $37.2 million for an average purchase price of approximately $43,723 per bitcoin, inclusive of fees and expenses. We did not sell any bitcoins during the period between January 1, 2024 and February 14, 2024. Refer to the “Our Bitcoin Acquisition Strategy” section under “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” for further information regarding our bitcoin purchases, including the source of capital used to purchase bitcoin.

At December 31, 2023, we carried $3.626 billion of digital assets on our balance sheet, consisting of approximately 189,150 bitcoins and reflecting $2.269 billion in cumulative impairment losses attributable to bitcoin trading price fluctuations, and held $46.8 million in cash and cash equivalents. At December 31, 2022, we carried $1.840 billion of digital assets on our balance sheet, consisting of approximately 132,500 bitcoins and reflecting $2.153 billion in cumulative impairment losses attributable to bitcoin trading price fluctuations, and held $43.8 million in cash and cash equivalents.

As of February 14, 2024, we held approximately 190,000 bitcoins that were acquired at an aggregate purchase price of $5.933 billion and an average purchase price of approximately $31,224 per bitcoin, inclusive of fees and expenses. As of February 14, 2024, at 4:00 p.m. Eastern Time, the market price of one bitcoin reported on the Coinbase exchange (our principal market) was $51,744.68.

Overview of the Bitcoin Industry and Market

Bitcoin is a digital asset that is issued by and transmitted through an open-source protocol, known as the Bitcoin protocol, collectively maintained by a peer-to-peer network of decentralized user nodes. This network hosts a public transaction ledger, known as the Bitcoin blockchain, on which bitcoin holdings and all validated transactions that have ever taken place on the Bitcoin network are recorded. Balances of bitcoin are stored in individual “wallet” functions, which associate network public addresses with one or more “private keys” that control the transfer of bitcoin. The Bitcoin blockchain can be updated without any single entity owning or operating the network.

Creation of New Bitcoin and Limits on Supply

New bitcoin is created and allocated by the Bitcoin protocol through a “mining” process that rewards users that validate transactions in the Bitcoin blockchain. Validated transactions are added in “blocks” approximately every 10 minutes. The mining process serves to validate transactions and secure the Bitcoin network. Mining is a competitive and costly operation that requires a large amount of computational power to solve complex mathematical algorithms. This expenditure of computing power is known as “proof of work.” To incentivize miners to incur the costs of mining bitcoin, the Bitcoin protocol rewards miners that successfully validate a block of transactions with newly generated bitcoin.

The Bitcoin protocol limits the total number of bitcoin that can be generated over time to 21 million. The current reward for miners that successfully validate a block of transactions is 6.25 bitcoin per mined block. Based on current mining rates, we anticipate the reward will decrease by half to 3.125 bitcoin per mined block sometime in April 2024. This decrease in mining reward is referred to as a bitcoin halving, and it occurs after every 210,000 blocks are mined, which has historically occurred approximately every four years.

Modifications to the Bitcoin Protocol

Bitcoin is an open-source network that has no central authority, so no one person can unilaterally make changes to the software that runs the network. However, there is a core group of developers that maintain the code for the Bitcoin protocol, and they can propose changes to the source code and release periodic updates and other changes. Unlike most software that has a central entity that can push updates to users, bitcoin is a peer-to-peer network in which individual network participants, called nodes, decide whether to upgrade the software and accept the new changes. As a practical matter, a modification becomes part of the Bitcoin protocol only if the proposed changes are accepted by participants collectively having the most processing power, known as hash rate, on the network. If a certain percentage of the nodes reject the changes, then a “fork” takes place and participants can choose the version of the software they want to run.

Forms of Attack Against the Bitcoin Network and Wallets

Blockchain technology has many built-in security features that make it difficult for hackers and other malicious actors to corrupt the protocol or blockchain. However, as with any computer network, the Bitcoin network may be subject to certain attacks. Some forms of attack include unauthorized access to wallets that hold bitcoin and direct attacks, like “51% attacks” or “denial-of-service attacks” on the Bitcoin protocol.

Bitcoin is controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the bitcoin is held. Private keys used to access bitcoin balances are not widely distributed and are typically held on hardware

(which can be physically controlled by the holder or by a third party such as a custodian) or via software programs on third-party servers. One form of obtaining unauthorized access to a wallet occurs following a phishing attack where the attacker deceives the victim and manipulates them into sharing their private keys for their digital wallet or other sensitive information. Other similar attacks may also result in the loss of private keys and the inability to access, and effective loss of, the corresponding bitcoin. See “Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings – We face risks relating to the custody of our bitcoin, including the loss or destruction of private keys required to access our bitcoin and cyberattacks or other data loss relating to our bitcoin.”

