Q2 Holdings, Inc.

Special Note Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q contains forward-looking statements that are based on our management's beliefs and assumptions and on information currently available to our management. The statements and information contained in this Quarterly Report on Form 10-Q that are not purely historical are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. You can identify these statements by words such as "anticipates," "believes," "can," "continue," "could," "estimates," "expects," "intends," "may," "plans," "seeks," "potential," "predicts," "projects," "should," "will," "strategy," "future," "likely," or "would" or the negative of these terms or similar expressions. These statements are not guarantees of future performance or development and involve known and unknown risks, uncertainties and other factors that are in some cases beyond our control. All of our forward-looking statements are subject to risks and uncertainties that may cause our actual results to differ materially from our expectations. Factors that could cause or contribute to such differences include, but are not limited to, the following:

•the risks associated with cyberattacks, financial transaction fraud, data and privacy breaches and breaches of security measures within our products, systems and infrastructure or the products, systems and infrastructure of third parties upon which we rely and the resultant disruption, costs and liabilities and harm to our business and reputation and our ability to sell our solutions;

•the risks associated with rapidly evolving technologies, such as quantum computing, and advances in artificial intelligence, or AI, including the increasing availability of more capable AI models to the public that may further enhance the ability of threat actors or autonomous AI agent systems to identify, develop and exploit vulnerabilities, automate certain aspects of cyberattacks and conduct more targeted or scalable social engineering, fraud schemes or end-to-end intrusions;

•the risks associated with the pace of AI development and resulting cybersecurity threats, including as presented by autonomous AI agent systems, and the limitations of traditional cybersecurity defenses, which may not be fully effective against these novel threat vectors now or as they quickly evolve, the security community’s rapidly evolving understanding of agentic-specific attack services, and the resource commitments and investments required to stay informed and evolve our cybersecurity defenses, vulnerability management and solutions to secure them;

•the impact of and our ability to respond to global economic uncertainties and challenges or changes in the financial services industry and credit markets, including as a result of mergers and acquisitions within the banking sector, inflationary pressures, fluctuating interest rates, instability in the financial services industry, any changes to, or new, financial regulations and their potential impacts on our prospects' and customers' operations, increased acceptance and use of emerging financial products, such as cryptocurrencies or stablecoins, including any impact on the timing of prospect and customer implementations and purchasing decisions, our business sales cycles and on account holder or end user, or End User, usage of our solutions;

•the risks associated with continued market volatility, including in the financial services sector, inflationary pressures and the impact of any monetary policy changes that may be implemented as a result, such as the recent increase in interest rates by the Federal Reserve, the impact of existing and future U.S. tariffs, uncertainty regarding the legal authority for certain tariffs, global trade measures, including retaliatory tariffs, and the impact on the valuation of marketable securities;

•the risk of increased or new competition in our existing markets and as we enter new markets or new segments of existing markets, or as we offer new solutions;

•the risks associated with the development of our solutions, including AI-based solutions, our AI and data strategies and solutions, our use of AI tools and solutions, changes to regulation related to AI and data privacy and any discordance between the market for our solutions compared to our expectations;

•quarterly fluctuations in our operating results relative to our expectations and guidance and the accuracy of our forecasts;

•the risks and increased costs associated with managing growth and global operations, including hiring, training, retaining and motivating employees to support such growth;

•the risks associated with our transactional business which are typically driven by End-User behavior and can be influenced by external drivers outside of our control;

•the risks associated with effectively managing our business and cost structure in an uncertain economic environment, including as a result of challenges in the financial services industry and the effects of seasonality and unexpected trends;

•the risks associated with geopolitical instability, including acts of war or military conflict, uncertainties or discord, including the continuing war in Ukraine, the war in Iran and related disruptions to shipping through the Strait of Hormuz and resulting volatility in energy prices, other conflicts in the Middle East and other parts of the world, heightened risk of state-sponsored cyberattacks or cyber fraud on financial services and other critical infrastructure;

•the risks associated with accurately forecasting and managing the impacts of any economic downturn or challenges in the financial services industry on our customers and their End Users, including in particular the impacts of any downturn on financial technology companies, or FinTechs, or alternative finance companies, or Alt-FIs, and our arrangements with them, which may include more complex revenue arrangements for us and which may be more vulnerable to an economic downturn than our financial institution customers;

•the challenges and costs associated with selling, implementing and supporting our solutions, particularly for larger customers with more complex requirements and longer implementation processes, including risks related to the timing and predictability of sales of our solutions and the impact that the timing of bookings and go-lives may have on our revenue and financial performance in a period;

•the risk that errors, interruptions or delays in our solutions or Web hosting negatively impact our business and sales;

•the risks associated with the operation of and reliance on third-party public cloud service providers, including any vendor concentration, dependency, integration, resiliency, performance or cost risks and post-migration specific risks;

•the difficulties and risks associated with developing and selling complex new solutions and enhancements, including those using AI, in an environment in which the technical and regulatory specifications and functionality required by our customers and relevant governmental authorities are difficult to predict;

•the risks associated with operating within and selling into a regulated industry, including risks related to the rapidly evolving regulation of, and litigation with respect to, AI and machine learning, the receipt, collection, storage, processing and transfer of data and increased regulatory scrutiny on financial technology and related services, including specifically on banking-as-a-service, or BaaS, services;

•the risks associated with our sales and marketing capabilities, including partner relationships and the length, cost and unpredictability of our sales cycle;

•the risks inherent in third-party technology and implementation partnerships, including defects, failures, interruptions or disruptions in third-party services or solutions, that could disrupt our services or otherwise cause harm to our business;

•the risks associated with our reliance on a limited number of third-party AI vendors and concentration in such relationships, including potential disruption of hosted AI services, pricing increases, contractual limitations or the loss of access to key AI capabilities;

•the risk that we will not be able to maintain historical contract terms such as pricing and duration;

•the general risks associated with the complexity of our customer arrangements and our solutions;

•the risks associated with integrating acquired companies and successfully selling and maintaining their solutions;

•the risks and challenges around increased regulatory scrutiny and evolving requirements for money movement services and the resulting potential higher costs, increased complexity and limitations on offerings on our business and financial results;

•litigation related to intellectual property and other matters and any related claims, negotiations and settlements;

•the risks associated with further consolidation in the financial services industry;

•the risks associated with selling our solutions internationally and with the continued expansion of our international operations;

•the risk that we may not be able to obtain capital when desired or needed on favorable terms; and

•such other risks and uncertainties described more fully in documents filed with or furnished to the Securities and Exchange Commission, or the SEC, including the risk factors discussed below and elsewhere in this Quarterly Report on Form 10-Q, particularly in the section titled "Risk Factors," and the risk factors discussed in our Annual Report on Form 10-K for the year ended December 31, 2025, filed with the SEC on February 11, 2026.

Given these risks and uncertainties, you should not place undue reliance on these forward-looking statements. Also, forward-looking statements represent our management's beliefs and assumptions only as of the date of this Quarterly Report on Form 10-Q. You should read this Quarterly Report on Form 10-Q completely and with the understanding that our actual future results may be materially different from what we expect. We hereby qualify our forward-looking statements by these cautionary statements. Except as required by law, we assume no obligation to update these forward-looking statements publicly, or to update the reasons actual results could differ materially from those anticipated in these forward-looking statements, even if new information becomes available in the future.