A “51% attack” may occur when a group of miners attain more than 50% of the Bitcoin network’s mining power, thereby enabling them to control the Bitcoin network and protocol and manipulate the blockchain. A “denial-of-service attack” occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious actor flooding the network with traffic until the network is unable to respond or crashes. The Bitcoin network has been, and can be in the future, subject to denial-of-service attacks, which can result in temporary delays in block creation and in the transfer of bitcoin. See “Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings – Bitcoin and other digital assets are novel assets, and are subject to significant legal, commercial, regulatory and technical uncertainty.”

Bitcoin Industry Participants

The primary Bitcoin industry participants are miners, investors and traders, digital asset exchanges and service providers, including custodians, brokers, payment processors, wallet providers and financial institutions.

Miners. Miners range from bitcoin enthusiasts to professional mining operations that design and build dedicated mining machines and data centers, including mining pools, which are groups of miners that act cohesively and combine their processing power to mine bitcoin blocks. See “—Creation of New Bitcoin and Limits on Supply” above.

Investors and Traders. Bitcoin investors and traders include individuals and institutional investors who, directly or indirectly, purchase, hold, and sell bitcoin or bitcoin-based derivatives. On January 10, 2024, the Securities and Exchange Commission (“SEC”) issued an order approving several applications for the listing and trading of shares of spot bitcoin exchange-traded products (“ETPs”) on U.S. national securities exchanges. While the SEC had previously approved exchange-traded funds where the underlying assets were bitcoin futures contracts, this order represents the first time the SEC has approved the listing and trading of ETPs that acquire, hold and sell bitcoin directly. ETPs can be bought and sold on a stock exchange like traditional stocks, and provide investors with another means of gaining economic exposure to bitcoin through traditional brokerage accounts.

Digital Asset Exchanges. Digital asset exchanges provide trading venues for purchases and sales of bitcoin in exchange for fiat or other digital assets. Bitcoin can be exchanged for fiat currencies, such as the U.S. dollar, at rates of exchange determined by market forces on bitcoin trading platforms, which are not regulated in the same manner as traditional securities exchanges. In addition to these platforms, over-the-counter markets and derivatives markets for bitcoin also exist. The value of bitcoin within the market is determined, in part, by the supply of and demand for bitcoin in the global bitcoin market, market expectations for the adoption of bitcoin as a store of value, the number of merchants that accept bitcoin as a form of payment, and the volume of peer-to-peer transactions, among other factors. For a discussion of risks associated with digital asset exchanges, see “Item 1A. Risk Factors—Risks Related to Our Bitcoin Acquisition Strategy and Holdings—Due to the unregulated nature and lack of transparency surrounding the operations of many bitcoin trading venues, bitcoin trading venues may experience greater fraud, security failures or regulatory or operational problems than trading venues for more established asset classes, which may result in a loss of confidence in bitcoin trading venues and adversely affect the value of our bitcoin.”

Service providers. Service providers offer a multitude of services to other participants in the Bitcoin industry, including custodial and trade execution services, commercial and retail payment processing, loans secured by bitcoin collateral, and financial advisory services. If adoption of the Bitcoin network continues to materially increase, we anticipate that service providers may expand the currently available range of services and that additional parties will enter the service sector for the Bitcoin network.

Other Digital Assets

As of the date of this Annual Report, bitcoin was the largest digital asset by market capitalization. However, there are numerous alternative digital assets and many entities, including consortia and financial institutions, are researching and investing resources into private or permissioned blockchain platforms or digital assets that do not use proof-of-work mining like the Bitcoin network. For example, in late 2022, the Ethereum network transitioned to a “proof-of-stake” mechanism for validating transactions that requires significantly less computing power than proof-of-work mining. Other alternative digital assets that compete with bitcoin in certain ways include “stablecoins,” which are designed to maintain a constant price because of their issuers’ promise to hold high-quality liquid assets (such as U.S. dollar deposits and short-term U.S. treasury securities) equal to the total value of stablecoins in circulation. Stablecoins have grown rapidly as an alternative to bitcoin and other digital assets as a medium of exchange and store of value, particularly on digital asset trading platforms. As of December 31, 2023, two of the seven largest digital assets by market capitalization are U.S. dollar-backed stablecoins.

Additionally, central banks in some countries have started to introduce digital forms of legal tender. For example, China’s central bank digital currency (“CBDC”) project was made available to consumers in January 2022, and governments including the United States and the European Union have been discussing the potential creation of new CBDCs. For a discussion of risks relating to the emergence of other digital assets, see “Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings—The emergence or growth of other digital assets, including those with significant private or public sector backing, could have a negative impact on the price of bitcoin and adversely affect our business.”

Custody of our Bitcoin

We hold substantially all of our bitcoin in custody accounts at U.S.-based, institutional-grade custodians that have demonstrated records of regulatory compliance and information security. As a result, the primary counterparty risk we are exposed to with respect to our bitcoin is performance obligations under the various custody arrangements into which we have entered. We custody our bitcoin across multiple custodians to diversify our potential risk exposure to any one custodian. Our custodial services contracts do not restrict our ability to reallocate our bitcoin among our custodians, and our bitcoin holdings may be concentrated with a single custodian from time to time. In light of the significant amount of bitcoin we hold, we continually seek to engage additional digital asset custodians to further diversify the custody of our bitcoin.

We carefully select the custodians that custody our bitcoin after undertaking a due diligence process. As part of our custodian selection process, we evaluate for and select custodians that can demonstrate that they operate with strict security protocols, including multifactor authentication procedures designed to safekeep our bitcoin. In addition, our custodial services agreements generally specify that the private keys that control our bitcoin will be held in offline or “cold” storage, which is designed to mitigate risks that a system may be susceptible to when connected to the internet, including the risks associated with unauthorized network access and cyberattacks. We also negotiate liability provisions in our custodial contracts, pursuant to which our custodians are held liable for their failure to safekeep our bitcoin. In addition to our custodial arrangements, we also utilize affiliates of our bitcoin custodians to execute bitcoin acquisition and disposition transactions on our behalf. We leverage the due diligence we conduct in connection with our custodial arrangements when conducting due diligence of these trade execution service providers.

We also conduct due diligence reviews during the custodial relationship to monitor the safekeeping of our bitcoin. As part of our process, we obtain and review our custodians’ Services Organization Controls reports. We are also contractually entitled to review our custodians’ relevant internal controls through a variety of methods. We have in the past conducted, and expect to conduct in the future, supplemental due diligence when we believe it is warranted by market circumstances or otherwise. For example, we obtained supporting documentation to verify certain factual information, including documentation and analysis regarding financial solvency, exposure to troubled exchanges, regulatory compliance, security protocols and our ownership of our bitcoin.

We negotiate specific contractual terms and conditions with our custodians that we believe will help establish, under existing law, that our property interest in the bitcoin held by our custodians is not subject to the claims of the custodian’s creditors in the event the custodian enters bankruptcy, receivership or similar insolvency proceedings. All of our custodians are subject to regulatory regimes intended to protect customers in the event that a custodian enters bankruptcy, receivership or similar insolvency proceedings. Based on existing law and the terms and conditions of our contractual arrangements with our custodians, we believe that the bitcoin held on our behalf by our custodians would not be considered part of a custodian’s bankruptcy estate were one or more of our custodians to enter bankruptcy, receivership or similar insolvency proceedings. For a discussion of risks relating to the custody of our bitcoin, see “Item 1A. Risk Factors—Risks Related to Our Bitcoin Acquisition Strategy and Holdings—Our bitcoin acquisition strategy exposes us to various risks associated with bitcoin,” and “—Our bitcoin acquisition strategy exposes us to risk of non-performance by counterparties.”

Potential Advantages and Disadvantages of Holding Bitcoin

We believe that bitcoin is an attractive asset because it can serve as a store of value, supported by a robust and public open-source architecture, that is untethered to sovereign monetary policy. We also believe that, due to its limited supply, bitcoin offers the potential to serve as a hedge against inflation in the long-term and, if its adoption increases, the opportunity for appreciation in value.

Bitcoin exists entirely in electronic form, as virtually irreversible public transaction ledger entries on the blockchain, and transactions in bitcoin are recorded and authenticated not by a central repository, but by a decentralized peer-to-peer network. This decentralization mitigates the risks of certain threats common to centralized computer networks, such as denial-of-service attacks, and reduces the dependency of the bitcoin network on any single system. The decentralization of user nodes and miners also mitigates the risk of a 51% attack, which would be very costly and difficult to execute with respect to bitcoin because the Bitcoin network is open source and widely distributed, and transactions on the blockchain require significant computing power to be validated. However, while the Bitcoin network as a whole is decentralized, the private keys used to access bitcoin balances are not widely distributed and are susceptible to phishing and other attacks designed to obtain sensitive information or gain access to password-protected systems. Loss of such private keys can result in an inability to access, and effective loss of, the corresponding bitcoin. Consequently, bitcoin holdings are susceptible to all of the risks inherent in holding any electronic data, such as power failure, data corruption, security breach, communication failure and user error, among others. These risks, in turn, make bitcoin substantially more susceptible to theft, destruction, or loss of value from hackers, corruption, viruses and other technology-specific factors as compared to conventional fiat currency or other conventional financial assets. See “Item 1A. Risk Factors—Risks Related to Our Bitcoin Acquisition Strategy and Holdings—If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected.”

In addition, the Bitcoin network relies on open-source developers to maintain and improve the Bitcoin protocol. Accordingly, bitcoin may be subject to protocol design changes, governance disputes such as “forked” protocols, competing protocols, and other open source-specific risks that do not affect conventional proprietary software.

We believe that in the context of the economic uncertainty precipitated by escalating geopolitical tensions and central banks having adopted inflationary measures at various times in recent history, as well as the breakdown of trust in and between political institutions and political parties in the United States and globally, bitcoin represents an attractive store of value, and that opportunity for appreciation in the value of bitcoin exists in the event that such factors lead to more widespread adoption of the use and acceptance of bitcoin and the adoption of bitcoin as a treasury reserve alternative by institutions.

Government Regulation

The laws and regulations applicable to bitcoin and digital assets are evolving and subject to interpretation and change.

Governments around the world have reacted differently to digital assets; certain governments have deemed them illegal, and others have allowed their use and trade without restriction, while in some jurisdictions, such as the U.S., digital assets are subject to overlapping, uncertain and evolving regulatory requirements.

As digital assets have grown in both popularity and market size, the U.S. Executive Branch, Congress and a number of U.S. federal and state agencies, including the Financial Crimes Enforcement Network, the Commodity Futures Trading Commission (“CFTC”), the SEC, the Financial Industry Regulatory Authority, the Consumer Financial Protection Bureau, the Department of Justice, the Department of Homeland Security, the Federal Bureau of Investigation, the IRS and state financial regulators, have been examining the operations of digital asset networks, digital asset users and digital asset exchanges, with particular focus on the extent to which digital assets can be used to violate state or federal laws, including to facilitate the laundering of proceeds of illegal activities or the funding of criminal or terrorist enterprises, and the safety and soundness and consumer-protective safeguards of exchanges or other service-providers that hold, transfer, trade or exchange digital assets for users. Many of these state and federal agencies have issued consumer advisories regarding the risks posed by digital assets to investors. In addition, federal and state agencies, and other countries have issued rules or guidance regarding the treatment of digital asset transactions and requirements for businesses engaged in activities related to digital assets.

Depending on the regulatory characterization of bitcoin, the markets for bitcoin in general, and our activities in particular, our business and our bitcoin acquisition strategy may be subject to regulation by one or more regulators in the United States and globally. Ongoing and future regulatory actions may alter, to a materially adverse extent, the nature of digital assets markets, the participation of industry participants, including service providers and financial institutions in these markets, and our ability to pursue our bitcoin strategy. Additionally, U.S. state and federal and foreign regulators and legislatures have taken action against industry participants, including digital assets businesses, and enacted restrictive regimes in response to adverse publicity arising from hacks, consumer harm, or criminal activity stemming from digital assets activity. U.S. federal and state energy regulatory authorities are also monitoring the total electricity consumption of cryptocurrency mining, and the potential impacts of cryptocurrency mining to the supply and dispatch functionality of the wholesale grid and retail distribution systems. Many state legislative bodies have passed, or are actively considering, legislation to address the impact of cryptocurrency mining in their respective states.

The CFTC takes the position that some digital assets, including bitcoin, fall within the definition of a “commodity” under the Commodities Exchange Act of 1936, as amended (the “CEA”). Under the CEA, the CFTC has broad enforcement authority to police market manipulation and fraud in spot digital assets markets in which we may transact. Beyond instances of fraud or manipulation, the CFTC generally does not oversee cash or spot market exchanges or transactions involving digital asset commodities that do not utilize margin, leverage, or financing. In addition, CFTC regulations and CFTC oversight and enforcement authority apply with respect to futures, swaps, other derivative products and certain retail leveraged commodity transactions involving digital asset commodities, including the markets on which these products trade.

The SEC and its staff have taken the position that certain other digital assets fall within the definition of a “security” under the U.S. federal securities laws. Public statements made by senior officials and senior members of the staff at the SEC indicate that the SEC does not consider bitcoin to be a security under the federal securities laws. However, such statements are not official policy statements by the SEC and reflect only the speakers’ views, which are not binding on the SEC or any other agency or court and cannot be generalized to any other digital assets.

In addition, since transactions in bitcoin provide a degree of anonymity, they are susceptible to misuse for criminal activities, such as money laundering. This misuse, or the perception of such misuse, could lead to greater regulatory oversight of bitcoin and Bitcoin platforms, and there is the possibility that law enforcement agencies could close bitcoin platforms or other bitcoin-related infrastructure with little or no notice and prevent users from accessing or retrieving bitcoin held via such platforms or infrastructure. For example, in her January 2021 nomination hearing before the Senate Finance Committee, Treasury Secretary Janet Yellen noted that cryptocurrencies have the potential to improve the efficiency of the financial system but that they can be used to finance terrorism, facilitate money laundering, and support activities that threaten U.S. national security interests and the integrity of the U.S. and international financial systems. The U.S. Treasury Department’s Office of Foreign Assets Control has issued updated advisories regarding the use of virtual currencies, added a number of digital asset exchanges and service providers to the Specially Designated Nationals and Blocked Persons list and engaged in several enforcement actions, including a series of enforcement actions that have either shut down or significantly curtailed the operations of several smaller digital asset exchanges associated with Russian and/or North Korean nationals.

As noted above, activities involving bitcoin and other digital assets may fall within the jurisdiction of more than one financial regulator and various courts and such laws and regulations are rapidly evolving and increasing in scope. On March 9, 2022, President Biden signed an executive order relating to cryptocurrencies. While the executive order did not mandate the adoption of any specific regulations, it instructed various federal agencies to consider potential regulatory measures, including the evaluation of the creation of a U.S. CBDC. On September 16, 2022, the White House released a framework for digital asset development, based on reports from various government agencies, including the U.S. Department of Treasury, the Department of Justice, and the Department of Commerce. Among other things, the framework encourages regulators to pursue enforcement actions, issue guidance and rules to address current and emergent risks, support the development and use of innovative technologies by payment providers to increase access to instant payments, consider creating a federal framework to regulate nonbank payment providers, and evaluate whether to call upon Congress to amend the Bank Secrecy Act and laws against unlicensed money transmission to apply explicitly to digital asset service providers. There have also been several bills introduced in Congress that propose to establish additional regulation and oversight of the digital asset markets.

Enterprise Analytics Software Strategy

MicroStrategy is a pioneer in AI-powered business intelligence (BI), and a global leader in enterprise analytics solutions. We provide software and services designed to turn complex, chaotic data environments into rich, reliable, and convenient information feeds for our customers. Our vision is to make every worker a domain expert by delivering Intelligence Everywhere™.

Our cloud-native flagship, MicroStrategy ONE™, powers some of the largest analytics deployments in the world for customers spanning a wide range of industries, including retail, banking, technology, manufacturing, insurance, consulting, healthcare, telecommunications, and the public sector.

Integral to the MicroStrategy ONE platform are Generative AI capabilities that are designed to automate and accelerate the deployment of AI-enabled applications across our customers’ enterprises. By making advanced analytics accessible through conversational AI, MicroStrategy ONE provides non-technical users with the ability to directly access novel and actionable insights for decision-making.

The MicroStrategy ONE Platform

MicroStrategy ONE combines the flexibility and scalability afforded by a modern, cloud application with the reliability and security of our robust data governance model. It empowers users by making rich analytics easily accessible and personalized, while enabling organizations to harness the value of their data wherever it is needed.

Key Capabilities and Competitive Differentiators:

Our key capabilities and competitive differentiators include the following:

Built for the cloud. Our cloud-native, containerized architecture has been optimized for all three hyperscalers – AWS, Azure, and GCP – giving our customers freedom of choice and making it easy to embed analytics into custom or third-party cloud and mobile applications.

Auto, the AI assistant. Our AI bot automates a variety of complex functions using a natural language interface, including SQL generation, dashboard creation, data discovery and advanced analytics like forecasting and key driver analysis. Our AI assistant tool enables our customers to build their own fully customized bot for any application in a matter of minutes.

HyperIntelligence™. This innovative feature presents context-based, click-free insights to the user by hovering over keywords on the screen. It can be implemented on mobile, web, or custom applications to enrich understanding and streamline workflows.

Our Enterprise Semantic Graph™ is a powerful metadata layer that helps ensure data insights are trustworthy regardless of how far-reaching the applications and users of data may reside.

Flexible deployment. Customers can choose to deploy our platform on premises, using their own cloud environment, or through our fully managed MicroStrategy Cloud Environment (MCE).

Open and interoperable. Developers can leverage scripts, APIs, and 200+ connectors (local and cloud) to embed the platform or build predictive, machine learning-enhanced data models on top of a secure and trusted foundation.

FedRAMP Authorization

The MicroStrategy Cloud for Government service (“MCG Service”) is authorized to operate under the Federal Risk and Authorization Management Program (“FedRAMP”) guidelines, which certifies compliance with essential cloud security and data protection standards set by the U.S. Federal government. The solution offers always-on threat monitoring that meets the rigorous technical and regulatory needs of governments and financial institutions worldwide. The MCG Service achieved this designation through collaboration with the U.S. Department of Health and Human Services.

MicroStrategy Professional Services™

Through our MicroStrategy Support, MicroStrategy Consulting, and MicroStrategy Education services, we help customers deploy and customize our solutions to facilitate adoption and maximize returns on data investments.

MicroStrategy Support

Our global network of MicroStrategy-certified technical support experts help our customers achieve their system availability and usage goals through highly responsive troubleshooting and assistance. Standard Support is included in every maintenance plan or subscription license. Premium support options are also available for extended coverage and enhanced service at each touchpoint.

MicroStrategy Consulting

Many companies lack the internal expertise needed to design solutions for managing and optimizing their data stores. MicroStrategy Consultants deliver architecture and implementation services to help customers realize their desired results. With thousands of successful projects delivered to customers worldwide, our consultants apply industry best practices to define, develop, and deliver AI-powered analytics solutions for virtually any business intelligence need.

MicroStrategy Education

To help organizations maximize the adoption and performance of their MicroStrategy solutions, MicroStrategy Education offers free and paid learning options, available worldwide in multiple languages and a variety of formats—both in person and online, live and on-demand.

Sales and Marketing

Licensing Models

MicroStrategy sells its software platform under two pricing models: (i) traditional enterprise software licensing for on premise deployments, and (ii) subscriptions for cloud-based deployments. Enterprise software license terms are often perpetual, but term licenses typically extend for between 12 and 36 months and include standard support and maintenance for the term of the license. Subscriptions for cloud-based deployments typically are for 36 months and include standard support. Premium support services are available with either licensing model for added fees.

Dedicated Sales and Customer Success Teams

We sell our offerings chiefly through our direct sales force, with sales offices throughout the world. We also support customers post-sale through a dedicated Customer Success team that manages the customer lifecycle, from onboarding and training through license renewal and expansion. This separation allows our Sales team to focus on new business development and acquisition, while our Customer Success team focuses on customer experience, satisfaction, and lifetime value.

Strategic Partnerships

We have established strategic partnerships with a wide variety of third-party vendors, including cloud hosting providers (AWS, Microsoft, and Google), system integrators, consulting firms, value added resellers (VARs), managed service providers (MSPs), and independent software vendors (ISVs). These firms resell, support, or extend the MicroStrategy platform for a variety of commercial purposes, and our agreements with them generally provide non-exclusive rights to our software, marketing materials, product training, and direct sales force for field-level assistance.

We make significant financial investments with our channel partners, including technical training, certifications, pre-sales and sales enablement, and co-marketing programs. Through our joint efforts, we believe customers can minimize their risk and maximize the return on their business intelligence projects. Our channel partners allow us to extend sales and service coverage and industry-specific expertise across regions, languages, and business types.

Marketing

Our marketing programs target the following principal audiences:

•

technology and line-of-business executives across large, global enterprises and mid-size organizations;

•

government technology buyers and vendors to the government community;

•

ISVs that want to embed analytics technology in their applications; and

•

system integrators that have technology relationships with large enterprises, governments, and information-intensive businesses.

The channels we use to reach prospective buyers and partners include digital and social media, search and display advertising, industry and hosted events, webinars, email, partner co-marketing activities, and educational forums.

Competition

The analytics market is highly competitive and subject to rapidly changing technology and market conditions. For enterprise analytics, we compete with global ISVs, such as IBM, Microsoft, Oracle, Salesforce, and SAP. Our ability to compete successfully depends on a number of factors within and outside of our control. Some of these factors include software quality, performance and reliability; the quality of our service and support teams; marketing and prospecting effectiveness; the ability to incorporate artificial intelligence and other technically advanced features; and our ability to differentiate our products. Failure to perform in these or other areas may reduce the demand for our offerings and materially adversely affect our revenue from both existing and prospective customers.

Government Regulation

Aspects of our business involve collecting, processing, disclosing, storing, and transmitting personal data, which are subject to certain privacy policies, contractual obligations, and U.S. and foreign laws, regulations, and directives relating to privacy and data protection. We store a substantial amount of customer and employee data, including personal data, on our networks and other systems and the cloud environments we manage. In addition, the types of data subject to protection as personal data in the European Union, the United States, and elsewhere have been expanding. In recent years, the collection and use of personal data by companies have come under increased regulatory and public scrutiny, especially in relation to the collection and processing of sensitive data, such as healthcare, biometric, genetic, financial services, and children’s data, precise location data, and data regarding a person’s race or ethnic origins, political opinions, or religious beliefs. For example, in the United States, protected health information is subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), which can provide for civil and criminal penalties for noncompliance. Entities (such as us) that engage in creating, receiving, maintaining, or transmitting protected health information provided by covered entities and other business associates are subject to enforcement under HIPAA. Our access to protected health information triggers obligations to comply with certain privacy rules and data security requirements under HIPAA.

There are a broad variety of other data protection laws in the United States that are applicable to our activities, and a wide range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. The Federal Trade Commission and state Attorneys General all are aggressive in reviewing privacy and data security protections for consumers. New laws also are being considered at both the state and federal levels. A broad range of legislative measures also have been introduced at the federal level. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. In the event of a security breach, we also may have obligations to notify our customers or other parties or individuals about this breach, and this can lead to significant costs and the risk of potential enforcement and/or litigation. There is also a threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

In the European Union, the General Data Protection Regulation (“GDPR”) imposes requirements regarding the handling and security of personal data, requires disclosure of data breaches to individuals, customers, and data protection authorities in certain circumstances, requires companies to honor data subjects’ requests relating to their personal data, permits regulators to impose fines of up to €20,000,000 or 4% of global annual revenue, whichever is higher, and establishes a private right of action. Furthermore, a new ePrivacy Regulation, regulating electronic communications, was proposed in 2017 and is under consideration by the European Commission, the European Parliament, and the European Council. More recently, the Court of Justice of the European Union (“CJEU”) invalidated the U.S.-EU Privacy Shield in July 2020. The U.S.-EU Privacy Shield provided a mechanism to lawfully transfer personal data from the European Union to the United States and certain other countries. In the wake of the invalidation of the U.S.-EU Privacy Shield, we have transitioned to reliance on the EU Standard Contractual Clauses (“SCCs”) to lawfully transfer certain personal data from the European Union to the United States.

In June 2021, the European Data Protection Board (“EDPB”) issued formal recommendations on measures to ensure compliance with the EU data protection requirements when transferring personal data outside of the European Economic Area (the “EDPB Recommendations”). In summary, if “problematic legislation” or practices are identified in the destination country which impinge on the effectiveness of the appropriate safeguards of the transfer tool(s), the EDPB now recommends the data exporter to consider whether the laws/practices will be applied in practice to the relevant data, taking into account the importer’s experience and sector.

In addition, the EDPB issued a new set of SCCs in June 2021, which were required to be adopted for new transfers of personal data from September 2021 and replace those used for existing transfers of personal data by December 2022. The new SCCs place obligations on us as a data importer in relation to government authorities’ access requests in respect of personal data transferred under the SCCs. The EDPB Recommendations are designed to be read in tandem with the new SCCs and set out requirements for organizations to assess third countries and identify appropriate data protection supplementary measures to be implemented on a case-by-case basis where needed.

The rules involving this alternative SCC data transfer option are continually undergoing revision and this transfer mechanism may also be declared invalid (or require us to change our business practices) in the future, requiring us to provide an alternative means of data transfer or implement significant changes in our data security and protection practices.

On July 10, 2023, the European Commission formally adopted an adequacy decision in respect of the EU-U.S. Data Privacy Framework (“DPF”). The DPF provides for safe transfers of personal data from the EU to U.S. companies which have joined the DPF and have agreed to comply with the DPF principles. The DPF replaces the previous EU-U.S. Privacy Shield and contains new U.S. data privacy principles. The DPF will be administered by the U.S. Department of Commerce, which will process applications for certification and monitor whether participating companies continue to meet their certification criteria and the U.S. Federal Trade Commission will enforce compliance with the DPF. Organizations like MicroStrategy that retained their certifications under the previous EU-U.S. Privacy Shield may begin relying on DPF immediately and will be provided with guidance to facilitate transition to DPF. Similar to the SCCs, the requirements under the DPF are subject to change and this transfer mechanism may also be declared invalid (or require us to change our business practices) in the future. In addition, given the uncertainty surrounding the long-term validity of the new DPF, there is some resistance to formal adoption of the DPF as a data transfer mechanism by certain entities, including some of our customers and vendors, which may require us to evaluate alternative means of data transfer or implement significant changes in our data security and protection practices.

As with other issues related to the withdrawal of the United Kingdom from the European Union, commonly referred to as “Brexit,” there are open questions about how personal data will be protected in the UK and whether personal information can transfer from the EU to the UK. Following the withdrawal of the UK from the EU, the UK Data Protection Act of 2018 applies to the processing of personal data that takes place in the UK and includes parallel obligations to those set forth by GDPR. While the Data Protection Act of 2018 in the United Kingdom that “implements” and complements GDPR achieved Royal Assent on May 23, 2018, and is now effective in the United Kingdom, it is still unclear whether transfer of data from the European Economic Area, or EEA, to the United Kingdom will remain lawful under GDPR. The United Kingdom government has already determined that it considers all European Union and EEA member states to be adequate for the purposes of data protection, ensuring that data flows from the United Kingdom to the European Union/EEA remain unaffected. The UK and EEA recently announced that personal data may flow between the EU/EEA and the UK without the need for SCCs. However, in response to concerns expressed primarily about changes to the UK data protection framework and human rights legislation, Europe’s adequacy decision will sunset and require renewal four years after entry.

In addition, on June 8, 2023, the UK and U.S. reached a commitment to establish a UK Extension to the DPF that will create a ‘data bridge’ between the two countries. The UK Government subsequently adopted regulations recognizing the U.S. as providing an adequate level of protection, allowing personal data in the scope of the DPF to be transferred to organizations in the U.S. which participate in the UK Extension to the EU-U.S. DPF beginning on October 12, 2023.

Brazil also enacted the Lei Geral de Proteção de Dados (the “Brazilian General Data Protection Law”), which became effective in August 2020 and imposes requirements largely similar to GDPR on products and services offered to users in Brazil. We may also be subject in China to the Cybersecurity Law that went into effect in June 2017 and a revision of the Personal Information Security Specification that went into effect in October 2020, which have uncertain but broad application and impose a number of new privacy and data security obligations. In the summer of 2021, China passed the Data Security Law of the P.R.C (“DSL”), which came into effect on September 1, 2021. China also passed the Personal Information Protection Law of the P.R.C. (“PIPL”), which came into effect on November 1, 2021. The PIPL resembles GDPR in many aspects but will create new and challenging obligations for companies doing business in China. Under these new regulations, if an entity operating in China violates the law, regulators may order it to take corrective actions, issue warnings, confiscate illegal income, suspend services, revoke operating permits or business licenses, or issue a fine. The fine can be up to ¥50 million or 5 percent of an organization’s annual revenue for the prior financial year. A broad range of other countries continue to explore either new privacy and data security laws or changes to existing laws.

In addition to these specific laws, we also are subject to other privacy, security, and data protection laws around the world. In addition to the laws in place already, other countries are also considering new or expanded laws governing privacy and data security that may impact our business practices. These laws may impact our ongoing business activities and our relationships with our business partners, customers and service providers.

In the United States there also are specific state laws that may impact our business activities. For example, the state of California adopted a comprehensive privacy law, the California Consumer Privacy Act (“CCPA”), which took effect in January 2020 and became enforceable in July 2020. We have been and will continue to be required to devote substantial resources to implement and maintain compliance with the CCPA, and noncompliance could result in regulatory investigations and fines or private litigation. Moreover, in November 2020, California voters approved a privacy law, the California Privacy Rights Act (“CPRA”), which amends the CCPA to create privacy rights and obligations in California. More than 12 other states already have passed similar state privacy laws, which already have gone into effect or will go into effect in the future. In addition, the state of Washington passed the My Health My Data Act in 2023 which specifically regulates health information that is not otherwise regulated by the HIPAA rules. Other states have already passed similar laws and other states may do so in the future. All of these privacy laws may impact our business activities and our relationships with business partners, customers and service providers.

Furthermore, the U.S. Congress is considering comprehensive privacy legislation. At this time, it is unclear whether Congress will pass such a law and if so, when and what it will require and prohibit. Moreover, it is not clear whether any such legislation would give the Federal Trade Commission (“FTC”) any new authority to impose civil penalties for violations of the Federal Trade Commission Act in the first instance, whether Congress will grant the FTC rulemaking authority over privacy and information security, or whether Congress will vest some or all privacy and data security regulatory authority and enforcement power in a new agency, akin to EU data protection authorities.

Employees

As of December 31, 2023, we had a total of 1,934 employees, of whom 642 were based in the United States and 1,292 were based internationally. None of our employees in the United States is represented by a labor union; however, employees of certain of our foreign subsidiaries are members of trade or local unions. For example, in France, our employees are represented by a works council as required by local law. We have not experienced any work stoppages and generally consider our relations with our employees to be good.

The following table summarizes employee headcount as of the dates indicated:

We recognize and value the contribution of all our employees. Due to their dedication, hard work, loyalty, and commitment, we have had continued success as a company. Our philosophy is to create an agile, evolving environment that allows all of our employees to grow and thrive, with initiatives and platforms that reward and recognize employees for their hard work and commitment to delivering personal excellence and creativity at MicroStrategy.

Our human capital management objectives are to attract, retain, and develop leading talent to deliver on our business strategies. To accomplish these objectives, we constantly strive to understand the drivers of talent attraction, retention, and sustainable engagement with our employees in each of the geographies in which we operate. As part of this process, we regularly benchmark the benefits we offer our employees against those offered within our industry generally and the local markets in which we operate. During 2023, we continued to expand our equity compensation programs worldwide to provide our employees with greater opportunities to share in any appreciation of our class A common stock. In addition, we pride ourselves on preparing a highly skilled workforce through technical boot camps, regular training workshops, and a variety of other learning experiences. Our initiative-driven teams work with a modern technology stack, and they meet and learn from some of the most experienced innovators in their field. Through these efforts we seek to create an environment in which our employees can flourish, respond quickly to client demand and enhance their connections with colleagues and towards the communities they are a part of globally.

Available Information

Our website is located atwww.microstrategy.com. We make available free of charge, on or through the Investor Relations section of our website (http://ir.microstrategy.com), our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as soon as reasonably practicable after electronically filing or furnishing such reports with the SEC. Information found on our website is not part of this Annual Report or any other report filed with the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers, including us, that file or furnish electronically with the SEC atwww.sec.gov.